fix: Details button opens full-screen node detail on desktop (#778)

The previous fix (#779) used hash navigation for the Details button,
which only re-selected the node in the side panel on desktop. Now the
Details button calls showFullScreenNode() to render the same full-screen
detail view that mobile users see, regardless of screen width.

- Extract showFullScreenNode() from mobile-only init code
- Reuse it for both mobile init and desktop Details button click
- Analytics links still navigate via hash as before
- Update Playwright test to verify full-screen view renders

.github/workflows/deploy.yml

@@ -3,10 +3,15 @@ name: CI/CD Pipeline
 on:
   push:
     branches: [master]
+    tags: ['v*']
   pull_request:
     branches: [master]
   workflow_dispatch:
 
+permissions:
+  contents: read
+  packages: write
+
 concurrency:
   group: ci-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
@@ -18,8 +23,8 @@ env:
   STAGING_CONTAINER: corescope-staging-go
 
 # Pipeline (sequential, fail-fast):
-#   go-test → e2e-test → build → deploy → publish
-#   PRs stop after build. Master continues to deploy + publish.
+#   go-test → e2e-test → build-and-publish → deploy → publish-badges
+#   PRs stop after build-and-publish (no GHCR push). Master continues to deploy + badges.
 
 jobs:
   # ───────────────────────────────────────────────────────────────
@@ -63,6 +68,17 @@ jobs:
           echo "--- Go Ingestor Coverage ---"
           go tool cover -func=ingestor-coverage.out | tail -1
 
+      - name: Build and test channel library + decrypt CLI
+        run: |
+          set -e -o pipefail
+          cd internal/channel
+          go test ./...
+          echo "--- Channel library tests passed ---"
+          cd ../../cmd/decrypt
+          CGO_ENABLED=0 go build -ldflags="-s -w" -o corescope-decrypt .
+          go test ./...
+          echo "--- Decrypt CLI tests passed ---"
+
       - name: Verify proto syntax
         run: |
           set -e
@@ -231,54 +247,150 @@ jobs:
           include-hidden-files: true
 
   # ───────────────────────────────────────────────────────────────
-  # 3. Build Docker Image
+  # 3. Build & Publish Docker Image
   # ───────────────────────────────────────────────────────────────
-  build:
-    name: "🏗️ Build Docker Image"
+  build-and-publish:
+    name: "🏗️ Build & Publish Docker Image"
     needs: [e2e-test]
-    runs-on: [self-hosted, meshcore-vm]
+    runs-on: [self-hosted, meshcore-runner-2]
     steps:
       - name: Checkout code
         uses: actions/checkout@v5
 
-      - name: Set up Node.js 22
-        uses: actions/setup-node@v5
-        with:
-          node-version: '22'
-
       - name: Free disk space
         run: |
           docker system prune -af 2>/dev/null || true
           docker builder prune -af 2>/dev/null || true
           df -h /
 
-      - name: Build Go Docker image
+      - name: Compute build metadata
+        id: meta
         run: |
-          echo "${GITHUB_SHA::7}" > .git-commit
-          APP_VERSION=$(node -p "require('./package.json').version") \
-          GIT_COMMIT="${GITHUB_SHA::7}" \
-          APP_VERSION=$(grep -oP 'APP_VERSION:-\K[^}]+' docker-compose.yml | head -1 || echo "3.0.0")
-          GIT_COMMIT=$(git rev-parse --short HEAD)
           BUILD_TIME=$(date -u '+%Y-%m-%dT%H:%M:%SZ')
-          export APP_VERSION GIT_COMMIT BUILD_TIME
+          GIT_COMMIT="${GITHUB_SHA::7}"
+          if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
+            APP_VERSION="${GITHUB_REF#refs/tags/}"
+          else
+            APP_VERSION="edge"
+          fi
+          echo "build_time=$BUILD_TIME" >> "$GITHUB_OUTPUT"
+          echo "git_commit=$GIT_COMMIT" >> "$GITHUB_OUTPUT"
+          echo "app_version=$APP_VERSION" >> "$GITHUB_OUTPUT"
+          echo "Build: version=$APP_VERSION commit=$GIT_COMMIT time=$BUILD_TIME"
+
+      - name: Build Go Docker image (local staging)
+        run: |
+          GIT_COMMIT="${{ steps.meta.outputs.git_commit }}" \
+          APP_VERSION="${{ steps.meta.outputs.app_version }}" \
+          BUILD_TIME="${{ steps.meta.outputs.build_time }}" \
           docker compose -f "$STAGING_COMPOSE_FILE" -p corescope-staging build "$STAGING_SERVICE"
           echo "Built Go staging image ✅"
 
+      - name: Set up Docker Buildx
+        if: github.event_name == 'push'
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        if: github.event_name == 'push'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract Docker metadata
+        if: github.event_name == 'push'
+        id: docker-meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/kpa-clawbot/corescope
+          tags: |
+            type=semver,pattern=v{{version}}
+            type=semver,pattern=v{{major}}.{{minor}}
+            type=semver,pattern=v{{major}}
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+            type=edge,branch=master
+
+      - name: Build and push to GHCR
+        if: github.event_name == 'push'
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          platforms: linux/amd64
+          tags: ${{ steps.docker-meta.outputs.tags }}
+          labels: ${{ steps.docker-meta.outputs.labels }}
+          build-args: |
+            APP_VERSION=${{ steps.meta.outputs.app_version }}
+            GIT_COMMIT=${{ steps.meta.outputs.git_commit }}
+            BUILD_TIME=${{ steps.meta.outputs.build_time }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
   # ───────────────────────────────────────────────────────────────
-  # 4. Deploy Staging (master only)
+  # 4. Release Artifacts (tags only)
   # ───────────────────────────────────────────────────────────────
-  deploy:
-    name: "🚀 Deploy Staging"
-    if: github.event_name == 'push'
-    needs: [build]
-    runs-on: [self-hosted, meshcore-vm]
+  release-artifacts:
+    name: "📦 Release Artifacts"
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: [go-test]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v5
 
+      - name: Set up Go 1.22
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.22'
+
+      - name: Build corescope-decrypt (static, linux/amd64)
+        run: |
+          cd cmd/decrypt
+          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X main.version=${{ github.ref_name }}" -o ../../corescope-decrypt-linux-amd64 .
+
+      - name: Build corescope-decrypt (static, linux/arm64)
+        run: |
+          cd cmd/decrypt
+          CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -ldflags="-s -w -X main.version=${{ github.ref_name }}" -o ../../corescope-decrypt-linux-arm64 .
+
+      - name: Upload release assets
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            corescope-decrypt-linux-amd64
+            corescope-decrypt-linux-arm64
+
+  # ───────────────────────────────────────────────────────────────
+  # 4b. Deploy Staging (master only)
+  # ───────────────────────────────────────────────────────────────
+  deploy:
+    name: "🚀 Deploy Staging"
+    if: github.event_name == 'push'
+    needs: [build-and-publish]
+    runs-on: [self-hosted, meshcore-runner-2]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Pull latest image from GHCR
+        run: |
+          # Try to pull the edge image from GHCR and tag for docker-compose compatibility
+          if docker pull ghcr.io/kpa-clawbot/corescope:edge; then
+            docker tag ghcr.io/kpa-clawbot/corescope:edge corescope-go:latest
+            echo "Pulled and tagged GHCR edge image ✅"
+          else
+            echo "⚠️ GHCR pull failed — falling back to locally built image"
+          fi
+
       - name: Deploy staging
         run: |
-          # Stop old container and release memory
+          # Force-remove the staging container regardless of how it was created
+          # (compose-managed OR manually created via docker run)
+          docker stop corescope-staging-go 2>/dev/null || true
+          docker rm -f corescope-staging-go 2>/dev/null || true
           docker compose -f "$STAGING_COMPOSE_FILE" -p corescope-staging down --timeout 30 2>/dev/null || true
 
           # Wait for container to be fully gone and OS to reclaim memory (3GB limit)

DEPLOY.md

@@ -0,0 +1,131 @@
+# Deploy CoreScope
+
+Pre-built images are published to GHCR for `linux/amd64` and `linux/arm64` (Raspberry Pi 4/5).
+
+## Quick Start
+
+### Docker run
+
+```bash
+docker run -d --name corescope \
+  -p 80:80 \
+  -v corescope-data:/app/data \
+  -e DISABLE_CADDY=true \
+  ghcr.io/kpa-clawbot/corescope:latest
+```
+
+Open `http://localhost` — done.
+
+### Docker Compose
+
+```bash
+curl -sL https://raw.githubusercontent.com/Kpa-clawbot/CoreScope/master/docker-compose.example.yml \
+  -o docker-compose.yml
+docker compose up -d
+```
+
+## Image Tags
+
+| Tag | Description |
+|-----|-------------|
+| `v3.4.1` | Pinned release (recommended for production) |
+| `v3.4` | Latest patch in v3.4.x |
+| `v3` | Latest minor+patch in v3.x |
+| `latest` | Latest release tag |
+| `edge` | Built from master — unstable, for testing |
+
+## Configuration
+
+Settings can be overridden via environment variables:
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `DISABLE_CADDY` | `false` | Skip internal Caddy (set `true` behind a reverse proxy) |
+| `DISABLE_MOSQUITTO` | `false` | Skip internal MQTT broker (use external) |
+| `HTTP_PORT` | `80` | Host port mapping |
+| `DATA_DIR` | `./data` | Host path for persistent data |
+
+For advanced configuration, mount a `config.json` into `/app/data/config.json`. See `config.example.json` in the repo.
+
+## Updating
+
+```bash
+docker compose pull
+docker compose up -d
+```
+
+## Data
+
+All persistent data lives in `/app/data`:
+- `meshcore.db` — SQLite database (packets, nodes)
+- `config.json` — custom config (optional)
+- `theme.json` — custom theme (optional)
+
+**Backup:** `cp data/meshcore.db ~/backup/`
+
+## TLS
+
+Option A — **External reverse proxy** (recommended): Run with `DISABLE_CADDY=true`, put nginx/traefik/Cloudflare in front.
+
+Option B — **Built-in Caddy**: Mount a custom Caddyfile at `/etc/caddy/Caddyfile` and expose ports 80+443.
+
+---
+
+## Migrating from manage.sh (existing admins)
+
+If you're currently deploying with `manage.sh` (git clone + local build), you have two options going forward:
+
+### Option A: Keep using manage.sh (no changes needed)
+
+`manage.sh update` continues to work exactly as before — it fetches the latest tag, builds locally, and restarts. Nothing breaks.
+
+```bash
+./manage.sh update          # latest release
+./manage.sh update v3.5.0   # specific version
+```
+
+### Option B: Switch to pre-built images (recommended)
+
+Pre-built images skip the build step entirely — faster updates, no Go toolchain needed.
+
+**One-time migration:**
+
+1. Stop the current deployment:
+   ```bash
+   ./manage.sh stop
+   ```
+
+2. Your data is in `~/meshcore-data/` (or whatever `PROD_DATA_DIR` is set to). It's untouched — the database, config, and theme files persist.
+
+3. Copy `docker-compose.example.yml` to where you want to run from:
+   ```bash
+   cp docker-compose.example.yml ~/docker-compose.yml
+   ```
+
+4. Start with the pre-built image:
+   ```bash
+   cd ~ && docker compose up -d
+   ```
+
+5. Verify it picked up your existing data:
+   ```bash
+   curl http://localhost/api/stats
+   ```
+
+**Updates after migration:**
+```bash
+docker compose pull && docker compose up -d
+```
+
+### What about manage.sh features?
+
+| manage.sh command | Pre-built equivalent |
+|---|---|
+| `./manage.sh update` | `docker compose pull && docker compose up -d` |
+| `./manage.sh stop` | `docker compose down` |
+| `./manage.sh start` | `docker compose up -d` |
+| `./manage.sh logs` | `docker compose logs -f` |
+| `./manage.sh status` | `docker compose ps` |
+| `./manage.sh setup` | Copy `docker-compose.example.yml`, edit env vars |
+
+`manage.sh` remains available for advanced use cases (building from source, custom patches, development). Pre-built images are recommended for most production deployments.

Dockerfile

@@ -10,6 +10,7 @@ ARG BUILD_TIME=unknown
 WORKDIR /build/server
 COPY cmd/server/go.mod cmd/server/go.sum ./
 COPY internal/geofilter/ ../../internal/geofilter/
+COPY internal/sigvalidate/ ../../internal/sigvalidate/
 RUN go mod download
 COPY cmd/server/ ./
 RUN go build -ldflags "-X main.Version=${APP_VERSION} -X main.Commit=${GIT_COMMIT} -X main.BuildTime=${BUILD_TIME}" -o /corescope-server .
@@ -17,10 +18,20 @@ RUN go build -ldflags "-X main.Version=${APP_VERSION} -X main.Commit=${GIT_COMMI
 # Build ingestor
 WORKDIR /build/ingestor
 COPY cmd/ingestor/go.mod cmd/ingestor/go.sum ./
+COPY internal/geofilter/ ../../internal/geofilter/
+COPY internal/sigvalidate/ ../../internal/sigvalidate/
 RUN go mod download
 COPY cmd/ingestor/ ./
 RUN go build -o /corescope-ingestor .
 
+# Build decrypt CLI
+WORKDIR /build/decrypt
+COPY cmd/decrypt/go.mod cmd/decrypt/go.sum ./
+COPY internal/channel/ ../../internal/channel/
+RUN go mod download
+COPY cmd/decrypt/ ./
+RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o /corescope-decrypt .
+
 # Runtime image
 FROM alpine:3.20
 
@@ -29,7 +40,7 @@ RUN apk add --no-cache mosquitto mosquitto-clients supervisor caddy wget
 WORKDIR /app
 
 # Go binaries
-COPY --from=builder /corescope-server /corescope-ingestor /app/
+COPY --from=builder /corescope-server /corescope-ingestor /corescope-decrypt /app/
 
 # Frontend assets + config
 COPY public/ ./public/
@@ -42,6 +53,8 @@ RUN echo "unknown" > .git-commit
 # Supervisor + Mosquitto + Caddy config
 COPY docker/supervisord-go.conf /etc/supervisor/conf.d/supervisord.conf
 COPY docker/supervisord-go-no-mosquitto.conf /etc/supervisor/conf.d/supervisord-no-mosquitto.conf
+COPY docker/supervisord-go-no-caddy.conf /etc/supervisor/conf.d/supervisord-no-caddy.conf
+COPY docker/supervisord-go-no-mosquitto-no-caddy.conf /etc/supervisor/conf.d/supervisord-no-mosquitto-no-caddy.conf
 COPY docker/mosquitto.conf /etc/mosquitto/mosquitto.conf
 COPY docker/Caddyfile /etc/caddy/Caddyfile
 

Dockerfile.go

@@ -40,6 +40,9 @@ RUN if [ ! -f .git-commit ]; then echo "unknown" > .git-commit; fi
 
 # Supervisor + Mosquitto + Caddy config
 COPY docker/supervisord-go.conf /etc/supervisor/conf.d/supervisord.conf
+COPY docker/supervisord-go-no-mosquitto.conf /etc/supervisor/conf.d/supervisord-no-mosquitto.conf
+COPY docker/supervisord-go-no-caddy.conf /etc/supervisor/conf.d/supervisord-no-caddy.conf
+COPY docker/supervisord-go-no-mosquitto-no-caddy.conf /etc/supervisor/conf.d/supervisord-no-mosquitto-no-caddy.conf
 COPY docker/mosquitto.conf /etc/mosquitto/mosquitto.conf
 COPY docker/Caddyfile /etc/caddy/Caddyfile
 

README.md

@@ -74,9 +74,34 @@ Full experience on your phone — proper touch controls, iOS safe area support,
 
 ## Quick Start
 
-### Docker (Recommended)
+### Pre-built Image (Recommended)
 
-No Go installation needed — everything builds inside the container.
+No build step required — just run:
+
+```bash
+docker run -d --name corescope \
+  --restart=unless-stopped \
+  -p 80:80 -p 1883:1883 \
+  -v /your/data:/app/data \
+  ghcr.io/kpa-clawbot/corescope:latest
+```
+
+Open `http://localhost` — done. No config file needed; CoreScope starts with sensible defaults.
+
+For HTTPS with a custom domain, add `-p 443:443` and mount your Caddyfile:
+```bash
+docker run -d --name corescope \
+  --restart=unless-stopped \
+  -p 80:80 -p 443:443 -p 1883:1883 \
+  -v /your/data:/app/data \
+  -v /your/Caddyfile:/etc/caddy/Caddyfile:ro \
+  -v /your/caddy-data:/data/caddy \
+  ghcr.io/kpa-clawbot/corescope:latest
+```
+
+Disable built-in services with `-e DISABLE_MOSQUITTO=true` or `-e DISABLE_CADDY=true`, or drop a `.env` file in your data volume. See [docs/deployment.md](docs/deployment.md) for the full reference.
+
+### Build from Source
 
 ```bash
 git clone https://github.com/Kpa-clawbot/CoreScope.git
@@ -95,8 +120,6 @@ The setup wizard walks you through config, domain, HTTPS, build, and run.
 ./manage.sh help         # All commands
 ```
 
-See [docs/DEPLOYMENT.md](docs/DEPLOYMENT.md) for the full deployment guide — HTTPS options (auto cert, bring your own, Cloudflare Tunnel), MQTT security, backups, and troubleshooting.
-
 ### Configure
 
 Copy `config.example.json` to `config.json` and edit:
@@ -242,6 +265,8 @@ Contributions welcome. Please read [AGENTS.md](AGENTS.md) for coding conventions
 
 **Live instance:** [analyzer.00id.net](https://analyzer.00id.net) — all API endpoints are public, no auth required.
 
+**API Documentation:** CoreScope auto-generates an OpenAPI 3.0 spec. Browse the interactive Swagger UI at [`/api/docs`](https://analyzer.00id.net/api/docs) or fetch the machine-readable spec at [`/api/spec`](https://analyzer.00id.net/api/spec).
+
 ## License
 
 MIT

cmd/decrypt/README.md

@@ -0,0 +1,142 @@
+# corescope-decrypt
+
+Standalone CLI tool to decrypt and export MeshCore hashtag channel messages from a CoreScope SQLite database.
+
+## Why
+
+MeshCore hashtag channels use symmetric encryption where the key is derived deterministically from the channel name. The CoreScope ingestor stores **all** `GRP_TXT` packets in the database, including those it cannot decrypt at ingest time.
+
+This tool enables:
+
+- **Retroactive decryption** — decrypt historical messages for any channel whose name you learn after the fact
+- **Forensics & analysis** — export channel traffic for offline review
+- **Bulk export** — dump an entire channel's history as JSON, HTML, or plain text
+
+## Installation
+
+### From Docker image
+
+The binary is included in the CoreScope Docker image at `/app/corescope-decrypt`:
+
+```bash
+docker exec corescope-prod /app/corescope-decrypt --channel "#wardriving" --db /app/data/meshcore.db
+```
+
+### From GitHub release
+
+Download the static binary from the [Releases](https://github.com/Kpa-clawbot/CoreScope/releases) page:
+
+```bash
+# Linux amd64
+curl -LO https://github.com/Kpa-clawbot/CoreScope/releases/latest/download/corescope-decrypt-linux-amd64
+chmod +x corescope-decrypt-linux-amd64
+./corescope-decrypt-linux-amd64 --help
+```
+
+### Build from source
+
+```bash
+cd cmd/decrypt
+CGO_ENABLED=0 go build -ldflags="-s -w" -o corescope-decrypt .
+```
+
+The binary is statically linked — no dependencies, runs on any Linux.
+
+## Usage
+
+```
+corescope-decrypt --channel NAME --db PATH [--format FORMAT] [--output FILE]
+```
+
+Run `corescope-decrypt --help` for full flag documentation.
+
+### JSON output (default)
+
+Machine-readable, includes all metadata (observers, path hops, raw hex):
+
+```bash
+corescope-decrypt --channel "#wardriving" --db meshcore.db
+```
+
+```json
+[
+  {
+    "hash": "a1b2c3...",
+    "timestamp": "2026-04-12T17:19:09Z",
+    "sender": "XMD Tag 1",
+    "message": "@[MapperBot] 37.76985, -122.40525 [0.3w]",
+    "channel": "#wardriving",
+    "raw_hex": "150206...",
+    "path": ["A3", "B0"],
+    "observers": [
+      {"name": "Observer1", "snr": 9.5, "rssi": -56, "timestamp": "2026-04-12T17:19:10Z"}
+    ]
+  }
+]
+```
+
+### HTML output
+
+Self-contained interactive viewer — search, sortable columns, expandable detail rows:
+
+```bash
+corescope-decrypt --channel "#wardriving" --db meshcore.db --format html --output wardriving.html
+open wardriving.html
+```
+
+No external dependencies. The JSON data is embedded directly in the HTML file.
+
+### IRC / log output
+
+Plain-text, one line per message — ideal for `grep`, `awk`, and piping:
+
+```bash
+corescope-decrypt --channel "#wardriving" --db meshcore.db --format irc
+```
+
+```
+[2026-04-12 17:19:09] <XMD Tag 1> @[MapperBot] 37.76985, -122.40525 [0.3w]
+[2026-04-12 17:20:25] <XMD Tag 1> @[MapperBot] 37.78075, -122.39774 [0.3w]
+[2026-04-12 17:25:30] <mk 🤠> @[MapperBot] 35.32444, -120.62077
+```
+
+```bash
+# Find all messages from a specific sender
+corescope-decrypt --channel "#wardriving" --db meshcore.db --format irc | grep "KE6QR"
+```
+
+## How channel encryption works
+
+MeshCore hashtag channels derive their encryption key from the channel name:
+
+1. **Key derivation**: `AES-128 key = SHA-256("#channelname")[:16]` (first 16 bytes)
+2. **Channel hash**: `SHA-256(key)[0]` — 1-byte identifier in the packet header, used for fast filtering
+3. **Encryption**: AES-128-ECB
+4. **MAC**: HMAC-SHA256 with a 32-byte secret (key + 16 zero bytes), truncated to 2 bytes
+5. **Plaintext format**: `timestamp(4 LE) + flags(1) + "sender: message\0"`
+
+See the firmware source at `firmware/src/helpers/BaseChatMesh.cpp` for the canonical implementation.
+
+## Testing against the fixture DB
+
+```bash
+cd cmd/decrypt
+go test ./...
+
+# Manual test with the real fixture:
+go run . --channel "#wardriving" --db ../../test-fixtures/e2e-fixture.db --format irc
+```
+
+The shared crypto library also has independent tests:
+
+```bash
+cd internal/channel
+go test -v ./...
+```
+
+## Limitations
+
+- **Hashtag channels only.** Only channels where the key is derived from `SHA-256("#name")` are supported. Custom PSK channels require the raw key (not implemented).
+- **No DM decryption.** Direct messages (`TXT_MSG`) use per-peer asymmetric encryption and cannot be decrypted by this tool.
+- **Read-only.** The tool opens the database in read-only mode and never modifies it.
+- **Timestamps are UTC.** The sender's embedded timestamp is used when available, displayed in UTC.

cmd/decrypt/go.mod

@@ -0,0 +1,22 @@
+module github.com/corescope/decrypt
+
+go 1.22
+
+require (
+	github.com/meshcore-analyzer/channel v0.0.0
+	modernc.org/sqlite v1.34.5
+)
+
+require (
+	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/ncruces/go-strftime v0.1.9 // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	golang.org/x/sys v0.22.0 // indirect
+	modernc.org/libc v1.55.3 // indirect
+	modernc.org/mathutil v1.6.0 // indirect
+	modernc.org/memory v1.8.0 // indirect
+)
+
+replace github.com/meshcore-analyzer/channel => ../../internal/channel

cmd/decrypt/go.sum

@@ -0,0 +1,43 @@
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/google/pprof v0.0.0-20240409012703-83162a5b38cd h1:gbpYu9NMq8jhDVbvlGkMFWCjLFlqqEZjEmObmhUy6Vo=
+github.com/google/pprof v0.0.0-20240409012703-83162a5b38cd/go.mod h1:kf6iHlnVGwgKolg33glAes7Yg/8iWP8ukqeldJSO7jw=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
+github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
+golang.org/x/mod v0.16.0 h1:QX4fJ0Rr5cPQCF7O9lh9Se4pmwfwskqZfq5moyldzic=
+golang.org/x/mod v0.16.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.22.0 h1:RI27ohtqKCnwULzJLqkv897zojh5/DwS/ENaMzUOaWI=
+golang.org/x/sys v0.22.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/tools v0.19.0 h1:tfGCXNR1OsFG+sVdLAitlpjAvD/I6dHDKnYrpEZUHkw=
+golang.org/x/tools v0.19.0/go.mod h1:qoJWxmGSIBmAeriMx19ogtrEPrGtDbPK634QFIcLAhc=
+modernc.org/cc/v4 v4.21.4 h1:3Be/Rdo1fpr8GrQ7IVw9OHtplU4gWbb+wNgeoBMmGLQ=
+modernc.org/cc/v4 v4.21.4/go.mod h1:HM7VJTZbUCR3rV8EYBi9wxnJ0ZBRiGE5OeGXNA0IsLQ=
+modernc.org/ccgo/v4 v4.19.2 h1:lwQZgvboKD0jBwdaeVCTouxhxAyN6iawF3STraAal8Y=
+modernc.org/ccgo/v4 v4.19.2/go.mod h1:ysS3mxiMV38XGRTTcgo0DQTeTmAO4oCmJl1nX9VFI3s=
+modernc.org/fileutil v1.3.0 h1:gQ5SIzK3H9kdfai/5x41oQiKValumqNTDXMvKo62HvE=
+modernc.org/fileutil v1.3.0/go.mod h1:XatxS8fZi3pS8/hKG2GH/ArUogfxjpEKs3Ku3aK4JyQ=
+modernc.org/gc/v2 v2.4.1 h1:9cNzOqPyMJBvrUipmynX0ZohMhcxPtMccYgGOJdOiBw=
+modernc.org/gc/v2 v2.4.1/go.mod h1:wzN5dK1AzVGoH6XOzc3YZ+ey/jPgYHLuVckd62P0GYU=
+modernc.org/libc v1.55.3 h1:AzcW1mhlPNrRtjS5sS+eW2ISCgSOLLNyFzRh/V3Qj/U=
+modernc.org/libc v1.55.3/go.mod h1:qFXepLhz+JjFThQ4kzwzOjA/y/artDeg+pcYnY+Q83w=
+modernc.org/mathutil v1.6.0 h1:fRe9+AmYlaej+64JsEEhoWuAYBkOtQiMEU7n/XgfYi4=
+modernc.org/mathutil v1.6.0/go.mod h1:Ui5Q9q1TR2gFm0AQRqQUaBWFLAhQpCwNcuhBOSedWPo=
+modernc.org/memory v1.8.0 h1:IqGTL6eFMaDZZhEWwcREgeMXYwmW83LYW8cROZYkg+E=
+modernc.org/memory v1.8.0/go.mod h1:XPZ936zp5OMKGWPqbD3JShgd/ZoQ7899TUuQqxY+peU=
+modernc.org/opt v0.1.3 h1:3XOZf2yznlhC+ibLltsDGzABUGVx8J6pnFMS3E4dcq4=
+modernc.org/opt v0.1.3/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
+modernc.org/sortutil v1.2.0 h1:jQiD3PfS2REGJNzNCMMaLSp/wdMNieTbKX920Cqdgqc=
+modernc.org/sortutil v1.2.0/go.mod h1:TKU2s7kJMf1AE84OoiGppNHJwvB753OYfNl2WRb++Ss=
+modernc.org/sqlite v1.34.5 h1:Bb6SR13/fjp15jt70CL4f18JIN7p7dnMExd+UFnF15g=
+modernc.org/sqlite v1.34.5/go.mod h1:YLuNmX9NKs8wRNK2ko1LW1NGYcc9FkBO69JOt1AR9JE=
+modernc.org/strutil v1.2.0 h1:agBi9dp1I+eOnxXeiZawM8F4LawKv4NzGWSaLfyeNZA=
+modernc.org/strutil v1.2.0/go.mod h1:/mdcBmfOibveCTBxUl5B5l6W+TTH1FXPLHZE6bTosX0=
+modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
+modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=

cmd/decrypt/main.go

@@ -0,0 +1,467 @@
+// corescope-decrypt decrypts and exports hashtag channel messages from a CoreScope SQLite database.
+//
+// Usage:
+//
+//	corescope-decrypt --channel "#wardriving" --db meshcore.db [--format json|html] [--output file]
+package main
+
+import (
+	"database/sql"
+	"encoding/hex"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"html"
+	"log"
+	"os"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/meshcore-analyzer/channel"
+	_ "modernc.org/sqlite"
+)
+
+// Version info (set via ldflags).
+var version = "dev"
+
+// ChannelMessage is a single decrypted channel message with metadata.
+type ChannelMessage struct {
+	Hash      string     `json:"hash"`
+	Timestamp string     `json:"timestamp"`
+	Sender    string     `json:"sender"`
+	Message   string     `json:"message"`
+	Channel   string     `json:"channel"`
+	RawHex    string     `json:"raw_hex"`
+	Path      []string   `json:"path"`
+	Observers []Observer `json:"observers"`
+}
+
+// Observer is a single observation of the transmission.
+type Observer struct {
+	Name      string  `json:"name"`
+	SNR       float64 `json:"snr"`
+	RSSI      float64 `json:"rssi"`
+	Timestamp string  `json:"timestamp"`
+}
+
+func main() {
+	channelName := flag.String("channel", "", "Channel name (e.g. \"#wardriving\")")
+	dbPath := flag.String("db", "", "Path to CoreScope SQLite database")
+	format := flag.String("format", "json", "Output format: json, html, irc (or log)")
+	output := flag.String("output", "", "Output file (default: stdout)")
+	showVersion := flag.Bool("version", false, "Print version and exit")
+
+	flag.Usage = func() {
+		fmt.Fprintf(os.Stderr, `corescope-decrypt — Decrypt and export MeshCore hashtag channel messages
+
+USAGE
+  corescope-decrypt --channel NAME --db PATH [--format FORMAT] [--output FILE]
+
+FLAGS
+  --channel NAME   Channel name to decrypt (e.g. "#wardriving", "wardriving")
+                   The "#" prefix is added automatically if missing.
+  --db PATH        Path to a CoreScope SQLite database file (read-only access).
+  --format FORMAT  Output format (default: json):
+                     json  — Machine-readable JSON array with full metadata
+                     html  — Self-contained HTML viewer with search and sorting
+                     irc   — Plain-text IRC-style log, one line per message
+                     log   — Alias for irc
+  --output FILE    Write output to FILE instead of stdout.
+  --version        Print version and exit.
+
+EXAMPLES
+  # Export #wardriving messages as JSON
+  corescope-decrypt --channel "#wardriving" --db /app/data/meshcore.db
+
+  # Generate an interactive HTML viewer
+  corescope-decrypt --channel wardriving --db meshcore.db --format html --output wardriving.html
+
+  # Greppable IRC log
+  corescope-decrypt --channel "#MeshCore" --db meshcore.db --format irc --output meshcore.log
+  grep "KE6QR" meshcore.log
+
+  # From the Docker container
+  docker exec corescope-prod /app/corescope-decrypt --channel "#wardriving" --db /app/data/meshcore.db
+
+RETROACTIVE DECRYPTION
+  MeshCore hashtag channels use symmetric encryption — the key is derived from the
+  channel name. The CoreScope ingestor stores ALL GRP_TXT packets in the database,
+  even those it cannot decrypt at ingest time. This tool lets you retroactively
+  decrypt messages for any channel whose name you know, even if the ingestor was
+  never configured with that channel's key.
+
+  This means you can recover historical messages by simply knowing the channel name.
+
+LIMITATIONS
+  - Only hashtag channels (shared-secret, name-derived key) are supported.
+  - Direct messages (TXT_MSG) use per-peer encryption and cannot be decrypted.
+  - Custom PSK channels (non-hashtag) require the raw key, not a channel name.
+`)
+	}
+
+	flag.Parse()
+
+	if *showVersion {
+		fmt.Println("corescope-decrypt", version)
+		os.Exit(0)
+	}
+
+	if *channelName == "" || *dbPath == "" {
+		flag.Usage()
+		os.Exit(1)
+	}
+
+	// Normalize channel name
+	ch := *channelName
+	if !strings.HasPrefix(ch, "#") {
+		ch = "#" + ch
+	}
+
+	key := channel.DeriveKey(ch)
+	chHash := channel.ChannelHash(key)
+
+	db, err := sql.Open("sqlite", *dbPath+"?mode=ro")
+	if err != nil {
+		log.Fatalf("Failed to open database: %v", err)
+	}
+	defer db.Close()
+
+	// Query all GRP_TXT packets
+	rows, err := db.Query(`SELECT id, hash, raw_hex, first_seen FROM transmissions WHERE payload_type = 5`)
+	if err != nil {
+		log.Fatalf("Query failed: %v", err)
+	}
+	defer rows.Close()
+
+	var messages []ChannelMessage
+	decrypted, total := 0, 0
+
+	for rows.Next() {
+		var id int
+		var txHash, rawHex, firstSeen string
+		if err := rows.Scan(&id, &txHash, &rawHex, &firstSeen); err != nil {
+			log.Printf("Scan error: %v", err)
+			continue
+		}
+		total++
+
+		payload, err := extractGRPPayload(rawHex)
+		if err != nil {
+			continue
+		}
+		if len(payload) < 3 {
+			continue
+		}
+
+		// Check channel hash byte
+		if payload[0] != chHash {
+			continue
+		}
+
+		mac := payload[1:3]
+		ciphertext := payload[3:]
+		if len(ciphertext) < 5 || len(ciphertext)%16 != 0 {
+			// Pad ciphertext to block boundary for decryption attempt
+			if len(ciphertext) < 16 {
+				continue
+			}
+			// Truncate to block boundary
+			ciphertext = ciphertext[:len(ciphertext)/16*16]
+		}
+
+		plaintext, ok := channel.Decrypt(key, mac, ciphertext)
+		if !ok {
+			continue
+		}
+
+		ts, sender, msg, err := channel.ParsePlaintext(plaintext)
+		if err != nil {
+			continue
+		}
+
+		decrypted++
+
+		// Convert MeshCore timestamp
+		timestamp := time.Unix(int64(ts), 0).UTC().Format(time.RFC3339)
+
+		// Get path from decoded_json
+		path := getPathFromDB(db, id)
+
+		// Get observers
+		observers := getObservers(db, id)
+
+		messages = append(messages, ChannelMessage{
+			Hash:      txHash,
+			Timestamp: timestamp,
+			Sender:    sender,
+			Message:   msg,
+			Channel:   ch,
+			RawHex:    rawHex,
+			Path:      path,
+			Observers: observers,
+		})
+	}
+
+	// Sort by timestamp
+	sort.Slice(messages, func(i, j int) bool {
+		return messages[i].Timestamp < messages[j].Timestamp
+	})
+
+	log.Printf("Scanned %d GRP_TXT packets, decrypted %d for channel %s", total, decrypted, ch)
+
+	// Generate output
+	var out []byte
+	switch *format {
+	case "json":
+		out, err = json.MarshalIndent(messages, "", "  ")
+		if err != nil {
+			log.Fatalf("JSON marshal: %v", err)
+		}
+		out = append(out, '\n')
+	case "html":
+		out = renderHTML(messages, ch)
+	case "irc", "log":
+		out = renderIRC(messages)
+	default:
+		log.Fatalf("Unknown format: %s (use json, html, irc, or log)", *format)
+	}
+
+	if *output != "" {
+		if err := os.WriteFile(*output, out, 0644); err != nil {
+			log.Fatalf("Write file: %v", err)
+		}
+		log.Printf("Written to %s", *output)
+	} else {
+		os.Stdout.Write(out)
+	}
+}
+
+// extractGRPPayload parses a raw hex packet and returns the GRP_TXT payload bytes.
+func extractGRPPayload(rawHex string) ([]byte, error) {
+	buf, err := hex.DecodeString(strings.TrimSpace(rawHex))
+	if err != nil || len(buf) < 2 {
+		return nil, fmt.Errorf("invalid hex")
+	}
+
+	// Header byte
+	header := buf[0]
+	payloadType := int((header >> 2) & 0x0F)
+	if payloadType != 5 { // GRP_TXT
+		return nil, fmt.Errorf("not GRP_TXT")
+	}
+
+	routeType := int(header & 0x03)
+	offset := 1
+
+	// Transport codes (2 codes × 2 bytes) come BEFORE path for transport routes
+	if routeType == 0 || routeType == 3 {
+		offset += 4
+	}
+
+	// Path byte
+	if offset >= len(buf) {
+		return nil, fmt.Errorf("too short for path")
+	}
+	pathByte := buf[offset]
+	offset++
+	hashSize := int(pathByte>>6) + 1
+	hashCount := int(pathByte & 0x3F)
+	offset += hashSize * hashCount
+
+	if offset >= len(buf) {
+		return nil, fmt.Errorf("too short for payload")
+	}
+
+	return buf[offset:], nil
+}
+
+func getPathFromDB(db *sql.DB, txID int) []string {
+	var decodedJSON sql.NullString
+	err := db.QueryRow(`SELECT decoded_json FROM transmissions WHERE id = ?`, txID).Scan(&decodedJSON)
+	if err != nil || !decodedJSON.Valid {
+		return nil
+	}
+
+	var decoded struct {
+		Path struct {
+			Hops []string `json:"hops"`
+		} `json:"path"`
+	}
+	if json.Unmarshal([]byte(decodedJSON.String), &decoded) == nil {
+		return decoded.Path.Hops
+	}
+	return nil
+}
+
+func getObservers(db *sql.DB, txID int) []Observer {
+	rows, err := db.Query(`
+		SELECT o.name, obs.snr, obs.rssi, obs.timestamp
+		FROM observations obs
+		LEFT JOIN observers o ON o.id = CAST(obs.observer_idx AS TEXT)
+		WHERE obs.transmission_id = ?
+		ORDER BY obs.timestamp
+	`, txID)
+	if err != nil {
+		return nil
+	}
+	defer rows.Close()
+
+	var observers []Observer
+	for rows.Next() {
+		var name sql.NullString
+		var snr, rssi sql.NullFloat64
+		var ts int64
+		if err := rows.Scan(&name, &snr, &rssi, &ts); err != nil {
+			continue
+		}
+		obs := Observer{
+			Timestamp: time.Unix(ts, 0).UTC().Format(time.RFC3339),
+		}
+		if name.Valid {
+			obs.Name = name.String
+		}
+		if snr.Valid {
+			obs.SNR = snr.Float64
+		}
+		if rssi.Valid {
+			obs.RSSI = rssi.Float64
+		}
+		observers = append(observers, obs)
+	}
+	return observers
+}
+
+func renderIRC(messages []ChannelMessage) []byte {
+	var b strings.Builder
+	for _, m := range messages {
+		sender := m.Sender
+		if sender == "" {
+			sender = "???"
+		}
+		// Parse RFC3339 timestamp into a compact format
+		t, err := time.Parse(time.RFC3339, m.Timestamp)
+		if err != nil {
+			b.WriteString(fmt.Sprintf("[%s] <%s> %s\n", m.Timestamp, sender, m.Message))
+			continue
+		}
+		b.WriteString(fmt.Sprintf("[%s] <%s> %s\n", t.Format("2006-01-02 15:04:05"), sender, m.Message))
+	}
+	return []byte(b.String())
+}
+
+func renderHTML(messages []ChannelMessage, channelName string) []byte {
+	jsonData, _ := json.Marshal(messages)
+
+	var b strings.Builder
+	b.WriteString(`<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>CoreScope Channel Export — ` + html.EscapeString(channelName) + `</title>
+<style>
+*{box-sizing:border-box;margin:0;padding:0}
+body{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;background:#0d1117;color:#c9d1d9;padding:20px}
+h1{color:#58a6ff;margin-bottom:16px;font-size:1.5em}
+.stats{color:#8b949e;margin-bottom:16px;font-size:0.9em}
+input[type=text]{width:100%;max-width:500px;padding:8px 12px;background:#161b22;border:1px solid #30363d;border-radius:6px;color:#c9d1d9;font-size:14px;margin-bottom:16px}
+input[type=text]:focus{outline:none;border-color:#58a6ff}
+table{width:100%;border-collapse:collapse;font-size:14px}
+th{background:#161b22;color:#8b949e;text-align:left;padding:8px 12px;border-bottom:2px solid #30363d;cursor:pointer;user-select:none;white-space:nowrap}
+th:hover{color:#58a6ff}
+th.sorted-asc::after{content:" ▲"}
+th.sorted-desc::after{content:" ▼"}
+td{padding:8px 12px;border-bottom:1px solid #21262d;vertical-align:top}
+tr:hover{background:#161b22}
+tr.expanded{background:#161b22}
+.detail-row td{padding:12px 24px;background:#0d1117;border-bottom:1px solid #21262d}
+.detail-row pre{background:#161b22;padding:12px;border-radius:6px;overflow-x:auto;font-size:12px;color:#8b949e}
+.detail-row .label{color:#58a6ff;font-weight:600;margin-top:8px;display:block}
+.observer-tag{display:inline-block;background:#1f6feb22;color:#58a6ff;padding:2px 8px;border-radius:4px;margin:2px;font-size:12px}
+.no-results{color:#8b949e;text-align:center;padding:40px;font-size:16px}
+.sender{color:#d2a8ff;font-weight:600}
+.timestamp{color:#8b949e;font-family:monospace;font-size:12px}
+</style>
+</head>
+<body>
+<h1>` + html.EscapeString(channelName) + ` — Channel Messages</h1>
+<div class="stats" id="stats"></div>
+<input type="text" id="search" placeholder="Search messages..." autocomplete="off">
+<table>
+<thead>
+<tr>
+<th data-col="timestamp">Timestamp</th>
+<th data-col="sender">Sender</th>
+<th data-col="message">Message</th>
+<th data-col="observers">Observers</th>
+</tr>
+</thead>
+<tbody id="tbody"></tbody>
+</table>
+<div class="no-results" id="no-results" style="display:none">No matching messages</div>
+<script>
+var DATA=` + string(jsonData) + `;
+var sortCol="timestamp",sortAsc=true,expandedHash=null;
+function init(){
+document.getElementById("stats").textContent=DATA.length+" messages";
+document.getElementById("search").addEventListener("input",render);
+document.querySelectorAll("th[data-col]").forEach(function(th){
+th.addEventListener("click",function(){
+var col=th.dataset.col;
+if(sortCol===col)sortAsc=!sortAsc;
+else{sortCol=col;sortAsc=true}
+render();
+});
+});
+render();
+}
+function render(){
+var q=document.getElementById("search").value.toLowerCase();
+var filtered=DATA.filter(function(m){
+if(!q)return true;
+return(m.message||"").toLowerCase().indexOf(q)>=0||(m.sender||"").toLowerCase().indexOf(q)>=0;
+});
+filtered.sort(function(a,b){
+var va=a[sortCol]||"",vb=b[sortCol]||"";
+if(sortCol==="observers"){va=a.observers?a.observers.length:0;vb=b.observers?b.observers.length:0}
+if(va<vb)return sortAsc?-1:1;
+if(va>vb)return sortAsc?1:-1;
+return 0;
+});
+document.querySelectorAll("th[data-col]").forEach(function(th){
+th.className=th.dataset.col===sortCol?(sortAsc?"sorted-asc":"sorted-desc"):"";
+});
+var tb=document.getElementById("tbody");
+tb.innerHTML="";
+document.getElementById("no-results").style.display=filtered.length?"none":"block";
+filtered.forEach(function(m){
+var tr=document.createElement("tr");
+tr.innerHTML='<td class="timestamp">'+esc(m.timestamp)+'</td><td class="sender">'+esc(m.sender||"—")+'</td><td>'+esc(m.message)+'</td><td>'+
+(m.observers?m.observers.map(function(o){return'<span class="observer-tag">'+esc(o.name||"?")+" SNR:"+o.snr.toFixed(1)+'</span>'}).join(""):"—")+'</td>';
+tr.style.cursor="pointer";
+tr.addEventListener("click",function(){
+expandedHash=expandedHash===m.hash?null:m.hash;
+render();
+});
+tb.appendChild(tr);
+if(expandedHash===m.hash){
+tr.className="expanded";
+var dr=document.createElement("tr");
+dr.className="detail-row";
+dr.innerHTML='<td colspan="4"><span class="label">Hash</span><pre>'+esc(m.hash)+'</pre>'+
+'<span class="label">Raw Hex</span><pre>'+esc(m.raw_hex)+'</pre>'+
+(m.path&&m.path.length?'<span class="label">Path</span><pre>'+esc(m.path.join(" → "))+'</pre>':'')+
+'<span class="label">Observers</span><pre>'+esc(JSON.stringify(m.observers,null,2))+'</pre></td>';
+tb.appendChild(dr);
+}
+});
+}
+function esc(s){var d=document.createElement("div");d.textContent=s;return d.innerHTML}
+init();
+</script>
+</body>
+</html>`)
+
+	return []byte(b.String())
+}

cmd/decrypt/main_test.go

@@ -0,0 +1,129 @@
+package main
+
+import (
+	"encoding/hex"
+	"encoding/json"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/meshcore-analyzer/channel"
+)
+
+func TestExtractGRPPayload(t *testing.T) {
+	// Build a minimal GRP_TXT packet: header(1) + path(1) + payload
+	// header: route=FLOOD(1), payload=GRP_TXT(5), version=0 → (5<<2)|1 = 0x15
+	// path: 0 hops, hash_size=1 → 0x00
+	payload := []byte{0x81, 0x12, 0x34} // channel_hash + mac + data
+	pkt := append([]byte{0x15, 0x00}, payload...)
+	rawHex := hex.EncodeToString(pkt)
+
+	result, err := extractGRPPayload(rawHex)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(result) != 3 || result[0] != 0x81 {
+		t.Fatalf("payload mismatch: %x", result)
+	}
+}
+
+func TestExtractGRPPayloadTransport(t *testing.T) {
+	// Transport flood: route=0, 4 bytes transport codes BEFORE path byte
+	// header: (5<<2)|0 = 0x14
+	payload := []byte{0xAA, 0xBB, 0xCC}
+	// header + 4 transport bytes + path(0 hops) + payload
+	pkt := append([]byte{0x14, 0xFF, 0xFF, 0xFF, 0xFF, 0x00}, payload...)
+	rawHex := hex.EncodeToString(pkt)
+
+	result, err := extractGRPPayload(rawHex)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result[0] != 0xAA {
+		t.Fatalf("expected AA, got %02X", result[0])
+	}
+}
+
+func TestExtractGRPPayloadNotGRP(t *testing.T) {
+	// payload type = ADVERT (4): (4<<2)|1 = 0x11
+	rawHex := hex.EncodeToString([]byte{0x11, 0x00, 0x01, 0x02})
+	_, err := extractGRPPayload(rawHex)
+	if err == nil {
+		t.Fatal("expected error for non-GRP_TXT")
+	}
+}
+
+func TestKeyDerivationConsistency(t *testing.T) {
+	// Verify key derivation matches what the ingestor expects
+	key := channel.DeriveKey("#wardriving")
+	if len(key) != 16 {
+		t.Fatalf("key len %d", len(key))
+	}
+	ch := channel.ChannelHash(key)
+	if ch != 0x81 {
+		// We know from fixture data that #wardriving has channelHashHex "81"
+		t.Fatalf("channel hash %02X, expected 81", ch)
+	}
+}
+
+func TestRenderIRC(t *testing.T) {
+	msgs := []ChannelMessage{
+		{Timestamp: "2026-04-12T03:45:12Z", Sender: "NodeA", Message: "Hello"},
+		{Timestamp: "2026-04-12T03:46:01Z", Sender: "", Message: "No sender"},
+	}
+	out := string(renderIRC(msgs))
+	if !strings.Contains(out, "[2026-04-12 03:45:12] <NodeA> Hello") {
+		t.Fatalf("IRC output missing expected line: %s", out)
+	}
+	if !strings.Contains(out, "<???> No sender") {
+		t.Fatalf("IRC output should use ??? for empty sender: %s", out)
+	}
+}
+
+func TestRenderHTMLValid(t *testing.T) {
+	msgs := []ChannelMessage{
+		{Hash: "abc", Timestamp: "2026-04-12T00:00:00Z", Sender: "X", Message: "test", Channel: "#test"},
+	}
+	out := string(renderHTML(msgs, "#test"))
+	if !strings.Contains(out, "<!DOCTYPE html>") {
+		t.Fatal("not valid HTML")
+	}
+	if !strings.Contains(out, "#test") {
+		t.Fatal("channel name missing")
+	}
+	if !strings.Contains(out, "</html>") {
+		t.Fatal("HTML not closed")
+	}
+}
+
+func TestJSONOutputParseable(t *testing.T) {
+	msgs := []ChannelMessage{
+		{Hash: "abc", Timestamp: "2026-04-12T00:00:00Z", Sender: "X", Message: "hi", Channel: "#test"},
+	}
+	data, err := json.MarshalIndent(msgs, "", "  ")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var parsed []ChannelMessage
+	if err := json.Unmarshal(data, &parsed); err != nil {
+		t.Fatalf("JSON not parseable: %v", err)
+	}
+	if len(parsed) != 1 || parsed[0].Sender != "X" {
+		t.Fatalf("parsed mismatch: %+v", parsed)
+	}
+}
+
+// Integration test against fixture DB (skipped if DB not found)
+func TestFixtureDecrypt(t *testing.T) {
+	dbPath := "../../test-fixtures/e2e-fixture.db"
+	if _, err := os.Stat(dbPath); os.IsNotExist(err) {
+		t.Skip("fixture DB not found")
+	}
+
+	// We know the fixture has #wardriving messages with channelHash 0x81
+	key := channel.DeriveKey("#wardriving")
+	ch := channel.ChannelHash(key)
+	if ch != 0x81 {
+		t.Fatalf("unexpected channel hash: %02X", ch)
+	}
+}

cmd/ingestor/config.go

@@ -2,7 +2,9 @@ package main
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
+	"log"
 	"os"
 	"strings"
 
@@ -79,15 +81,21 @@ func (c *Config) NodeDaysOrDefault() int {
 }
 
 // LoadConfig reads configuration from a JSON file, with env var overrides.
+// If the config file does not exist, sensible defaults are used (zero-config startup).
 func LoadConfig(path string) (*Config, error) {
+	var cfg Config
+
 	data, err := os.ReadFile(path)
 	if err != nil {
-		return nil, fmt.Errorf("reading config %s: %w", path, err)
-	}
-
-	var cfg Config
-	if err := json.Unmarshal(data, &cfg); err != nil {
-		return nil, fmt.Errorf("parsing config %s: %w", path, err)
+		if !errors.Is(err, os.ErrNotExist) {
+			return nil, fmt.Errorf("reading config %s: %w", path, err)
+		}
+		// Config file doesn't exist — use defaults (zero-config mode)
+		log.Printf("config file %s not found, using sensible defaults", path)
+	} else {
+		if err := json.Unmarshal(data, &cfg); err != nil {
+			return nil, fmt.Errorf("parsing config %s: %w", path, err)
+		}
 	}
 
 	// Env var overrides
@@ -121,6 +129,16 @@ func LoadConfig(path string) (*Config, error) {
 		}}
 	}
 
+	// Default MQTT source: connect to localhost broker when no sources configured
+	if len(cfg.MQTTSources) == 0 {
+		cfg.MQTTSources = []MQTTSource{{
+			Name:   "local",
+			Broker: "mqtt://localhost:1883",
+			Topics: []string{"meshcore/#"},
+		}}
+		log.Printf("no MQTT sources configured, defaulting to mqtt://localhost:1883")
+	}
+
 	return &cfg, nil
 }
 

cmd/ingestor/config_test.go

@@ -32,9 +32,25 @@ func TestLoadConfigValidJSON(t *testing.T) {
 }
 
 func TestLoadConfigMissingFile(t *testing.T) {
-	_, err := LoadConfig("/nonexistent/path/config.json")
-	if err == nil {
-		t.Error("expected error for missing file")
+	t.Setenv("DB_PATH", "")
+	t.Setenv("MQTT_BROKER", "")
+
+	cfg, err := LoadConfig("/nonexistent/path/config.json")
+	if err != nil {
+		t.Fatalf("missing config should not error (zero-config mode), got: %v", err)
+	}
+	if cfg.DBPath != "data/meshcore.db" {
+		t.Errorf("dbPath=%s, want data/meshcore.db", cfg.DBPath)
+	}
+	// Should default to localhost MQTT
+	if len(cfg.MQTTSources) != 1 {
+		t.Fatalf("mqttSources len=%d, want 1", len(cfg.MQTTSources))
+	}
+	if cfg.MQTTSources[0].Broker != "mqtt://localhost:1883" {
+		t.Errorf("default broker=%s, want mqtt://localhost:1883", cfg.MQTTSources[0].Broker)
+	}
+	if cfg.MQTTSources[0].Name != "local" {
+		t.Errorf("default source name=%s, want local", cfg.MQTTSources[0].Name)
 	}
 }
 
@@ -196,8 +212,8 @@ func TestLoadConfigLegacyMQTTEmptyBroker(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if len(cfg.MQTTSources) != 0 {
-		t.Errorf("mqttSources should be empty when legacy broker is empty, got %d", len(cfg.MQTTSources))
+	if len(cfg.MQTTSources) != 1 || cfg.MQTTSources[0].Name != "local" {
+		t.Errorf("mqttSources should default to local broker when legacy broker is empty, got %v", cfg.MQTTSources)
 	}
 }
 

cmd/ingestor/coverage_boost_test.go

@@ -203,21 +203,13 @@ func TestHandleMessageChannelMessage(t *testing.T) {
 		t.Errorf("direction=%v, want rx", direction)
 	}
 
-	// Should create sender node
+	// Sender node should NOT be created (see issue #665: synthetic "sender-" keys
+	// are unreachable from the claiming/health flow)
 	if err := store.db.QueryRow("SELECT COUNT(*) FROM nodes").Scan(&count); err != nil {
 		t.Fatal(err)
 	}
-	if count != 1 {
-		t.Errorf("nodes count=%d, want 1 (sender node)", count)
-	}
-
-	// Verify sender node name
-	var nodeName string
-	if err := store.db.QueryRow("SELECT name FROM nodes LIMIT 1").Scan(&nodeName); err != nil {
-		t.Fatal(err)
-	}
-	if nodeName != "Alice" {
-		t.Errorf("node name=%s, want Alice", nodeName)
+	if count != 0 {
+		t.Errorf("nodes count=%d, want 0 (no phantom sender node)", count)
 	}
 }
 
@@ -461,7 +453,7 @@ func TestDecodeAdvertLocationTruncated(t *testing.T) {
 	buf[100] = 0x11
 	// Only 4 bytes after flags — not enough for full location (needs 8)
 
-	p := decodeAdvert(buf[:105])
+	p := decodeAdvert(buf[:105], false)
 	if p.Error != "" {
 		t.Fatalf("error: %s", p.Error)
 	}
@@ -483,7 +475,7 @@ func TestDecodeAdvertFeat1Truncated(t *testing.T) {
 	buf[100] = 0x21
 	// Only 1 byte after flags — not enough for feat1 (needs 2)
 
-	p := decodeAdvert(buf[:102])
+	p := decodeAdvert(buf[:102], false)
 	if p.Feat1 != nil {
 		t.Error("feat1 should be nil with truncated data")
 	}
@@ -504,7 +496,7 @@ func TestDecodeAdvertFeat2Truncated(t *testing.T) {
 	buf[102] = 0x00
 	// Only 1 byte left — not enough for feat2
 
-	p := decodeAdvert(buf[:104])
+	p := decodeAdvert(buf[:104], false)
 	if p.Feat1 == nil {
 		t.Error("feat1 should be set")
 	}
@@ -544,7 +536,7 @@ func TestDecodeAdvertSensorBadTelemetry(t *testing.T) {
 	buf[105] = 0x20
 	buf[106] = 0x4E
 
-	p := decodeAdvert(buf[:107])
+	p := decodeAdvert(buf[:107], false)
 	if p.BatteryMv != nil {
 		t.Error("battery_mv=0 should be nil")
 	}
@@ -740,7 +732,7 @@ func TestDecodeAdvertSensorNoName(t *testing.T) {
 	buf[103] = 0xC4
 	buf[104] = 0x09
 
-	p := decodeAdvert(buf[:105])
+	p := decodeAdvert(buf[:105], false)
 	if p.Error != "" {
 		t.Fatalf("error: %s", p.Error)
 	}
@@ -835,7 +827,7 @@ func TestDecodePacketNoPathByteAfterHeader(t *testing.T) {
 	// Non-transport route, but only header byte (no path byte)
 	// Actually 0A alone = 1 byte, but we need >= 2
 	// Header + exactly at offset boundary
-	_, err := DecodePacket("0A", nil)
+	_, err := DecodePacket("0A", nil, false)
 	if err == nil {
 		t.Error("should error - too short")
 	}
@@ -856,7 +848,7 @@ func TestDecodeAdvertNameNoNull(t *testing.T) {
 	// Name without null terminator — goes to end of buffer
 	copy(buf[101:], []byte("LongNameNoNull"))
 
-	p := decodeAdvert(buf[:115])
+	p := decodeAdvert(buf[:115], false)
 	if p.Name != "LongNameNoNull" {
 		t.Errorf("name=%q, want LongNameNoNull", p.Name)
 	}

cmd/ingestor/db.go

@@ -345,6 +345,28 @@ func applySchema(db *sql.DB) error {
 		log.Println("[migration] packets_sent/packets_recv columns added")
 	}
 
+	// Migration: add channel_hash column for fast channel queries (#762)
+	row = db.QueryRow("SELECT 1 FROM _migrations WHERE name = 'channel_hash_v1'")
+	if row.Scan(&migDone) != nil {
+		log.Println("[migration] Adding channel_hash column to transmissions...")
+		db.Exec(`ALTER TABLE transmissions ADD COLUMN channel_hash TEXT DEFAULT NULL`)
+		db.Exec(`CREATE INDEX IF NOT EXISTS idx_tx_channel_hash ON transmissions(channel_hash) WHERE payload_type = 5`)
+		// Backfill: extract channel name for decrypted (CHAN) packets
+		res, err := db.Exec(`UPDATE transmissions SET channel_hash = json_extract(decoded_json, '$.channel') WHERE payload_type = 5 AND channel_hash IS NULL AND json_extract(decoded_json, '$.type') = 'CHAN'`)
+		if err == nil {
+			n, _ := res.RowsAffected()
+			log.Printf("[migration] Backfilled channel_hash for %d CHAN packets", n)
+		}
+		// Backfill: extract channelHashHex for encrypted (GRP_TXT) packets, prefixed with 'enc_'
+		res, err = db.Exec(`UPDATE transmissions SET channel_hash = 'enc_' || json_extract(decoded_json, '$.channelHashHex') WHERE payload_type = 5 AND channel_hash IS NULL AND json_extract(decoded_json, '$.type') = 'GRP_TXT'`)
+		if err == nil {
+			n, _ := res.RowsAffected()
+			log.Printf("[migration] Backfilled channel_hash for %d GRP_TXT packets", n)
+		}
+		db.Exec(`INSERT INTO _migrations (name) VALUES ('channel_hash_v1')`)
+		log.Println("[migration] channel_hash column added and backfilled")
+	}
+
 	return nil
 }
 
@@ -357,8 +379,8 @@ func (s *Store) prepareStatements() error {
 	}
 
 	s.stmtInsertTransmission, err = s.db.Prepare(`
-		INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, payload_version, decoded_json)
-		VALUES (?, ?, ?, ?, ?, ?, ?)
+		INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, payload_version, decoded_json, channel_hash)
+		VALUES (?, ?, ?, ?, ?, ?, ?, ?)
 	`)
 	if err != nil {
 		return err
@@ -481,7 +503,7 @@ func (s *Store) InsertTransmission(data *PacketData) (bool, error) {
 		result, err := s.stmtInsertTransmission.Exec(
 			data.RawHex, hash, now,
 			data.RouteType, data.PayloadType, data.PayloadVersion,
-			data.DecodedJSON,
+			data.DecodedJSON, nilIfEmpty(data.ChannelHash),
 		)
 		if err != nil {
 			s.Stats.WriteErrors.Add(1)
@@ -773,6 +795,15 @@ type PacketData struct {
 	PayloadVersion int
 	PathJSON       string
 	DecodedJSON    string
+	ChannelHash    string // grouping key for channel queries (#762)
+}
+
+// nilIfEmpty returns nil for empty strings (for nullable DB columns).
+func nilIfEmpty(s string) interface{} {
+	if s == "" {
+		return nil
+	}
+	return s
 }
 
 // MQTTPacketMessage is the JSON payload from an MQTT raw packet message.
@@ -794,7 +825,7 @@ func BuildPacketData(msg *MQTTPacketMessage, decoded *DecodedPacket, observerID,
 		pathJSON = string(b)
 	}
 
-	return &PacketData{
+	pd := &PacketData{
 		RawHex:         msg.Raw,
 		Timestamp:      now,
 		ObserverID:     observerID,
@@ -810,4 +841,15 @@ func BuildPacketData(msg *MQTTPacketMessage, decoded *DecodedPacket, observerID,
 		PathJSON:       pathJSON,
 		DecodedJSON:    PayloadJSON(&decoded.Payload),
 	}
+
+	// Populate channel_hash for fast channel queries (#762)
+	if decoded.Header.PayloadType == PayloadGRP_TXT {
+		if decoded.Payload.Type == "CHAN" && decoded.Payload.Channel != "" {
+			pd.ChannelHash = decoded.Payload.Channel
+		} else if decoded.Payload.Type == "GRP_TXT" && decoded.Payload.ChannelHashHex != "" {
+			pd.ChannelHash = "enc_" + decoded.Payload.ChannelHashHex
+		}
+	}
+
+	return pd
 }

cmd/ingestor/db_test.go

@@ -576,7 +576,7 @@ func TestEndToEndIngest(t *testing.T) {
 	// Simulate full pipeline: decode + insert
 	rawHex := "120046D62DE27D4C5194D7821FC5A34A45565DCC2537B300B9AB6275255CEFB65D840CE5C169C94C9AED39E8BCB6CB6EB0335497A198B33A1A610CD3B03D8DCFC160900E5244280323EE0B44CACAB8F02B5B38B91CFA18BD067B0B5E63E94CFC85F758A8530B9240933402E0E6B8F84D5252322D52"
 
-	decoded, err := DecodePacket(rawHex, nil)
+	decoded, err := DecodePacket(rawHex, nil, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -764,7 +764,7 @@ func TestInsertTransmissionNilSNRRSSI(t *testing.T) {
 
 func TestBuildPacketData(t *testing.T) {
 	rawHex := "0A00D69FD7A5A7475DB07337749AE61FA53A4788E976"
-	decoded, err := DecodePacket(rawHex, nil)
+	decoded, err := DecodePacket(rawHex, nil, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -818,7 +818,7 @@ func TestBuildPacketData(t *testing.T) {
 func TestBuildPacketDataWithHops(t *testing.T) {
 	// A packet with actual hops in the path
 	raw := "0505AABBCCDDEE" + strings.Repeat("00", 10)
-	decoded, err := DecodePacket(raw, nil)
+	decoded, err := DecodePacket(raw, nil, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -834,7 +834,7 @@ func TestBuildPacketDataWithHops(t *testing.T) {
 }
 
 func TestBuildPacketDataNilSNRRSSI(t *testing.T) {
-	decoded, _ := DecodePacket("0A00"+strings.Repeat("00", 10), nil)
+	decoded, _ := DecodePacket("0A00"+strings.Repeat("00", 10), nil, false)
 	msg := &MQTTPacketMessage{Raw: "0A00" + strings.Repeat("00", 10)}
 	pkt := BuildPacketData(msg, decoded, "", "")
 
@@ -1624,7 +1624,7 @@ func TestObsTimestampIndexMigration(t *testing.T) {
 
 func TestBuildPacketDataScoreAndDirection(t *testing.T) {
 	rawHex := "0A00D69FD7A5A7475DB07337749AE61FA53A4788E976"
-	decoded, err := DecodePacket(rawHex, nil)
+	decoded, err := DecodePacket(rawHex, nil, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1647,7 +1647,7 @@ func TestBuildPacketDataScoreAndDirection(t *testing.T) {
 }
 
 func TestBuildPacketDataNilScoreDirection(t *testing.T) {
-	decoded, _ := DecodePacket("0A00"+strings.Repeat("00", 10), nil)
+	decoded, _ := DecodePacket("0A00"+strings.Repeat("00", 10), nil, false)
 	msg := &MQTTPacketMessage{Raw: "0A00" + strings.Repeat("00", 10)}
 	pkt := BuildPacketData(msg, decoded, "", "")
 

cmd/ingestor/decoder.go

@@ -11,6 +11,8 @@ import (
 	"math"
 	"strings"
 	"unicode/utf8"
+
+	"github.com/meshcore-analyzer/sigvalidate"
 )
 
 // Route type constants (header bits 1-0)
@@ -78,9 +80,10 @@ type TransportCodes struct {
 
 // Path holds decoded path/hop information.
 type Path struct {
-	HashSize  int      `json:"hashSize"`
-	HashCount int      `json:"hashCount"`
-	Hops      []string `json:"hops"`
+	HashSize      int      `json:"hashSize"`
+	HashCount     int      `json:"hashCount"`
+	Hops          []string `json:"hops"`
+	HopsCompleted *int     `json:"hopsCompleted,omitempty"`
 }
 
 // AdvertFlags holds decoded advert flag bits.
@@ -109,6 +112,7 @@ type Payload struct {
 	Timestamp     uint32       `json:"timestamp,omitempty"`
 	TimestampISO  string       `json:"timestampISO,omitempty"`
 	Signature     string       `json:"signature,omitempty"`
+	SignatureValid *bool       `json:"signatureValid,omitempty"`
 	Flags         *AdvertFlags `json:"flags,omitempty"`
 	Lat           *float64     `json:"lat,omitempty"`
 	Lon           *float64     `json:"lon,omitempty"`
@@ -140,6 +144,7 @@ type DecodedPacket struct {
 	Path           Path            `json:"path"`
 	Payload        Payload         `json:"payload"`
 	Raw            string          `json:"raw"`
+	Anomaly        string          `json:"anomaly,omitempty"`
 }
 
 func decodeHeader(b byte) Header {
@@ -215,7 +220,7 @@ func decodeAck(buf []byte) Payload {
 	}
 }
 
-func decodeAdvert(buf []byte) Payload {
+func decodeAdvert(buf []byte, validateSignatures bool) Payload {
 	if len(buf) < 100 {
 		return Payload{Type: "ADVERT", Error: "too short for advert", RawHex: hex.EncodeToString(buf)}
 	}
@@ -233,6 +238,16 @@ func decodeAdvert(buf []byte) Payload {
 		Signature:    signature,
 	}
 
+	if validateSignatures {
+		valid, err := sigvalidate.ValidateAdvert(buf[0:32], buf[36:100], timestamp, appdata)
+		if err != nil {
+			f := false
+			p.SignatureValid = &f
+		} else {
+			p.SignatureValid = &valid
+		}
+	}
+
 	if len(appdata) > 0 {
 		flags := appdata[0]
 		advType := int(flags & 0x0F)
@@ -506,7 +521,7 @@ func decodeTrace(buf []byte) Payload {
 	return p
 }
 
-func decodePayload(payloadType int, buf []byte, channelKeys map[string]string) Payload {
+func decodePayload(payloadType int, buf []byte, channelKeys map[string]string, validateSignatures bool) Payload {
 	switch payloadType {
 	case PayloadREQ:
 		return decodeEncryptedPayload("REQ", buf)
@@ -517,7 +532,7 @@ func decodePayload(payloadType int, buf []byte, channelKeys map[string]string) P
 	case PayloadACK:
 		return decodeAck(buf)
 	case PayloadADVERT:
-		return decodeAdvert(buf)
+		return decodeAdvert(buf, validateSignatures)
 	case PayloadGRP_TXT:
 		return decodeGrpTxt(buf, channelKeys)
 	case PayloadANON_REQ:
@@ -532,7 +547,7 @@ func decodePayload(payloadType int, buf []byte, channelKeys map[string]string) P
 }
 
 // DecodePacket decodes a hex-encoded MeshCore packet.
-func DecodePacket(hexString string, channelKeys map[string]string) (*DecodedPacket, error) {
+func DecodePacket(hexString string, channelKeys map[string]string, validateSignatures bool) (*DecodedPacket, error) {
 	hexString = strings.ReplaceAll(hexString, " ", "")
 	hexString = strings.ReplaceAll(hexString, "\n", "")
 	hexString = strings.ReplaceAll(hexString, "\r", "")
@@ -570,29 +585,58 @@ func DecodePacket(hexString string, channelKeys map[string]string) (*DecodedPack
 	offset += bytesConsumed
 
 	payloadBuf := buf[offset:]
-	payload := decodePayload(header.PayloadType, payloadBuf, channelKeys)
+	payload := decodePayload(header.PayloadType, payloadBuf, channelKeys, validateSignatures)
 
 	// TRACE packets store hop IDs in the payload (buf[9:]) rather than the header
-	// path field. The header path byte still encodes hashSize in bits 6-7, which
-	// we use to split the payload path data into individual hop prefixes.
+	// path field. Firmware always sends TRACE as DIRECT (route_type 2 or 3);
+	// FLOOD-routed TRACEs are anomalous but handled gracefully (parsed, but
+	// flagged). The TRACE flags byte (payload offset 8) encodes path_sz in
+	// bits 0-1 as a power-of-two exponent: hash_bytes = 1 << path_sz.
+	// NOT the header path byte's hash_size bits. The header path contains SNR
+	// bytes — one per hop that actually forwarded.
+	// We expose hopsCompleted (count of SNR bytes) so consumers can distinguish
+	// how far the trace got vs the full intended route.
+	var anomaly string
 	if header.PayloadType == PayloadTRACE && payload.PathData != "" {
+		// Flag anomalous routing — firmware only sends TRACE as DIRECT
+		if header.RouteType != RouteDirect && header.RouteType != RouteTransportDirect {
+			anomaly = "TRACE packet with non-DIRECT routing (expected DIRECT or TRANSPORT_DIRECT)"
+		}
+		// The header path hops count represents SNR entries = completed hops
+		hopsCompleted := path.HashCount
 		pathBytes, err := hex.DecodeString(payload.PathData)
-		if err == nil && path.HashSize > 0 {
-			hops := make([]string, 0, len(pathBytes)/path.HashSize)
-			for i := 0; i+path.HashSize <= len(pathBytes); i += path.HashSize {
-				hops = append(hops, strings.ToUpper(hex.EncodeToString(pathBytes[i:i+path.HashSize])))
+		if err == nil && payload.TraceFlags != nil {
+			// path_sz from flags byte is a power-of-two exponent per firmware:
+			// hash_bytes = 1 << (flags & 0x03)
+			pathSz := 1 << (*payload.TraceFlags & 0x03)
+			hops := make([]string, 0, len(pathBytes)/pathSz)
+			for i := 0; i+pathSz <= len(pathBytes); i += pathSz {
+				hops = append(hops, strings.ToUpper(hex.EncodeToString(pathBytes[i:i+pathSz])))
 			}
 			path.Hops = hops
 			path.HashCount = len(hops)
+			path.HashSize = pathSz
+			path.HopsCompleted = &hopsCompleted
 		}
 	}
 
+	// Zero-hop direct packets have hash_count=0 (lower 6 bits of pathByte),
+	// which makes the generic formula yield a bogus hashSize. Reset to 0
+	// (unknown) so API consumers get correct data. We mask with 0x3F to check
+	// only hash_count, matching the JS frontend approach — the upper hash_size
+	// bits are meaningless when there are no hops. Skip TRACE packets — they
+	// use hashSize to parse hops from the payload above.
+	if (header.RouteType == RouteDirect || header.RouteType == RouteTransportDirect) && pathByte&0x3F == 0 && header.PayloadType != PayloadTRACE {
+		path.HashSize = 0
+	}
+
 	return &DecodedPacket{
 		Header:         header,
 		TransportCodes: tc,
 		Path:           path,
 		Payload:        payload,
 		Raw:            strings.ToUpper(hexString),
+		Anomaly:        anomaly,
 	}, nil
 }
 

cmd/ingestor/decoder_test.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"crypto/aes"
+	"crypto/ed25519"
 	"crypto/hmac"
 	"crypto/sha256"
 	"encoding/binary"
@@ -9,6 +10,8 @@ import (
 	"math"
 	"strings"
 	"testing"
+
+	"github.com/meshcore-analyzer/sigvalidate"
 )
 
 func TestDecodeHeaderRoutTypes(t *testing.T) {
@@ -55,7 +58,7 @@ func TestDecodeHeaderPayloadTypes(t *testing.T) {
 
 func TestDecodePathZeroHops(t *testing.T) {
 	// 0x00: 0 hops, 1-byte hashes
-	pkt, err := DecodePacket("0500"+strings.Repeat("00", 10), nil)
+	pkt, err := DecodePacket("0500"+strings.Repeat("00", 10), nil, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -72,7 +75,7 @@ func TestDecodePathZeroHops(t *testing.T) {
 
 func TestDecodePath1ByteHashes(t *testing.T) {
 	// 0x05: 5 hops, 1-byte hashes → 5 path bytes
-	pkt, err := DecodePacket("0505"+"AABBCCDDEE"+strings.Repeat("00", 10), nil)
+	pkt, err := DecodePacket("0505"+"AABBCCDDEE"+strings.Repeat("00", 10), nil, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -95,7 +98,7 @@ func TestDecodePath1ByteHashes(t *testing.T) {
 
 func TestDecodePath2ByteHashes(t *testing.T) {
 	// 0x45: 5 hops, 2-byte hashes
-	pkt, err := DecodePacket("0545"+"AA11BB22CC33DD44EE55"+strings.Repeat("00", 10), nil)
+	pkt, err := DecodePacket("0545"+"AA11BB22CC33DD44EE55"+strings.Repeat("00", 10), nil, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -112,7 +115,7 @@ func TestDecodePath2ByteHashes(t *testing.T) {
 
 func TestDecodePath3ByteHashes(t *testing.T) {
 	// 0x8A: 10 hops, 3-byte hashes
-	pkt, err := DecodePacket("058A"+strings.Repeat("AA11FF", 10)+strings.Repeat("00", 10), nil)
+	pkt, err := DecodePacket("058A"+strings.Repeat("AA11FF", 10)+strings.Repeat("00", 10), nil, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -131,7 +134,7 @@ func TestTransportCodes(t *testing.T) {
 	// Route type 0 (TRANSPORT_FLOOD) should have transport codes
 	// Firmware order: header + transport_codes(4) + path_len + path + payload
 	hex := "14" + "AABB" + "CCDD" + "00" + strings.Repeat("00", 10)
-	pkt, err := DecodePacket(hex, nil)
+	pkt, err := DecodePacket(hex, nil, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -149,7 +152,7 @@ func TestTransportCodes(t *testing.T) {
 	}
 
 	// Route type 1 (FLOOD) should NOT have transport codes
-	pkt2, err := DecodePacket("0500"+strings.Repeat("00", 10), nil)
+	pkt2, err := DecodePacket("0500"+strings.Repeat("00", 10), nil, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -169,7 +172,7 @@ func TestDecodeAdvertFull(t *testing.T) {
 	name := "546573744E6F6465" // "TestNode"
 
 	hex := "1200" + pubkey + timestamp + signature + flags + lat + lon + name
-	pkt, err := DecodePacket(hex, nil)
+	pkt, err := DecodePacket(hex, nil, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -227,7 +230,7 @@ func TestDecodeAdvertTypeEnums(t *testing.T) {
 	makeAdvert := func(flagsByte byte) *DecodedPacket {
 		hex := "1200" + strings.Repeat("AA", 32) + "00000000" + strings.Repeat("BB", 64) +
 			strings.ToUpper(string([]byte{hexDigit(flagsByte>>4), hexDigit(flagsByte & 0x0f)}))
-		pkt, err := DecodePacket(hex, nil)
+		pkt, err := DecodePacket(hex, nil, false)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -272,7 +275,7 @@ func hexDigit(v byte) byte {
 
 func TestDecodeAdvertNoLocationNoName(t *testing.T) {
 	hex := "1200" + strings.Repeat("CC", 32) + "00000000" + strings.Repeat("DD", 64) + "02"
-	pkt, err := DecodePacket(hex, nil)
+	pkt, err := DecodePacket(hex, nil, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -291,7 +294,7 @@ func TestDecodeAdvertNoLocationNoName(t *testing.T) {
 }
 
 func TestGoldenFixtureTxtMsg(t *testing.T) {
-	pkt, err := DecodePacket("0A00D69FD7A5A7475DB07337749AE61FA53A4788E976", nil)
+	pkt, err := DecodePacket("0A00D69FD7A5A7475DB07337749AE61FA53A4788E976", nil, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -314,7 +317,7 @@ func TestGoldenFixtureTxtMsg(t *testing.T) {
 
 func TestGoldenFixtureAdvert(t *testing.T) {
 	rawHex := "120046D62DE27D4C5194D7821FC5A34A45565DCC2537B300B9AB6275255CEFB65D840CE5C169C94C9AED39E8BCB6CB6EB0335497A198B33A1A610CD3B03D8DCFC160900E5244280323EE0B44CACAB8F02B5B38B91CFA18BD067B0B5E63E94CFC85F758A8530B9240933402E0E6B8F84D5252322D52"
-	pkt, err := DecodePacket(rawHex, nil)
+	pkt, err := DecodePacket(rawHex, nil, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -337,7 +340,7 @@ func TestGoldenFixtureAdvert(t *testing.T) {
 
 func TestGoldenFixtureUnicodeAdvert(t *testing.T) {
 	rawHex := "120073CFF971E1CB5754A742C152B2D2E0EB108A19B246D663ED8898A72C4A5AD86EA6768E66694B025EDF6939D5C44CFF719C5D5520E5F06B20680A83AD9C2C61C3227BBB977A85EE462F3553445FECF8EDD05C234ECE217272E503F14D6DF2B1B9B133890C923CDF3002F8FDC1F85045414BF09F8CB3"
-	pkt, err := DecodePacket(rawHex, nil)
+	pkt, err := DecodePacket(rawHex, nil, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -354,14 +357,14 @@ func TestGoldenFixtureUnicodeAdvert(t *testing.T) {
 }
 
 func TestDecodePacketTooShort(t *testing.T) {
-	_, err := DecodePacket("FF", nil)
+	_, err := DecodePacket("FF", nil, false)
 	if err == nil {
 		t.Error("expected error for 1-byte packet")
 	}
 }
 
 func TestDecodePacketInvalidHex(t *testing.T) {
-	_, err := DecodePacket("ZZZZ", nil)
+	_, err := DecodePacket("ZZZZ", nil, false)
 	if err == nil {
 		t.Error("expected error for invalid hex")
 	}
@@ -568,7 +571,7 @@ func TestDecodeTracePathParsing(t *testing.T) {
 	// Packet from issue #276: 260001807dca00000000007d547d
 	// Path byte 0x00 → hashSize=1, hops in payload at buf[9:] = 7d 54 7d
 	// Expected path: ["7D", "54", "7D"]
-	pkt, err := DecodePacket("260001807dca00000000007d547d", nil)
+	pkt, err := DecodePacket("260001807dca00000000007d547d", nil, false)
 	if err != nil {
 		t.Fatalf("DecodePacket error: %v", err)
 	}
@@ -590,7 +593,7 @@ func TestDecodeTracePathParsing(t *testing.T) {
 }
 
 func TestDecodeAdvertShort(t *testing.T) {
-	p := decodeAdvert(make([]byte, 50))
+	p := decodeAdvert(make([]byte, 50), false)
 	if p.Error != "too short for advert" {
 		t.Errorf("expected 'too short for advert' error, got %q", p.Error)
 	}
@@ -628,7 +631,7 @@ func TestDecodeEncryptedPayloadValid(t *testing.T) {
 
 func TestDecodePayloadGRPData(t *testing.T) {
 	buf := []byte{0x01, 0x02, 0x03}
-	p := decodePayload(PayloadGRP_DATA, buf, nil)
+	p := decodePayload(PayloadGRP_DATA, buf, nil, false)
 	if p.Type != "UNKNOWN" {
 		t.Errorf("type=%s, want UNKNOWN", p.Type)
 	}
@@ -639,7 +642,7 @@ func TestDecodePayloadGRPData(t *testing.T) {
 
 func TestDecodePayloadRAWCustom(t *testing.T) {
 	buf := []byte{0xFF, 0xFE}
-	p := decodePayload(PayloadRAW_CUSTOM, buf, nil)
+	p := decodePayload(PayloadRAW_CUSTOM, buf, nil, false)
 	if p.Type != "UNKNOWN" {
 		t.Errorf("type=%s, want UNKNOWN", p.Type)
 	}
@@ -647,49 +650,49 @@ func TestDecodePayloadRAWCustom(t *testing.T) {
 
 func TestDecodePayloadAllTypes(t *testing.T) {
 	// REQ
-	p := decodePayload(PayloadREQ, make([]byte, 10), nil)
+	p := decodePayload(PayloadREQ, make([]byte, 10), nil, false)
 	if p.Type != "REQ" {
 		t.Errorf("REQ: type=%s", p.Type)
 	}
 
 	// RESPONSE
-	p = decodePayload(PayloadRESPONSE, make([]byte, 10), nil)
+	p = decodePayload(PayloadRESPONSE, make([]byte, 10), nil, false)
 	if p.Type != "RESPONSE" {
 		t.Errorf("RESPONSE: type=%s", p.Type)
 	}
 
 	// TXT_MSG
-	p = decodePayload(PayloadTXT_MSG, make([]byte, 10), nil)
+	p = decodePayload(PayloadTXT_MSG, make([]byte, 10), nil, false)
 	if p.Type != "TXT_MSG" {
 		t.Errorf("TXT_MSG: type=%s", p.Type)
 	}
 
 	// ACK
-	p = decodePayload(PayloadACK, make([]byte, 10), nil)
+	p = decodePayload(PayloadACK, make([]byte, 10), nil, false)
 	if p.Type != "ACK" {
 		t.Errorf("ACK: type=%s", p.Type)
 	}
 
 	// GRP_TXT
-	p = decodePayload(PayloadGRP_TXT, make([]byte, 10), nil)
+	p = decodePayload(PayloadGRP_TXT, make([]byte, 10), nil, false)
 	if p.Type != "GRP_TXT" {
 		t.Errorf("GRP_TXT: type=%s", p.Type)
 	}
 
 	// ANON_REQ
-	p = decodePayload(PayloadANON_REQ, make([]byte, 40), nil)
+	p = decodePayload(PayloadANON_REQ, make([]byte, 40), nil, false)
 	if p.Type != "ANON_REQ" {
 		t.Errorf("ANON_REQ: type=%s", p.Type)
 	}
 
 	// PATH
-	p = decodePayload(PayloadPATH, make([]byte, 10), nil)
+	p = decodePayload(PayloadPATH, make([]byte, 10), nil, false)
 	if p.Type != "PATH" {
 		t.Errorf("PATH: type=%s", p.Type)
 	}
 
 	// TRACE
-	p = decodePayload(PayloadTRACE, make([]byte, 20), nil)
+	p = decodePayload(PayloadTRACE, make([]byte, 20), nil, false)
 	if p.Type != "TRACE" {
 		t.Errorf("TRACE: type=%s", p.Type)
 	}
@@ -925,7 +928,7 @@ func TestComputeContentHashLongFallback(t *testing.T) {
 
 func TestDecodePacketWithWhitespace(t *testing.T) {
 	raw := "0A 00 D6 9F D7 A5 A7 47 5D B0 73 37 74 9A E6 1F A5 3A 47 88 E9 76"
-	pkt, err := DecodePacket(raw, nil)
+	pkt, err := DecodePacket(raw, nil, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -936,7 +939,7 @@ func TestDecodePacketWithWhitespace(t *testing.T) {
 
 func TestDecodePacketWithNewlines(t *testing.T) {
 	raw := "0A00\nD69F\r\nD7A5A7475DB07337749AE61FA53A4788E976"
-	pkt, err := DecodePacket(raw, nil)
+	pkt, err := DecodePacket(raw, nil, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -947,7 +950,7 @@ func TestDecodePacketWithNewlines(t *testing.T) {
 
 func TestDecodePacketTransportRouteTooShort(t *testing.T) {
 	// TRANSPORT_FLOOD (route=0) but only 2 bytes total → too short for transport codes
-	_, err := DecodePacket("1400", nil)
+	_, err := DecodePacket("1400", nil, false)
 	if err == nil {
 		t.Error("expected error for transport route with too-short buffer")
 	}
@@ -1007,7 +1010,7 @@ func TestDecodeHeaderUnknownTypes(t *testing.T) {
 
 func TestDecodePayloadMultipart(t *testing.T) {
 	// MULTIPART (0x0A) falls through to default → UNKNOWN
-	p := decodePayload(PayloadMULTIPART, []byte{0x01, 0x02}, nil)
+	p := decodePayload(PayloadMULTIPART, []byte{0x01, 0x02}, nil, false)
 	if p.Type != "UNKNOWN" {
 		t.Errorf("MULTIPART type=%s, want UNKNOWN", p.Type)
 	}
@@ -1015,7 +1018,7 @@ func TestDecodePayloadMultipart(t *testing.T) {
 
 func TestDecodePayloadControl(t *testing.T) {
 	// CONTROL (0x0B) falls through to default → UNKNOWN
-	p := decodePayload(PayloadCONTROL, []byte{0x01, 0x02}, nil)
+	p := decodePayload(PayloadCONTROL, []byte{0x01, 0x02}, nil, false)
 	if p.Type != "UNKNOWN" {
 		t.Errorf("CONTROL type=%s, want UNKNOWN", p.Type)
 	}
@@ -1039,7 +1042,7 @@ func TestDecodePathTruncatedBuffer(t *testing.T) {
 func TestDecodeFloodAdvert5Hops(t *testing.T) {
 	// From test-decoder.js Test 1
 	raw := "11451000D818206D3AAC152C8A91F89957E6D30CA51F36E28790228971C473B755F244F718754CF5EE4A2FD58D944466E42CDED140C66D0CC590183E32BAF40F112BE8F3F2BDF6012B4B2793C52F1D36F69EE054D9A05593286F78453E56C0EC4A3EB95DDA2A7543FCCC00B939CACC009278603902FC12BCF84B706120526F6F6620536F6C6172"
-	pkt, err := DecodePacket(raw, nil)
+	pkt, err := DecodePacket(raw, nil, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1410,7 +1413,7 @@ func TestDecodeAdvertWithTelemetry(t *testing.T) {
 		name + nullTerm +
 		hex.EncodeToString(batteryLE) + hex.EncodeToString(tempLE)
 
-	pkt, err := DecodePacket(hexStr, nil)
+	pkt, err := DecodePacket(hexStr, nil, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1449,7 +1452,7 @@ func TestDecodeAdvertWithTelemetryNegativeTemp(t *testing.T) {
 		name + nullTerm +
 		hex.EncodeToString(batteryLE) + hex.EncodeToString(tempLE)
 
-	pkt, err := DecodePacket(hexStr, nil)
+	pkt, err := DecodePacket(hexStr, nil, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1476,7 +1479,7 @@ func TestDecodeAdvertWithoutTelemetry(t *testing.T) {
 	name := hex.EncodeToString([]byte("Node1"))
 
 	hexStr := "1200" + pubkey + timestamp + signature + flags + name
-	pkt, err := DecodePacket(hexStr, nil)
+	pkt, err := DecodePacket(hexStr, nil, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1503,7 +1506,7 @@ func TestDecodeAdvertNonSensorIgnoresTelemetryBytes(t *testing.T) {
 	extraBytes := "B40ED403" // battery-like and temp-like bytes
 
 	hexStr := "1200" + pubkey + timestamp + signature + flags + name + nullTerm + extraBytes
-	pkt, err := DecodePacket(hexStr, nil)
+	pkt, err := DecodePacket(hexStr, nil, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1531,7 +1534,7 @@ func TestDecodeAdvertTelemetryZeroTemp(t *testing.T) {
 		name + nullTerm +
 		hex.EncodeToString(batteryLE) + hex.EncodeToString(tempLE)
 
-	pkt, err := DecodePacket(hexStr, nil)
+	pkt, err := DecodePacket(hexStr, nil, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1542,3 +1545,193 @@ func TestDecodeAdvertTelemetryZeroTemp(t *testing.T) {
 		t.Errorf("temperature_c=%f, want 0.0", *pkt.Payload.TemperatureC)
 	}
 }
+
+func repeatHex(byteHex string, n int) string {
+	s := ""
+	for i := 0; i < n; i++ {
+		s += byteHex
+	}
+	return s
+}
+
+func TestZeroHopDirectHashSize(t *testing.T) {
+	// DIRECT (RouteType=2) + REQ (PayloadType=0) → header byte = 0x02
+	// pathByte=0x00 → hash_count=0, hash_size bits=0 → should get HashSize=0
+	hex := "02" + "00" + repeatHex("AA", 20)
+	pkt, err := DecodePacket(hex, nil, false)
+	if err != nil {
+		t.Fatalf("DecodePacket failed: %v", err)
+	}
+	if pkt.Path.HashSize != 0 {
+		t.Errorf("DIRECT zero-hop: want HashSize=0, got %d", pkt.Path.HashSize)
+	}
+}
+
+func TestZeroHopDirectHashSizeWithNonZeroUpperBits(t *testing.T) {
+	// DIRECT (RouteType=2) + REQ (PayloadType=0) → header byte = 0x02
+	// pathByte=0x40 → hash_count=0, hash_size bits=01 → should still get HashSize=0
+	hex := "02" + "40" + repeatHex("AA", 20)
+	pkt, err := DecodePacket(hex, nil, false)
+	if err != nil {
+		t.Fatalf("DecodePacket failed: %v", err)
+	}
+	if pkt.Path.HashSize != 0 {
+		t.Errorf("DIRECT zero-hop with hash_size bits set: want HashSize=0, got %d", pkt.Path.HashSize)
+	}
+}
+
+func TestNonDirectZeroPathByteKeepsHashSize(t *testing.T) {
+	// FLOOD (RouteType=1) + REQ (PayloadType=0) → header byte = 0x01
+	// pathByte=0x00 → non-DIRECT should keep HashSize=1
+	hex := "01" + "00" + repeatHex("AA", 20)
+	pkt, err := DecodePacket(hex, nil, false)
+	if err != nil {
+		t.Fatalf("DecodePacket failed: %v", err)
+	}
+	if pkt.Path.HashSize != 1 {
+		t.Errorf("FLOOD zero pathByte: want HashSize=1, got %d", pkt.Path.HashSize)
+	}
+}
+
+func TestDirectNonZeroHopKeepsHashSize(t *testing.T) {
+	// DIRECT (RouteType=2) + REQ (PayloadType=0) → header byte = 0x02
+	// pathByte=0x01 → hash_count=1, hash_size=1 → should keep HashSize=1
+	hex := "02" + "01" + repeatHex("BB", 21)
+	pkt, err := DecodePacket(hex, nil, false)
+	if err != nil {
+		t.Fatalf("DecodePacket failed: %v", err)
+	}
+	if pkt.Path.HashSize != 1 {
+		t.Errorf("DIRECT with 1 hop: want HashSize=1, got %d", pkt.Path.HashSize)
+	}
+}
+
+func TestZeroHopTransportDirectHashSize(t *testing.T) {
+	// TRANSPORT_DIRECT (RouteType=3) + REQ (PayloadType=0) → header byte = 0x03
+	// 4 bytes transport codes + pathByte=0x00 → hash_count=0 → should get HashSize=0
+	hex := "03" + "11223344" + "00" + repeatHex("AA", 20)
+	pkt, err := DecodePacket(hex, nil, false)
+	if err != nil {
+		t.Fatalf("DecodePacket failed: %v", err)
+	}
+	if pkt.Path.HashSize != 0 {
+		t.Errorf("TRANSPORT_DIRECT zero-hop: want HashSize=0, got %d", pkt.Path.HashSize)
+	}
+}
+
+func TestZeroHopTransportDirectHashSizeWithNonZeroUpperBits(t *testing.T) {
+	// TRANSPORT_DIRECT (RouteType=3) + REQ (PayloadType=0) → header byte = 0x03
+	// 4 bytes transport codes + pathByte=0xC0 → hash_count=0, hash_size bits=11 → should still get HashSize=0
+	hex := "03" + "11223344" + "C0" + repeatHex("AA", 20)
+	pkt, err := DecodePacket(hex, nil, false)
+	if err != nil {
+		t.Fatalf("DecodePacket failed: %v", err)
+	}
+	if pkt.Path.HashSize != 0 {
+		t.Errorf("TRANSPORT_DIRECT zero-hop with hash_size bits set: want HashSize=0, got %d", pkt.Path.HashSize)
+	}
+}
+
+func TestValidateAdvertSignature(t *testing.T) {
+	// Generate a real ed25519 key pair
+	pub, priv, err := ed25519.GenerateKey(nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var timestamp uint32 = 1234567890
+	appdata := []byte{0x02, 0x11, 0x22} // flags + some data
+
+	// Build the signed message: pubKey + timestamp(LE) + appdata
+	message := make([]byte, 32+4+len(appdata))
+	copy(message[0:32], pub)
+	binary.LittleEndian.PutUint32(message[32:36], timestamp)
+	copy(message[36:], appdata)
+
+	sig := ed25519.Sign(priv, message)
+
+	// Valid signature
+	valid, err := sigvalidate.ValidateAdvert([]byte(pub), sig, timestamp, appdata)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !valid {
+		t.Error("expected valid signature")
+	}
+
+	// Tampered appdata → invalid
+	badAppdata := []byte{0x03, 0x11, 0x22}
+	valid, err = sigvalidate.ValidateAdvert([]byte(pub), sig, timestamp, badAppdata)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if valid {
+		t.Error("expected invalid signature with tampered appdata")
+	}
+
+	// Wrong timestamp → invalid
+	valid, err = sigvalidate.ValidateAdvert([]byte(pub), sig, timestamp+1, appdata)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if valid {
+		t.Error("expected invalid signature with wrong timestamp")
+	}
+
+	// Wrong length pubkey
+	_, err = sigvalidate.ValidateAdvert([]byte{0xAA, 0xBB}, sig, timestamp, appdata)
+	if err == nil {
+		t.Error("expected error for short pubkey")
+	}
+
+	// Wrong length signature
+	_, err = sigvalidate.ValidateAdvert([]byte(pub), []byte{0xAA, 0xBB}, timestamp, appdata)
+	if err == nil {
+		t.Error("expected error for short signature")
+	}
+}
+
+func TestDecodeAdvertWithSignatureValidation(t *testing.T) {
+	// Generate key pair
+	pub, priv, err := ed25519.GenerateKey(nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var timestamp uint32 = 1000000
+	appdata := []byte{0x02} // repeater type, no location
+
+	// Build signed message
+	message := make([]byte, 32+4+len(appdata))
+	copy(message[0:32], pub)
+	binary.LittleEndian.PutUint32(message[32:36], timestamp)
+	copy(message[36:], appdata)
+	sig := ed25519.Sign(priv, message)
+
+	// Build advert buffer: pubkey(32) + timestamp(4) + signature(64) + appdata
+	buf := make([]byte, 0, 101)
+	buf = append(buf, pub...)
+	ts := make([]byte, 4)
+	binary.LittleEndian.PutUint32(ts, timestamp)
+	buf = append(buf, ts...)
+	buf = append(buf, sig...)
+	buf = append(buf, appdata...)
+
+	// With validation enabled
+	p := decodeAdvert(buf, true)
+	if p.Error != "" {
+		t.Fatalf("decode error: %s", p.Error)
+	}
+	if p.SignatureValid == nil {
+		t.Fatal("SignatureValid should be set when validation enabled")
+	}
+	if !*p.SignatureValid {
+		t.Error("expected valid signature")
+	}
+
+	// Without validation
+	p2 := decodeAdvert(buf, false)
+	if p2.SignatureValid != nil {
+		t.Error("SignatureValid should be nil when validation disabled")
+	}
+}

cmd/ingestor/go.mod

@@ -5,11 +5,14 @@ go 1.22
 require (
 	github.com/eclipse/paho.mqtt.golang v1.5.0
 	github.com/meshcore-analyzer/geofilter v0.0.0
+	github.com/meshcore-analyzer/sigvalidate v0.0.0
 	modernc.org/sqlite v1.34.5
 )
 
 replace github.com/meshcore-analyzer/geofilter => ../../internal/geofilter
 
+replace github.com/meshcore-analyzer/sigvalidate => ../../internal/sigvalidate
+
 require (
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/google/uuid v1.6.0 // indirect

cmd/ingestor/main.go

@@ -49,9 +49,6 @@ func main() {
 	}
 
 	sources := cfg.ResolvedSources()
-	if len(sources) == 0 {
-		log.Fatal("no MQTT sources configured — set mqttSources in config or MQTT_BROKER env var")
-	}
 
 	store, err := OpenStoreWithInterval(cfg.DBPath, cfg.MetricsSampleInterval())
 	if err != nil {
@@ -163,7 +160,7 @@ func main() {
 	}
 
 	if len(clients) == 0 {
-		log.Fatal("no MQTT connections established")
+		log.Fatal("no MQTT connections established — check broker is running (default: mqtt://localhost:1883). Set MQTT_BROKER env var or configure mqttSources in config.json")
 	}
 
 	log.Printf("Running — %d MQTT source(s) connected", len(clients))
@@ -251,7 +248,7 @@ func handleMessage(store *Store, tag string, source MQTTSource, m mqtt.Message,
 	// Format 1: Raw packet (meshcoretomqtt / Cisien format)
 	rawHex, _ := msg["raw"].(string)
 	if rawHex != "" {
-		decoded, err := DecodePacket(rawHex, channelKeys)
+		decoded, err := DecodePacket(rawHex, channelKeys, false)
 		if err != nil {
 			log.Printf("MQTT [%s] decode error: %v", tag, err)
 			return
@@ -443,19 +440,18 @@ func handleMessage(store *Store, tag string, source MQTTSource, m mqtt.Message,
 			PayloadType:  5, // GRP_TXT
 			PathJSON:     "[]",
 			DecodedJSON:  string(decodedJSON),
+			ChannelHash:  channelName, // fast channel queries (#762)
 		}
 
 		if _, err := store.InsertTransmission(pktData); err != nil {
 			log.Printf("MQTT [%s] channel insert error: %v", tag, err)
 		}
 
-		// Upsert sender as a companion node
-		if sender != "" {
-			senderKey := "sender-" + strings.ToLower(sender)
-			if err := store.UpsertNode(senderKey, sender, "companion", nil, nil, now); err != nil {
-				log.Printf("MQTT [%s] sender node upsert error: %v", tag, err)
-			}
-		}
+		// Note: we intentionally do NOT create a node entry for channel message senders.
+		// Channel messages don't carry the sender's real pubkey, so any entry we create
+		// would use a synthetic key ("sender-<name>") that doesn't match the real pubkey
+		// used for claiming/health lookups. The node will get a proper entry when it
+		// sends an advert. See issue #665.
 
 		log.Printf("MQTT [%s] channel message: ch%s from %s", tag, channelIdx, firstNonEmpty(sender, "unknown"))
 		return

cmd/server/apikey_security_test.go

@@ -0,0 +1,111 @@
+package main
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestIsWeakAPIKey(t *testing.T) {
+	// Known defaults must be detected
+	for _, weak := range []string{
+		"your-secret-api-key-here", "change-me", "example", "test",
+		"password", "admin", "apikey", "api-key", "secret", "default",
+	} {
+		if !IsWeakAPIKey(weak) {
+			t.Errorf("expected %q to be weak", weak)
+		}
+	}
+	// Case-insensitive
+	if !IsWeakAPIKey("Password") {
+		t.Error("expected case-insensitive match for Password")
+	}
+	if !IsWeakAPIKey("YOUR-SECRET-API-KEY-HERE") {
+		t.Error("expected case-insensitive match")
+	}
+
+	// Short keys (<16 chars) are weak
+	if !IsWeakAPIKey("short") {
+		t.Error("expected short key to be weak")
+	}
+	if !IsWeakAPIKey("exactly15chars!") { // 15 chars
+		t.Error("expected 15-char key to be weak")
+	}
+
+	// Empty key is NOT weak (handled separately as "disabled")
+	if IsWeakAPIKey("") {
+		t.Error("empty key should not be flagged as weak")
+	}
+
+	// Strong keys pass
+	if IsWeakAPIKey("a-very-strong-key-1234") {
+		t.Error("expected strong key to pass")
+	}
+	if IsWeakAPIKey("xK9!mP2@nL5#qR8$") {
+		t.Error("expected 17-char random key to pass")
+	}
+}
+
+func TestRequireAPIKey_RejectsWeakKey(t *testing.T) {
+	s := &Server{cfg: &Config{APIKey: "test"}}
+	handler := s.requireAPIKey(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	req := httptest.NewRequest("POST", "/api/packets", nil)
+	req.Header.Set("X-API-Key", "test")
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	if rr.Code != http.StatusForbidden {
+		t.Errorf("expected 403 for weak key, got %d", rr.Code)
+	}
+}
+
+func TestRequireAPIKey_AcceptsStrongKey(t *testing.T) {
+	strongKey := "a-very-strong-key-1234"
+	s := &Server{cfg: &Config{APIKey: strongKey}}
+	handler := s.requireAPIKey(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	req := httptest.NewRequest("POST", "/api/packets", nil)
+	req.Header.Set("X-API-Key", strongKey)
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	if rr.Code != http.StatusOK {
+		t.Errorf("expected 200 for strong key, got %d", rr.Code)
+	}
+}
+
+func TestRequireAPIKey_EmptyKeyDisablesEndpoints(t *testing.T) {
+	s := &Server{cfg: &Config{APIKey: ""}}
+	handler := s.requireAPIKey(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	req := httptest.NewRequest("POST", "/api/packets", nil)
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	if rr.Code != http.StatusForbidden {
+		t.Errorf("expected 403 for empty key, got %d", rr.Code)
+	}
+}
+
+func TestRequireAPIKey_WrongKeyUnauthorized(t *testing.T) {
+	s := &Server{cfg: &Config{APIKey: "a-very-strong-key-1234"}}
+	handler := s.requireAPIKey(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	req := httptest.NewRequest("POST", "/api/packets", nil)
+	req.Header.Set("X-API-Key", "wrong-key-entirely-here")
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	if rr.Code != http.StatusUnauthorized {
+		t.Errorf("expected 401 for wrong key, got %d", rr.Code)
+	}
+}

cmd/server/backfill_async_test.go

@@ -0,0 +1,132 @@
+package main
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/gorilla/mux"
+)
+
+// TestBackfillAsyncChunked verifies that backfillResolvedPathsAsync processes
+// observations in chunks, yields between batches, and sets the completion flag.
+func TestBackfillAsyncChunked(t *testing.T) {
+	store := &PacketStore{
+		packets:  make([]*StoreTx, 0),
+		byHash:   make(map[string]*StoreTx),
+		byTxID:   make(map[int]*StoreTx),
+		byObsID:  make(map[int]*StoreObs),
+	}
+
+	// No pending observations → should complete immediately.
+	backfillResolvedPathsAsync(store, "", 100, time.Millisecond, 24)
+	if !store.backfillComplete.Load() {
+		t.Fatal("expected backfillComplete to be true with empty store")
+	}
+}
+
+// TestBackfillStatusHeader verifies the X-CoreScope-Status header is set correctly.
+func TestBackfillStatusHeader(t *testing.T) {
+	store := &PacketStore{
+		packets: make([]*StoreTx, 0),
+		byHash:  make(map[string]*StoreTx),
+		byTxID:  make(map[int]*StoreTx),
+		byObsID: make(map[int]*StoreObs),
+	}
+
+	srv := &Server{store: store}
+
+	handler := srv.backfillStatusMiddleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(200)
+	}))
+
+	// Before backfill completes → backfilling
+	req := httptest.NewRequest("GET", "/api/stats", nil)
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+	if got := rec.Header().Get("X-CoreScope-Status"); got != "backfilling" {
+		t.Fatalf("expected 'backfilling', got %q", got)
+	}
+
+	// After backfill completes → ready
+	store.backfillComplete.Store(true)
+	rec = httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+	if got := rec.Header().Get("X-CoreScope-Status"); got != "ready" {
+		t.Fatalf("expected 'ready', got %q", got)
+	}
+}
+
+// TestStatsBackfillFields verifies /api/stats includes backfill fields.
+func TestStatsBackfillFields(t *testing.T) {
+	db := setupTestDBv2(t)
+	defer db.Close()
+	seedV2Data(t, db)
+
+	store := &PacketStore{
+		db:      db,
+		packets: make([]*StoreTx, 0),
+		byHash:  make(map[string]*StoreTx),
+		byTxID:  make(map[int]*StoreTx),
+		byObsID: make(map[int]*StoreObs),
+		loaded:  true,
+	}
+
+	cfg := &Config{Port: 0}
+	hub := NewHub()
+	srv := NewServer(db, cfg, hub)
+	srv.store = store
+
+	router := mux.NewRouter()
+	srv.RegisterRoutes(router)
+
+	// While backfilling
+	req := httptest.NewRequest("GET", "/api/stats", nil)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	var resp map[string]interface{}
+	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("failed to parse stats response: %v", err)
+	}
+
+	if backfilling, ok := resp["backfilling"]; !ok {
+		t.Fatal("missing 'backfilling' field in stats response")
+	} else if backfilling != true {
+		t.Fatalf("expected backfilling=true, got %v", backfilling)
+	}
+
+	if _, ok := resp["backfillProgress"]; !ok {
+		t.Fatal("missing 'backfillProgress' field in stats response")
+	}
+
+	// Check header
+	if got := rec.Header().Get("X-CoreScope-Status"); got != "backfilling" {
+		t.Fatalf("expected X-CoreScope-Status=backfilling, got %q", got)
+	}
+
+	// After backfill completes
+	store.backfillComplete.Store(true)
+	// Invalidate stats cache
+	srv.statsMu.Lock()
+	srv.statsCache = nil
+	srv.statsMu.Unlock()
+
+	rec = httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	resp = nil
+	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("failed to parse stats response: %v", err)
+	}
+
+	if backfilling, ok := resp["backfilling"]; !ok || backfilling != false {
+		t.Fatalf("expected backfilling=false after completion, got %v", backfilling)
+	}
+
+	if got := rec.Header().Get("X-CoreScope-Status"); got != "ready" {
+		t.Fatalf("expected X-CoreScope-Status=ready, got %q", got)
+	}
+}

cmd/server/cache_invalidation_test.go

@@ -9,14 +9,15 @@ import (
 func newTestStore(t *testing.T) *PacketStore {
 	t.Helper()
 	return &PacketStore{
-		rfCache:      make(map[string]*cachedResult),
-		topoCache:    make(map[string]*cachedResult),
-		hashCache:    make(map[string]*cachedResult),
-		chanCache:    make(map[string]*cachedResult),
-		distCache:    make(map[string]*cachedResult),
-		subpathCache: make(map[string]*cachedResult),
-		rfCacheTTL:   15 * time.Second,
-		invCooldown:  10 * time.Second,
+		rfCache:        make(map[string]*cachedResult),
+		topoCache:      make(map[string]*cachedResult),
+		hashCache:      make(map[string]*cachedResult),
+		collisionCache: make(map[string]*cachedResult),
+		chanCache:      make(map[string]*cachedResult),
+		distCache:      make(map[string]*cachedResult),
+		subpathCache:   make(map[string]*cachedResult),
+		rfCacheTTL:     15 * time.Second,
+		invCooldown:    10 * time.Second,
 	}
 }
 
@@ -29,6 +30,7 @@ func populateAllCaches(s *PacketStore) {
 	s.rfCache["global"] = dummy
 	s.topoCache["global"] = dummy
 	s.hashCache["global"] = dummy
+	s.collisionCache["global"] = dummy
 	s.chanCache["global"] = dummy
 	s.distCache["global"] = dummy
 	s.subpathCache["global"] = dummy
@@ -39,12 +41,13 @@ func cachePopulated(s *PacketStore) map[string]bool {
 	s.cacheMu.Lock()
 	defer s.cacheMu.Unlock()
 	return map[string]bool{
-		"rf":      len(s.rfCache) > 0,
-		"topo":    len(s.topoCache) > 0,
-		"hash":    len(s.hashCache) > 0,
-		"chan":     len(s.chanCache) > 0,
-		"dist":    len(s.distCache) > 0,
-		"subpath": len(s.subpathCache) > 0,
+		"rf":        len(s.rfCache) > 0,
+		"topo":      len(s.topoCache) > 0,
+		"hash":      len(s.hashCache) > 0,
+		"collision": len(s.collisionCache) > 0,
+		"chan":       len(s.chanCache) > 0,
+		"dist":      len(s.distCache) > 0,
+		"subpath":   len(s.subpathCache) > 0,
 	}
 }
 
@@ -90,7 +93,8 @@ func TestInvalidateCachesFor_NewTransmissionsOnly(t *testing.T) {
 	if pop["hash"] {
 		t.Error("hash cache should be cleared on new transmissions")
 	}
-	for _, name := range []string{"rf", "topo", "chan", "dist", "subpath"} {
+	// collisionCache should NOT be cleared by transmissions alone (only by hasNewNodes)
+	for _, name := range []string{"rf", "topo", "collision", "chan", "dist", "subpath"} {
 		if !pop[name] {
 			t.Errorf("%s cache should NOT be cleared on transmission-only ingest", name)
 		}
@@ -331,3 +335,180 @@ func BenchmarkCacheHitDuringIngestion(b *testing.B) {
 	}
 	b.ReportMetric(float64(hits)/float64(hits+misses)*100, "hit%")
 }
+
+// TestInvCooldownFromConfig verifies that invalidationDebounce from config
+// is wired to invCooldown on PacketStore.
+func TestInvCooldownFromConfig(t *testing.T) {
+	// Default without config
+	ps := NewPacketStore(nil, nil)
+	if ps.invCooldown != 300*time.Second {
+		t.Errorf("default invCooldown = %v, want 300s", ps.invCooldown)
+	}
+
+	// With config override
+	ct := map[string]interface{}{"invalidationDebounce": float64(60)}
+	ps2 := NewPacketStore(nil, nil, ct)
+	if ps2.invCooldown != 60*time.Second {
+		t.Errorf("configured invCooldown = %v, want 60s", ps2.invCooldown)
+	}
+}
+
+// TestCollisionCacheNotClearedByTransmissions verifies that collisionCache
+// is only cleared by hasNewNodes, not hasNewTransmissions (fixes #720).
+func TestCollisionCacheNotClearedByTransmissions(t *testing.T) {
+	s := newTestStore(t)
+	populateAllCaches(s)
+
+	s.invalidateCachesFor(cacheInvalidation{hasNewTransmissions: true})
+
+	pop := cachePopulated(s)
+	if !pop["collision"] {
+		t.Error("collisionCache should NOT be cleared by hasNewTransmissions alone")
+	}
+	if pop["hash"] {
+		t.Error("hashCache should be cleared by hasNewTransmissions")
+	}
+}
+
+// TestCollisionCacheClearedByNewNodes verifies that collisionCache IS cleared
+// when genuinely new nodes are discovered.
+func TestCollisionCacheClearedByNewNodes(t *testing.T) {
+	s := newTestStore(t)
+	populateAllCaches(s)
+
+	s.invalidateCachesFor(cacheInvalidation{hasNewNodes: true})
+
+	pop := cachePopulated(s)
+	if pop["collision"] {
+		t.Error("collisionCache should be cleared by hasNewNodes")
+	}
+	// Other caches should survive
+	for _, name := range []string{"rf", "topo", "hash", "chan", "dist", "subpath"} {
+		if !pop[name] {
+			t.Errorf("%s cache should NOT be cleared on new-nodes-only ingest", name)
+		}
+	}
+}
+
+// TestCacheSurvivesMultipleIngestCyclesWithinCooldown verifies that caches
+// survive repeated ingest cycles during the cooldown period.
+func TestCacheSurvivesMultipleIngestCyclesWithinCooldown(t *testing.T) {
+	s := newTestStore(t)
+	s.invCooldown = 200 * time.Millisecond
+
+	// First invalidation goes through (starts cooldown)
+	populateAllCaches(s)
+	s.invalidateCachesFor(cacheInvalidation{hasNewObservations: true})
+	pop := cachePopulated(s)
+	if pop["rf"] {
+		t.Error("rf should be cleared on first invalidation")
+	}
+
+	// Repopulate and simulate 5 rapid ingest cycles
+	populateAllCaches(s)
+	for i := 0; i < 5; i++ {
+		s.invalidateCachesFor(cacheInvalidation{
+			hasNewObservations:  true,
+			hasNewTransmissions: true,
+			hasNewPaths:         true,
+		})
+	}
+
+	// All caches should survive during cooldown
+	pop = cachePopulated(s)
+	for name, has := range pop {
+		if !has {
+			t.Errorf("%s cache should survive during cooldown period (ingest cycle %d)", name, 5)
+		}
+	}
+}
+
+// TestNewNodesAccumulatedDuringCooldown verifies that hasNewNodes flags
+// accumulated during cooldown are applied when cooldown expires.
+func TestNewNodesAccumulatedDuringCooldown(t *testing.T) {
+	s := newTestStore(t)
+	s.invCooldown = 100 * time.Millisecond
+
+	// First call starts cooldown
+	s.invalidateCachesFor(cacheInvalidation{hasNewObservations: true})
+
+	// During cooldown, accumulate hasNewNodes
+	s.invalidateCachesFor(cacheInvalidation{hasNewNodes: true})
+
+	// Verify accumulated
+	s.cacheMu.Lock()
+	if s.pendingInv == nil || !s.pendingInv.hasNewNodes {
+		t.Error("hasNewNodes should be accumulated in pendingInv")
+	}
+	s.cacheMu.Unlock()
+
+	// Wait for cooldown
+	time.Sleep(150 * time.Millisecond)
+
+	// Trigger flush
+	populateAllCaches(s)
+	s.invalidateCachesFor(cacheInvalidation{})
+
+	pop := cachePopulated(s)
+	if pop["collision"] {
+		t.Error("collisionCache should be cleared after pending hasNewNodes is flushed")
+	}
+}
+
+// BenchmarkAnalyticsLatencyCacheHitVsMiss benchmarks cache hit vs miss
+// for analytics endpoints to demonstrate the performance impact.
+func BenchmarkAnalyticsLatencyCacheHitVsMiss(b *testing.B) {
+	s := &PacketStore{
+		rfCache:        make(map[string]*cachedResult),
+		topoCache:      make(map[string]*cachedResult),
+		hashCache:      make(map[string]*cachedResult),
+		collisionCache: make(map[string]*cachedResult),
+		chanCache:      make(map[string]*cachedResult),
+		distCache:      make(map[string]*cachedResult),
+		subpathCache:   make(map[string]*cachedResult),
+		rfCacheTTL:     1800 * time.Second,
+		invCooldown:    300 * time.Second,
+	}
+
+	// Pre-populate cache
+	s.cacheMu.Lock()
+	s.rfCache["global"] = &cachedResult{
+		data:      map[string]interface{}{"bins": make([]int, 100)},
+		expiresAt: time.Now().Add(time.Hour),
+	}
+	s.cacheMu.Unlock()
+
+	// Trigger initial invalidation to start cooldown
+	s.invalidateCachesFor(cacheInvalidation{hasNewObservations: true})
+
+	var hits, misses int64
+	for i := 0; i < b.N; i++ {
+		// Re-populate (simulates query filling cache)
+		s.cacheMu.Lock()
+		if len(s.rfCache) == 0 {
+			s.rfCache["global"] = &cachedResult{
+				data:      map[string]interface{}{"bins": make([]int, 100)},
+				expiresAt: time.Now().Add(time.Hour),
+			}
+		}
+		s.cacheMu.Unlock()
+
+		// Simulate ingest (rate-limited)
+		s.invalidateCachesFor(cacheInvalidation{hasNewObservations: true})
+
+		// Check hit
+		s.cacheMu.Lock()
+		if len(s.rfCache) > 0 {
+			hits++
+		} else {
+			misses++
+		}
+		s.cacheMu.Unlock()
+	}
+
+	hitRate := float64(hits) / float64(hits+misses) * 100
+	b.ReportMetric(hitRate, "hit%")
+	if hitRate < 50 {
+		b.Errorf("hit rate %.1f%% is below 50%% target", hitRate)
+	}
+}

cmd/server/clock_skew.go

@@ -0,0 +1,580 @@
+package main
+
+import (
+	"math"
+	"sort"
+	"sync"
+	"time"
+)
+
+// ── Clock Skew Severity ────────────────────────────────────────────────────────
+
+type SkewSeverity string
+
+const (
+	SkewOK       SkewSeverity = "ok"       // < 5 min
+	SkewWarning  SkewSeverity = "warning"  // 5 min – 1 hour
+	SkewCritical SkewSeverity = "critical" // 1 hour – 30 days
+	SkewAbsurd   SkewSeverity = "absurd"   // > 30 days
+	SkewNoClock  SkewSeverity = "no_clock" // > 365 days — uninitialized RTC
+)
+
+// Default thresholds in seconds.
+const (
+	skewThresholdWarnSec     = 5 * 60          // 5 minutes
+	skewThresholdCriticalSec = 60 * 60         // 1 hour
+	skewThresholdAbsurdSec   = 30 * 24 * 3600  // 30 days
+	skewThresholdNoClockSec  = 365 * 24 * 3600 // 365 days — uninitialized RTC
+
+	// minDriftSamples is the minimum number of advert transmissions needed
+	// to compute a meaningful linear drift rate.
+	minDriftSamples = 5
+
+	// maxReasonableDriftPerDay caps drift display. Physically impossible
+	// drift rates (> 1 day/day) indicate insufficient or outlier samples.
+	maxReasonableDriftPerDay = 86400.0
+)
+
+// classifySkew maps absolute skew (seconds) to a severity level.
+// Float64 comparison is safe: inputs are rounded to 1 decimal via round(),
+// and thresholds are integer multiples of 60 — no rounding artifacts.
+func classifySkew(absSkewSec float64) SkewSeverity {
+	switch {
+	case absSkewSec >= skewThresholdNoClockSec:
+		return SkewNoClock
+	case absSkewSec >= skewThresholdAbsurdSec:
+		return SkewAbsurd
+	case absSkewSec >= skewThresholdCriticalSec:
+		return SkewCritical
+	case absSkewSec >= skewThresholdWarnSec:
+		return SkewWarning
+	default:
+		return SkewOK
+	}
+}
+
+// ── Data Types ─────────────────────────────────────────────────────────────────
+
+// skewSample is a single raw skew measurement from one advert observation.
+type skewSample struct {
+	advertTS    int64  // node's advert Unix timestamp
+	observedTS  int64  // observation Unix timestamp
+	observerID  string // which observer saw this
+	hash        string // transmission hash (for multi-observer grouping)
+}
+
+// ObserverCalibration holds the computed clock offset for an observer.
+type ObserverCalibration struct {
+	ObserverID string  `json:"observerID"`
+	OffsetSec  float64 `json:"offsetSec"`  // positive = observer clock ahead
+	Samples    int     `json:"samples"`    // number of multi-observer packets used
+}
+
+// NodeClockSkew is the API response for a single node's clock skew data.
+type NodeClockSkew struct {
+	Pubkey          string       `json:"pubkey"`
+	MeanSkewSec     float64      `json:"meanSkewSec"`     // corrected mean skew (positive = node ahead)
+	MedianSkewSec   float64      `json:"medianSkewSec"`   // corrected median skew
+	LastSkewSec     float64      `json:"lastSkewSec"`     // most recent corrected skew
+	DriftPerDaySec  float64      `json:"driftPerDaySec"`  // linear drift rate (sec/day)
+	Severity        SkewSeverity `json:"severity"`
+	SampleCount     int          `json:"sampleCount"`
+	Calibrated      bool         `json:"calibrated"`      // true if observer calibration was applied
+	LastAdvertTS    int64        `json:"lastAdvertTS"`     // most recent advert timestamp
+	LastObservedTS  int64        `json:"lastObservedTS"`   // most recent observation timestamp
+	Samples         []SkewSample `json:"samples,omitempty"` // time-series for sparklines
+	NodeName        string       `json:"nodeName,omitempty"` // populated in fleet responses
+	NodeRole        string       `json:"nodeRole,omitempty"` // populated in fleet responses
+}
+
+// SkewSample is a single (timestamp, skew) point for sparkline rendering.
+type SkewSample struct {
+	Timestamp int64   `json:"ts"`   // Unix epoch of observation
+	SkewSec   float64 `json:"skew"` // corrected skew in seconds
+}
+
+// txSkewResult maps tx hash → per-transmission skew stats. This is an
+// intermediate result keyed by hash (not pubkey); the store maps hash → pubkey
+// when building the final per-node view.
+type txSkewResult = map[string]*NodeClockSkew
+
+// ── Clock Skew Engine ──────────────────────────────────────────────────────────
+
+// ClockSkewEngine computes and caches clock skew data for nodes and observers.
+type ClockSkewEngine struct {
+	mu               sync.RWMutex
+	observerOffsets  map[string]float64 // observerID → calibrated offset (seconds)
+	observerSamples  map[string]int     // observerID → number of multi-observer packets used
+	nodeSkew         txSkewResult
+	lastComputed     time.Time
+	computeInterval  time.Duration
+}
+
+func NewClockSkewEngine() *ClockSkewEngine {
+	return &ClockSkewEngine{
+		observerOffsets:  make(map[string]float64),
+		observerSamples: make(map[string]int),
+		nodeSkew:       make(txSkewResult),
+		computeInterval: 30 * time.Second,
+	}
+}
+
+// Recompute recalculates all clock skew data from the packet store.
+// Called periodically or on demand. Holds store RLock externally.
+// Uses read-copy-update: heavy computation runs outside the write lock,
+// then results are swapped in under a brief lock.
+func (e *ClockSkewEngine) Recompute(store *PacketStore) {
+	// Fast path: check under read lock if recompute is needed.
+	e.mu.RLock()
+	fresh := time.Since(e.lastComputed) < e.computeInterval
+	e.mu.RUnlock()
+	if fresh {
+		return
+	}
+
+	// Phase 1: Collect skew samples from ADVERT packets (store RLock held by caller).
+	samples := collectSamples(store)
+
+	// Phase 2–3: Compute outside the write lock.
+	var newOffsets map[string]float64
+	var newSamples map[string]int
+	var newNodeSkew txSkewResult
+
+	if len(samples) > 0 {
+		newOffsets, newSamples = calibrateObservers(samples)
+		newNodeSkew = computeNodeSkew(samples, newOffsets)
+	} else {
+		newOffsets = make(map[string]float64)
+		newSamples = make(map[string]int)
+		newNodeSkew = make(txSkewResult)
+	}
+
+	// Swap results under brief write lock.
+	e.mu.Lock()
+	// Re-check: another goroutine may have computed while we were working.
+	if time.Since(e.lastComputed) < e.computeInterval {
+		e.mu.Unlock()
+		return
+	}
+	e.observerOffsets = newOffsets
+	e.observerSamples = newSamples
+	e.nodeSkew = newNodeSkew
+	e.lastComputed = time.Now()
+	e.mu.Unlock()
+}
+
+// collectSamples extracts skew samples from ADVERT packets in the store.
+// Must be called with store.mu held (at least RLock).
+func collectSamples(store *PacketStore) []skewSample {
+	adverts := store.byPayloadType[PayloadADVERT]
+	if len(adverts) == 0 {
+		return nil
+	}
+
+	samples := make([]skewSample, 0, len(adverts)*2)
+	for _, tx := range adverts {
+		decoded := tx.ParsedDecoded()
+		if decoded == nil {
+			continue
+		}
+		// Extract advert timestamp from decoded JSON.
+		advertTS := extractTimestamp(decoded)
+		if advertTS <= 0 {
+			continue
+		}
+		// Sanity: skip timestamps before year 2020 or after year 2100.
+		if advertTS < 1577836800 || advertTS > 4102444800 {
+			continue
+		}
+
+		for _, obs := range tx.Observations {
+			obsTS := parseISO(obs.Timestamp)
+			if obsTS <= 0 {
+				continue
+			}
+			samples = append(samples, skewSample{
+				advertTS:   advertTS,
+				observedTS: obsTS,
+				observerID: obs.ObserverID,
+				hash:       tx.Hash,
+			})
+		}
+	}
+	return samples
+}
+
+// extractTimestamp gets the Unix timestamp from a decoded ADVERT payload.
+func extractTimestamp(decoded map[string]interface{}) int64 {
+	// Try payload.timestamp first (nested in "payload" key).
+	if payload, ok := decoded["payload"]; ok {
+		if pm, ok := payload.(map[string]interface{}); ok {
+			if ts := jsonNumber(pm, "timestamp"); ts > 0 {
+				return ts
+			}
+		}
+	}
+	// Fallback: top-level timestamp.
+	if ts := jsonNumber(decoded, "timestamp"); ts > 0 {
+		return ts
+	}
+	return 0
+}
+
+// jsonNumber extracts an int64 from a JSON-parsed map (handles float64 and json.Number).
+func jsonNumber(m map[string]interface{}, key string) int64 {
+	v, ok := m[key]
+	if !ok || v == nil {
+		return 0
+	}
+	switch n := v.(type) {
+	case float64:
+		return int64(n)
+	case int64:
+		return n
+	case int:
+		return int64(n)
+	}
+	return 0
+}
+
+// parseISO parses an ISO 8601 timestamp string to Unix seconds.
+func parseISO(s string) int64 {
+	if s == "" {
+		return 0
+	}
+	t, err := time.Parse(time.RFC3339, s)
+	if err != nil {
+		// Try with fractional seconds.
+		t, err = time.Parse("2006-01-02T15:04:05.999999999Z07:00", s)
+		if err != nil {
+			return 0
+		}
+	}
+	return t.Unix()
+}
+
+// ── Phase 2: Observer Calibration ──────────────────────────────────────────────
+
+// calibrateObservers computes each observer's clock offset using multi-observer
+// packets. Returns offset map and sample count map.
+func calibrateObservers(samples []skewSample) (map[string]float64, map[string]int) {
+	// Group observations by packet hash.
+	byHash := make(map[string][]skewSample)
+	for _, s := range samples {
+		byHash[s.hash] = append(byHash[s.hash], s)
+	}
+
+	// For each multi-observer packet, compute per-observer deviation from median.
+	deviations := make(map[string][]float64) // observerID → list of deviations
+	for _, group := range byHash {
+		if len(group) < 2 {
+			continue // single-observer packet, can't calibrate
+		}
+		// Compute median observation timestamp for this packet.
+		obsTimes := make([]float64, len(group))
+		for i, s := range group {
+			obsTimes[i] = float64(s.observedTS)
+		}
+		medianObs := median(obsTimes)
+		for _, s := range group {
+			dev := float64(s.observedTS) - medianObs
+			deviations[s.observerID] = append(deviations[s.observerID], dev)
+		}
+	}
+
+	// Each observer's offset = median of its deviations.
+	offsets := make(map[string]float64, len(deviations))
+	counts := make(map[string]int, len(deviations))
+	for obsID, devs := range deviations {
+		offsets[obsID] = median(devs)
+		counts[obsID] = len(devs)
+	}
+	return offsets, counts
+}
+
+// ── Phase 3: Per-Node Skew ─────────────────────────────────────────────────────
+
+// computeNodeSkew calculates corrected skew statistics for each node.
+func computeNodeSkew(samples []skewSample, obsOffsets map[string]float64) txSkewResult {
+	// Compute corrected skew per sample, grouped by hash (each hash = one
+	// node's advert transmission). The caller maps hash → pubkey via byNode.
+	type correctedSample struct {
+		skew       float64
+		observedTS int64
+		calibrated bool
+	}
+
+	byHash := make(map[string][]correctedSample)
+	hashAdvertTS := make(map[string]int64)
+
+	for _, s := range samples {
+		obsOffset, hasCal := obsOffsets[s.observerID]
+		rawSkew := float64(s.advertTS - s.observedTS)
+		corrected := rawSkew
+		if hasCal {
+			// Observer offset = obs_ts - median(all_obs_ts). If observer is ahead,
+			// its obs_ts is inflated, making raw_skew too low. Add offset to correct.
+			corrected = rawSkew + obsOffset
+		}
+		byHash[s.hash] = append(byHash[s.hash], correctedSample{
+			skew:       corrected,
+			observedTS: s.observedTS,
+			calibrated: hasCal,
+		})
+		hashAdvertTS[s.hash] = s.advertTS
+	}
+
+	// Each hash represents one advert from one node. Compute median corrected
+	// skew per hash (across multiple observers).
+
+	result := make(map[string]*NodeClockSkew) // keyed by hash for now
+	for hash, cs := range byHash {
+		skews := make([]float64, len(cs))
+		for i, c := range cs {
+			skews[i] = c.skew
+		}
+		medSkew := median(skews)
+		meanSkew := mean(skews)
+
+		// Find latest observation.
+		var latestObsTS int64
+		var anyCal bool
+		for _, c := range cs {
+			if c.observedTS > latestObsTS {
+				latestObsTS = c.observedTS
+			}
+			if c.calibrated {
+				anyCal = true
+			}
+		}
+
+		absMedian := math.Abs(medSkew)
+		result[hash] = &NodeClockSkew{
+			MeanSkewSec:    round(meanSkew, 1),
+			MedianSkewSec:  round(medSkew, 1),
+			LastSkewSec:    round(cs[len(cs)-1].skew, 1),
+			Severity:       classifySkew(absMedian),
+			SampleCount:    len(cs),
+			Calibrated:     anyCal,
+			LastAdvertTS:   hashAdvertTS[hash],
+			LastObservedTS: latestObsTS,
+		}
+	}
+	return result
+}
+
+// ── Integration with PacketStore ───────────────────────────────────────────────
+
+// GetNodeClockSkew returns the clock skew data for a specific node (acquires RLock).
+func (s *PacketStore) GetNodeClockSkew(pubkey string) *NodeClockSkew {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.getNodeClockSkewLocked(pubkey)
+}
+
+// getNodeClockSkewLocked returns clock skew for a node.
+// Must be called with s.mu held (at least RLock).
+func (s *PacketStore) getNodeClockSkewLocked(pubkey string) *NodeClockSkew {
+	s.clockSkew.Recompute(s)
+
+	txs := s.byNode[pubkey]
+	if len(txs) == 0 {
+		return nil
+	}
+
+	s.clockSkew.mu.RLock()
+	defer s.clockSkew.mu.RUnlock()
+
+	var allSkews []float64
+	var lastSkew float64
+	var lastObsTS, lastAdvTS int64
+	var totalSamples int
+	var anyCal bool
+	var tsSkews []tsSkewPair
+
+	for _, tx := range txs {
+		if tx.PayloadType == nil || *tx.PayloadType != PayloadADVERT {
+			continue
+		}
+		cs, ok := s.clockSkew.nodeSkew[tx.Hash]
+		if !ok {
+			continue
+		}
+		allSkews = append(allSkews, cs.MedianSkewSec)
+		totalSamples += cs.SampleCount
+		if cs.Calibrated {
+			anyCal = true
+		}
+		if cs.LastObservedTS > lastObsTS {
+			lastObsTS = cs.LastObservedTS
+			lastSkew = cs.LastSkewSec
+			lastAdvTS = cs.LastAdvertTS
+		}
+		tsSkews = append(tsSkews, tsSkewPair{ts: cs.LastObservedTS, skew: cs.MedianSkewSec})
+	}
+
+	if len(allSkews) == 0 {
+		return nil
+	}
+
+	medSkew := median(allSkews)
+	meanSkew := mean(allSkews)
+	absMedian := math.Abs(medSkew)
+	severity := classifySkew(absMedian)
+
+	// For no_clock nodes (uninitialized RTC), skip drift — data is meaningless.
+	var drift float64
+	if severity != SkewNoClock && len(tsSkews) >= minDriftSamples {
+		drift = computeDrift(tsSkews)
+		// Cap physically impossible drift rates.
+		if math.Abs(drift) > maxReasonableDriftPerDay {
+			drift = 0
+		}
+	}
+
+	// Build sparkline samples from tsSkews (sorted by time).
+	sort.Slice(tsSkews, func(i, j int) bool { return tsSkews[i].ts < tsSkews[j].ts })
+	samples := make([]SkewSample, len(tsSkews))
+	for i, p := range tsSkews {
+		samples[i] = SkewSample{Timestamp: p.ts, SkewSec: round(p.skew, 1)}
+	}
+
+	return &NodeClockSkew{
+		Pubkey:         pubkey,
+		MeanSkewSec:    round(meanSkew, 1),
+		MedianSkewSec:  round(medSkew, 1),
+		LastSkewSec:    round(lastSkew, 1),
+		DriftPerDaySec: round(drift, 2),
+		Severity:       severity,
+		SampleCount:    totalSamples,
+		Calibrated:     anyCal,
+		LastAdvertTS:   lastAdvTS,
+		LastObservedTS: lastObsTS,
+		Samples:        samples,
+	}
+}
+
+// GetFleetClockSkew returns clock skew data for all nodes that have skew data.
+// Must NOT be called with s.mu held.
+func (s *PacketStore) GetFleetClockSkew() []*NodeClockSkew {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	// Build name/role lookup from DB cache (requires s.mu held).
+	allNodes, _ := s.getCachedNodesAndPM()
+	nameMap := make(map[string]nodeInfo, len(allNodes))
+	for _, ni := range allNodes {
+		nameMap[ni.PublicKey] = ni
+	}
+
+	var results []*NodeClockSkew
+	for pubkey := range s.byNode {
+		cs := s.getNodeClockSkewLocked(pubkey)
+		if cs == nil {
+			continue
+		}
+		// Enrich with node name/role.
+		if ni, ok := nameMap[pubkey]; ok {
+			cs.NodeName = ni.Name
+			cs.NodeRole = ni.Role
+		}
+		// Omit samples in fleet response (too much data).
+		cs.Samples = nil
+		results = append(results, cs)
+	}
+	return results
+}
+
+// GetObserverCalibrations returns the current observer clock offsets.
+func (s *PacketStore) GetObserverCalibrations() []ObserverCalibration {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	s.clockSkew.Recompute(s)
+
+	s.clockSkew.mu.RLock()
+	defer s.clockSkew.mu.RUnlock()
+
+	result := make([]ObserverCalibration, 0, len(s.clockSkew.observerOffsets))
+	for obsID, offset := range s.clockSkew.observerOffsets {
+		result = append(result, ObserverCalibration{
+			ObserverID: obsID,
+			OffsetSec:  round(offset, 1),
+			Samples:    s.clockSkew.observerSamples[obsID],
+		})
+	}
+	// Sort by absolute offset descending.
+	sort.Slice(result, func(i, j int) bool {
+		return math.Abs(result[i].OffsetSec) > math.Abs(result[j].OffsetSec)
+	})
+	return result
+}
+
+// ── Math Helpers ───────────────────────────────────────────────────────────────
+
+func median(vals []float64) float64 {
+	if len(vals) == 0 {
+		return 0
+	}
+	sorted := make([]float64, len(vals))
+	copy(sorted, vals)
+	sort.Float64s(sorted)
+	n := len(sorted)
+	if n%2 == 0 {
+		return (sorted[n/2-1] + sorted[n/2]) / 2
+	}
+	return sorted[n/2]
+}
+
+func mean(vals []float64) float64 {
+	if len(vals) == 0 {
+		return 0
+	}
+	sum := 0.0
+	for _, v := range vals {
+		sum += v
+	}
+	return sum / float64(len(vals))
+}
+
+// tsSkewPair is a (timestamp, skew) pair for drift estimation.
+type tsSkewPair struct {
+	ts   int64
+	skew float64
+}
+
+// computeDrift estimates linear drift in seconds per day from time-ordered
+// (timestamp, skew) pairs using simple linear regression.
+func computeDrift(pairs []tsSkewPair) float64 {
+	if len(pairs) < 2 {
+		return 0
+	}
+	// Sort by timestamp.
+	sort.Slice(pairs, func(i, j int) bool {
+		return pairs[i].ts < pairs[j].ts
+	})
+
+	// Time span too short? Skip.
+	spanSec := float64(pairs[len(pairs)-1].ts - pairs[0].ts)
+	if spanSec < 3600 { // need at least 1 hour of data
+		return 0
+	}
+
+	// Simple linear regression: skew = a + b*t
+	n := float64(len(pairs))
+	var sumX, sumY, sumXY, sumX2 float64
+	for _, p := range pairs {
+		x := float64(p.ts - pairs[0].ts) // normalize to avoid large numbers
+		y := p.skew
+		sumX += x
+		sumY += y
+		sumXY += x * y
+		sumX2 += x * x
+	}
+	denom := n*sumX2 - sumX*sumX
+	if denom == 0 {
+		return 0
+	}
+	slope := (n*sumXY - sumX*sumY) / denom // seconds of drift per second
+	return slope * 86400                     // convert to seconds per day
+}

cmd/server/clock_skew_test.go

@@ -0,0 +1,546 @@
+package main
+
+import (
+	"fmt"
+	"math"
+	"testing"
+	"time"
+)
+
+// ── classifySkew ───────────────────────────────────────────────────────────────
+
+func TestClassifySkew(t *testing.T) {
+	tests := []struct {
+		absSkew  float64
+		expected SkewSeverity
+	}{
+		{0, SkewOK},
+		{60, SkewOK},           // 1 min
+		{299, SkewOK},          // just under 5 min
+		{300, SkewWarning},     // exactly 5 min
+		{1800, SkewWarning},    // 30 min
+		{3599, SkewWarning},    // just under 1 hour
+		{3600, SkewCritical},   // exactly 1 hour
+		{86400, SkewCritical},  // 1 day
+		{2592000 - 1, SkewCritical}, // just under 30 days
+		{2592000, SkewAbsurd},  // exactly 30 days
+		{86400 * 365 - 1, SkewAbsurd}, // just under 365 days
+		{86400 * 365, SkewNoClock}, // exactly 365 days
+		{86400 * 365 * 10, SkewNoClock}, // 10 years (epoch-0 style)
+	}
+	for _, tc := range tests {
+		got := classifySkew(tc.absSkew)
+		if got != tc.expected {
+			t.Errorf("classifySkew(%v) = %v, want %v", tc.absSkew, got, tc.expected)
+		}
+	}
+}
+
+// ── median ─────────────────────────────────────────────────────────────────────
+
+func TestMedian(t *testing.T) {
+	tests := []struct {
+		vals     []float64
+		expected float64
+	}{
+		{nil, 0},
+		{[]float64{}, 0},
+		{[]float64{5}, 5},
+		{[]float64{1, 3}, 2},
+		{[]float64{3, 1, 2}, 2},
+		{[]float64{4, 1, 3, 2}, 2.5},
+		{[]float64{-10, 0, 10}, 0},
+	}
+	for _, tc := range tests {
+		got := median(tc.vals)
+		if got != tc.expected {
+			t.Errorf("median(%v) = %v, want %v", tc.vals, got, tc.expected)
+		}
+	}
+}
+
+func TestMean(t *testing.T) {
+	tests := []struct {
+		vals     []float64
+		expected float64
+	}{
+		{nil, 0},
+		{[]float64{10}, 10},
+		{[]float64{2, 4, 6}, 4},
+	}
+	for _, tc := range tests {
+		got := mean(tc.vals)
+		if got != tc.expected {
+			t.Errorf("mean(%v) = %v, want %v", tc.vals, got, tc.expected)
+		}
+	}
+}
+
+// ── parseISO ───────────────────────────────────────────────────────────────────
+
+func TestParseISO(t *testing.T) {
+	tests := []struct {
+		input    string
+		expected int64
+	}{
+		{"", 0},
+		{"garbage", 0},
+		{"2026-04-15T12:00:00Z", 1776254400},
+		{"2026-04-15T12:00:00+00:00", 1776254400},
+	}
+	for _, tc := range tests {
+		got := parseISO(tc.input)
+		if got != tc.expected {
+			t.Errorf("parseISO(%q) = %v, want %v", tc.input, got, tc.expected)
+		}
+	}
+}
+
+// ── extractTimestamp ────────────────────────────────────────────────────────────
+
+func TestExtractTimestamp(t *testing.T) {
+	// Nested payload.timestamp
+	decoded := map[string]interface{}{
+		"payload": map[string]interface{}{
+			"timestamp": float64(1776340800),
+		},
+	}
+	got := extractTimestamp(decoded)
+	if got != 1776340800 {
+		t.Errorf("extractTimestamp (nested) = %v, want 1776340800", got)
+	}
+
+	// Top-level timestamp
+	decoded2 := map[string]interface{}{
+		"timestamp": float64(1776340900),
+	}
+	got2 := extractTimestamp(decoded2)
+	if got2 != 1776340900 {
+		t.Errorf("extractTimestamp (top-level) = %v, want 1776340900", got2)
+	}
+
+	// No timestamp
+	decoded3 := map[string]interface{}{"foo": "bar"}
+	got3 := extractTimestamp(decoded3)
+	if got3 != 0 {
+		t.Errorf("extractTimestamp (missing) = %v, want 0", got3)
+	}
+}
+
+// ── calibrateObservers ─────────────────────────────────────────────────────────
+
+func TestCalibrateObservers_SingleObserver(t *testing.T) {
+	// Single-observer packets can't calibrate — should return empty.
+	samples := []skewSample{
+		{advertTS: 1000, observedTS: 1000, observerID: "obs1", hash: "h1"},
+		{advertTS: 2000, observedTS: 2000, observerID: "obs1", hash: "h2"},
+	}
+	offsets, _ := calibrateObservers(samples)
+	if len(offsets) != 0 {
+		t.Errorf("expected no offsets for single-observer, got %v", offsets)
+	}
+}
+
+func TestCalibrateObservers_MultiObserver(t *testing.T) {
+	// Packet h1 seen by 3 observers: obs1 at t=100, obs2 at t=110, obs3 at t=100.
+	// Median observation = 100. obs1=0, obs2=+10, obs3=0
+	// Packet h2 seen by 3 observers: obs1 at t=200, obs2 at t=210, obs3 at t=200.
+	// Median observation = 200. obs1=0, obs2=+10, obs3=0
+	samples := []skewSample{
+		{advertTS: 100, observedTS: 100, observerID: "obs1", hash: "h1"},
+		{advertTS: 100, observedTS: 110, observerID: "obs2", hash: "h1"},
+		{advertTS: 100, observedTS: 100, observerID: "obs3", hash: "h1"},
+		{advertTS: 200, observedTS: 200, observerID: "obs1", hash: "h2"},
+		{advertTS: 200, observedTS: 210, observerID: "obs2", hash: "h2"},
+		{advertTS: 200, observedTS: 200, observerID: "obs3", hash: "h2"},
+	}
+	offsets, _ := calibrateObservers(samples)
+	if offsets["obs1"] != 0 {
+		t.Errorf("obs1 offset = %v, want 0", offsets["obs1"])
+	}
+	if offsets["obs2"] != 10 {
+		t.Errorf("obs2 offset = %v, want 10", offsets["obs2"])
+	}
+	if offsets["obs3"] != 0 {
+		t.Errorf("obs3 offset = %v, want 0", offsets["obs3"])
+	}
+}
+
+// ── computeNodeSkew ────────────────────────────────────────────────────────────
+
+func TestComputeNodeSkew_BasicCorrection(t *testing.T) {
+	// Validates observer offset correction direction.
+	//
+	// Setup: node is 60s ahead, obs1 accurate, obs2 is 10s ahead.
+	// With 2 observers, median obs_ts = 1005.
+	//   obs1 offset = 1000 - 1005 = -5
+	//   obs2 offset = 1010 - 1005 = +5
+	// Correction: corrected = raw_skew + obsOffset
+	//   obs1: raw=60, corrected = 60 + (-5) = 55
+	//   obs2: raw=50, corrected = 50 + 5 = 55
+	// Both converge to 55 (not exact 60 because with only 2 observers,
+	// the median can't fully distinguish which observer is drifted).
+
+	samples := []skewSample{
+		// Same packet seen by accurate obs1 and obs2 (+10s ahead)
+		{advertTS: 1060, observedTS: 1000, observerID: "obs1", hash: "h1"},
+		{advertTS: 1060, observedTS: 1010, observerID: "obs2", hash: "h1"},
+	}
+	offsets, _ := calibrateObservers(samples)
+	// median obs = 1005, obs1 offset = -5, obs2 offset = +5
+	// So the median approach finds obs2 is +5 ahead (relative to median)
+
+	// Now compute node skew with those offsets:
+	nodeSkew := computeNodeSkew(samples, offsets)
+	cs, ok := nodeSkew["h1"]
+	if !ok {
+		t.Fatal("expected skew data for hash h1")
+	}
+	// With only 2 observers, median obs_ts = 1005.
+	// obs1 offset = 1000-1005 = -5, obs2 offset = 1010-1005 = +5
+	// raw from obs1 = 60, corrected = 60 + (-5) = 55
+	// raw from obs2 = 50, corrected = 50 + 5 = 55
+	// median = 55
+	if cs.MedianSkewSec != 55 {
+		t.Errorf("median skew = %v, want 55", cs.MedianSkewSec)
+	}
+}
+
+func TestComputeNodeSkew_ThreeObservers(t *testing.T) {
+	// Node is exactly 60s ahead. obs1 accurate, obs2 accurate, obs3 +30s ahead.
+	// advertTS = 1060, real time = 1000
+	samples := []skewSample{
+		{advertTS: 1060, observedTS: 1000, observerID: "obs1", hash: "h1"},
+		{advertTS: 1060, observedTS: 1000, observerID: "obs2", hash: "h1"},
+		{advertTS: 1060, observedTS: 1030, observerID: "obs3", hash: "h1"},
+	}
+	offsets, _ := calibrateObservers(samples)
+	// median obs_ts = 1000. obs1=0, obs2=0, obs3=+30
+	if offsets["obs3"] != 30 {
+		t.Errorf("obs3 offset = %v, want 30", offsets["obs3"])
+	}
+
+	nodeSkew := computeNodeSkew(samples, offsets)
+	cs := nodeSkew["h1"]
+	if cs == nil {
+		t.Fatal("expected skew data for h1")
+	}
+	// raw from obs1 = 60, corrected = 60 + 0 = 60
+	// raw from obs2 = 60, corrected = 60 + 0 = 60
+	// raw from obs3 = 30, corrected = 30 + 30 = 60
+	// All three converge to 60. 
+	if cs.MedianSkewSec != 60 {
+		t.Errorf("median skew = %v, want 60 (node is 60s ahead)", cs.MedianSkewSec)
+	}
+}
+
+// ── computeDrift ───────────────────────────────────────────────────────────────
+
+func TestComputeDrift_Stable(t *testing.T) {
+	// Constant skew = no drift.
+	pairs := []tsSkewPair{
+		{ts: 0, skew: 60},
+		{ts: 7200, skew: 60},
+		{ts: 14400, skew: 60},
+	}
+	drift := computeDrift(pairs)
+	if drift != 0 {
+		t.Errorf("drift = %v, want 0 for stable skew", drift)
+	}
+}
+
+func TestComputeDrift_LinearDrift(t *testing.T) {
+	// 1 second drift per hour = 24 sec/day.
+	pairs := []tsSkewPair{
+		{ts: 0, skew: 0},
+		{ts: 3600, skew: 1},
+		{ts: 7200, skew: 2},
+	}
+	drift := computeDrift(pairs)
+	expected := 24.0
+	if math.Abs(drift-expected) > 0.1 {
+		t.Errorf("drift = %v, want ~%v", drift, expected)
+	}
+}
+
+func TestComputeDrift_TooFewSamples(t *testing.T) {
+	pairs := []tsSkewPair{{ts: 0, skew: 10}}
+	if computeDrift(pairs) != 0 {
+		t.Error("expected 0 drift for single sample")
+	}
+}
+
+func TestComputeDrift_TooShortSpan(t *testing.T) {
+	// Less than 1 hour apart.
+	pairs := []tsSkewPair{
+		{ts: 0, skew: 0},
+		{ts: 1800, skew: 10},
+	}
+	if computeDrift(pairs) != 0 {
+		t.Error("expected 0 drift for short time span")
+	}
+}
+
+// ── jsonNumber ─────────────────────────────────────────────────────────────────
+
+func TestJsonNumber(t *testing.T) {
+	m := map[string]interface{}{
+		"a": float64(42),
+		"b": int64(99),
+		"c": "not a number",
+		"d": nil,
+	}
+	if jsonNumber(m, "a") != 42 {
+		t.Error("float64 case failed")
+	}
+	if jsonNumber(m, "b") != 99 {
+		t.Error("int64 case failed")
+	}
+	if jsonNumber(m, "c") != 0 {
+		t.Error("string case should return 0")
+	}
+	if jsonNumber(m, "d") != 0 {
+		t.Error("nil case should return 0")
+	}
+	if jsonNumber(m, "missing") != 0 {
+		t.Error("missing key should return 0")
+	}
+}
+
+// ── Integration: GetNodeClockSkew via PacketStore ──────────────────────────────
+
+func TestGetNodeClockSkew_Integration(t *testing.T) {
+	ps := NewPacketStore(nil, nil)
+
+	// Simulate two ADVERT transmissions for the same node, seen by 2 observers each.
+	// Node "AABB" has clock 120s ahead.
+	pt := 4 // ADVERT
+	tx1 := &StoreTx{
+		Hash:        "hash1",
+		PayloadType: &pt,
+		DecodedJSON: `{"payload":{"timestamp":1700002320}}`, // obs=1700002200, node ahead by 120s
+		Observations: []*StoreObs{
+			{ObserverID: "obs1", Timestamp: "2023-11-14T22:50:00Z"}, // 1700002200
+			{ObserverID: "obs2", Timestamp: "2023-11-14T22:50:00Z"}, // 1700002200
+		},
+	}
+	tx2 := &StoreTx{
+		Hash:        "hash2",
+		PayloadType: &pt,
+		DecodedJSON: `{"payload":{"timestamp":1700005920}}`, // obs=1700005800, node ahead by 120s
+		Observations: []*StoreObs{
+			{ObserverID: "obs1", Timestamp: "2023-11-14T23:50:00Z"}, // 1700005800
+			{ObserverID: "obs2", Timestamp: "2023-11-14T23:50:00Z"}, // 1700005800
+		},
+	}
+
+	ps.mu.Lock()
+	ps.byNode["AABB"] = []*StoreTx{tx1, tx2}
+	ps.byPayloadType[4] = []*StoreTx{tx1, tx2}
+	// Force recompute by setting interval to 0.
+	ps.clockSkew.computeInterval = 0
+	ps.mu.Unlock()
+
+	result := ps.GetNodeClockSkew("AABB")
+	if result == nil {
+		t.Fatal("expected clock skew result for node AABB")
+	}
+	if result.Pubkey != "AABB" {
+		t.Errorf("pubkey = %q, want AABB", result.Pubkey)
+	}
+	// Both transmissions show 120s skew, so median should be 120.
+	if result.MedianSkewSec != 120 {
+		t.Errorf("median skew = %v, want 120", result.MedianSkewSec)
+	}
+	if result.SampleCount < 2 {
+		t.Errorf("sample count = %v, want >= 2", result.SampleCount)
+	}
+	if result.Severity != SkewOK {
+		t.Errorf("severity = %v, want ok (120s < 5min)", result.Severity)
+	}
+	// Drift should be ~0 since skew is constant.
+	if math.Abs(result.DriftPerDaySec) > 1 {
+		t.Errorf("drift = %v, want ~0 for constant skew", result.DriftPerDaySec)
+	}
+}
+
+func TestGetNodeClockSkew_NoData(t *testing.T) {
+	ps := NewPacketStore(nil, nil)
+	result := ps.GetNodeClockSkew("nonexistent")
+	if result != nil {
+		t.Error("expected nil for nonexistent node")
+	}
+}
+
+// ── Sanity check tests (#XXX — clock skew crazy stats) ────────────────────────
+
+func TestGetNodeClockSkew_NoClock_EpochZero(t *testing.T) {
+	// Node with epoch-0 timestamp produces huge skew → no_clock severity, drift=0.
+	ps := NewPacketStore(nil, nil)
+	pt := 4 // ADVERT
+
+	// Epoch-ish advert: advertTS near start of 2020, observed in 2023 → |skew| > 365 days
+	var txs []*StoreTx
+	baseObs := int64(1700000000) // ~Nov 2023
+	for i := 0; i < 6; i++ {
+		obsTS := baseObs + int64(i)*7200
+		tx := &StoreTx{
+			Hash:        "epoch-h" + string(rune('0'+i)),
+			PayloadType: &pt,
+			DecodedJSON: `{"payload":{"timestamp":1577836800}}`, // Jan 1 2020 — valid but way off
+			Observations: []*StoreObs{
+				{ObserverID: "obs1", Timestamp: time.Unix(obsTS, 0).UTC().Format(time.RFC3339)},
+			},
+		}
+		txs = append(txs, tx)
+	}
+
+	ps.mu.Lock()
+	ps.byNode["EPOCH"] = txs
+	for _, tx := range txs {
+		ps.byPayloadType[4] = append(ps.byPayloadType[4], tx)
+	}
+	ps.clockSkew.computeInterval = 0
+	ps.mu.Unlock()
+
+	result := ps.GetNodeClockSkew("EPOCH")
+	if result == nil {
+		t.Fatal("expected clock skew result for epoch-0 node")
+	}
+	if result.Severity != SkewNoClock {
+		t.Errorf("severity = %v, want no_clock", result.Severity)
+	}
+	if result.DriftPerDaySec != 0 {
+		t.Errorf("drift = %v, want 0 for no_clock node", result.DriftPerDaySec)
+	}
+}
+
+func TestGetNodeClockSkew_TooFewSamplesForDrift(t *testing.T) {
+	// Node with only 2 advert samples → drift should not be computed.
+	ps := NewPacketStore(nil, nil)
+	pt := 4
+
+	baseObs := int64(1700000000)
+	var txs []*StoreTx
+	for i := 0; i < 2; i++ {
+		obsTS := baseObs + int64(i)*7200
+		advTS := obsTS + 120 // 120s ahead
+		tx := &StoreTx{
+			Hash:        "few-h" + string(rune('0'+i)),
+			PayloadType: &pt,
+			DecodedJSON: `{"payload":{"timestamp":` + formatInt64(advTS) + `}}`,
+			Observations: []*StoreObs{
+				{ObserverID: "obs1", Timestamp: time.Unix(obsTS, 0).UTC().Format(time.RFC3339)},
+			},
+		}
+		txs = append(txs, tx)
+	}
+
+	ps.mu.Lock()
+	ps.byNode["FEWSAMP"] = txs
+	for _, tx := range txs {
+		ps.byPayloadType[4] = append(ps.byPayloadType[4], tx)
+	}
+	ps.clockSkew.computeInterval = 0
+	ps.mu.Unlock()
+
+	result := ps.GetNodeClockSkew("FEWSAMP")
+	if result == nil {
+		t.Fatal("expected clock skew result")
+	}
+	if result.DriftPerDaySec != 0 {
+		t.Errorf("drift = %v, want 0 for 2-sample node (minimum is %d)", result.DriftPerDaySec, minDriftSamples)
+	}
+}
+
+func TestGetNodeClockSkew_AbsurdDriftCapped(t *testing.T) {
+	// Node with wildly varying skew producing |drift| > 86400 s/day → drift capped to 0.
+	ps := NewPacketStore(nil, nil)
+	pt := 4
+
+	// Create 6 samples with extreme skew variation to produce absurd drift.
+	baseObs := int64(1700000000)
+	var txs []*StoreTx
+	for i := 0; i < 6; i++ {
+		obsTS := baseObs + int64(i)*3600
+		// Alternate between huge positive and negative skew offsets
+		skewOffset := int64(50000 * (1 - 2*(i%2))) // +50000 or -50000
+		advTS := obsTS + skewOffset
+		tx := &StoreTx{
+			Hash:        "wild-h" + string(rune('0'+i)),
+			PayloadType: &pt,
+			DecodedJSON: `{"payload":{"timestamp":` + formatInt64(advTS) + `}}`,
+			Observations: []*StoreObs{
+				{ObserverID: "obs1", Timestamp: time.Unix(obsTS, 0).UTC().Format(time.RFC3339)},
+			},
+		}
+		txs = append(txs, tx)
+	}
+
+	ps.mu.Lock()
+	ps.byNode["WILD"] = txs
+	for _, tx := range txs {
+		ps.byPayloadType[4] = append(ps.byPayloadType[4], tx)
+	}
+	ps.clockSkew.computeInterval = 0
+	ps.mu.Unlock()
+
+	result := ps.GetNodeClockSkew("WILD")
+	if result == nil {
+		t.Fatal("expected clock skew result")
+	}
+	if math.Abs(result.DriftPerDaySec) > maxReasonableDriftPerDay {
+		t.Errorf("drift = %v, should be capped (|drift| > %v)", result.DriftPerDaySec, maxReasonableDriftPerDay)
+	}
+}
+
+func TestGetNodeClockSkew_NormalNodeWithDrift(t *testing.T) {
+	// Normal node with 6 samples and consistent linear drift → drift computed correctly.
+	ps := NewPacketStore(nil, nil)
+	pt := 4
+
+	baseObs := int64(1700000000)
+	var txs []*StoreTx
+	for i := 0; i < 6; i++ {
+		obsTS := baseObs + int64(i)*7200 // every 2 hours
+		// Drift: 1 sec/hour = 24 sec/day
+		advTS := obsTS + 120 + int64(i) // skew grows by 1s per sample (2h apart)
+		tx := &StoreTx{
+			Hash:        "norm-h" + string(rune('0'+i)),
+			PayloadType: &pt,
+			DecodedJSON: `{"payload":{"timestamp":` + formatInt64(advTS) + `}}`,
+			Observations: []*StoreObs{
+				{ObserverID: "obs1", Timestamp: time.Unix(obsTS, 0).UTC().Format(time.RFC3339)},
+			},
+		}
+		txs = append(txs, tx)
+	}
+
+	ps.mu.Lock()
+	ps.byNode["NORMAL"] = txs
+	for _, tx := range txs {
+		ps.byPayloadType[4] = append(ps.byPayloadType[4], tx)
+	}
+	ps.clockSkew.computeInterval = 0
+	ps.mu.Unlock()
+
+	result := ps.GetNodeClockSkew("NORMAL")
+	if result == nil {
+		t.Fatal("expected clock skew result")
+	}
+	if result.Severity != SkewOK {
+		t.Errorf("severity = %v, want ok", result.Severity)
+	}
+	// 1s per 7200s = 12 s/day
+	if result.DriftPerDaySec == 0 {
+		t.Error("expected non-zero drift for linearly drifting node")
+	}
+	if math.Abs(result.DriftPerDaySec) > maxReasonableDriftPerDay {
+		t.Errorf("drift = %v, should be reasonable", result.DriftPerDaySec)
+	}
+}
+
+// formatInt64 is a test helper to format int64 as string for JSON embedding.
+func formatInt64(n int64) string {
+	return fmt.Sprintf("%d", n)
+}

cmd/server/collision_details_test.go

@@ -0,0 +1,131 @@
+package main
+
+import (
+	"testing"
+	"time"
+)
+
+// TestCollisionDetailsIncludeNodePairs verifies that collision details contain
+// the correct prefix and matching node pairs (#757).
+func TestCollisionDetailsIncludeNodePairs(t *testing.T) {
+	db := setupTestDB(t)
+	defer db.Close()
+
+	now := time.Now().UTC()
+	recent := now.Add(-1 * time.Hour).Format(time.RFC3339)
+	recentEpoch := now.Add(-1 * time.Hour).Unix()
+
+	// Insert two repeater nodes with the same 3-byte prefix "AABB11"
+	db.conn.Exec(`INSERT INTO nodes (public_key, name, role) VALUES ('aabb11ccdd001122', 'Node Alpha', 'repeater')`)
+	db.conn.Exec(`INSERT INTO nodes (public_key, name, role) VALUES ('aabb11eeff334455', 'Node Beta', 'repeater')`)
+
+	// Add advert transmissions with hash_size=3 path bytes (0x80 = bits 10 → size 3)
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
+		VALUES ('0180aabb11ccdd', 'col_hash_01', ?, 1, 4, '{"pubKey":"aabb11ccdd001122","name":"Node Alpha","type":"ADVERT"}')`, recent)
+	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
+		VALUES (1, 1, 10.0, -91, '["aabb11"]', ?)`, recentEpoch)
+
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
+		VALUES ('0180aabb11eeff', 'col_hash_02', ?, 1, 4, '{"pubKey":"aabb11eeff334455","name":"Node Beta","type":"ADVERT"}')`, recent)
+	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
+		VALUES (2, 1, 9.0, -93, '["aabb11"]', ?)`, recentEpoch)
+
+	store := NewPacketStore(db, nil)
+	store.Load()
+
+	result := store.GetAnalyticsHashCollisions("")
+	bySize, ok := result["by_size"].(map[string]interface{})
+	if !ok {
+		t.Fatal("expected by_size map")
+	}
+
+	size3, ok := bySize["3"].(map[string]interface{})
+	if !ok {
+		t.Fatal("expected by_size[3] map")
+	}
+
+	collisions, ok := size3["collisions"].([]collisionEntry)
+	if !ok {
+		t.Fatalf("expected collisions as []collisionEntry, got %T", size3["collisions"])
+	}
+
+	// Find our collision
+	var found *collisionEntry
+	for i := range collisions {
+		if collisions[i].Prefix == "AABB11" {
+			found = &collisions[i]
+			break
+		}
+	}
+	if found == nil {
+		t.Fatal("expected collision with prefix AABB11")
+	}
+	if found.Appearances != 2 {
+		t.Errorf("expected 2 appearances, got %d", found.Appearances)
+	}
+	if len(found.Nodes) != 2 {
+		t.Fatalf("expected 2 nodes in collision, got %d", len(found.Nodes))
+	}
+
+	// Verify node pairs
+	pubkeys := map[string]bool{}
+	names := map[string]bool{}
+	for _, n := range found.Nodes {
+		pubkeys[n.PublicKey] = true
+		names[n.Name] = true
+	}
+	if !pubkeys["aabb11ccdd001122"] {
+		t.Error("expected node aabb11ccdd001122 in collision")
+	}
+	if !pubkeys["aabb11eeff334455"] {
+		t.Error("expected node aabb11eeff334455 in collision")
+	}
+	if !names["Node Alpha"] {
+		t.Error("expected Node Alpha in collision")
+	}
+	if !names["Node Beta"] {
+		t.Error("expected Node Beta in collision")
+	}
+}
+
+// TestCollisionDetailsEmptyWhenNoCollisions verifies that collision details are
+// empty when there are no collisions (#757).
+func TestCollisionDetailsEmptyWhenNoCollisions(t *testing.T) {
+	db := setupTestDB(t)
+	defer db.Close()
+
+	now := time.Now().UTC()
+	recent := now.Add(-1 * time.Hour).Format(time.RFC3339)
+	recentEpoch := now.Add(-1 * time.Hour).Unix()
+
+	// Insert one repeater node with 3-byte hash
+	db.conn.Exec(`INSERT INTO nodes (public_key, name, role) VALUES ('aabb11ccdd001122', 'Solo Node', 'repeater')`)
+
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
+		VALUES ('0180aabb11ccdd', 'solo_hash_01', ?, 1, 4, '{"pubKey":"aabb11ccdd001122","name":"Solo Node","type":"ADVERT"}')`, recent)
+	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
+		VALUES (1, 1, 10.0, -91, '["aabb11"]', ?)`, recentEpoch)
+
+	store := NewPacketStore(db, nil)
+	store.Load()
+
+	result := store.GetAnalyticsHashCollisions("")
+	bySize, ok := result["by_size"].(map[string]interface{})
+	if !ok {
+		t.Fatal("expected by_size map")
+	}
+
+	size3, ok := bySize["3"].(map[string]interface{})
+	if !ok {
+		t.Fatal("expected by_size[3] map")
+	}
+
+	collisions, ok := size3["collisions"].([]collisionEntry)
+	if !ok {
+		t.Fatalf("expected collisions as []collisionEntry, got %T", size3["collisions"])
+	}
+
+	if len(collisions) != 0 {
+		t.Errorf("expected 0 collisions, got %d", len(collisions))
+	}
+}

cmd/server/config.go

@@ -57,6 +57,47 @@ type Config struct {
 	Timestamps *TimestampConfig `json:"timestamps,omitempty"`
 
 	DebugAffinity bool `json:"debugAffinity,omitempty"`
+
+	ResolvedPath  *ResolvedPathConfig  `json:"resolvedPath,omitempty"`
+	NeighborGraph *NeighborGraphConfig `json:"neighborGraph,omitempty"`
+}
+
+// weakAPIKeys is the blocklist of known default/example API keys that must be rejected.
+var weakAPIKeys = map[string]bool{
+	"your-secret-api-key-here": true,
+	"change-me":                true,
+	"example":                  true,
+	"test":                     true,
+	"password":                 true,
+	"admin":                    true,
+	"apikey":                   true,
+	"api-key":                  true,
+	"secret":                   true,
+	"default":                  true,
+}
+
+// IsWeakAPIKey returns true if the key is in the blocklist or shorter than 16 characters.
+func IsWeakAPIKey(key string) bool {
+	if key == "" {
+		return false // empty is handled separately (endpoints disabled)
+	}
+	if weakAPIKeys[strings.ToLower(key)] {
+		return true
+	}
+	if len(key) < 16 {
+		return true
+	}
+	return false
+}
+
+// ResolvedPathConfig controls async backfill behavior.
+type ResolvedPathConfig struct {
+	BackfillHours int `json:"backfillHours"` // how far back (hours) to scan for NULL resolved_path (default 24)
+}
+
+// NeighborGraphConfig controls neighbor edge pruning.
+type NeighborGraphConfig struct {
+	MaxAgeDays int `json:"maxAgeDays"` // edges older than this are pruned (default 5)
 }
 
 // PacketStoreConfig controls in-memory packet store limits.
@@ -82,6 +123,21 @@ func (c *Config) MetricsRetentionDays() int {
 	return 30
 }
 
+// BackfillHours returns configured backfill window or 24h default.
+func (c *Config) BackfillHours() int {
+	if c.ResolvedPath != nil && c.ResolvedPath.BackfillHours > 0 {
+		return c.ResolvedPath.BackfillHours
+	}
+	return 24
+}
+
+// NeighborMaxAgeDays returns configured max edge age or 30 days default.
+func (c *Config) NeighborMaxAgeDays() int {
+	if c.NeighborGraph != nil && c.NeighborGraph.MaxAgeDays > 0 {
+		return c.NeighborGraph.MaxAgeDays
+	}
+	return 5
+}
 
 type TimestampConfig struct {
 	DefaultMode       string `json:"defaultMode"`       // "ago" | "absolute"

cmd/server/config_knobs_test.go

@@ -0,0 +1,177 @@
+package main
+
+import (
+	"database/sql"
+	"path/filepath"
+	"testing"
+	"time"
+
+	_ "modernc.org/sqlite"
+)
+
+func TestBackfillHoursDefault(t *testing.T) {
+	cfg := &Config{}
+	if got := cfg.BackfillHours(); got != 24 {
+		t.Errorf("BackfillHours() = %d, want 24", got)
+	}
+}
+
+func TestBackfillHoursConfigured(t *testing.T) {
+	cfg := &Config{ResolvedPath: &ResolvedPathConfig{BackfillHours: 48}}
+	if got := cfg.BackfillHours(); got != 48 {
+		t.Errorf("BackfillHours() = %d, want 48", got)
+	}
+}
+
+func TestBackfillHoursZeroFallsBack(t *testing.T) {
+	cfg := &Config{ResolvedPath: &ResolvedPathConfig{BackfillHours: 0}}
+	if got := cfg.BackfillHours(); got != 24 {
+		t.Errorf("BackfillHours() = %d, want 24 (default for zero)", got)
+	}
+}
+
+func TestNeighborMaxAgeDaysDefault(t *testing.T) {
+	cfg := &Config{}
+	if got := cfg.NeighborMaxAgeDays(); got != 5 {
+		t.Errorf("NeighborMaxAgeDays() = %d, want 5", got)
+	}
+}
+
+func TestNeighborMaxAgeDaysConfigured(t *testing.T) {
+	cfg := &Config{NeighborGraph: &NeighborGraphConfig{MaxAgeDays: 7}}
+	if got := cfg.NeighborMaxAgeDays(); got != 7 {
+		t.Errorf("NeighborMaxAgeDays() = %d, want 7", got)
+	}
+}
+
+func TestGraphPruneOlderThan(t *testing.T) {
+	g := NewNeighborGraph()
+	now := time.Now().UTC()
+
+	// Add a recent edge
+	g.upsertEdge("aaa", "bbb", "bb", "obs1", nil, now)
+	// Add an old edge
+	g.upsertEdge("ccc", "ddd", "dd", "obs1", nil, now.Add(-60*24*time.Hour))
+
+	if len(g.AllEdges()) != 2 {
+		t.Fatalf("expected 2 edges, got %d", len(g.AllEdges()))
+	}
+
+	cutoff := now.Add(-30 * 24 * time.Hour)
+	pruned := g.PruneOlderThan(cutoff)
+	if pruned != 1 {
+		t.Errorf("PruneOlderThan pruned %d, want 1", pruned)
+	}
+
+	edges := g.AllEdges()
+	if len(edges) != 1 {
+		t.Fatalf("expected 1 edge after prune, got %d", len(edges))
+	}
+	if edges[0].NodeA != "aaa" && edges[0].NodeB != "aaa" {
+		t.Errorf("wrong edge survived prune: %+v", edges[0])
+	}
+}
+
+func TestPruneNeighborEdgesDB(t *testing.T) {
+	tmpDir := t.TempDir()
+	dbPath := filepath.Join(tmpDir, "test.db")
+	db, err := sql.Open("sqlite", "file:"+dbPath+"?_journal_mode=WAL")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+
+	_, err = db.Exec(`CREATE TABLE neighbor_edges (
+		node_a TEXT NOT NULL,
+		node_b TEXT NOT NULL,
+		count INTEGER DEFAULT 1,
+		last_seen TEXT,
+		PRIMARY KEY (node_a, node_b)
+	)`)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	now := time.Now().UTC()
+	old := now.Add(-60 * 24 * time.Hour)
+
+	db.Exec("INSERT INTO neighbor_edges (node_a, node_b, count, last_seen) VALUES (?, ?, 5, ?)",
+		"aaa", "bbb", now.Format(time.RFC3339))
+	db.Exec("INSERT INTO neighbor_edges (node_a, node_b, count, last_seen) VALUES (?, ?, 3, ?)",
+		"ccc", "ddd", old.Format(time.RFC3339))
+
+	g := NewNeighborGraph()
+	g.upsertEdge("aaa", "bbb", "bb", "obs1", nil, now)
+	g.upsertEdge("ccc", "ddd", "dd", "obs1", nil, old)
+
+	pruned, err := PruneNeighborEdges(dbPath, g, 30)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if pruned != 1 {
+		t.Errorf("PruneNeighborEdges pruned %d DB rows, want 1", pruned)
+	}
+
+	var count int
+	db.QueryRow("SELECT COUNT(*) FROM neighbor_edges").Scan(&count)
+	if count != 1 {
+		t.Errorf("expected 1 row in DB after prune, got %d", count)
+	}
+
+	if len(g.AllEdges()) != 1 {
+		t.Errorf("expected 1 in-memory edge after prune, got %d", len(g.AllEdges()))
+	}
+}
+
+func TestBackfillRespectsHourWindow(t *testing.T) {
+	store := &PacketStore{}
+
+	now := time.Now().UTC()
+	oldTime := now.Add(-48 * time.Hour).Format(time.RFC3339Nano)
+	newTime := now.Add(-30 * time.Minute).Format(time.RFC3339Nano)
+
+	store.packets = []*StoreTx{
+		{
+			ID:        1,
+			Hash:      "old-hash",
+			FirstSeen: oldTime,
+			Observations: []*StoreObs{
+				{ID: 1, PathJSON: `["abc"]`},
+			},
+		},
+		{
+			ID:        2,
+			Hash:      "new-hash",
+			FirstSeen: newTime,
+			Observations: []*StoreObs{
+				{ID: 2, PathJSON: `["def"]`},
+			},
+		},
+	}
+
+	// With a 1-hour window, only the new tx should be processed.
+	// backfillResolvedPathsAsync will find no prefix map and finish quickly,
+	// but we can verify the pending count reflects the window.
+	go backfillResolvedPathsAsync(store, "", 100, time.Millisecond, 1)
+
+	// Wait for completion
+	for i := 0; i < 100; i++ {
+		if store.backfillComplete.Load() {
+			break
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+
+	if !store.backfillComplete.Load() {
+		t.Fatal("backfill did not complete")
+	}
+
+	// With no prefix map, total should be 0 (early exit) or just the new one
+	// The function exits early when pm == nil, so backfillTotal stays at 0
+	// if there were pending items but no pm. Let's verify it didn't process
+	// the old one by checking total <= 1.
+	total := store.backfillTotal.Load()
+	if total > 1 {
+		t.Errorf("backfill total = %d, want <= 1 (old tx should be excluded by hour window)", total)
+	}
+}

cmd/server/coverage_test.go

@@ -41,7 +41,7 @@ func setupTestDBv2(t *testing.T) *DB {
 			id INTEGER PRIMARY KEY AUTOINCREMENT, raw_hex TEXT NOT NULL,
 			hash TEXT NOT NULL UNIQUE, first_seen TEXT NOT NULL,
 			route_type INTEGER, payload_type INTEGER, payload_version INTEGER,
-			decoded_json TEXT, created_at TEXT DEFAULT (datetime('now'))
+			decoded_json TEXT, channel_hash TEXT DEFAULT NULL, created_at TEXT DEFAULT (datetime('now'))
 		);
 		CREATE TABLE observations (
 			id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -2198,6 +2198,53 @@ func TestStoreGetAnalyticsHashSizes(t *testing.T) {
 	})
 }
 
+func TestHashSizesDistributionByRepeatersFiltersRole(t *testing.T) {
+	db := setupRichTestDB(t)
+	defer db.Close()
+	store := NewPacketStore(db, nil)
+	store.Load()
+
+	result := store.GetAnalyticsHashSizes("")
+
+	// distributionByRepeaters should only count repeater nodes.
+	// Rich test DB: aabbccdd11223344 = repeater (hash size 2), eeff00112233aabb = companion (hash size 3).
+	dbr, ok := result["distributionByRepeaters"].(map[string]int)
+	if !ok {
+		t.Fatal("expected distributionByRepeaters map")
+	}
+	// Only the repeater node should be counted.
+	if dbr["3"] != 0 {
+		t.Errorf("distributionByRepeaters[3] = %d, want 0 (companion should be excluded)", dbr["3"])
+	}
+	if dbr["2"] != 1 {
+		t.Errorf("distributionByRepeaters[2] = %d, want 1 (repeater)", dbr["2"])
+	}
+
+	// multiByteNodes should include role field for frontend filtering.
+	mbn, ok := result["multiByteNodes"].([]map[string]interface{})
+	if !ok {
+		t.Fatal("expected multiByteNodes slice")
+	}
+	for _, node := range mbn {
+		if _, hasRole := node["role"]; !hasRole {
+			t.Errorf("multiByteNodes entry missing 'role' field: %v", node)
+		}
+	}
+	// Verify companion is included in multiByteNodes (it's multi-byte) with correct role.
+	foundCompanion := false
+	for _, node := range mbn {
+		if node["pubkey"] == "eeff00112233aabb" {
+			foundCompanion = true
+			if node["role"] != "companion" {
+				t.Errorf("companion node role = %v, want 'companion'", node["role"])
+			}
+		}
+	}
+	if !foundCompanion {
+		t.Error("expected companion node in multiByteNodes (multi-byte adopters should include all roles)")
+	}
+}
+
 func TestStoreGetAnalyticsSubpaths(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
@@ -3170,6 +3217,189 @@ func TestGetNodeHashSizeInfoEdgeCases(t *testing.T) {
 	}
 }
 
+// TestHashSizeTransportRoutePathByteOffset verifies that transport routes (0, 3)
+// read the path byte from offset 5 (after 4 transport code bytes), not offset 1.
+// Regression test for #744 / #722.
+func TestHashSizeTransportRoutePathByteOffset(t *testing.T) {
+	db := setupTestDB(t)
+	defer db.Close()
+
+	now := time.Now().UTC()
+	recent := now.Add(-1 * time.Hour).Format(time.RFC3339)
+	recentEpoch := now.Add(-1 * time.Hour).Unix()
+
+	db.conn.Exec(`INSERT INTO observers (id, name, iata, last_seen, first_seen, packet_count)
+		VALUES ('obs1', 'Obs', 'SJC', ?, '2026-01-01T00:00:00Z', 10)`, recent)
+
+	// Route type 0 (TRANSPORT_FLOOD): header=0x04 (payload_type=1, route_type=0)
+	// 4 transport bytes + path byte at offset 5.
+	// Path byte 0x80 → hash_size bits = 10 → size 3
+	// If bug is present, code reads byte 1 (0xAA) → hash_size bits = 10 → size 3 (coincidence)
+	// Use path byte 0x40 (hash_size=2) and transport byte 0x01 at offset 1 (hash_size=1 if misread)
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
+		VALUES ('100102030440aabb', 'tf_offset', ?, 0, 4, '{"pubKey":"aaaa000000000001","name":"TF-Node","type":"ADVERT"}')`, recent)
+	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
+		VALUES (1, 1, 10.0, -90, '[]', ?)`, recentEpoch)
+
+	// Route type 3 (TRANSPORT_DIRECT): header=0x13 (payload_type=4, route_type=3)
+	// 4 transport bytes + path byte at offset 5.
+	// Path byte 0xC1 → hash_size bits = 11 → size 4, hop_count = 1 (not zero-hop)
+	// Byte 1 = 0x05 → hash_size bits = 00 → size 1 if misread
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
+		VALUES ('1305060708C1bbcc', 'td_offset', ?, 3, 4, '{"pubKey":"aaaa000000000002","name":"TD-Node","type":"ADVERT"}')`, recent)
+	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
+		VALUES (2, 1, 10.0, -90, '[]', ?)`, recentEpoch)
+
+	// Route type 1 (FLOOD): header=0x11 (payload_type=4, route_type=1)
+	// Path byte at offset 1. Path byte 0x80 → hash_size bits = 10 → size 3
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
+		VALUES ('1180aabbccdd', 'flood_offset', ?, 1, 4, '{"pubKey":"aaaa000000000003","name":"Flood-Node","type":"ADVERT"}')`, recent)
+	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
+		VALUES (3, 1, 10.0, -90, '[]', ?)`, recentEpoch)
+
+	store := NewPacketStore(db, nil)
+	store.Load()
+	info := store.GetNodeHashSizeInfo()
+
+	// Transport flood node: path byte 0x40 → hash_size = 2
+	if ni, ok := info["aaaa000000000001"]; !ok {
+		t.Error("transport flood node missing from hash size info")
+	} else if ni.HashSize != 2 {
+		t.Errorf("transport flood node: want HashSize=2 (from path byte at offset 5), got %d", ni.HashSize)
+	}
+
+	// Transport direct node: path byte 0xC1 → hash_size = 4
+	if ni, ok := info["aaaa000000000002"]; !ok {
+		t.Error("transport direct node missing from hash size info")
+	} else if ni.HashSize != 4 {
+		t.Errorf("transport direct node: want HashSize=4 (from path byte at offset 5), got %d", ni.HashSize)
+	}
+
+	// Regular flood node: path byte 0x80 → hash_size = 3
+	if ni, ok := info["aaaa000000000003"]; !ok {
+		t.Error("regular flood node missing from hash size info")
+	} else if ni.HashSize != 3 {
+		t.Errorf("regular flood node: want HashSize=3 (from path byte at offset 1), got %d", ni.HashSize)
+	}
+}
+
+// TestHashSizeTransportDirectZeroHopSkipped verifies that RouteTransportDirect
+// zero-hop adverts are skipped (same as RouteDirect). Regression test for #744.
+func TestHashSizeTransportDirectZeroHopSkipped(t *testing.T) {
+	db := setupTestDB(t)
+	defer db.Close()
+
+	now := time.Now().UTC()
+	recent := now.Add(-1 * time.Hour).Format(time.RFC3339)
+	recentEpoch := now.Add(-1 * time.Hour).Unix()
+
+	db.conn.Exec(`INSERT INTO observers (id, name, iata, last_seen, first_seen, packet_count)
+		VALUES ('obs1', 'Obs', 'SJC', ?, '2026-01-01T00:00:00Z', 10)`, recent)
+
+	// RouteDirect (2) zero-hop: path byte 0x40 → hop_count=0, hash_size bits=01
+	// Should be skipped (existing behavior)
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
+		VALUES ('1240aabbccdd', 'direct_zh', ?, 2, 4, '{"pubKey":"bbbb000000000001","name":"Direct-ZH","type":"ADVERT"}')`, recent)
+	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
+		VALUES (1, 1, 10.0, -90, '[]', ?)`, recentEpoch)
+
+	// RouteTransportDirect (3) zero-hop: 4 transport bytes + path byte 0x40 → hop_count=0
+	// Should ALSO be skipped (this was the missing case)
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
+		VALUES ('130102030440aabb', 'tdirect_zh', ?, 3, 4, '{"pubKey":"bbbb000000000002","name":"TDirect-ZH","type":"ADVERT"}')`, recent)
+	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
+		VALUES (2, 1, 10.0, -90, '[]', ?)`, recentEpoch)
+
+	// RouteDirect (2) non-zero-hop: path byte 0x41 → hop_count=1
+	// Should NOT be skipped
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
+		VALUES ('1241aabbccdd', 'direct_1h', ?, 2, 4, '{"pubKey":"bbbb000000000003","name":"Direct-1H","type":"ADVERT"}')`, recent)
+	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
+		VALUES (3, 1, 10.0, -90, '[]', ?)`, recentEpoch)
+
+	store := NewPacketStore(db, nil)
+	store.Load()
+	info := store.GetNodeHashSizeInfo()
+
+	// RouteDirect zero-hop should be absent
+	if _, ok := info["bbbb000000000001"]; ok {
+		t.Error("RouteDirect zero-hop advert should be skipped")
+	}
+
+	// RouteTransportDirect zero-hop should also be absent
+	if _, ok := info["bbbb000000000002"]; ok {
+		t.Error("RouteTransportDirect zero-hop advert should be skipped")
+	}
+
+	// RouteDirect non-zero-hop should be present with hash_size=2
+	if ni, ok := info["bbbb000000000003"]; !ok {
+		t.Error("RouteDirect non-zero-hop should be in hash size info")
+	} else if ni.HashSize != 2 {
+		t.Errorf("RouteDirect non-zero-hop: want HashSize=2, got %d", ni.HashSize)
+	}
+}
+
+// TestAnalyticsHashSizesZeroHopSkip verifies that computeAnalyticsHashSizes
+// does not overwrite a node's hash_size with a zero-hop advert's unreliable value.
+// Regression test for #744.
+func TestAnalyticsHashSizesZeroHopSkip(t *testing.T) {
+	db := setupTestDB(t)
+	defer db.Close()
+
+	now := time.Now().UTC()
+	recent := now.Add(-1 * time.Hour).Format(time.RFC3339)
+	recentEpoch := now.Add(-1 * time.Hour).Unix()
+
+	db.conn.Exec(`INSERT INTO observers (id, name, iata, last_seen, first_seen, packet_count)
+		VALUES ('obs1', 'Obs', 'SJC', ?, '2026-01-01T00:00:00Z', 10)`, recent)
+
+	pk := "cccc000000000001"
+	db.conn.Exec(`INSERT INTO nodes (public_key, name, role) VALUES (?, 'ZH-Analytics', 'repeater')`, pk)
+
+	decoded := `{"pubKey":"` + pk + `","name":"ZH-Analytics","type":"ADVERT"}`
+
+	// First: a flood advert with hashSize=2 (reliable, multi-hop)
+	// header 0x11 = route_type 1 (flood), payload_type 4
+	// pathByte 0x41 = hashSize bits 01 → size 2, hop_count 1
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
+		VALUES ('1141aabbccdd', 'az_flood', ?, 1, 4, ?)`, recent, decoded)
+	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
+		VALUES (1, 1, 10.0, -90, '["aabb"]', ?)`, recentEpoch)
+
+	// Second: a direct zero-hop advert with pathByte=0x00 → would give hashSize=1
+	// header 0x12 = route_type 2 (direct), payload_type 4
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
+		VALUES ('1200aabbccdd', 'az_direct', ?, 2, 4, ?)`, recent, decoded)
+	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
+		VALUES (2, 1, 10.0, -90, '[]', ?)`, recentEpoch)
+
+	store := NewPacketStore(db, nil)
+	store.Load()
+
+	result := store.GetAnalyticsHashSizes("")
+
+	// The node should appear in multiByteNodes (hashSize=2 from the flood advert)
+	// If the zero-hop bug is present, hashSize would be 1 and the node would NOT
+	// appear in multiByteNodes.
+	multiByteNodes, ok := result["multiByteNodes"].([]map[string]interface{})
+	if !ok {
+		t.Fatal("expected multiByteNodes slice in analytics hash sizes")
+	}
+
+	found := false
+	for _, n := range multiByteNodes {
+		if n["pubkey"] == pk {
+			found = true
+			if hs, ok := n["hashSize"].(int); ok && hs != 2 {
+				t.Errorf("expected hashSize=2 from flood advert, got %d", hs)
+			}
+		}
+	}
+	if !found {
+		t.Error("node should appear in multiByteNodes with hashSize=2; zero-hop advert should not overwrite to 1")
+	}
+}
+
 func TestHandleResolveHopsEdgeCases(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
@@ -4086,6 +4316,90 @@ func TestIndexByNodePreCheck(t *testing.T) {
 	})
 }
 
+// TestIndexByNodeResolvedPath tests that resolved_path entries are indexed in byNode.
+func TestIndexByNodeResolvedPath(t *testing.T) {
+	store := &PacketStore{
+		byNode:     make(map[string][]*StoreTx),
+		nodeHashes: make(map[string]map[string]bool),
+	}
+
+	t.Run("indexes resolved path pubkeys from observations", func(t *testing.T) {
+		relayPK := "aabb1122334455ff"
+		tx := &StoreTx{
+			Hash:        "rp1",
+			DecodedJSON: `{"type":"CHAN","text":"hello"}`, // no pubKey fields
+			Observations: []*StoreObs{
+				{ResolvedPath: []*string{&relayPK}},
+			},
+		}
+		store.indexByNode(tx)
+		if len(store.byNode[relayPK]) != 1 {
+			t.Errorf("expected relay pubkey indexed, got %d", len(store.byNode[relayPK]))
+		}
+	})
+
+	t.Run("skips null entries in resolved path", func(t *testing.T) {
+		pk := "cc11dd22ee33ff44"
+		tx := &StoreTx{
+			Hash: "rp2",
+			Observations: []*StoreObs{
+				{ResolvedPath: []*string{nil, &pk, nil}},
+			},
+		}
+		store.indexByNode(tx)
+		if len(store.byNode[pk]) != 1 {
+			t.Errorf("expected resolved pubkey indexed, got %d", len(store.byNode[pk]))
+		}
+		// Verify nil entries didn't create empty-string keys
+		if _, exists := store.byNode[""]; exists {
+			t.Error("nil/empty resolved path entries should not create byNode entries")
+		}
+	})
+
+	t.Run("relay-only node appears in byNode", func(t *testing.T) {
+		// A packet with no decoded pubkey fields, only a relay in resolved path
+		relayOnly := "relay0only0pubkey"
+		tx := &StoreTx{
+			Hash: "rp3",
+			// No DecodedJSON at all — pure relay
+			Observations: []*StoreObs{
+				{ResolvedPath: []*string{&relayOnly}},
+			},
+		}
+		store.indexByNode(tx)
+		if len(store.byNode[relayOnly]) != 1 {
+			t.Errorf("expected relay-only node indexed, got %d", len(store.byNode[relayOnly]))
+		}
+	})
+
+	t.Run("dedup between decoded JSON and resolved path", func(t *testing.T) {
+		pk := "dedup0test0pk1234"
+		tx := &StoreTx{
+			Hash:        "rp4",
+			DecodedJSON: `{"pubKey":"` + pk + `"}`,
+			Observations: []*StoreObs{
+				{ResolvedPath: []*string{&pk}},
+			},
+		}
+		store.indexByNode(tx)
+		if len(store.byNode[pk]) != 1 {
+			t.Errorf("expected dedup to keep 1 entry, got %d", len(store.byNode[pk]))
+		}
+	})
+
+	t.Run("indexes tx.ResolvedPath when observations empty", func(t *testing.T) {
+		rpPK := "txlevel0resolved1"
+		tx := &StoreTx{
+			Hash:         "rp5",
+			ResolvedPath: []*string{&rpPK},
+		}
+		store.indexByNode(tx)
+		if len(store.byNode[rpPK]) != 1 {
+			t.Errorf("expected tx-level resolved path indexed, got %d", len(store.byNode[rpPK]))
+		}
+	})
+}
+
 // BenchmarkIndexByNode measures indexByNode performance with and without pubkey
 // fields to demonstrate the strings.Contains pre-check optimization.
 func BenchmarkIndexByNode(b *testing.B) {
@@ -4339,3 +4653,53 @@ func TestHandleBatchObservations(t *testing.T) {
 		}
 	})
 }
+
+// TestIngestTraceBroadcastIncludesPath verifies that TRACE packet broadcasts
+// include decoded.path with hopsCompleted (#683).
+func TestIngestTraceBroadcastIncludesPath(t *testing.T) {
+	db := setupTestDB(t)
+	defer db.Close()
+	store := NewPacketStore(db, nil)
+	store.Load()
+
+	initialMax := store.MaxTransmissionID()
+
+	// TRACE packet: header=0x25, path_byte=0x02 (2 SNR bytes), 2 SNR bytes,
+	// then payload: tag(4) + authCode(4) + flags(1) + 4 hop hashes (1-byte each)
+	traceHex := "2502AABB010000000200000000DEADBEEF"
+	now := time.Now().UTC().Format(time.RFC3339)
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
+		VALUES (?, 'tracehash683test', ?, 1, 9, '')`, traceHex, now)
+	newTxID := 0
+	db.conn.QueryRow("SELECT MAX(id) FROM transmissions").Scan(&newTxID)
+	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
+		VALUES (?, 1, 5.0, -100, '["aa"]', ?)`, newTxID, time.Now().Unix())
+
+	broadcastMaps, _ := store.IngestNewFromDB(initialMax, 100)
+	if len(broadcastMaps) < 1 {
+		t.Fatal("expected >=1 broadcast maps")
+	}
+
+	bm := broadcastMaps[0]
+	decoded, ok := bm["decoded"].(map[string]interface{})
+	if !ok {
+		t.Fatal("broadcast map missing 'decoded'")
+	}
+
+	pathObj, ok := decoded["path"]
+	if !ok {
+		t.Fatal("decoded missing 'path' for TRACE packet — hopsCompleted not delivered to frontend (#683)")
+	}
+
+	// The path should be a Path struct with HopsCompleted = 2
+	pathStruct, ok := pathObj.(Path)
+	if !ok {
+		t.Fatalf("expected Path struct, got %T", pathObj)
+	}
+	if pathStruct.HopsCompleted == nil {
+		t.Fatal("path.HopsCompleted is nil for TRACE packet")
+	}
+	if *pathStruct.HopsCompleted != 2 {
+		t.Errorf("expected hopsCompleted=2, got %d", *pathStruct.HopsCompleted)
+	}
+}

cmd/server/db.go

@@ -8,6 +8,7 @@ import (
 	"math"
 	"os"
 	"strings"
+	"sync"
 	"time"
 
 	_ "modernc.org/sqlite"
@@ -19,6 +20,12 @@ type DB struct {
 	path             string // filesystem path to the database file
 	isV3             bool   // v3 schema: observer_idx in observations (vs observer_id in v2)
 	hasResolvedPath  bool   // observations table has resolved_path column
+
+	// Channel list cache (60s TTL) — avoids repeated GROUP BY scans (#762)
+	channelsCacheMu  sync.Mutex
+	channelsCacheKey string
+	channelsCacheRes []map[string]interface{}
+	channelsCacheExp time.Time
 }
 
 // OpenDB opens a read-only SQLite connection with WAL mode.
@@ -1153,69 +1160,219 @@ func (db *DB) GetTraces(hash string) ([]map[string]interface{}, error) {
 // Queries transmissions directly (not a VIEW) to avoid observation-level
 // duplicates that could cause stale lastMessage when an older message has
 // a later re-observation timestamp.
-func (db *DB) GetChannels() ([]map[string]interface{}, error) {
-	rows, err := db.conn.Query(`SELECT decoded_json, first_seen FROM transmissions WHERE payload_type = 5 ORDER BY first_seen ASC`)
+func (db *DB) GetChannels(region ...string) ([]map[string]interface{}, error) {
+	regionParam := ""
+	if len(region) > 0 {
+		regionParam = region[0]
+	}
+
+	// Check cache (60s TTL)
+	db.channelsCacheMu.Lock()
+	if db.channelsCacheRes != nil && db.channelsCacheKey == regionParam && time.Now().Before(db.channelsCacheExp) {
+		res := db.channelsCacheRes
+		db.channelsCacheMu.Unlock()
+		return res, nil
+	}
+	db.channelsCacheMu.Unlock()
+
+	regionCodes := normalizeRegionCodes(regionParam)
+
+	var querySQL string
+	args := make([]interface{}, 0, len(regionCodes))
+
+	if len(regionCodes) > 0 {
+		placeholders := make([]string, len(regionCodes))
+		for i, code := range regionCodes {
+			placeholders[i] = "?"
+			args = append(args, code)
+		}
+		regionPlaceholder := strings.Join(placeholders, ",")
+		if db.isV3 {
+			querySQL = fmt.Sprintf(`SELECT t.channel_hash,
+					COUNT(*) AS msg_count,
+					MAX(t.first_seen) AS last_activity,
+					(SELECT t2.decoded_json FROM transmissions t2
+					 WHERE t2.channel_hash = t.channel_hash AND t2.payload_type = 5
+					 ORDER BY t2.first_seen DESC LIMIT 1) AS sample_json
+				FROM transmissions t
+				JOIN observations o ON o.transmission_id = t.id
+				LEFT JOIN observers obs ON obs.rowid = o.observer_idx
+				WHERE t.payload_type = 5
+				AND t.channel_hash IS NOT NULL
+				AND t.channel_hash NOT LIKE 'enc_%%'
+				AND obs.rowid IS NOT NULL AND UPPER(TRIM(obs.iata)) IN (%s)
+				GROUP BY t.channel_hash
+				ORDER BY last_activity DESC`, regionPlaceholder)
+		} else {
+			querySQL = fmt.Sprintf(`SELECT t.channel_hash,
+					COUNT(*) AS msg_count,
+					MAX(t.first_seen) AS last_activity,
+					(SELECT t2.decoded_json FROM transmissions t2
+					 WHERE t2.channel_hash = t.channel_hash AND t2.payload_type = 5
+					 ORDER BY t2.first_seen DESC LIMIT 1) AS sample_json
+				FROM transmissions t
+				JOIN observations o ON o.transmission_id = t.id
+				WHERE t.payload_type = 5
+				AND t.channel_hash IS NOT NULL
+				AND t.channel_hash NOT LIKE 'enc_%%'
+				AND EXISTS (
+					SELECT 1 FROM observers obs
+					WHERE obs.id = o.observer_id
+					AND UPPER(TRIM(obs.iata)) IN (%s)
+				)
+				GROUP BY t.channel_hash
+				ORDER BY last_activity DESC`, regionPlaceholder)
+		}
+	} else {
+		querySQL = `SELECT channel_hash,
+				COUNT(*) AS msg_count,
+				MAX(first_seen) AS last_activity,
+				(SELECT t2.decoded_json FROM transmissions t2
+				 WHERE t2.channel_hash = t.channel_hash AND t2.payload_type = 5
+				 ORDER BY t2.first_seen DESC LIMIT 1) AS sample_json
+			FROM transmissions t
+			WHERE payload_type = 5
+			AND channel_hash IS NOT NULL
+			AND channel_hash NOT LIKE 'enc_%%'
+			GROUP BY channel_hash
+			ORDER BY last_activity DESC`
+	}
+
+	rows, err := db.conn.Query(querySQL, args...)
 	if err != nil {
 		return nil, err
 	}
 	defer rows.Close()
 
-	channelMap := map[string]map[string]interface{}{}
+	channels := make([]map[string]interface{}, 0)
 	for rows.Next() {
-		var dj, fs sql.NullString
-		rows.Scan(&dj, &fs)
-		if !dj.Valid {
+		var chHash, lastActivity, sampleJSON sql.NullString
+		var msgCount int
+		if err := rows.Scan(&chHash, &msgCount, &lastActivity, &sampleJSON); err != nil {
 			continue
 		}
-		var decoded map[string]interface{}
-		if json.Unmarshal([]byte(dj.String), &decoded) != nil {
-			continue
-		}
-		dtype, _ := decoded["type"].(string)
-		if dtype != "CHAN" {
-			continue
-		}
-		// Filter out garbage-decrypted channel names/messages (pre-#197 data still in DB)
-		chanStr, _ := decoded["channel"].(string)
-		textStr, _ := decoded["text"].(string)
-		if hasGarbageChars(chanStr) || hasGarbageChars(textStr) {
-			continue
-		}
-		channelName, _ := decoded["channel"].(string)
+		channelName := nullStr(chHash)
 		if channelName == "" {
-			channelName = "unknown"
+			continue
 		}
-		key := channelName
 
-		ch, exists := channelMap[key]
-		if !exists {
-			ch = map[string]interface{}{
-				"hash": key, "name": channelName,
-				"lastMessage": nil, "lastSender": nil,
-				"messageCount": 0, "lastActivity": nullStr(fs),
-			}
-			channelMap[key] = ch
-		}
-		ch["messageCount"] = ch["messageCount"].(int) + 1
-		if fs.Valid {
-			ch["lastActivity"] = fs.String
-		}
-		if text, ok := decoded["text"].(string); ok && text != "" {
-			idx := strings.Index(text, ": ")
-			if idx > 0 {
-				ch["lastMessage"] = text[idx+2:]
-			} else {
-				ch["lastMessage"] = text
-			}
-			if sender, ok := decoded["sender"].(string); ok {
-				ch["lastSender"] = sender
+		var lastMessage, lastSender interface{}
+		if sampleJSON.Valid {
+			var decoded map[string]interface{}
+			if json.Unmarshal([]byte(sampleJSON.String), &decoded) == nil {
+				if text, ok := decoded["text"].(string); ok && text != "" {
+					idx := strings.Index(text, ": ")
+					if idx > 0 {
+						lastMessage = text[idx+2:]
+					} else {
+						lastMessage = text
+					}
+					if sender, ok := decoded["sender"].(string); ok {
+						lastSender = sender
+					}
+				}
 			}
 		}
+
+		channels = append(channels, map[string]interface{}{
+			"hash": channelName, "name": channelName,
+			"lastMessage": lastMessage, "lastSender": lastSender,
+			"messageCount": msgCount, "lastActivity": nullStr(lastActivity),
+		})
 	}
 
-	channels := make([]map[string]interface{}, 0, len(channelMap))
-	for _, ch := range channelMap {
-		channels = append(channels, ch)
+	// Store in cache (60s TTL)
+	db.channelsCacheMu.Lock()
+	db.channelsCacheRes = channels
+	db.channelsCacheKey = regionParam
+	db.channelsCacheExp = time.Now().Add(60 * time.Second)
+	db.channelsCacheMu.Unlock()
+
+	return channels, nil
+}
+
+// GetEncryptedChannels returns channels where all messages are undecryptable (no key).
+// Uses channel_hash column (prefixed with 'enc_') for fast grouped queries.
+func (db *DB) GetEncryptedChannels(region ...string) ([]map[string]interface{}, error) {
+	regionParam := ""
+	if len(region) > 0 {
+		regionParam = region[0]
+	}
+	regionCodes := normalizeRegionCodes(regionParam)
+
+	var querySQL string
+	args := make([]interface{}, 0, len(regionCodes))
+
+	if len(regionCodes) > 0 {
+		placeholders := make([]string, len(regionCodes))
+		for i, code := range regionCodes {
+			placeholders[i] = "?"
+			args = append(args, code)
+		}
+		regionPlaceholder := strings.Join(placeholders, ",")
+		if db.isV3 {
+			querySQL = fmt.Sprintf(`SELECT t.channel_hash,
+					COUNT(*) AS msg_count,
+					MAX(t.first_seen) AS last_activity
+				FROM transmissions t
+				JOIN observations o ON o.transmission_id = t.id
+				LEFT JOIN observers obs ON obs.rowid = o.observer_idx
+				WHERE t.payload_type = 5
+				AND t.channel_hash LIKE 'enc_%%'
+				AND obs.rowid IS NOT NULL AND UPPER(TRIM(obs.iata)) IN (%s)
+				GROUP BY t.channel_hash
+				ORDER BY last_activity DESC`, regionPlaceholder)
+		} else {
+			querySQL = fmt.Sprintf(`SELECT t.channel_hash,
+					COUNT(*) AS msg_count,
+					MAX(t.first_seen) AS last_activity
+				FROM transmissions t
+				JOIN observations o ON o.transmission_id = t.id
+				WHERE t.payload_type = 5
+				AND t.channel_hash LIKE 'enc_%%'
+				AND EXISTS (
+					SELECT 1 FROM observers obs
+					WHERE obs.id = o.observer_id
+					AND UPPER(TRIM(obs.iata)) IN (%s)
+				)
+				GROUP BY t.channel_hash
+				ORDER BY last_activity DESC`, regionPlaceholder)
+		}
+	} else {
+		querySQL = `SELECT channel_hash,
+				COUNT(*) AS msg_count,
+				MAX(first_seen) AS last_activity
+			FROM transmissions
+			WHERE payload_type = 5
+			AND channel_hash LIKE 'enc_%%'
+			GROUP BY channel_hash
+			ORDER BY last_activity DESC`
+	}
+
+	rows, err := db.conn.Query(querySQL, args...)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	channels := make([]map[string]interface{}, 0)
+	for rows.Next() {
+		var chHash, lastActivity sql.NullString
+		var msgCount int
+		if err := rows.Scan(&chHash, &msgCount, &lastActivity); err != nil {
+			continue
+		}
+		fullHash := nullStrVal(chHash) // e.g. "enc_3A"
+		hexPart := strings.TrimPrefix(fullHash, "enc_")
+		channels = append(channels, map[string]interface{}{
+			"hash":         fullHash,
+			"name":         "Encrypted (0x" + hexPart + ")",
+			"lastMessage":  nil,
+			"lastSender":   nil,
+			"messageCount": msgCount,
+			"lastActivity": nullStr(lastActivity),
+			"encrypted":    true,
+		})
 	}
 	return channels, nil
 }
@@ -1244,15 +1401,16 @@ func (db *DB) GetChannelMessages(channelHash string, limit, offset int, region .
 		regionPlaceholders = strings.Join(placeholders, ",")
 	}
 
+	// Fetch messages with channel_hash filter (pagination applied in Go after dedup)
 	var querySQL string
-	args := make([]interface{}, 0, len(regionArgs))
+	args := []interface{}{channelHash}
 	if db.isV3 {
 		querySQL = `SELECT o.id, t.hash, t.decoded_json, t.first_seen,
 				obs.id, obs.name, o.snr, o.path_json
 			FROM observations o
 			JOIN transmissions t ON t.id = o.transmission_id
 			LEFT JOIN observers obs ON obs.rowid = o.observer_idx
-			WHERE t.payload_type = 5`
+			WHERE t.channel_hash = ? AND t.payload_type = 5`
 		if len(regionCodes) > 0 {
 			querySQL += fmt.Sprintf(" AND obs.rowid IS NOT NULL AND UPPER(TRIM(obs.iata)) IN (%s)", regionPlaceholders)
 			args = append(args, regionArgs...)
@@ -1264,14 +1422,11 @@ func (db *DB) GetChannelMessages(channelHash string, limit, offset int, region .
 				o.observer_id, o.observer_name, o.snr, o.path_json
 			FROM observations o
 			JOIN transmissions t ON t.id = o.transmission_id
-			WHERE t.payload_type = 5`
+			WHERE t.channel_hash = ? AND t.payload_type = 5`
 		if len(regionCodes) > 0 {
 			querySQL += fmt.Sprintf(` AND EXISTS (
-				SELECT 1
-				FROM observers obs
-				WHERE obs.id = o.observer_id
-				AND UPPER(TRIM(obs.iata)) IN (%s)
-			)`, regionPlaceholders)
+				SELECT 1 FROM observers obs WHERE obs.id = o.observer_id
+				AND UPPER(TRIM(obs.iata)) IN (%s))`, regionPlaceholders)
 			args = append(args, regionArgs...)
 		}
 		querySQL += `
@@ -1303,17 +1458,6 @@ func (db *DB) GetChannelMessages(channelHash string, limit, offset int, region .
 		if json.Unmarshal([]byte(dj.String), &decoded) != nil {
 			continue
 		}
-		dtype, _ := decoded["type"].(string)
-		if dtype != "CHAN" {
-			continue
-		}
-		ch, _ := decoded["channel"].(string)
-		if ch == "" {
-			ch = "unknown"
-		}
-		if ch != channelHash {
-			continue
-		}
 
 		text, _ := decoded["text"].(string)
 		sender, _ := decoded["sender"].(string)
@@ -1373,18 +1517,18 @@ func (db *DB) GetChannelMessages(channelHash string, limit, offset int, region .
 		}
 	}
 
-	total := len(msgOrder)
-	// Return latest messages (tail)
-	start := total - limit - offset
+	// Return latest messages (tail) with pagination
+	msgTotal := len(msgOrder)
+	start := msgTotal - limit - offset
 	if start < 0 {
 		start = 0
 	}
-	end := total - offset
+	end := msgTotal - offset
 	if end < 0 {
 		end = 0
 	}
-	if end > total {
-		end = total
+	if end > msgTotal {
+		end = msgTotal
 	}
 
 	messages := make([]map[string]interface{}, 0)
@@ -1395,7 +1539,7 @@ func (db *DB) GetChannelMessages(channelHash string, limit, offset int, region .
 		messages = append(messages, m.Data)
 	}
 
-	return messages, total, nil
+	return messages, msgTotal, nil
 }
 
 
@@ -1704,12 +1848,10 @@ func nullInt(ni sql.NullInt64) interface{} {
 // Returns the number of transmissions deleted.
 // Opens a separate read-write connection since the main connection is read-only.
 func (db *DB) PruneOldPackets(days int) (int64, error) {
-	dsn := fmt.Sprintf("file:%s?_journal_mode=WAL&_busy_timeout=10000", db.path)
-	rw, err := sql.Open("sqlite", dsn)
+	rw, err := openRW(db.path)
 	if err != nil {
 		return 0, err
 	}
-	rw.SetMaxOpenConns(1)
 	defer rw.Close()
 
 	cutoff := time.Now().UTC().AddDate(0, 0, -days).Format(time.RFC3339)
@@ -2053,12 +2195,10 @@ func (db *DB) GetMetricsSummary(since string) ([]MetricsSummaryRow, error) {
 
 // PruneOldMetrics deletes observer_metrics rows older than retentionDays.
 func (db *DB) PruneOldMetrics(retentionDays int) (int64, error) {
-	dsn := fmt.Sprintf("file:%s?_journal_mode=WAL&_busy_timeout=10000", db.path)
-	rw, err := sql.Open("sqlite", dsn)
+	rw, err := openRW(db.path)
 	if err != nil {
 		return 0, err
 	}
-	rw.SetMaxOpenConns(1)
 	defer rw.Close()
 
 	cutoff := time.Now().UTC().AddDate(0, 0, -retentionDays).Format(time.RFC3339)
@@ -2072,3 +2212,14 @@ func (db *DB) PruneOldMetrics(retentionDays int) (int64, error) {
 	}
 	return n, nil
 }
+
+// TouchNodeLastSeen updates last_seen for a node identified by full public key.
+// Only updates if the new timestamp is newer than the existing value (or NULL).
+// Returns nil even if no rows are affected (node doesn't exist).
+func (db *DB) TouchNodeLastSeen(pubkey string, timestamp string) error {
+	_, err := db.conn.Exec(
+		"UPDATE nodes SET last_seen = ? WHERE public_key = ? AND (last_seen IS NULL OR last_seen < ?)",
+		timestamp, pubkey, timestamp,
+	)
+	return err
+}

cmd/server/db_test.go

@@ -60,6 +60,7 @@ func setupTestDB(t *testing.T) *DB {
 			payload_type INTEGER,
 			payload_version INTEGER,
 			decoded_json TEXT,
+			channel_hash TEXT DEFAULT NULL,
 			created_at TEXT DEFAULT (datetime('now'))
 		);
 
@@ -72,7 +73,8 @@ func setupTestDB(t *testing.T) *DB {
 			rssi REAL,
 			score INTEGER,
 			path_json TEXT,
-			timestamp INTEGER NOT NULL
+			timestamp INTEGER NOT NULL,
+			resolved_path TEXT
 		);
 
 		CREATE TABLE IF NOT EXISTS observer_metrics (
@@ -95,7 +97,7 @@ func setupTestDB(t *testing.T) *DB {
 		t.Fatal(err)
 	}
 
-	return &DB{conn: conn, isV3: true}
+	return &DB{conn: conn, isV3: true, hasResolvedPath: true}
 }
 
 func seedTestData(t *testing.T, db *DB) {
@@ -123,23 +125,24 @@ func seedTestData(t *testing.T, db *DB) {
 		VALUES ('1122334455667788', 'TestRoom', 'room', 37.4, -121.9, ?, '2026-01-01T00:00:00Z', 5)`, twoDaysAgo)
 
 	// Seed transmissions
-	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
-		VALUES ('AABB', 'abc123def4567890', ?, 1, 4, '{"pubKey":"aabbccdd11223344","name":"TestRepeater","type":"ADVERT","timestamp":1700000000,"timestampISO":"2023-11-14T22:13:20.000Z","signature":"abcdef","flags":{"isRepeater":true},"lat":37.5,"lon":-122.0}')`, recent)
-	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
-		VALUES ('CCDD', '1234567890abcdef', ?, 1, 5, '{"type":"CHAN","channel":"#test","text":"Hello: World","sender":"TestUser"}')`, yesterday)
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json, channel_hash)
+		VALUES ('AABB', 'abc123def4567890', ?, 1, 4, '{"pubKey":"aabbccdd11223344","name":"TestRepeater","type":"ADVERT","timestamp":1700000000,"timestampISO":"2023-11-14T22:13:20.000Z","signature":"abcdef","flags":{"isRepeater":true},"lat":37.5,"lon":-122.0}', '#test')`, recent)
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json, channel_hash)
+		VALUES ('CCDD', '1234567890abcdef', ?, 1, 5, '{"type":"CHAN","channel":"#test","text":"Hello: World","sender":"TestUser"}', '#test')`, yesterday)
 	// Second ADVERT for same node with different hash_size (raw_hex byte 0x1F → hs=1 vs 0xBB → hs=3)
 	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
 		VALUES ('AA1F', 'def456abc1230099', ?, 1, 4, '{"pubKey":"aabbccdd11223344","name":"TestRepeater","type":"ADVERT","timestamp":1700000100,"timestampISO":"2023-11-14T22:14:40.000Z","signature":"fedcba","flags":{"isRepeater":true},"lat":37.5,"lon":-122.0}')`, yesterday)
 
 	// Seed observations (use unix timestamps)
-	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
-		VALUES (1, 1, 12.5, -90, '["aa","bb"]', ?)`, recentEpoch)
-	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
-		VALUES (1, 2, 8.0, -95, '["aa"]', ?)`, recentEpoch-100)
+	// resolved_path contains full pubkeys parallel to path_json hops
+	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp, resolved_path)
+		VALUES (1, 1, 12.5, -90, '["aa","bb"]', ?, '["aabbccdd11223344","eeff00112233aabb"]')`, recentEpoch)
+	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp, resolved_path)
+		VALUES (1, 2, 8.0, -95, '["aa"]', ?, '["aabbccdd11223344"]')`, recentEpoch-100)
 	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
 		VALUES (2, 1, 15.0, -85, '[]', ?)`, yesterdayEpoch)
-	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
-		VALUES (3, 1, 10.0, -92, '["cc"]', ?)`, yesterdayEpoch)
+	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp, resolved_path)
+		VALUES (3, 1, 10.0, -92, '["cc"]', ?, '["1122334455667788"]')`, yesterdayEpoch)
 }
 
 func TestGetStats(t *testing.T) {
@@ -733,12 +736,12 @@ func TestGetChannelMessagesRegionFiltering(t *testing.T) {
 
 	db.conn.Exec(`INSERT INTO observers (id, name, iata) VALUES ('obs1', 'Observer One', 'SJC')`)
 	db.conn.Exec(`INSERT INTO observers (id, name, iata) VALUES ('obs2', 'Observer Two', ' sfo ')`)
-	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json, channel_hash)
 		VALUES ('AA', 'chanregion0001', ?, 1, 5,
-		'{"type":"CHAN","channel":"#region","text":"SjcUser: One","sender":"SjcUser"}')`, ts1)
-	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
+		'{"type":"CHAN","channel":"#region","text":"SjcUser: One","sender":"SjcUser"}', '#region')`, ts1)
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json, channel_hash)
 		VALUES ('BB', 'chanregion0002', ?, 1, 5,
-		'{"type":"CHAN","channel":"#region","text":"SfoUser: Two","sender":"SfoUser"}')`, ts2)
+		'{"type":"CHAN","channel":"#region","text":"SfoUser: Two","sender":"SfoUser"}', '#region')`, ts2)
 	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
 		VALUES (1, 1, 10.0, -90, '[]', ?)`, epoch1)
 	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
@@ -1117,6 +1120,7 @@ func setupTestDBV2(t *testing.T) *DB {
 			payload_type INTEGER,
 			payload_version INTEGER,
 			decoded_json TEXT,
+			channel_hash TEXT DEFAULT NULL,
 			created_at TEXT DEFAULT (datetime('now'))
 		);
 
@@ -1200,12 +1204,12 @@ func TestGetChannelMessagesDedup(t *testing.T) {
 	db.conn.Exec(`INSERT INTO observers (id, name, iata) VALUES ('obs2', 'Observer Two', 'SFO')`)
 
 	// Insert two transmissions with same hash to test dedup
-	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json, channel_hash)
 		VALUES ('AA', 'chanmsg00000001', '2026-01-15T10:00:00Z', 1, 5,
-		'{"type":"CHAN","channel":"#general","text":"User1: Hello","sender":"User1"}')`)
-	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
+		'{"type":"CHAN","channel":"#general","text":"User1: Hello","sender":"User1"}', '#general')`)
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json, channel_hash)
 		VALUES ('BB', 'chanmsg00000002', '2026-01-15T10:01:00Z', 1, 5,
-		'{"type":"CHAN","channel":"#general","text":"User2: World","sender":"User2"}')`)
+		'{"type":"CHAN","channel":"#general","text":"User2: World","sender":"User2"}', '#general')`)
 
 	// Observations: first msg seen by two observers (dedup), second by one
 	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
@@ -1249,9 +1253,9 @@ func TestGetChannelMessagesNoSender(t *testing.T) {
 	defer db.Close()
 
 	db.conn.Exec(`INSERT INTO observers (id, name, iata) VALUES ('obs1', 'Observer One', 'SJC')`)
-	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json, channel_hash)
 		VALUES ('CC', 'chanmsg00000003', '2026-01-15T10:02:00Z', 1, 5,
-		'{"type":"CHAN","channel":"#noname","text":"plain text no colon"}')`)
+		'{"type":"CHAN","channel":"#noname","text":"plain text no colon"}', '#noname')`)
 	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
 		VALUES (1, 1, 12.0, -90, null, 1736935300)`)
 
@@ -1354,9 +1358,9 @@ func TestGetChannelMessagesObserverFallback(t *testing.T) {
 	defer db.Close()
 
 	// Observer with ID but no name entry (observer_idx won't match)
-	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json, channel_hash)
 		VALUES ('AA', 'chanmsg00000004', '2026-01-15T10:00:00Z', 1, 5,
-		'{"type":"CHAN","channel":"#obs","text":"Sender: Test","sender":"Sender"}')`)
+		'{"type":"CHAN","channel":"#obs","text":"Sender: Test","sender":"Sender"}', '#obs')`)
 	// Observation without observer (observer_idx = NULL)
 	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
 		VALUES (1, NULL, 12.0, -90, null, 1736935200)`)
@@ -1378,12 +1382,12 @@ func TestGetChannelsMultiple(t *testing.T) {
 	defer db.Close()
 
 	db.conn.Exec(`INSERT INTO observers (id, name, iata) VALUES ('obs1', 'Observer', 'SJC')`)
-	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json, channel_hash)
 		VALUES ('AA', 'chan1hash', '2026-01-15T10:00:00Z', 1, 5,
-		'{"type":"CHAN","channel":"#alpha","text":"Alice: Hello","sender":"Alice"}')`)
-	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
+		'{"type":"CHAN","channel":"#alpha","text":"Alice: Hello","sender":"Alice"}', '#alpha')`)
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json, channel_hash)
 		VALUES ('BB', 'chan2hash', '2026-01-15T10:01:00Z', 1, 5,
-		'{"type":"CHAN","channel":"#beta","text":"Bob: World","sender":"Bob"}')`)
+		'{"type":"CHAN","channel":"#beta","text":"Bob: World","sender":"Bob"}', '#beta')`)
 	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
 		VALUES ('CC', 'chan3hash', '2026-01-15T10:02:00Z', 1, 5,
 		'{"type":"CHAN","channel":"","text":"No channel"}')`)
@@ -1466,13 +1470,13 @@ func TestGetChannelsStaleMessage(t *testing.T) {
 	db.conn.Exec(`INSERT INTO observers (id, name, iata) VALUES ('obs2', 'Observer2', 'SFO')`)
 
 	// Older message (first_seen T1)
-	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json, channel_hash)
 		VALUES ('AA', 'oldhash1', '2026-01-15T10:00:00Z', 1, 5,
-		'{"type":"CHAN","channel":"#test","text":"Alice: Old message","sender":"Alice"}')`)
+		'{"type":"CHAN","channel":"#test","text":"Alice: Old message","sender":"Alice"}', '#test')`)
 	// Newer message (first_seen T2 > T1)
-	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json, channel_hash)
 		VALUES ('BB', 'newhash2', '2026-01-15T10:05:00Z', 1, 5,
-		'{"type":"CHAN","channel":"#test","text":"Bob: New message","sender":"Bob"}')`)
+		'{"type":"CHAN","channel":"#test","text":"Bob: New message","sender":"Bob"}', '#test')`)
 
 	// Observations: older message re-observed AFTER newer message (stale scenario)
 	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, timestamp)
@@ -1502,6 +1506,61 @@ func TestGetChannelsStaleMessage(t *testing.T) {
 	}
 }
 
+func TestGetChannelsRegionFiltering(t *testing.T) {
+	db := setupTestDB(t)
+	defer db.Close()
+
+	db.conn.Exec(`INSERT INTO observers (id, name, iata) VALUES ('obs1', 'Observer1', 'SJC')`)
+	db.conn.Exec(`INSERT INTO observers (id, name, iata) VALUES ('obs2', 'Observer2', 'SFO')`)
+
+	// Channel message seen only in SJC
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json, channel_hash)
+		VALUES ('AA', 'hash1', '2026-01-15T10:00:00Z', 1, 5,
+		'{"type":"CHAN","channel":"#sjc-only","text":"Alice: Hello SJC","sender":"Alice"}', '#sjc-only')`)
+	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, timestamp)
+		VALUES (1, 1, 12.0, -90, 1736935200)`)
+
+	// Channel message seen only in SFO
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json, channel_hash)
+		VALUES ('BB', 'hash2', '2026-01-15T10:05:00Z', 1, 5,
+		'{"type":"CHAN","channel":"#sfo-only","text":"Bob: Hello SFO","sender":"Bob"}', '#sfo-only')`)
+	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, timestamp)
+		VALUES (2, 2, 14.0, -88, 1736935500)`)
+
+	// No region filter — both channels
+	all, err := db.GetChannels()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(all) != 2 {
+		t.Fatalf("expected 2 channels without region filter, got %d", len(all))
+	}
+
+	// Filter SJC — only #sjc-only
+	sjc, err := db.GetChannels("SJC")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(sjc) != 1 {
+		t.Fatalf("expected 1 channel for SJC, got %d", len(sjc))
+	}
+	if sjc[0]["name"] != "#sjc-only" {
+		t.Errorf("expected channel '#sjc-only', got %q", sjc[0]["name"])
+	}
+
+	// Filter SFO — only #sfo-only
+	sfo, err := db.GetChannels("SFO")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(sfo) != 1 {
+		t.Fatalf("expected 1 channel for SFO, got %d", len(sfo))
+	}
+	if sfo[0]["name"] != "#sfo-only" {
+		t.Errorf("expected channel '#sfo-only', got %q", sfo[0]["name"])
+	}
+}
+
 func TestNodeTelemetryFields(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()

cmd/server/decoder.go

@@ -9,6 +9,8 @@ import (
 	"math"
 	"strings"
 	"time"
+
+	"github.com/meshcore-analyzer/sigvalidate"
 )
 
 // Route type constants (header bits 1-0)
@@ -60,9 +62,10 @@ type TransportCodes struct {
 
 // Path holds decoded path/hop information.
 type Path struct {
-	HashSize  int      `json:"hashSize"`
-	HashCount int      `json:"hashCount"`
-	Hops      []string `json:"hops"`
+	HashSize      int      `json:"hashSize"`
+	HashCount     int      `json:"hashCount"`
+	Hops          []string `json:"hops"`
+	HopsCompleted *int     `json:"hopsCompleted,omitempty"`
 }
 
 // AdvertFlags holds decoded advert flag bits.
@@ -91,6 +94,7 @@ type Payload struct {
 	Timestamp       uint32       `json:"timestamp,omitempty"`
 	TimestampISO    string       `json:"timestampISO,omitempty"`
 	Signature       string       `json:"signature,omitempty"`
+	SignatureValid  *bool        `json:"signatureValid,omitempty"`
 	Flags           *AdvertFlags `json:"flags,omitempty"`
 	Lat             *float64     `json:"lat,omitempty"`
 	Lon             *float64     `json:"lon,omitempty"`
@@ -112,6 +116,7 @@ type DecodedPacket struct {
 	Path           Path            `json:"path"`
 	Payload        Payload         `json:"payload"`
 	Raw            string          `json:"raw"`
+	Anomaly        string          `json:"anomaly,omitempty"`
 }
 
 func decodeHeader(b byte) Header {
@@ -187,7 +192,7 @@ func decodeAck(buf []byte) Payload {
 	}
 }
 
-func decodeAdvert(buf []byte) Payload {
+func decodeAdvert(buf []byte, validateSignatures bool) Payload {
 	if len(buf) < 100 {
 		return Payload{Type: "ADVERT", Error: "too short for advert", RawHex: hex.EncodeToString(buf)}
 	}
@@ -205,6 +210,16 @@ func decodeAdvert(buf []byte) Payload {
 		Signature:    signature,
 	}
 
+	if validateSignatures {
+		valid, err := sigvalidate.ValidateAdvert(buf[0:32], buf[36:100], timestamp, appdata)
+		if err != nil {
+			f := false
+			p.SignatureValid = &f
+		} else {
+			p.SignatureValid = &valid
+		}
+	}
+
 	if len(appdata) > 0 {
 		flags := appdata[0]
 		advType := int(flags & 0x0F)
@@ -307,7 +322,7 @@ func decodeTrace(buf []byte) Payload {
 	return p
 }
 
-func decodePayload(payloadType int, buf []byte) Payload {
+func decodePayload(payloadType int, buf []byte, validateSignatures bool) Payload {
 	switch payloadType {
 	case PayloadREQ:
 		return decodeEncryptedPayload("REQ", buf)
@@ -318,7 +333,7 @@ func decodePayload(payloadType int, buf []byte) Payload {
 	case PayloadACK:
 		return decodeAck(buf)
 	case PayloadADVERT:
-		return decodeAdvert(buf)
+		return decodeAdvert(buf, validateSignatures)
 	case PayloadGRP_TXT:
 		return decodeGrpTxt(buf)
 	case PayloadANON_REQ:
@@ -333,7 +348,7 @@ func decodePayload(payloadType int, buf []byte) Payload {
 }
 
 // DecodePacket decodes a hex-encoded MeshCore packet.
-func DecodePacket(hexString string) (*DecodedPacket, error) {
+func DecodePacket(hexString string, validateSignatures bool) (*DecodedPacket, error) {
 	hexString = strings.ReplaceAll(hexString, " ", "")
 	hexString = strings.ReplaceAll(hexString, "\n", "")
 	hexString = strings.ReplaceAll(hexString, "\r", "")
@@ -371,29 +386,58 @@ func DecodePacket(hexString string) (*DecodedPacket, error) {
 	offset += bytesConsumed
 
 	payloadBuf := buf[offset:]
-	payload := decodePayload(header.PayloadType, payloadBuf)
+	payload := decodePayload(header.PayloadType, payloadBuf, validateSignatures)
 
 	// TRACE packets store hop IDs in the payload (buf[9:]) rather than the header
-	// path field. The header path byte still encodes hashSize in bits 6-7, which
-	// we use to split the payload path data into individual hop prefixes.
+	// path field. Firmware always sends TRACE as DIRECT (route_type 2 or 3);
+	// FLOOD-routed TRACEs are anomalous but handled gracefully (parsed, but
+	// flagged). The TRACE flags byte (payload offset 8) encodes path_sz in
+	// bits 0-1 as a power-of-two exponent: hash_bytes = 1 << path_sz.
+	// NOT the header path byte's hash_size bits. The header path contains SNR
+	// bytes — one per hop that actually forwarded.
+	// We expose hopsCompleted (count of SNR bytes) so consumers can distinguish
+	// how far the trace got vs the full intended route.
+	var anomaly string
 	if header.PayloadType == PayloadTRACE && payload.PathData != "" {
+		// Flag anomalous routing — firmware only sends TRACE as DIRECT
+		if header.RouteType != RouteDirect && header.RouteType != RouteTransportDirect {
+			anomaly = "TRACE packet with non-DIRECT routing (expected DIRECT or TRANSPORT_DIRECT)"
+		}
+		// The header path hops count represents SNR entries = completed hops
+		hopsCompleted := path.HashCount
 		pathBytes, err := hex.DecodeString(payload.PathData)
-		if err == nil && path.HashSize > 0 {
-			hops := make([]string, 0, len(pathBytes)/path.HashSize)
-			for i := 0; i+path.HashSize <= len(pathBytes); i += path.HashSize {
-				hops = append(hops, strings.ToUpper(hex.EncodeToString(pathBytes[i:i+path.HashSize])))
+		if err == nil && payload.TraceFlags != nil {
+			// path_sz from flags byte is a power-of-two exponent per firmware:
+			// hash_bytes = 1 << (flags & 0x03)
+			pathSz := 1 << (*payload.TraceFlags & 0x03)
+			hops := make([]string, 0, len(pathBytes)/pathSz)
+			for i := 0; i+pathSz <= len(pathBytes); i += pathSz {
+				hops = append(hops, strings.ToUpper(hex.EncodeToString(pathBytes[i:i+pathSz])))
 			}
 			path.Hops = hops
 			path.HashCount = len(hops)
+			path.HashSize = pathSz
+			path.HopsCompleted = &hopsCompleted
 		}
 	}
 
+	// Zero-hop direct packets have hash_count=0 (lower 6 bits of pathByte),
+	// which makes the generic formula yield a bogus hashSize. Reset to 0
+	// (unknown) so API consumers get correct data. We mask with 0x3F to check
+	// only hash_count, matching the JS frontend approach — the upper hash_size
+	// bits are meaningless when there are no hops. Skip TRACE packets — they
+	// use hashSize to parse hops from the payload above.
+	if (header.RouteType == RouteDirect || header.RouteType == RouteTransportDirect) && pathByte&0x3F == 0 && header.PayloadType != PayloadTRACE {
+		path.HashSize = 0
+	}
+
 	return &DecodedPacket{
 		Header:         header,
 		TransportCodes: tc,
 		Path:           path,
 		Payload:        payload,
 		Raw:            strings.ToUpper(hexString),
+		Anomaly:        anomaly,
 	}, nil
 }
 

cmd/server/decoder_test.go

@@ -1,6 +1,9 @@
 package main
 
 import (
+	"crypto/ed25519"
+	"encoding/binary"
+	"encoding/hex"
 	"testing"
 )
 
@@ -65,7 +68,7 @@ func TestDecodePacket_TransportFloodHasCodes(t *testing.T) {
 	// Path byte: 0x00 (hashSize=1, hashCount=0)
 	// Payload: at least some bytes for GRP_TXT
 	hex := "14AABBCCDD00112233445566778899"
-	pkt, err := DecodePacket(hex)
+	pkt, err := DecodePacket(hex, false)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -85,7 +88,7 @@ func TestDecodePacket_FloodHasNoCodes(t *testing.T) {
 	// Path byte: 0x00 (no hops)
 	// Some payload bytes
 	hex := "110011223344556677889900AABBCCDD"
-	pkt, err := DecodePacket(hex)
+	pkt, err := DecodePacket(hex, false)
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -235,6 +238,87 @@ func assertRange(t *testing.T, ranges []HexRange, label string, wantStart, wantE
 	t.Errorf("range %q not found in %v", label, rangeLabels(ranges))
 }
 
+func TestZeroHopDirectHashSize(t *testing.T) {
+	// DIRECT (RouteType=2) + REQ (PayloadType=0) → header byte = 0x02
+	// pathByte=0x00 → hash_count=0, hash_size bits=0 → should get HashSize=0
+	// Need at least a few payload bytes after pathByte.
+	hex := "02" + "00" + repeatHex("AA", 20)
+	pkt, err := DecodePacket(hex, false)
+	if err != nil {
+		t.Fatalf("DecodePacket failed: %v", err)
+	}
+	if pkt.Path.HashSize != 0 {
+		t.Errorf("DIRECT zero-hop: want HashSize=0, got %d", pkt.Path.HashSize)
+	}
+}
+
+func TestZeroHopDirectHashSizeWithNonZeroUpperBits(t *testing.T) {
+	// DIRECT (RouteType=2) + REQ (PayloadType=0) → header byte = 0x02
+	// pathByte=0x40 → hash_count=0, hash_size bits=01 → should still get HashSize=0
+	// because hash_count is zero (lower 6 bits are 0).
+	hex := "02" + "40" + repeatHex("AA", 20)
+	pkt, err := DecodePacket(hex, false)
+	if err != nil {
+		t.Fatalf("DecodePacket failed: %v", err)
+	}
+	if pkt.Path.HashSize != 0 {
+		t.Errorf("DIRECT zero-hop with hash_size bits set: want HashSize=0, got %d", pkt.Path.HashSize)
+	}
+}
+
+func TestZeroHopTransportDirectHashSize(t *testing.T) {
+	// TRANSPORT_DIRECT (RouteType=3) + REQ (PayloadType=0) → header byte = 0x03
+	// 4 bytes transport codes + pathByte=0x00 → hash_count=0 → should get HashSize=0
+	hex := "03" + "11223344" + "00" + repeatHex("AA", 20)
+	pkt, err := DecodePacket(hex, false)
+	if err != nil {
+		t.Fatalf("DecodePacket failed: %v", err)
+	}
+	if pkt.Path.HashSize != 0 {
+		t.Errorf("TRANSPORT_DIRECT zero-hop: want HashSize=0, got %d", pkt.Path.HashSize)
+	}
+}
+
+func TestZeroHopTransportDirectHashSizeWithNonZeroUpperBits(t *testing.T) {
+	// TRANSPORT_DIRECT (RouteType=3) + REQ (PayloadType=0) → header byte = 0x03
+	// 4 bytes transport codes + pathByte=0xC0 → hash_count=0, hash_size bits=11 → should still get HashSize=0
+	hex := "03" + "11223344" + "C0" + repeatHex("AA", 20)
+	pkt, err := DecodePacket(hex, false)
+	if err != nil {
+		t.Fatalf("DecodePacket failed: %v", err)
+	}
+	if pkt.Path.HashSize != 0 {
+		t.Errorf("TRANSPORT_DIRECT zero-hop with hash_size bits set: want HashSize=0, got %d", pkt.Path.HashSize)
+	}
+}
+
+func TestNonDirectZeroPathByteKeepsHashSize(t *testing.T) {
+	// FLOOD (RouteType=1) + REQ (PayloadType=0) → header byte = 0x01
+	// pathByte=0x00 → even though hash_count=0, non-DIRECT should keep HashSize=1
+	hex := "01" + "00" + repeatHex("AA", 20)
+	pkt, err := DecodePacket(hex, false)
+	if err != nil {
+		t.Fatalf("DecodePacket failed: %v", err)
+	}
+	if pkt.Path.HashSize != 1 {
+		t.Errorf("FLOOD zero pathByte: want HashSize=1 (unchanged), got %d", pkt.Path.HashSize)
+	}
+}
+
+func TestDirectNonZeroHopKeepsHashSize(t *testing.T) {
+	// DIRECT (RouteType=2) + REQ (PayloadType=0) → header byte = 0x02
+	// pathByte=0x01 → hash_count=1, hash_size=1 → should keep HashSize=1
+	// Need 1 hop hash byte after pathByte.
+	hex := "02" + "01" + repeatHex("BB", 21)
+	pkt, err := DecodePacket(hex, false)
+	if err != nil {
+		t.Fatalf("DecodePacket failed: %v", err)
+	}
+	if pkt.Path.HashSize != 1 {
+		t.Errorf("DIRECT with 1 hop: want HashSize=1, got %d", pkt.Path.HashSize)
+	}
+}
+
 func repeatHex(byteHex string, n int) string {
 	s := ""
 	for i := 0; i < n; i++ {
@@ -242,3 +326,257 @@ func repeatHex(byteHex string, n int) string {
 	}
 	return s
 }
+
+func TestDecodePacket_TraceHopsCompleted(t *testing.T) {
+	// Build a TRACE packet:
+	// header: route=FLOOD(1), payload=TRACE(9), version=0 → (0<<6)|(9<<2)|1 = 0x25
+	// path_length: hash_size bits=0b00 (1-byte), hash_count=2 (2 SNR bytes) → 0x02
+	// path: 2 SNR bytes: 0xAA, 0xBB
+	// payload: tag(4 LE) + authCode(4 LE) + flags(1) + 4 hop hashes (1 byte each)
+	hex := "2502AABB" + // header + path_length + 2 SNR bytes
+		"01000000" + // tag = 1
+		"02000000" + // authCode = 2
+		"00" + // flags = 0
+		"DEADBEEF" // 4 hops (1-byte hash each)
+
+	pkt, err := DecodePacket(hex, false)
+	if err != nil {
+		t.Fatalf("DecodePacket error: %v", err)
+	}
+	if pkt.Payload.Type != "TRACE" {
+		t.Fatalf("expected TRACE, got %s", pkt.Payload.Type)
+	}
+	// Full intended route = 4 hops from payload
+	if len(pkt.Path.Hops) != 4 {
+		t.Errorf("expected 4 hops, got %d: %v", len(pkt.Path.Hops), pkt.Path.Hops)
+	}
+	// HopsCompleted = 2 (from header path SNR count)
+	if pkt.Path.HopsCompleted == nil {
+		t.Fatal("expected HopsCompleted to be set")
+	}
+	if *pkt.Path.HopsCompleted != 2 {
+		t.Errorf("expected HopsCompleted=2, got %d", *pkt.Path.HopsCompleted)
+	}
+	// FLOOD routing for TRACE is anomalous
+	if pkt.Anomaly == "" {
+		t.Error("expected anomaly flag for FLOOD-routed TRACE")
+	}
+}
+
+func TestDecodePacket_TraceNoSNR(t *testing.T) {
+	// TRACE with 0 SNR bytes (trace hasn't been forwarded yet)
+	// path_length: hash_size=0b00 (1-byte), hash_count=0 → 0x00
+	hex := "2500" + // header + path_length (0 hops in header)
+		"01000000" + // tag
+		"02000000" + // authCode
+		"00" + // flags
+		"AABBCC" // 3 hops intended
+
+	pkt, err := DecodePacket(hex, false)
+	if err != nil {
+		t.Fatalf("DecodePacket error: %v", err)
+	}
+	if pkt.Path.HopsCompleted == nil {
+		t.Fatal("expected HopsCompleted to be set")
+	}
+	if *pkt.Path.HopsCompleted != 0 {
+		t.Errorf("expected HopsCompleted=0, got %d", *pkt.Path.HopsCompleted)
+	}
+	if len(pkt.Path.Hops) != 3 {
+		t.Errorf("expected 3 hops, got %d", len(pkt.Path.Hops))
+	}
+}
+
+func TestDecodePacket_TraceFullyCompleted(t *testing.T) {
+	// TRACE where all hops completed (SNR count = hop count)
+	// path_length: hash_size=0b00 (1-byte), hash_count=3 → 0x03
+	hex := "2503AABBCC" + // header + path_length + 3 SNR bytes
+		"01000000" + // tag
+		"02000000" + // authCode
+		"00" + // flags
+		"DDEEFF" // 3 hops intended
+
+	pkt, err := DecodePacket(hex, false)
+	if err != nil {
+		t.Fatalf("DecodePacket error: %v", err)
+	}
+	if pkt.Path.HopsCompleted == nil {
+		t.Fatal("expected HopsCompleted to be set")
+	}
+	if *pkt.Path.HopsCompleted != 3 {
+		t.Errorf("expected HopsCompleted=3, got %d", *pkt.Path.HopsCompleted)
+	}
+	if len(pkt.Path.Hops) != 3 {
+		t.Errorf("expected 3 hops, got %d", len(pkt.Path.Hops))
+	}
+}
+
+func TestDecodePacket_TraceFlags1_TwoBytePathSz(t *testing.T) {
+	// TRACE with flags=1 → path_sz = 1 << (1 & 0x03) = 2-byte hashes
+	// Firmware always sends TRACE as DIRECT (route_type=2), so header byte =
+	// (0<<6)|(9<<2)|2 = 0x26. path_length 0x00 = 0 SNR bytes.
+	hex := "2600" + // header (DIRECT+TRACE) + path_length (0 SNR)
+		"01000000" + // tag
+		"02000000" + // authCode
+		"01" + // flags = 1 → path_sz = 2
+		"AABBCCDD" // 4 bytes = 2 hops of 2-byte each
+
+	pkt, err := DecodePacket(hex, false)
+	if err != nil {
+		t.Fatalf("DecodePacket error: %v", err)
+	}
+	if len(pkt.Path.Hops) != 2 {
+		t.Errorf("expected 2 hops (2-byte path_sz), got %d: %v", len(pkt.Path.Hops), pkt.Path.Hops)
+	}
+	if pkt.Path.HashSize != 2 {
+		t.Errorf("expected HashSize=2, got %d", pkt.Path.HashSize)
+	}
+	if pkt.Anomaly != "" {
+		t.Errorf("expected no anomaly for DIRECT TRACE, got %q", pkt.Anomaly)
+	}
+}
+
+func TestDecodePacket_TraceFlags2_FourBytePathSz(t *testing.T) {
+	// TRACE with flags=2 → path_sz = 1 << (2 & 0x03) = 4-byte hashes
+	// DIRECT route_type (0x26)
+	hex := "2600" + // header (DIRECT+TRACE) + path_length (0 SNR)
+		"01000000" + // tag
+		"02000000" + // authCode
+		"02" + // flags = 2 → path_sz = 4
+		"AABBCCDD11223344" // 8 bytes = 2 hops of 4-byte each
+
+	pkt, err := DecodePacket(hex, false)
+	if err != nil {
+		t.Fatalf("DecodePacket error: %v", err)
+	}
+	if len(pkt.Path.Hops) != 2 {
+		t.Errorf("expected 2 hops (4-byte path_sz), got %d: %v", len(pkt.Path.Hops), pkt.Path.Hops)
+	}
+	if pkt.Path.HashSize != 4 {
+		t.Errorf("expected HashSize=4, got %d", pkt.Path.HashSize)
+	}
+}
+
+func TestDecodePacket_TracePathSzUnevenPayload(t *testing.T) {
+	// TRACE with flags=1 → path_sz=2, but 5 bytes of path data (not evenly divisible)
+	// Should produce 2 hops (4 bytes) and ignore the trailing byte
+	hex := "2600" + // header (DIRECT+TRACE) + path_length (0 SNR)
+		"01000000" + // tag
+		"02000000" + // authCode
+		"01" + // flags = 1 → path_sz = 2
+		"AABBCCDDEE" // 5 bytes → 2 hops, 1 byte remainder ignored
+
+	pkt, err := DecodePacket(hex, false)
+	if err != nil {
+		t.Fatalf("DecodePacket error: %v", err)
+	}
+	if len(pkt.Path.Hops) != 2 {
+		t.Errorf("expected 2 hops (trailing byte ignored), got %d: %v", len(pkt.Path.Hops), pkt.Path.Hops)
+	}
+}
+
+func TestDecodePacket_TraceTransportDirect(t *testing.T) {
+	// TRACE via TRANSPORT_DIRECT (route_type=3) — includes 4 transport code bytes
+	// header: (0<<6)|(9<<2)|3 = 0x27
+	hex := "27" + // header (TRANSPORT_DIRECT+TRACE)
+		"AABB" + "CCDD" + // transport codes (2+2 bytes)
+		"02" + // path_length: hash_count=2 SNR bytes
+		"EEFF" + // 2 SNR bytes
+		"01000000" + // tag
+		"02000000" + // authCode
+		"00" + // flags = 0 → path_sz = 1
+		"112233" // 3 hops (1-byte each)
+
+	pkt, err := DecodePacket(hex, false)
+	if err != nil {
+		t.Fatalf("DecodePacket error: %v", err)
+	}
+	if pkt.TransportCodes == nil {
+		t.Fatal("expected transport codes for TRANSPORT_DIRECT")
+	}
+	if pkt.TransportCodes.Code1 != "AABB" {
+		t.Errorf("expected Code1=AABB, got %s", pkt.TransportCodes.Code1)
+	}
+	if len(pkt.Path.Hops) != 3 {
+		t.Errorf("expected 3 hops, got %d: %v", len(pkt.Path.Hops), pkt.Path.Hops)
+	}
+	if pkt.Path.HopsCompleted == nil || *pkt.Path.HopsCompleted != 2 {
+		t.Errorf("expected HopsCompleted=2, got %v", pkt.Path.HopsCompleted)
+	}
+	if pkt.Anomaly != "" {
+		t.Errorf("expected no anomaly for TRANSPORT_DIRECT TRACE, got %q", pkt.Anomaly)
+	}
+}
+
+func TestDecodePacket_TraceFloodRouteAnomaly(t *testing.T) {
+	// TRACE via FLOOD (route_type=1) — anomalous per firmware (firmware only
+	// sends TRACE as DIRECT). Should still parse but flag the anomaly.
+	hex := "2500" + // header (FLOOD+TRACE) + path_length (0 SNR)
+		"01000000" + // tag
+		"02000000" + // authCode
+		"01" + // flags = 1 → path_sz = 2
+		"AABBCCDD" // 4 bytes = 2 hops of 2-byte each
+
+	pkt, err := DecodePacket(hex, false)
+	if err != nil {
+		t.Fatalf("should not crash on anomalous FLOOD+TRACE: %v", err)
+	}
+	if len(pkt.Path.Hops) != 2 {
+		t.Errorf("expected 2 hops even for anomalous FLOOD route, got %d", len(pkt.Path.Hops))
+	}
+	if pkt.Anomaly == "" {
+		t.Error("expected anomaly flag for FLOOD-routed TRACE, got empty string")
+	}
+}
+
+func TestDecodeAdvertSignatureValidation(t *testing.T) {
+	pub, priv, err := ed25519.GenerateKey(nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var timestamp uint32 = 1234567890
+	appdata := []byte{0x02} // flags: repeater, no extras
+
+	// Build signed message: pubKey(32) + timestamp(4 LE) + appdata
+	msg := make([]byte, 32+4+len(appdata))
+	copy(msg[0:32], pub)
+	binary.LittleEndian.PutUint32(msg[32:36], timestamp)
+	copy(msg[36:], appdata)
+	sig := ed25519.Sign(priv, msg)
+
+	// Build a raw advert buffer: pubKey(32) + timestamp(4) + signature(64) + appdata
+	buf := make([]byte, 100+len(appdata))
+	copy(buf[0:32], pub)
+	binary.LittleEndian.PutUint32(buf[32:36], timestamp)
+	copy(buf[36:100], sig)
+	copy(buf[100:], appdata)
+
+	// With validation enabled
+	p := decodeAdvert(buf, true)
+	if p.SignatureValid == nil {
+		t.Fatal("expected SignatureValid to be set")
+	}
+	if !*p.SignatureValid {
+		t.Error("expected valid signature")
+	}
+	if p.PubKey != hex.EncodeToString(pub) {
+		t.Errorf("pubkey mismatch: got %s", p.PubKey)
+	}
+
+	// Tamper with signature → invalid
+	buf[40] ^= 0xFF
+	p = decodeAdvert(buf, true)
+	if p.SignatureValid == nil {
+		t.Fatal("expected SignatureValid to be set")
+	}
+	if *p.SignatureValid {
+		t.Error("expected invalid signature after tampering")
+	}
+
+	// Without validation → SignatureValid should be nil
+	p = decodeAdvert(buf, false)
+	if p.SignatureValid != nil {
+		t.Error("expected SignatureValid to be nil when validation disabled")
+	}
+}

cmd/server/encrypted_channels_test.go

@@ -0,0 +1,145 @@
+package main
+
+import (
+	"encoding/json"
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+// seedEncryptedChannelData adds undecryptable GRP_TXT packets to the test DB.
+func seedEncryptedChannelData(t *testing.T, db *DB) {
+	t.Helper()
+	now := time.Now().UTC()
+	recent := now.Add(-1 * time.Hour).Format(time.RFC3339)
+	recentEpoch := now.Add(-1 * time.Hour).Unix()
+
+	// Two encrypted GRP_TXT packets on channel hash "A1B2"
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json, channel_hash)
+		VALUES ('EE01', 'enc_hash_001', ?, 1, 5, '{"type":"GRP_TXT","channelHashHex":"A1B2","decryptionStatus":"no_key"}', 'enc_A1B2')`, recent)
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json, channel_hash)
+		VALUES ('EE02', 'enc_hash_002', ?, 1, 5, '{"type":"GRP_TXT","channelHashHex":"A1B2","decryptionStatus":"no_key"}', 'enc_A1B2')`, recent)
+
+	// Observations for both
+	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
+		VALUES ((SELECT id FROM transmissions WHERE hash='enc_hash_001'), 1, 10.0, -90, '[]', ?)`, recentEpoch)
+	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
+		VALUES ((SELECT id FROM transmissions WHERE hash='enc_hash_002'), 1, 10.0, -90, '[]', ?)`, recentEpoch)
+}
+
+func TestGetEncryptedChannels(t *testing.T) {
+	db := setupTestDB(t)
+	defer db.Close()
+	seedTestData(t, db)
+	seedEncryptedChannelData(t, db)
+
+	channels, err := db.GetEncryptedChannels()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(channels) != 1 {
+		t.Fatalf("expected 1 encrypted channel, got %d", len(channels))
+	}
+	ch := channels[0]
+	if ch["hash"] != "enc_A1B2" {
+		t.Errorf("expected hash enc_A1B2, got %v", ch["hash"])
+	}
+	if ch["encrypted"] != true {
+		t.Errorf("expected encrypted=true, got %v", ch["encrypted"])
+	}
+	if ch["messageCount"] != 2 {
+		t.Errorf("expected messageCount=2, got %v", ch["messageCount"])
+	}
+}
+
+func TestChannelsAPIExcludesEncrypted(t *testing.T) {
+	_, router := setupTestServer(t)
+	// Seed encrypted data into the server's DB
+	// setupTestServer uses seedTestData which has no encrypted packets,
+	// so default /api/channels should NOT include encrypted channels.
+	req := httptest.NewRequest("GET", "/api/channels", nil)
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+
+	if w.Code != 200 {
+		t.Fatalf("expected 200, got %d", w.Code)
+	}
+	var body map[string]interface{}
+	json.Unmarshal(w.Body.Bytes(), &body)
+	channels := body["channels"].([]interface{})
+
+	for _, ch := range channels {
+		m := ch.(map[string]interface{})
+		if enc, ok := m["encrypted"]; ok && enc == true {
+			t.Errorf("default /api/channels should not include encrypted channels, found: %v", m["hash"])
+		}
+	}
+}
+
+func TestChannelsAPIIncludesEncryptedWithParam(t *testing.T) {
+	srv, router := setupTestServer(t)
+	// Add encrypted data to the server's DB
+	seedEncryptedChannelData(t, srv.db)
+	// Reload store so in-memory also has the data
+	store := NewPacketStore(srv.db, nil)
+	if err := store.Load(); err != nil {
+		t.Fatalf("store.Load: %v", err)
+	}
+	srv.store = store
+
+	req := httptest.NewRequest("GET", "/api/channels?includeEncrypted=true", nil)
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+
+	if w.Code != 200 {
+		t.Fatalf("expected 200, got %d", w.Code)
+	}
+	var body map[string]interface{}
+	json.Unmarshal(w.Body.Bytes(), &body)
+	channels := body["channels"].([]interface{})
+
+	foundEncrypted := false
+	for _, ch := range channels {
+		m := ch.(map[string]interface{})
+		if enc, ok := m["encrypted"]; ok && enc == true {
+			foundEncrypted = true
+			break
+		}
+	}
+	if !foundEncrypted {
+		t.Error("expected encrypted channels with includeEncrypted=true, found none")
+	}
+}
+
+func TestChannelMessagesExcludesEncrypted(t *testing.T) {
+	srv, router := setupTestServer(t)
+	seedEncryptedChannelData(t, srv.db)
+	store := NewPacketStore(srv.db, nil)
+	if err := store.Load(); err != nil {
+		t.Fatalf("store.Load: %v", err)
+	}
+	srv.store = store
+
+	// Request messages for the encrypted channel — should return empty
+	req := httptest.NewRequest("GET", "/api/channels/enc_A1B2/messages", nil)
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+
+	if w.Code != 200 {
+		t.Fatalf("expected 200, got %d", w.Code)
+	}
+	var body map[string]interface{}
+	json.Unmarshal(w.Body.Bytes(), &body)
+	messages, ok := body["messages"].([]interface{})
+	if !ok {
+		// messages might be null/missing — that's fine, means no messages
+		return
+	}
+	// Encrypted messages should not be returned as readable messages
+	for _, msg := range messages {
+		m := msg.(map[string]interface{})
+		if text, ok := m["text"].(string); ok && text != "" {
+			t.Errorf("encrypted channel should not return readable messages, got text: %s", text)
+		}
+	}
+}

cmd/server/eviction_test.go

@@ -85,6 +85,12 @@ func makeTestStore(count int, startTime time.Time, intervalMin int) *PacketStore
 
 		// Subpath index
 		addTxToSubpathIndex(store.spIndex, tx)
+
+		// Track bytes for self-accounting
+		store.trackedBytes += estimateStoreTxBytes(tx)
+		for _, obs := range tx.Observations {
+			store.trackedBytes += estimateStoreObsBytes(obs)
+		}
 	}
 
 	return store
@@ -166,43 +172,43 @@ func TestEvictStale_MemoryBasedEviction(t *testing.T) {
 	// All packets are recent (1h old) so time-based won't trigger.
 	store.retentionHours = 24
 	store.maxMemoryMB = 3
-	// Inject deterministic estimator: simulates 6MB (over 3MB limit).
-	// Uses packet count so it scales correctly after eviction.
-	store.memoryEstimator = func() float64 {
-		return float64(len(store.packets)*5120+store.totalObs*500) / 1048576.0
-	}
+	// Set trackedBytes to simulate 6MB (over 3MB limit).
+	store.trackedBytes = 6 * 1048576
 
 	evicted := store.EvictStale()
 	if evicted == 0 {
 		t.Fatal("expected some evictions for memory cap")
 	}
-	estMB := store.estimatedMemoryMB()
-	if estMB > 3.5 {
-		t.Fatalf("expected <=3.5MB after eviction, got %.1fMB", estMB)
+	// 25% safety cap should limit to 250 per pass
+	if evicted > 250 {
+		t.Fatalf("25%% safety cap violated: evicted %d", evicted)
+	}
+	// trackedBytes should have decreased
+	if store.trackedBytes >= 6*1048576 {
+		t.Fatal("trackedBytes should have decreased after eviction")
 	}
 }
 
-// TestEvictStale_MemoryBasedEviction_UnderestimatedHeap verifies that eviction
-// fires correctly when actual heap is much larger than a formula-based estimate
-// would report — the scenario that caused OOM kills in production.
+// TestEvictStale_MemoryBasedEviction_UnderestimatedHeap verifies that the 25%
+// safety cap prevents cascading eviction even when trackedBytes is very high.
 func TestEvictStale_MemoryBasedEviction_UnderestimatedHeap(t *testing.T) {
 	now := time.Now().UTC()
 	store := makeTestStore(1000, now.Add(-1*time.Hour), 0)
 	store.retentionHours = 24
 	store.maxMemoryMB = 500
-	// Simulate actual heap 5x over budget (like production: ~5GB actual vs ~1GB limit).
-	store.memoryEstimator = func() float64 {
-		return 2500.0 // 2500MB actual vs 500MB limit
-	}
+	// Simulate trackedBytes 5x over budget.
+	store.trackedBytes = 2500 * 1048576
 
 	evicted := store.EvictStale()
 	if evicted == 0 {
-		t.Fatal("expected evictions when heap is 5x over limit")
+		t.Fatal("expected evictions when tracked is 5x over limit")
 	}
-	// Should keep roughly 500/2500 * 0.9 = 18% of packets → ~180 of 1000.
-	remaining := len(store.packets)
-	if remaining > 250 {
-		t.Fatalf("expected most packets evicted (heap 5x over), but %d of 1000 remain", remaining)
+	// Safety cap: max 25% per pass = 250
+	if evicted > 250 {
+		t.Fatalf("25%% safety cap violated: evicted %d of 1000", evicted)
+	}
+	if evicted != 250 {
+		t.Fatalf("expected exactly 250 evicted (25%% cap), got %d", evicted)
 	}
 }
 
@@ -239,6 +245,79 @@ func TestEvictStale_CleansNodeIndexes(t *testing.T) {
 	}
 }
 
+func TestEvictStale_CleansResolvedPathNodeIndexes(t *testing.T) {
+	now := time.Now().UTC()
+	store := &PacketStore{
+		packets:       make([]*StoreTx, 0),
+		byHash:        make(map[string]*StoreTx),
+		byTxID:        make(map[int]*StoreTx),
+		byObsID:       make(map[int]*StoreObs),
+		byObserver:    make(map[string][]*StoreObs),
+		byNode:        make(map[string][]*StoreTx),
+		nodeHashes:    make(map[string]map[string]bool),
+		byPayloadType: make(map[int][]*StoreTx),
+		spIndex:       make(map[string]int),
+		distHops:      make([]distHopRecord, 0),
+		distPaths:     make([]distPathRecord, 0),
+		rfCache:       make(map[string]*cachedResult),
+		topoCache:     make(map[string]*cachedResult),
+		hashCache:     make(map[string]*cachedResult),
+		chanCache:     make(map[string]*cachedResult),
+		distCache:     make(map[string]*cachedResult),
+		subpathCache:  make(map[string]*cachedResult),
+		rfCacheTTL:    15 * time.Second,
+		retentionHours: 24,
+	}
+
+	// Create a packet indexed only via resolved_path (no decoded JSON pubkeys)
+	relayPK := "relay0001abcdef"
+	tx := &StoreTx{
+		ID:        1,
+		Hash:      "hash_rp_001",
+		FirstSeen: now.Add(-48 * time.Hour).UTC().Format(time.RFC3339),
+	}
+	rpPtr := &relayPK
+	obs := &StoreObs{
+		ID:             100,
+		TransmissionID: 1,
+		ObserverID:     "obs0",
+		Timestamp:      tx.FirstSeen,
+		ResolvedPath:   []*string{rpPtr},
+	}
+	tx.Observations = append(tx.Observations, obs)
+	tx.ResolvedPath = []*string{rpPtr}
+
+	store.packets = append(store.packets, tx)
+	store.byHash[tx.Hash] = tx
+	store.byTxID[tx.ID] = tx
+	store.byObsID[obs.ID] = obs
+	store.byObserver["obs0"] = append(store.byObserver["obs0"], obs)
+
+	// Index via resolved_path
+	store.indexByNode(tx)
+
+	// Verify indexed
+	if len(store.byNode[relayPK]) != 1 {
+		t.Fatalf("expected 1 entry in byNode[%s], got %d", relayPK, len(store.byNode[relayPK]))
+	}
+	if !store.nodeHashes[relayPK][tx.Hash] {
+		t.Fatalf("expected nodeHashes[%s] to contain %s", relayPK, tx.Hash)
+	}
+
+	evicted := store.EvictStale()
+	if evicted != 1 {
+		t.Fatalf("expected 1 evicted, got %d", evicted)
+	}
+
+	// Verify resolved_path entries are cleaned up
+	if len(store.byNode[relayPK]) != 0 {
+		t.Fatalf("expected byNode[%s] to be empty after eviction, got %d", relayPK, len(store.byNode[relayPK]))
+	}
+	if _, exists := store.nodeHashes[relayPK]; exists {
+		t.Fatalf("expected nodeHashes[%s] to be deleted after eviction", relayPK)
+	}
+}
+
 func TestEvictStale_RunEvictionThreadSafe(t *testing.T) {
 	now := time.Now().UTC()
 	store := makeTestStore(20, now.Add(-48*time.Hour), 0)
@@ -276,3 +355,228 @@ func TestNewPacketStoreNilConfig(t *testing.T) {
 		t.Fatalf("expected retentionHours=0, got %f", store.retentionHours)
 	}
 }
+
+func TestCacheTTLFromConfig(t *testing.T) {
+	// With config values: analyticsHashSizes and analyticsRF should override defaults.
+	cacheTTL := map[string]interface{}{
+		"analyticsHashSizes": float64(7200),
+		"analyticsRF":        float64(300),
+	}
+	store := NewPacketStore(nil, nil, cacheTTL)
+	if store.collisionCacheTTL != 7200*time.Second {
+		t.Fatalf("expected collisionCacheTTL=7200s, got %v", store.collisionCacheTTL)
+	}
+	if store.rfCacheTTL != 300*time.Second {
+		t.Fatalf("expected rfCacheTTL=300s, got %v", store.rfCacheTTL)
+	}
+}
+
+func TestCacheTTLDefaults(t *testing.T) {
+	// Without config, defaults should apply.
+	store := NewPacketStore(nil, nil)
+	if store.collisionCacheTTL != 3600*time.Second {
+		t.Fatalf("expected default collisionCacheTTL=3600s, got %v", store.collisionCacheTTL)
+	}
+	if store.rfCacheTTL != 15*time.Second {
+		t.Fatalf("expected default rfCacheTTL=15s, got %v", store.rfCacheTTL)
+	}
+}
+
+// --- Self-accounting memory tracking tests ---
+
+func TestTrackedBytes_IncreasesOnInsert(t *testing.T) {
+	now := time.Now().UTC()
+	store := makeTestStore(0, now, 0)
+	if store.trackedBytes != 0 {
+		t.Fatalf("expected 0 trackedBytes for empty store, got %d", store.trackedBytes)
+	}
+
+	store2 := makeTestStore(10, now, 1)
+	if store2.trackedBytes <= 0 {
+		t.Fatal("expected positive trackedBytes after inserting 10 packets")
+	}
+	// Each packet has 2 observations; should be roughly 10*(384+5*48) + 20*(192+2*48) = 10*624 + 20*288 = 12000
+	expectedMin := int64(10*600 + 20*250) // rough lower bound
+	if store2.trackedBytes < expectedMin {
+		t.Fatalf("trackedBytes %d seems too low (expected > %d)", store2.trackedBytes, expectedMin)
+	}
+}
+
+func TestTrackedBytes_DecreasesOnEvict(t *testing.T) {
+	now := time.Now().UTC()
+	store := makeTestStore(100, now.Add(-48*time.Hour), 0)
+	store.retentionHours = 24
+
+	beforeBytes := store.trackedBytes
+	if beforeBytes <= 0 {
+		t.Fatal("expected positive trackedBytes before eviction")
+	}
+
+	evicted := store.EvictStale()
+	if evicted != 100 {
+		t.Fatalf("expected 100 evicted, got %d", evicted)
+	}
+	if store.trackedBytes != 0 {
+		t.Fatalf("expected 0 trackedBytes after evicting all, got %d", store.trackedBytes)
+	}
+}
+
+func TestTrackedBytes_MatchesExpectedAfterMixedInsertEvict(t *testing.T) {
+	now := time.Now().UTC()
+	// Create 100 packets, 50 old + 50 recent
+	store := makeTestStore(100, now.Add(-48*time.Hour), 0)
+	for i := 50; i < 100; i++ {
+		store.packets[i].FirstSeen = now.Add(-1 * time.Hour).Format(time.RFC3339)
+	}
+	store.retentionHours = 24
+
+	totalBefore := store.trackedBytes
+
+	// Calculate expected bytes for first 50 packets (to be evicted)
+	var evictedBytes int64
+	for i := 0; i < 50; i++ {
+		tx := store.packets[i]
+		evictedBytes += estimateStoreTxBytes(tx)
+		for _, obs := range tx.Observations {
+			evictedBytes += estimateStoreObsBytes(obs)
+		}
+	}
+
+	store.EvictStale()
+
+	expectedAfter := totalBefore - evictedBytes
+	if store.trackedBytes != expectedAfter {
+		t.Fatalf("trackedBytes %d != expected %d (before=%d, evicted=%d)",
+			store.trackedBytes, expectedAfter, totalBefore, evictedBytes)
+	}
+}
+
+func TestWatermarkHysteresis(t *testing.T) {
+	now := time.Now().UTC()
+	store := makeTestStore(1000, now.Add(-1*time.Hour), 0)
+	store.retentionHours = 0 // no time-based eviction
+	store.maxMemoryMB = 1    // 1MB budget
+
+	// Set trackedBytes to just above high watermark
+	highWatermark := int64(1 * 1048576)
+	lowWatermark := int64(float64(highWatermark) * 0.85)
+	store.trackedBytes = highWatermark + 1
+
+	evicted := store.EvictStale()
+	if evicted == 0 {
+		t.Fatal("expected eviction when above high watermark")
+	}
+	if store.trackedBytes > lowWatermark+1024 {
+		t.Fatalf("expected trackedBytes near low watermark after eviction, got %d (low=%d)",
+			store.trackedBytes, lowWatermark)
+	}
+
+	// Now set trackedBytes to just below high watermark — should NOT trigger
+	store.trackedBytes = highWatermark - 1
+	evicted2 := store.EvictStale()
+	if evicted2 != 0 {
+		t.Fatalf("expected no eviction below high watermark, got %d", evicted2)
+	}
+}
+
+func TestSafetyCap25Percent(t *testing.T) {
+	now := time.Now().UTC()
+	store := makeTestStore(1000, now.Add(-1*time.Hour), 0)
+	store.retentionHours = 0
+	store.maxMemoryMB = 1
+
+	// Set trackedBytes way over limit to force maximum eviction
+	store.trackedBytes = 100 * 1048576 // 100MB vs 1MB limit
+
+	evicted := store.EvictStale()
+	// 25% of 1000 = 250
+	if evicted > 250 {
+		t.Fatalf("25%% safety cap violated: evicted %d of 1000 (max should be 250)", evicted)
+	}
+	if evicted != 250 {
+		t.Fatalf("expected exactly 250 evicted (25%% cap), got %d", evicted)
+	}
+	if len(store.packets) != 750 {
+		t.Fatalf("expected 750 remaining, got %d", len(store.packets))
+	}
+}
+
+func TestMultiplePassesConverge(t *testing.T) {
+	now := time.Now().UTC()
+	store := makeTestStore(1000, now.Add(-1*time.Hour), 0)
+	store.retentionHours = 0
+	// Set budget to half the actual tracked bytes — requires ~2 passes
+	actualBytes := store.trackedBytes
+	store.maxMemoryMB = int(float64(actualBytes) / 1048576.0 / 2)
+	if store.maxMemoryMB < 1 {
+		store.maxMemoryMB = 1
+	}
+
+	totalEvicted := 0
+	for pass := 0; pass < 20; pass++ {
+		evicted := store.EvictStale()
+		if evicted == 0 {
+			break
+		}
+		totalEvicted += evicted
+	}
+
+	// After convergence, trackedBytes should be at or below high watermark
+	// (may be between low and high due to hysteresis — that's fine)
+	highWatermark := int64(store.maxMemoryMB) * 1048576
+	if store.trackedBytes > highWatermark {
+		t.Fatalf("did not converge: trackedBytes=%d (%.1fMB) > highWatermark=%d after multiple passes",
+			store.trackedBytes, float64(store.trackedBytes)/1048576.0, highWatermark)
+	}
+	if totalEvicted == 0 {
+		t.Fatal("expected some evictions across multiple passes")
+	}
+}
+
+func TestEstimateStoreTxBytes(t *testing.T) {
+	tx := &StoreTx{
+		RawHex:      "aabbcc",
+		Hash:        "hash1234",
+		DecodedJSON: `{"pubKey":"pk1"}`,
+		PathJSON:    `["aa","bb"]`,
+	}
+	est := estimateStoreTxBytes(tx)
+	// Manual calculation: base + string lengths + index entries + perTxMaps + path hops + subpaths
+	hops := int64(len(txGetParsedPath(tx)))
+	manualCalc := int64(storeTxBaseBytes) + int64(len(tx.RawHex)+len(tx.Hash)+len(tx.DecodedJSON)+len(tx.PathJSON)) + int64(numIndexesPerTx*indexEntryBytes)
+	manualCalc += perTxMapsBytes
+	manualCalc += hops * perPathHopBytes
+	if hops > 1 {
+		manualCalc += (hops * (hops - 1) / 2) * perSubpathEntryBytes
+	}
+	if est != manualCalc {
+		t.Fatalf("estimateStoreTxBytes = %d, want %d (manual calc)", est, manualCalc)
+	}
+	if est < 600 || est > 1200 {
+		t.Fatalf("estimateStoreTxBytes = %d, expected in range [600, 1200]", est)
+	}
+}
+
+func TestEstimateStoreObsBytes(t *testing.T) {
+	obs := &StoreObs{
+		ObserverID: "obs123",
+		PathJSON:   `["aa"]`,
+	}
+	est := estimateStoreObsBytes(obs)
+	// storeObsBaseBytes(192) + len(ObserverID=6) + len(PathJSON=6) + 2*48(96) = 300
+	expected := int64(192 + 6 + 6 + 2*48)
+	if est != expected {
+		t.Fatalf("estimateStoreObsBytes = %d, want %d", est, expected)
+	}
+}
+
+func BenchmarkEviction100K(b *testing.B) {
+	now := time.Now().UTC()
+	for i := 0; i < b.N; i++ {
+		b.StopTimer()
+		store := makeTestStore(100000, now.Add(-48*time.Hour), 0)
+		store.retentionHours = 24
+		b.StartTimer()
+		store.EvictStale()
+	}
+}

cmd/server/go.mod

@@ -6,11 +6,14 @@ require (
 	github.com/gorilla/mux v1.8.1
 	github.com/gorilla/websocket v1.5.3
 	github.com/meshcore-analyzer/geofilter v0.0.0
+	github.com/meshcore-analyzer/sigvalidate v0.0.0
 	modernc.org/sqlite v1.34.5
 )
 
 replace github.com/meshcore-analyzer/geofilter => ../../internal/geofilter
 
+replace github.com/meshcore-analyzer/sigvalidate => ../../internal/sigvalidate
+
 require (
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/google/uuid v1.6.0 // indirect

cmd/server/main.go

@@ -104,6 +104,8 @@ func main() {
 	}
 	if cfg.APIKey == "" {
 		log.Printf("[security] WARNING: no apiKey configured — write endpoints are BLOCKED (set apiKey in config.json to enable them)")
+	} else if IsWeakAPIKey(cfg.APIKey) {
+		log.Printf("[security] WARNING: API key is weak or a known default — write endpoints are vulnerable")
 	}
 
 	// Resolve DB path
@@ -139,7 +141,7 @@ func main() {
 	}
 
 	// In-memory packet store
-	store := NewPacketStore(database, cfg.PacketStore)
+	store := NewPacketStore(database, cfg.PacketStore, cfg.CacheTTL)
 	if err := store.Load(); err != nil {
 		log.Fatalf("[store] failed to load: %v", err)
 	}
@@ -153,7 +155,7 @@ func main() {
 	// NOTE on startup ordering (review item #10): ensureResolvedPathColumn runs AFTER
 	// OpenDB/detectSchema, so db.hasResolvedPath will be false on first run with a
 	// pre-existing DB. This means Load() won't SELECT resolved_path from SQLite.
-	// That's OK: backfillResolvedPaths (below) computes and persists them in-memory
+	// Async backfill runs after HTTP starts (see backfillResolvedPathsAsync below)
 	// AND to SQLite. On next restart, detectSchema finds the column and Load() reads it.
 	if err := ensureResolvedPathColumn(dbPath); err != nil {
 		log.Printf("[store] warning: could not add resolved_path column: %v", err)
@@ -166,27 +168,59 @@ func main() {
 		store.graph = loadNeighborEdgesFromDB(database.conn)
 		log.Printf("[neighbor] loaded persisted neighbor graph")
 	} else {
-		log.Printf("[neighbor] no persisted edges found, building from store...")
-		rw, rwErr := openRW(dbPath)
-		if rwErr == nil {
-			edgeCount := buildAndPersistEdges(store, rw)
-			rw.Close()
-			log.Printf("[neighbor] persisted %d edges", edgeCount)
+		log.Printf("[neighbor] no persisted edges found, will build in background...")
+		store.graph = NewNeighborGraph() // empty graph — gets populated by background goroutine
+		go func() {
+			defer func() {
+				if r := recover(); r != nil {
+					log.Printf("[neighbor] graph build panic recovered: %v", r)
+				}
+			}()
+			rw, rwErr := openRW(dbPath)
+			if rwErr == nil {
+				edgeCount := buildAndPersistEdges(store, rw)
+				rw.Close()
+				log.Printf("[neighbor] persisted %d edges", edgeCount)
+			}
+			built := BuildFromStore(store)
+			store.mu.Lock()
+			store.graph = built
+			store.mu.Unlock()
+			log.Printf("[neighbor] graph build complete")
+		}()
+	}
+
+	// Initial pickBestObservation runs in background — doesn't need to block HTTP.
+	// API serves best-effort data until this completes (~10s for 100K txs).
+	// Processes in chunks of 5000, releasing the lock between chunks so API
+	// handlers remain responsive.
+	go func() {
+		defer func() {
+			if r := recover(); r != nil {
+				log.Printf("[store] pickBestObservation panic recovered: %v", r)
+			}
+		}()
+		const chunkSize = 5000
+		store.mu.RLock()
+		totalPackets := len(store.packets)
+		store.mu.RUnlock()
+
+		for i := 0; i < totalPackets; i += chunkSize {
+			end := i + chunkSize
+			if end > totalPackets {
+				end = totalPackets
+			}
+			store.mu.Lock()
+			for j := i; j < end && j < len(store.packets); j++ {
+				pickBestObservation(store.packets[j])
+			}
+			store.mu.Unlock()
+			if end < totalPackets {
+				time.Sleep(10 * time.Millisecond) // yield to API handlers
+			}
 		}
-		store.graph = BuildFromStore(store)
-	}
-
-	// Backfill resolved_path for observations that don't have it yet
-	if backfilled := backfillResolvedPaths(store, dbPath); backfilled > 0 {
-		log.Printf("[store] backfilled resolved_path for %d observations", backfilled)
-	}
-
-	// Re-pick best observation now that resolved paths are populated
-	store.mu.Lock()
-	for _, tx := range store.packets {
-		pickBestObservation(tx)
-	}
-	store.mu.Unlock()
+		log.Printf("[store] initial pickBestObservation complete (%d transmissions)", totalPackets)
+	}()
 
 	// WebSocket hub
 	hub := NewHub()
@@ -234,6 +268,11 @@ func main() {
 			close(pruneDone)
 		}
 		go func() {
+			defer func() {
+				if r := recover(); r != nil {
+					log.Printf("[prune] panic recovered: %v", r)
+				}
+			}()
 			time.Sleep(1 * time.Minute)
 			if n, err := database.PruneOldPackets(days); err != nil {
 				log.Printf("[prune] error: %v", err)
@@ -267,6 +306,11 @@ func main() {
 			close(metricsPruneDone)
 		}
 		go func() {
+			defer func() {
+				if r := recover(); r != nil {
+					log.Printf("[metrics-prune] panic recovered: %v", r)
+				}
+			}()
 			time.Sleep(2 * time.Minute) // stagger after packet prune
 			database.PruneOldMetrics(metricsDays)
 			for {
@@ -281,6 +325,42 @@ func main() {
 		log.Printf("[metrics-prune] auto-prune enabled: metrics older than %d days", metricsDays)
 	}
 
+	// Auto-prune old neighbor edges
+	var stopEdgePrune func()
+	{
+		maxAgeDays := cfg.NeighborMaxAgeDays()
+		edgePruneTicker := time.NewTicker(24 * time.Hour)
+		edgePruneDone := make(chan struct{})
+		stopEdgePrune = func() {
+			edgePruneTicker.Stop()
+			close(edgePruneDone)
+		}
+		go func() {
+			defer func() {
+				if r := recover(); r != nil {
+					log.Printf("[neighbor-prune] panic recovered: %v", r)
+				}
+			}()
+			time.Sleep(4 * time.Minute) // stagger after metrics prune
+			store.mu.RLock()
+			g := store.graph
+			store.mu.RUnlock()
+			PruneNeighborEdges(dbPath, g, maxAgeDays)
+			for {
+				select {
+				case <-edgePruneTicker.C:
+					store.mu.RLock()
+					g := store.graph
+					store.mu.RUnlock()
+					PruneNeighborEdges(dbPath, g, maxAgeDays)
+				case <-edgePruneDone:
+					return
+				}
+			}
+		}()
+		log.Printf("[neighbor-prune] auto-prune enabled: edges older than %d days", maxAgeDays)
+	}
+
 	// Graceful shutdown
 	httpServer := &http.Server{
 		Addr:         fmt.Sprintf(":%d", cfg.Port),
@@ -306,6 +386,9 @@ func main() {
 		if stopMetricsPrune != nil {
 			stopMetricsPrune()
 		}
+		if stopEdgePrune != nil {
+			stopEdgePrune()
+		}
 
 		// 2. Gracefully drain HTTP connections (up to 15s)
 		ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
@@ -325,6 +408,10 @@ func main() {
 	}()
 
 	log.Printf("[server] CoreScope (Go) listening on http://localhost:%d", cfg.Port)
+
+	// Start async backfill in background — HTTP is now available.
+	go backfillResolvedPathsAsync(store, dbPath, 5000, 100*time.Millisecond, cfg.BackfillHours())
+
 	if err := httpServer.ListenAndServe(); err != http.ErrServerClosed {
 		log.Fatalf("[server] %v", err)
 	}

cmd/server/multibyte_capability_test.go

@@ -0,0 +1,428 @@
+package main
+
+import (
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"testing"
+
+	_ "modernc.org/sqlite"
+)
+
+// setupCapabilityTestDB creates a minimal in-memory DB with nodes table.
+func setupCapabilityTestDB(t *testing.T) *DB {
+	t.Helper()
+	conn, err := sql.Open("sqlite", ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	conn.SetMaxOpenConns(1)
+	conn.Exec(`CREATE TABLE nodes (
+		public_key TEXT PRIMARY KEY, name TEXT, role TEXT,
+		lat REAL, lon REAL, last_seen TEXT, first_seen TEXT,
+		advert_count INTEGER DEFAULT 0, battery_mv INTEGER, temperature_c REAL
+	)`)
+	conn.Exec(`CREATE TABLE observers (
+		id TEXT PRIMARY KEY, name TEXT, iata TEXT, last_seen TEXT,
+		first_seen TEXT, packet_count INTEGER DEFAULT 0, model TEXT,
+		firmware TEXT, client_version TEXT, radio TEXT, battery_mv INTEGER,
+		uptime_secs INTEGER
+	)`)
+	return &DB{conn: conn}
+}
+
+// addTestPacket adds a StoreTx to the store's internal structures including
+// the byPathHop index and byPayloadType index.
+func addTestPacket(store *PacketStore, tx *StoreTx) {
+	store.mu.Lock()
+	defer store.mu.Unlock()
+	tx.ID = len(store.packets) + 1
+	if tx.Hash == "" {
+		tx.Hash = fmt.Sprintf("test-hash-%d", tx.ID)
+	}
+	store.packets = append(store.packets, tx)
+	store.byHash[tx.Hash] = tx
+	store.byTxID[tx.ID] = tx
+	if tx.PayloadType != nil {
+		store.byPayloadType[*tx.PayloadType] = append(store.byPayloadType[*tx.PayloadType], tx)
+	}
+	addTxToPathHopIndex(store.byPathHop, tx)
+}
+
+// buildPathByte returns a 2-char hex string for the path byte with given
+// hashSize (1-3) and hopCount.
+func buildPathByte(hashSize, hopCount int) string {
+	b := byte(((hashSize - 1) & 0x3) << 6) | byte(hopCount&0x3F)
+	return fmt.Sprintf("%02x", b)
+}
+
+// makeTestAdvert creates a StoreTx representing a flood advert packet.
+func makeTestAdvert(pubkey string, hashSize int) *StoreTx {
+	decoded, _ := json.Marshal(map[string]interface{}{"pubKey": pubkey, "name": pubkey[:8]})
+	pt := 4
+	pathByte := buildPathByte(hashSize, 1)
+	prefix := strings.ToLower(pubkey[:hashSize*2])
+	rawHex := "01" + pathByte + prefix // flood header + path byte + hop prefix
+	return &StoreTx{
+		RawHex:      rawHex,
+		PayloadType: &pt,
+		DecodedJSON: string(decoded),
+		PathJSON:    `["` + prefix + `"]`,
+		FirstSeen:   "2026-04-11T00:00:00.000Z",
+	}
+}
+
+// TestMultiByteCapability_Confirmed tests that a repeater advertising
+// with hash_size >= 2 is classified as "confirmed".
+func TestMultiByteCapability_Confirmed(t *testing.T) {
+	db := setupCapabilityTestDB(t)
+	defer db.conn.Close()
+
+	db.conn.Exec("INSERT INTO nodes (public_key, name, role, last_seen) VALUES (?, ?, ?, ?)",
+		"aabbccdd11223344", "RepA", "repeater", "2026-04-11T00:00:00Z")
+
+	store := NewPacketStore(db, nil)
+	addTestPacket(store, makeTestAdvert("aabbccdd11223344", 2))
+
+	caps := store.computeMultiByteCapability(nil)
+	if len(caps) != 1 {
+		t.Fatalf("expected 1 entry, got %d", len(caps))
+	}
+	if caps[0].Status != "confirmed" {
+		t.Errorf("expected confirmed, got %s", caps[0].Status)
+	}
+	if caps[0].Evidence != "advert" {
+		t.Errorf("expected advert evidence, got %s", caps[0].Evidence)
+	}
+	if caps[0].MaxHashSize != 2 {
+		t.Errorf("expected maxHashSize 2, got %d", caps[0].MaxHashSize)
+	}
+}
+
+// TestMultiByteCapability_Suspected tests that a repeater whose prefix
+// appears in a multi-byte path is classified as "suspected".
+func TestMultiByteCapability_Suspected(t *testing.T) {
+	db := setupCapabilityTestDB(t)
+	defer db.conn.Close()
+
+	db.conn.Exec("INSERT INTO nodes (public_key, name, role, last_seen) VALUES (?, ?, ?, ?)",
+		"aabbccdd11223344", "RepB", "repeater", "2026-04-10T00:00:00Z")
+
+	store := NewPacketStore(db, nil)
+
+	// Non-advert packet with 2-byte hash in path, hop prefix matching node
+	pathByte := buildPathByte(2, 1)
+	rawHex := "01" + pathByte + "aabb"
+	pt := 1
+	pkt := &StoreTx{
+		RawHex:      rawHex,
+		PayloadType: &pt,
+		PathJSON:    `["aabb"]`,
+		FirstSeen:   "2026-04-10T00:00:00.000Z",
+	}
+	addTestPacket(store, pkt)
+
+	caps := store.computeMultiByteCapability(nil)
+	if len(caps) != 1 {
+		t.Fatalf("expected 1 entry, got %d", len(caps))
+	}
+	if caps[0].Status != "suspected" {
+		t.Errorf("expected suspected, got %s", caps[0].Status)
+	}
+	if caps[0].Evidence != "path" {
+		t.Errorf("expected path evidence, got %s", caps[0].Evidence)
+	}
+	if caps[0].MaxHashSize != 2 {
+		t.Errorf("expected maxHashSize 2, got %d", caps[0].MaxHashSize)
+	}
+}
+
+// TestMultiByteCapability_Unknown tests that a repeater with only 1-byte
+// adverts and no multi-byte path appearances is classified as "unknown".
+func TestMultiByteCapability_Unknown(t *testing.T) {
+	db := setupCapabilityTestDB(t)
+	defer db.conn.Close()
+
+	db.conn.Exec("INSERT INTO nodes (public_key, name, role, last_seen) VALUES (?, ?, ?, ?)",
+		"aabbccdd11223344", "RepC", "repeater", "2026-04-08T00:00:00Z")
+
+	store := NewPacketStore(db, nil)
+
+	// Advert with 1-byte hash only
+	addTestPacket(store, makeTestAdvert("aabbccdd11223344", 1))
+
+	caps := store.computeMultiByteCapability(nil)
+	if len(caps) != 1 {
+		t.Fatalf("expected 1 entry, got %d", len(caps))
+	}
+	if caps[0].Status != "unknown" {
+		t.Errorf("expected unknown, got %s", caps[0].Status)
+	}
+	if caps[0].MaxHashSize != 1 {
+		t.Errorf("expected maxHashSize 1, got %d", caps[0].MaxHashSize)
+	}
+}
+
+// TestMultiByteCapability_PrefixCollision tests that when two repeaters
+// share the same prefix, one confirmed via advert, the other gets
+// suspected (not confirmed) from path data alone.
+func TestMultiByteCapability_PrefixCollision(t *testing.T) {
+	db := setupCapabilityTestDB(t)
+	defer db.conn.Close()
+
+	// Two repeaters sharing 1-byte prefix "aa"
+	db.conn.Exec("INSERT INTO nodes (public_key, name, role, last_seen) VALUES (?, ?, ?, ?)",
+		"aabb000000000001", "RepConfirmed", "repeater", "2026-04-11T00:00:00Z")
+	db.conn.Exec("INSERT INTO nodes (public_key, name, role, last_seen) VALUES (?, ?, ?, ?)",
+		"aacc000000000002", "RepOther", "repeater", "2026-04-11T00:00:00Z")
+
+	store := NewPacketStore(db, nil)
+
+	// RepConfirmed has a 2-byte advert
+	addTestPacket(store, makeTestAdvert("aabb000000000001", 2))
+
+	// A packet with 2-byte path containing 1-byte hop "aa" — both share this prefix
+	pathByte := buildPathByte(2, 1)
+	rawHex := "01" + pathByte + "aa"
+	pt := 1
+	pkt := &StoreTx{
+		RawHex:      rawHex,
+		PayloadType: &pt,
+		PathJSON:    `["aa"]`,
+		FirstSeen:   "2026-04-10T00:00:00.000Z",
+	}
+	addTestPacket(store, pkt)
+
+	caps := store.computeMultiByteCapability(nil)
+	if len(caps) != 2 {
+		t.Fatalf("expected 2 entries, got %d", len(caps))
+	}
+
+	capByName := map[string]MultiByteCapEntry{}
+	for _, c := range caps {
+		capByName[c.Name] = c
+	}
+
+	if capByName["RepConfirmed"].Status != "confirmed" {
+		t.Errorf("RepConfirmed expected confirmed, got %s", capByName["RepConfirmed"].Status)
+	}
+	if capByName["RepOther"].Status != "suspected" {
+		t.Errorf("RepOther expected suspected, got %s", capByName["RepOther"].Status)
+	}
+}
+
+// TestMultiByteCapability_TraceExcluded tests that TRACE packets (payload_type 8)
+// do NOT contribute to "suspected" multi-byte capability. TRACE packets carry
+// hash size in their own flags, so pre-1.14 repeaters can forward multi-byte
+// TRACEs without actually supporting multi-byte hashes. See #714.
+func TestMultiByteCapability_TraceExcluded(t *testing.T) {
+	db := setupCapabilityTestDB(t)
+	defer db.conn.Close()
+
+	db.conn.Exec("INSERT INTO nodes (public_key, name, role, last_seen) VALUES (?, ?, ?, ?)",
+		"aabbccdd11223344", "RepTrace", "repeater", "2026-04-10T00:00:00Z")
+
+	store := NewPacketStore(db, nil)
+
+	// TRACE packet (payload_type 8) with 2-byte hash in path
+	pathByte := buildPathByte(2, 1)
+	rawHex := "01" + pathByte + "aabb"
+	pt := 8
+	pkt := &StoreTx{
+		RawHex:      rawHex,
+		PayloadType: &pt,
+		PathJSON:    `["aabb"]`,
+		FirstSeen:   "2026-04-10T00:00:00.000Z",
+	}
+	addTestPacket(store, pkt)
+
+	caps := store.computeMultiByteCapability(nil)
+	if len(caps) != 1 {
+		t.Fatalf("expected 1 entry, got %d", len(caps))
+	}
+	if caps[0].Status != "unknown" {
+		t.Errorf("expected unknown (TRACE excluded), got %s", caps[0].Status)
+	}
+}
+
+// TestMultiByteCapability_NonTraceStillSuspected verifies that non-TRACE packets
+// with 2-byte paths still correctly mark a repeater as "suspected".
+func TestMultiByteCapability_NonTraceStillSuspected(t *testing.T) {
+	db := setupCapabilityTestDB(t)
+	defer db.conn.Close()
+
+	db.conn.Exec("INSERT INTO nodes (public_key, name, role, last_seen) VALUES (?, ?, ?, ?)",
+		"aabbccdd11223344", "RepNonTrace", "repeater", "2026-04-10T00:00:00Z")
+
+	store := NewPacketStore(db, nil)
+
+	// GRP_TXT packet (payload_type 1) with 2-byte hash in path
+	pathByte := buildPathByte(2, 1)
+	rawHex := "01" + pathByte + "aabb"
+	pt := 1
+	pkt := &StoreTx{
+		RawHex:      rawHex,
+		PayloadType: &pt,
+		PathJSON:    `["aabb"]`,
+		FirstSeen:   "2026-04-10T00:00:00.000Z",
+	}
+	addTestPacket(store, pkt)
+
+	caps := store.computeMultiByteCapability(nil)
+	if len(caps) != 1 {
+		t.Fatalf("expected 1 entry, got %d", len(caps))
+	}
+	if caps[0].Status != "suspected" {
+		t.Errorf("expected suspected, got %s", caps[0].Status)
+	}
+}
+
+// TestMultiByteCapability_ConfirmedUnaffectedByTraceExclusion verifies that
+// "confirmed" status from adverts is not affected by the TRACE exclusion.
+func TestMultiByteCapability_ConfirmedUnaffectedByTraceExclusion(t *testing.T) {
+	db := setupCapabilityTestDB(t)
+	defer db.conn.Close()
+
+	db.conn.Exec("INSERT INTO nodes (public_key, name, role, last_seen) VALUES (?, ?, ?, ?)",
+		"aabbccdd11223344", "RepConfirmedTrace", "repeater", "2026-04-11T00:00:00Z")
+
+	store := NewPacketStore(db, nil)
+
+	// Advert with 2-byte hash (confirms capability)
+	addTestPacket(store, makeTestAdvert("aabbccdd11223344", 2))
+
+	// TRACE packet also present — should not downgrade confirmed status
+	pathByte := buildPathByte(2, 1)
+	rawHex := "01" + pathByte + "aabb"
+	pt := 8
+	pkt := &StoreTx{
+		RawHex:      rawHex,
+		PayloadType: &pt,
+		PathJSON:    `["aabb"]`,
+		FirstSeen:   "2026-04-10T00:00:00.000Z",
+	}
+	addTestPacket(store, pkt)
+
+	caps := store.computeMultiByteCapability(nil)
+	if len(caps) != 1 {
+		t.Fatalf("expected 1 entry, got %d", len(caps))
+	}
+	if caps[0].Status != "confirmed" {
+		t.Errorf("expected confirmed (unaffected by TRACE), got %s", caps[0].Status)
+	}
+}
+
+// TestMultiByteCapability_CompanionConfirmed tests that a companion with
+// multi-byte advert is classified as "confirmed", not "unknown" (Bug 1, #754).
+func TestMultiByteCapability_CompanionConfirmed(t *testing.T) {
+	db := setupCapabilityTestDB(t)
+	defer db.conn.Close()
+
+	db.conn.Exec("INSERT INTO nodes (public_key, name, role, last_seen) VALUES (?, ?, ?, ?)",
+		"aabbccdd11223344", "CompA", "companion", "2026-04-11T00:00:00Z")
+
+	store := NewPacketStore(db, nil)
+	addTestPacket(store, makeTestAdvert("aabbccdd11223344", 2))
+
+	caps := store.computeMultiByteCapability(nil)
+	if len(caps) != 1 {
+		t.Fatalf("expected 1 entry, got %d", len(caps))
+	}
+	if caps[0].Status != "confirmed" {
+		t.Errorf("expected confirmed for companion, got %s", caps[0].Status)
+	}
+	if caps[0].Role != "companion" {
+		t.Errorf("expected role companion, got %s", caps[0].Role)
+	}
+	if caps[0].Evidence != "advert" {
+		t.Errorf("expected advert evidence, got %s", caps[0].Evidence)
+	}
+}
+
+// TestMultiByteCapability_RoleColumnPopulated tests that the Role field is
+// populated for all node types (Bug 2, #754).
+func TestMultiByteCapability_RoleColumnPopulated(t *testing.T) {
+	db := setupCapabilityTestDB(t)
+	defer db.conn.Close()
+
+	db.conn.Exec("INSERT INTO nodes (public_key, name, role, last_seen) VALUES (?, ?, ?, ?)",
+		"aabb000000000001", "Rep1", "repeater", "2026-04-11T00:00:00Z")
+	db.conn.Exec("INSERT INTO nodes (public_key, name, role, last_seen) VALUES (?, ?, ?, ?)",
+		"ccdd000000000002", "Comp1", "companion", "2026-04-11T00:00:00Z")
+	db.conn.Exec("INSERT INTO nodes (public_key, name, role, last_seen) VALUES (?, ?, ?, ?)",
+		"eeff000000000003", "Room1", "room_server", "2026-04-11T00:00:00Z")
+
+	store := NewPacketStore(db, nil)
+	addTestPacket(store, makeTestAdvert("aabb000000000001", 2))
+	addTestPacket(store, makeTestAdvert("ccdd000000000002", 2))
+	addTestPacket(store, makeTestAdvert("eeff000000000003", 1))
+
+	caps := store.computeMultiByteCapability(nil)
+	if len(caps) != 3 {
+		t.Fatalf("expected 3 entries, got %d", len(caps))
+	}
+
+	roleByName := map[string]string{}
+	for _, c := range caps {
+		roleByName[c.Name] = c.Role
+	}
+	if roleByName["Rep1"] != "repeater" {
+		t.Errorf("Rep1 role: expected repeater, got %s", roleByName["Rep1"])
+	}
+	if roleByName["Comp1"] != "companion" {
+		t.Errorf("Comp1 role: expected companion, got %s", roleByName["Comp1"])
+	}
+	if roleByName["Room1"] != "room_server" {
+		t.Errorf("Room1 role: expected room_server, got %s", roleByName["Room1"])
+	}
+}
+
+// TestMultiByteCapability_AdopterEvidenceTakesPrecedence tests that when
+// adopter data shows hashSize >= 2 but path evidence says "suspected",
+// the node is upgraded to "confirmed" (Bug 3, #754).
+func TestMultiByteCapability_AdopterEvidenceTakesPrecedence(t *testing.T) {
+	db := setupCapabilityTestDB(t)
+	defer db.conn.Close()
+
+	db.conn.Exec("INSERT INTO nodes (public_key, name, role, last_seen) VALUES (?, ?, ?, ?)",
+		"aabbccdd11223344", "RepAdopter", "repeater", "2026-04-11T00:00:00Z")
+
+	store := NewPacketStore(db, nil)
+
+	// Only a path-based packet (no advert) — would normally be "suspected"
+	pathByte := buildPathByte(2, 1)
+	rawHex := "01" + pathByte + "aabb"
+	pt := 1
+	pkt := &StoreTx{
+		RawHex:      rawHex,
+		PayloadType: &pt,
+		PathJSON:    `["aabb"]`,
+		FirstSeen:   "2026-04-10T00:00:00.000Z",
+	}
+	addTestPacket(store, pkt)
+
+	// Without adopter data: should be suspected
+	caps := store.computeMultiByteCapability(nil)
+	capByName := map[string]MultiByteCapEntry{}
+	for _, c := range caps {
+		capByName[c.Name] = c
+	}
+	if capByName["RepAdopter"].Status != "suspected" {
+		t.Errorf("without adopter data: expected suspected, got %s", capByName["RepAdopter"].Status)
+	}
+
+	// With adopter data showing hashSize 2: should be confirmed
+	adopterHS := map[string]int{"aabbccdd11223344": 2}
+	caps = store.computeMultiByteCapability(adopterHS)
+	capByName = map[string]MultiByteCapEntry{}
+	for _, c := range caps {
+		capByName[c.Name] = c
+	}
+	if capByName["RepAdopter"].Status != "confirmed" {
+		t.Errorf("with adopter data: expected confirmed, got %s", capByName["RepAdopter"].Status)
+	}
+	if capByName["RepAdopter"].Evidence != "advert" {
+		t.Errorf("with adopter data: expected advert evidence, got %s", capByName["RepAdopter"].Evidence)
+	}
+}

cmd/server/neighbor_api.go

@@ -20,19 +20,20 @@ type NeighborResponse struct {
 }
 
 type NeighborEntry struct {
-	Pubkey     *string           `json:"pubkey"`
-	Prefix     string            `json:"prefix"`
-	Name       *string           `json:"name"`
-	Role       *string           `json:"role"`
-	Count      int               `json:"count"`
-	Score      float64           `json:"score"`
-	FirstSeen  string            `json:"first_seen"`
-	LastSeen   string            `json:"last_seen"`
-	AvgSNR     *float64          `json:"avg_snr"`
-	Observers  []string          `json:"observers"`
-	Ambiguous  bool              `json:"ambiguous"`
-	Unresolved bool              `json:"unresolved,omitempty"`
-	Candidates []CandidateEntry  `json:"candidates,omitempty"`
+	Pubkey      *string          `json:"pubkey"`
+	Prefix      string           `json:"prefix"`
+	Name        *string          `json:"name"`
+	Role        *string          `json:"role"`
+	Count       int              `json:"count"`
+	Score       float64          `json:"score"`
+	FirstSeen   string           `json:"first_seen"`
+	LastSeen    string           `json:"last_seen"`
+	AvgSNR      *float64         `json:"avg_snr"`
+	DistanceKm  *float64         `json:"distance_km,omitempty"`
+	Observers   []string         `json:"observers"`
+	Ambiguous   bool             `json:"ambiguous"`
+	Unresolved  bool             `json:"unresolved,omitempty"`
+	Candidates  []CandidateEntry `json:"candidates,omitempty"`
 }
 
 type CandidateEntry struct {
@@ -115,9 +116,15 @@ func (s *Server) handleNodeNeighbors(w http.ResponseWriter, r *http.Request) {
 	edges := graph.Neighbors(pubkey)
 	now := time.Now()
 
-	// Build node info lookup for names/roles.
+	// Build node info lookup for names/roles/coordinates.
 	nodeMap := s.buildNodeInfoMap()
 
+	// Look up the queried node's GPS coordinates for distance computation.
+	var srcInfo nodeInfo
+	if nodeMap != nil {
+		srcInfo = nodeMap[pubkey]
+	}
+
 	var entries []NeighborEntry
 	totalObs := 0
 
@@ -170,12 +177,20 @@ func (s *Server) handleNodeNeighbors(w http.ResponseWriter, r *http.Request) {
 			if info, ok := nodeMap[strings.ToLower(neighborPK)]; ok {
 				entry.Name = &info.Name
 				entry.Role = &info.Role
+				if srcInfo.HasGPS && info.HasGPS {
+					d := haversineKm(srcInfo.Lat, srcInfo.Lon, info.Lat, info.Lon)
+					entry.DistanceKm = &d
+				}
 			}
 		}
 
 		entries = append(entries, entry)
 	}
 
+	// Defense-in-depth: deduplicate unresolved prefix entries that match
+	// resolved pubkey entries in the same neighbor set (fixes #698).
+	entries = dedupPrefixEntries(entries)
+
 	// Sort by score descending.
 	sort.Slice(entries, func(i, j int) bool {
 		return entries[i].Score > entries[j].Score
@@ -358,5 +373,97 @@ func (s *Server) buildNodeInfoMap() map[string]nodeInfo {
 	for _, n := range nodes {
 		m[strings.ToLower(n.PublicKey)] = n
 	}
+
+	// Enrich observer-only nodes: if an observer pubkey isn't already in the
+	// map (i.e. it's not also a repeater/companion), add it with role "observer".
+	if s.db != nil {
+		rows, err := s.db.conn.Query("SELECT id, name FROM observers")
+		if err == nil {
+			defer rows.Close()
+			for rows.Next() {
+				var id, name string
+				if rows.Scan(&id, &name) != nil {
+					continue
+				}
+				key := strings.ToLower(id)
+				if _, exists := m[key]; !exists {
+					m[key] = nodeInfo{PublicKey: id, Name: name, Role: "observer"}
+				}
+			}
+		}
+	}
+
 	return m
 }
+
+// dedupPrefixEntries merges unresolved prefix entries with resolved pubkey entries
+// where the prefix is a prefix of the resolved pubkey. Defense-in-depth for #698.
+func dedupPrefixEntries(entries []NeighborEntry) []NeighborEntry {
+	if len(entries) < 2 {
+		return entries
+	}
+
+	// Mark indices of unresolved entries to remove after merging.
+	remove := make(map[int]bool)
+
+	for i := range entries {
+		if entries[i].Pubkey != nil {
+			continue // only check unresolved (no pubkey)
+		}
+		prefix := strings.ToLower(entries[i].Prefix)
+		if prefix == "" {
+			continue
+		}
+		// Find all resolved entries matching this prefix.
+		matchIdx := -1
+		matchCount := 0
+		for j := range entries {
+			if i == j || entries[j].Pubkey == nil {
+				continue
+			}
+			if strings.HasPrefix(strings.ToLower(*entries[j].Pubkey), prefix) {
+				matchIdx = j
+				matchCount++
+			}
+		}
+		// Only merge when exactly one resolved entry matches — ambiguous
+		// prefixes that match multiple resolved neighbors must not be
+		// arbitrarily assigned to one of them.
+		if matchCount != 1 {
+			continue
+		}
+		j := matchIdx
+
+		// Merge counts from unresolved into resolved.
+		entries[j].Count += entries[i].Count
+
+		// Preserve higher LastSeen.
+		if entries[i].LastSeen > entries[j].LastSeen {
+			entries[j].LastSeen = entries[i].LastSeen
+		}
+
+		// Merge observers.
+		obsSet := make(map[string]bool)
+		for _, o := range entries[j].Observers {
+			obsSet[o] = true
+		}
+		for _, o := range entries[i].Observers {
+			obsSet[o] = true
+		}
+		entries[j].Observers = observerList(obsSet)
+
+		remove[i] = true
+	}
+
+	if len(remove) == 0 {
+		return entries
+	}
+
+	result := make([]NeighborEntry, 0, len(entries)-len(remove))
+	for i, e := range entries {
+		if !remove[i] {
+			result = append(result, e)
+		}
+	}
+	return result
+}

cmd/server/neighbor_api_test.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"database/sql"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
@@ -8,6 +9,7 @@ import (
 	"time"
 
 	"github.com/gorilla/mux"
+	_ "modernc.org/sqlite"
 )
 
 // ─── Helpers ───────────────────────────────────────────────────────────────────
@@ -347,6 +349,69 @@ func TestNeighborGraphAPI_AmbiguousEdgesCount(t *testing.T) {
 	}
 }
 
+func TestNeighborAPI_DistanceKm_WithGPS(t *testing.T) {
+	db := setupTestDB(t)
+	defer db.Close()
+
+	db.conn.Exec(`INSERT INTO nodes (public_key, name, role, lat, lon, last_seen, first_seen)
+		VALUES ('aaaa', 'NodeA', 'repeater', 51.5074, -0.1278, '2026-01-01T00:00:00Z', '2025-01-01T00:00:00Z')`)
+	db.conn.Exec(`INSERT INTO nodes (public_key, name, role, lat, lon, last_seen, first_seen)
+		VALUES ('bbbb', 'NodeB', 'repeater', 51.5200, -0.1200, '2026-01-01T00:00:00Z', '2025-01-01T00:00:00Z')`)
+
+	cfg := &Config{Port: 3000}
+	hub := NewHub()
+	srv := NewServer(db, cfg, hub)
+	srv.store = NewPacketStore(db, nil)
+
+	now := time.Now()
+	srv.neighborGraph = makeTestGraph(newEdge("aaaa", "bbbb", "bb", 50, now))
+
+	rr := serveRequest(srv, "GET", "/api/nodes/aaaa/neighbors")
+	var resp NeighborResponse
+	json.Unmarshal(rr.Body.Bytes(), &resp)
+
+	if len(resp.Neighbors) != 1 {
+		t.Fatalf("expected 1 neighbor, got %d", len(resp.Neighbors))
+	}
+	n := resp.Neighbors[0]
+	if n.DistanceKm == nil {
+		t.Fatal("expected distance_km to be set for GPS-enabled nodes")
+	}
+	if *n.DistanceKm <= 0 {
+		t.Errorf("expected positive distance, got %f", *n.DistanceKm)
+	}
+}
+
+func TestNeighborAPI_DistanceKm_NoGPS(t *testing.T) {
+	db := setupTestDB(t)
+	defer db.Close()
+
+	// Nodes with 0,0 coords → HasGPS=false
+	db.conn.Exec(`INSERT INTO nodes (public_key, name, role, lat, lon, last_seen, first_seen)
+		VALUES ('aaaa', 'NodeA', 'repeater', 0, 0, '2026-01-01T00:00:00Z', '2025-01-01T00:00:00Z')`)
+	db.conn.Exec(`INSERT INTO nodes (public_key, name, role, lat, lon, last_seen, first_seen)
+		VALUES ('bbbb', 'NodeB', 'repeater', 0, 0, '2026-01-01T00:00:00Z', '2025-01-01T00:00:00Z')`)
+
+	cfg := &Config{Port: 3000}
+	hub := NewHub()
+	srv := NewServer(db, cfg, hub)
+	srv.store = NewPacketStore(db, nil)
+
+	now := time.Now()
+	srv.neighborGraph = makeTestGraph(newEdge("aaaa", "bbbb", "bb", 50, now))
+
+	rr := serveRequest(srv, "GET", "/api/nodes/aaaa/neighbors")
+	var resp NeighborResponse
+	json.Unmarshal(rr.Body.Bytes(), &resp)
+
+	if len(resp.Neighbors) != 1 {
+		t.Fatalf("expected 1 neighbor, got %d", len(resp.Neighbors))
+	}
+	if resp.Neighbors[0].DistanceKm != nil {
+		t.Errorf("expected nil distance_km for nodes without GPS, got %f", *resp.Neighbors[0].DistanceKm)
+	}
+}
+
 func TestNeighborGraphAPI_RegionFilter(t *testing.T) {
 	now := time.Now()
 	// Edge with observer "obs-sjc" — would match region SJC if we had region resolution.
@@ -394,3 +459,69 @@ func TestNeighborGraphAPI_ResponseShape(t *testing.T) {
 		}
 	}
 }
+
+// ─── Tests: buildNodeInfoMap observer enrichment (#753) ────────────────────────
+
+func TestBuildNodeInfoMap_ObserverEnrichment(t *testing.T) {
+	// Create a temp SQLite DB with nodes and observers tables.
+	tmpDir := t.TempDir()
+	dbPath := tmpDir + "/test.db"
+
+	conn, err := sql.Open("sqlite", dbPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Close()
+
+	// Create tables
+	for _, stmt := range []string{
+		"CREATE TABLE nodes (public_key TEXT, name TEXT, role TEXT, lat REAL, lon REAL)",
+		"CREATE TABLE observers (id TEXT, name TEXT)",
+		"INSERT INTO nodes VALUES ('AAAA1111', 'Repeater-1', 'repeater', 0, 0)",
+		"INSERT INTO observers VALUES ('BBBB2222', 'Observer-Alpha')",
+		"INSERT INTO observers VALUES ('AAAA1111', 'Obs-also-repeater')",
+	} {
+		if _, err := conn.Exec(stmt); err != nil {
+			t.Fatalf("exec %q: %v", stmt, err)
+		}
+	}
+	conn.Close()
+
+	// Open via our DB wrapper
+	db, err := OpenDB(dbPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.conn.Close()
+
+	// Build a PacketStore with this DB (minimal — just need getCachedNodesAndPM)
+	store := NewPacketStore(db, nil)
+	store.Load()
+
+	srv := &Server{
+		db:        db,
+		store:     store,
+		perfStats: NewPerfStats(),
+	}
+
+	m := srv.buildNodeInfoMap()
+
+	// AAAA1111 should be from nodes table (repeater), NOT overwritten by observer
+	if info, ok := m["aaaa1111"]; !ok {
+		t.Error("expected aaaa1111 in map")
+	} else if info.Role != "repeater" {
+		t.Errorf("expected role=repeater for aaaa1111, got %q", info.Role)
+	}
+
+	// BBBB2222 should be enriched from observers table
+	if info, ok := m["bbbb2222"]; !ok {
+		t.Error("expected bbbb2222 in map (observer-only node)")
+	} else {
+		if info.Role != "observer" {
+			t.Errorf("expected role=observer for bbbb2222, got %q", info.Role)
+		}
+		if info.Name != "Observer-Alpha" {
+			t.Errorf("expected name=Observer-Alpha for bbbb2222, got %q", info.Name)
+		}
+	}
+}

cmd/server/neighbor_dedup_test.go

@@ -0,0 +1,527 @@
+package main
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+// ─── Phase 1.5: resolveAmbiguousEdges tests ───────────────────────────────────
+
+// Test 1: Ambiguous edge resolved after Phase 1.5 when geo proximity succeeds.
+func TestResolveAmbiguousEdges_GeoProximity(t *testing.T) {
+	// Node A at lat=45, lon=-122. Candidate B1 at lat=45.1, lon=-122.1 (close).
+	// Candidate B2 at lat=10, lon=10 (far away). Prefix "b0" matches both.
+	nodeA := nodeInfo{PublicKey: "aaaa1111", Name: "NodeA", HasGPS: true, Lat: 45.0, Lon: -122.0}
+	nodeB1 := nodeInfo{PublicKey: "b0b1eeee", Name: "CloseNode", HasGPS: true, Lat: 45.1, Lon: -122.1}
+	nodeB2 := nodeInfo{PublicKey: "b0c2ffff", Name: "FarNode", HasGPS: true, Lat: 10.0, Lon: 10.0}
+
+	pm := buildPrefixMap([]nodeInfo{nodeA, nodeB1, nodeB2})
+
+	graph := NewNeighborGraph()
+	now := time.Now()
+
+	// Insert an ambiguous edge: NodeA ↔ prefix:b0
+	pseudoB := "prefix:b0"
+	key := makeEdgeKey("aaaa1111", pseudoB)
+	graph.edges[key] = &NeighborEdge{
+		NodeA:      key.A,
+		NodeB:      "",
+		Prefix:     "b0",
+		Count:      50,
+		FirstSeen:  now.Add(-1 * time.Hour),
+		LastSeen:   now,
+		Observers:  map[string]bool{"obs1": true},
+		Ambiguous:  true,
+		Candidates: []string{"b0b1eeee", "b0c2ffff"},
+	}
+	graph.byNode["aaaa1111"] = append(graph.byNode["aaaa1111"], graph.edges[key])
+
+	resolveAmbiguousEdges(pm, graph)
+
+	// The ambiguous edge should be resolved to b0b1eeee (closest by geo).
+	graph.mu.RLock()
+	defer graph.mu.RUnlock()
+
+	if _, ok := graph.edges[key]; ok {
+		t.Error("ambiguous edge should have been removed")
+	}
+
+	resolvedKey := makeEdgeKey("aaaa1111", "b0b1eeee")
+	e, ok := graph.edges[resolvedKey]
+	if !ok {
+		t.Fatal("resolved edge not found")
+	}
+	if e.Ambiguous {
+		t.Error("resolved edge should not be ambiguous")
+	}
+	if e.Count != 50 {
+		t.Errorf("expected count 50, got %d", e.Count)
+	}
+}
+
+// Test 2: Ambiguous edge merged with existing resolved edge (count accumulation).
+func TestResolveAmbiguousEdges_MergeWithExisting(t *testing.T) {
+	nodeA := nodeInfo{PublicKey: "aaaa1111", Name: "NodeA", HasGPS: true, Lat: 45.0, Lon: -122.0}
+	nodeB := nodeInfo{PublicKey: "b0b1eeee", Name: "NodeB", HasGPS: true, Lat: 45.1, Lon: -122.1}
+
+	pm := buildPrefixMap([]nodeInfo{nodeA, nodeB})
+
+	graph := NewNeighborGraph()
+	now := time.Now()
+
+	// Existing resolved edge: NodeA ↔ NodeB with count=10.
+	resolvedKey := makeEdgeKey("aaaa1111", "b0b1eeee")
+	resolvedEdge := &NeighborEdge{
+		NodeA:     resolvedKey.A,
+		NodeB:     resolvedKey.B,
+		Prefix:    "b0b1",
+		Count:     10,
+		FirstSeen: now.Add(-2 * time.Hour),
+		LastSeen:  now.Add(-30 * time.Minute),
+		Observers: map[string]bool{"obs1": true},
+	}
+	graph.edges[resolvedKey] = resolvedEdge
+	graph.byNode[resolvedKey.A] = append(graph.byNode[resolvedKey.A], resolvedEdge)
+	graph.byNode[resolvedKey.B] = append(graph.byNode[resolvedKey.B], resolvedEdge)
+
+	// Ambiguous edge: NodeA ↔ prefix:b0 with count=207.
+	pseudoB := "prefix:b0"
+	ambigKey := makeEdgeKey("aaaa1111", pseudoB)
+	ambigEdge := &NeighborEdge{
+		NodeA:      ambigKey.A,
+		NodeB:      "",
+		Prefix:     "b0",
+		Count:      207,
+		FirstSeen:  now.Add(-3 * time.Hour),
+		LastSeen:   now, // more recent than resolved edge
+		Observers:  map[string]bool{"obs2": true},
+		Ambiguous:  true,
+		Candidates: []string{"b0b1eeee"},
+	}
+	graph.edges[ambigKey] = ambigEdge
+	graph.byNode["aaaa1111"] = append(graph.byNode["aaaa1111"], ambigEdge)
+
+	resolveAmbiguousEdges(pm, graph)
+
+	graph.mu.RLock()
+	defer graph.mu.RUnlock()
+
+	// Ambiguous edge should be gone.
+	if _, ok := graph.edges[ambigKey]; ok {
+		t.Error("ambiguous edge should have been removed")
+	}
+
+	// Resolved edge should have merged counts.
+	e := graph.edges[resolvedKey]
+	if e == nil {
+		t.Fatal("resolved edge not found")
+	}
+	if e.Count != 217 { // 10 + 207
+		t.Errorf("expected merged count 217, got %d", e.Count)
+	}
+	// LastSeen should be the max of both.
+	if !e.LastSeen.Equal(now) {
+		t.Errorf("expected LastSeen to be %v, got %v", now, e.LastSeen)
+	}
+	// Both observers should be present.
+	if !e.Observers["obs1"] || !e.Observers["obs2"] {
+		t.Error("expected both observers to be present after merge")
+	}
+}
+
+// Test 3: Ambiguous edge left as-is when resolution fails.
+func TestResolveAmbiguousEdges_FailsNoChange(t *testing.T) {
+	// Two candidates, neither has GPS, no affinity data — resolution falls through.
+	nodeA := nodeInfo{PublicKey: "aaaa1111", Name: "NodeA"}
+	nodeB1 := nodeInfo{PublicKey: "b0b1eeee", Name: "B1"}
+	nodeB2 := nodeInfo{PublicKey: "b0c2ffff", Name: "B2"}
+
+	pm := buildPrefixMap([]nodeInfo{nodeA, nodeB1, nodeB2})
+
+	graph := NewNeighborGraph()
+	now := time.Now()
+
+	pseudoB := "prefix:b0"
+	key := makeEdgeKey("aaaa1111", pseudoB)
+	graph.edges[key] = &NeighborEdge{
+		NodeA:      key.A,
+		NodeB:      "",
+		Prefix:     "b0",
+		Count:      5,
+		FirstSeen:  now.Add(-1 * time.Hour),
+		LastSeen:   now,
+		Observers:  map[string]bool{"obs1": true},
+		Ambiguous:  true,
+		Candidates: []string{"b0b1eeee", "b0c2ffff"},
+	}
+	graph.byNode["aaaa1111"] = append(graph.byNode["aaaa1111"], graph.edges[key])
+
+	resolveAmbiguousEdges(pm, graph)
+
+	graph.mu.RLock()
+	defer graph.mu.RUnlock()
+
+	// Edge should still be ambiguous — resolution falls to first_match which
+	// does resolve (it always picks something), but that's fine. Let's verify
+	// if it resolved or stayed. Actually, resolveWithContext returns first_match
+	// as fallback, so it WILL resolve. Let me adjust — the spec says "left as-is
+	// when resolution fails." For resolveWithContext to truly fail, we need
+	// no candidates at all in the prefix map.
+	// Actually the spec says resolution fails = "no_match" confidence. That
+	// only happens when pm.m has no entries for the prefix. With candidates
+	// in pm, it always returns something. Let me test the true no-match case.
+}
+
+// Test 3 (corrected): Resolution fails when prefix has no candidates in prefix map.
+func TestResolveAmbiguousEdges_NoMatch(t *testing.T) {
+	nodeA := nodeInfo{PublicKey: "aaaa1111", Name: "NodeA"}
+	// pm has no entries matching prefix "zz"
+	pm := buildPrefixMap([]nodeInfo{nodeA})
+
+	graph := NewNeighborGraph()
+	now := time.Now()
+
+	pseudoB := "prefix:zz"
+	key := makeEdgeKey("aaaa1111", pseudoB)
+	graph.edges[key] = &NeighborEdge{
+		NodeA:      key.A,
+		NodeB:      "",
+		Prefix:     "zz",
+		Count:      5,
+		FirstSeen:  now.Add(-1 * time.Hour),
+		LastSeen:   now,
+		Observers:  map[string]bool{"obs1": true},
+		Ambiguous:  true,
+		Candidates: []string{},
+	}
+	graph.byNode["aaaa1111"] = append(graph.byNode["aaaa1111"], graph.edges[key])
+
+	resolveAmbiguousEdges(pm, graph)
+
+	graph.mu.RLock()
+	defer graph.mu.RUnlock()
+
+	// Edge should still exist and be ambiguous.
+	e, ok := graph.edges[key]
+	if !ok {
+		t.Fatal("edge should still exist")
+	}
+	if !e.Ambiguous {
+		t.Error("edge should still be ambiguous")
+	}
+}
+
+// Test 6: Phase 1 edge collection unchanged (no regression).
+func TestPhase1EdgeCollection_Unchanged(t *testing.T) {
+	// Build a simple graph and verify non-ambiguous edges are not touched.
+	nodeA := nodeInfo{PublicKey: "aaaa1111", Name: "NodeA", HasGPS: true, Lat: 45.0, Lon: -122.0}
+	nodeB := nodeInfo{PublicKey: "bbbb2222", Name: "NodeB", HasGPS: true, Lat: 45.1, Lon: -122.1}
+
+	ts := time.Now().UTC().Format(time.RFC3339)
+	payloadType := 4
+	obs := []*StoreObs{{
+		ObserverID: "cccc3333",
+		PathJSON:   `["bbbb2222"]`,
+		Timestamp:  ts,
+	}}
+	tx := &StoreTx{
+		ID:          1,
+		PayloadType: &payloadType,
+		DecodedJSON: `{"pubKey":"aaaa1111"}`,
+		Observations: obs,
+	}
+
+	store := ngTestStore([]nodeInfo{nodeA, nodeB, {PublicKey: "cccc3333", Name: "Observer"}}, []*StoreTx{tx})
+	graph := BuildFromStore(store)
+
+	edges := graph.Neighbors("aaaa1111")
+	found := false
+	for _, e := range edges {
+		if (e.NodeA == "aaaa1111" && e.NodeB == "bbbb2222") || (e.NodeA == "bbbb2222" && e.NodeB == "aaaa1111") {
+			found = true
+			if e.Ambiguous {
+				t.Error("resolved edge should not be ambiguous")
+			}
+			if e.Count != 1 {
+				t.Errorf("expected count 1, got %d", e.Count)
+			}
+		}
+	}
+	if !found {
+		t.Error("expected resolved edge between aaaa1111 and bbbb2222")
+	}
+}
+
+// Test 7: Merge preserves higher LastSeen timestamp.
+func TestResolveAmbiguousEdges_PreservesHigherLastSeen(t *testing.T) {
+	nodeA := nodeInfo{PublicKey: "aaaa1111", Name: "NodeA", HasGPS: true, Lat: 45.0, Lon: -122.0}
+	nodeB := nodeInfo{PublicKey: "b0b1eeee", Name: "NodeB", HasGPS: true, Lat: 45.1, Lon: -122.1}
+	pm := buildPrefixMap([]nodeInfo{nodeA, nodeB})
+
+	graph := NewNeighborGraph()
+	later := time.Date(2026, 4, 10, 12, 0, 0, 0, time.UTC)
+	earlier := time.Date(2026, 4, 9, 12, 0, 0, 0, time.UTC)
+
+	// Resolved edge has LATER LastSeen.
+	resolvedKey := makeEdgeKey("aaaa1111", "b0b1eeee")
+	re := &NeighborEdge{
+		NodeA: resolvedKey.A, NodeB: resolvedKey.B,
+		Count: 5, FirstSeen: earlier, LastSeen: later,
+		Observers: map[string]bool{"obs1": true},
+	}
+	graph.edges[resolvedKey] = re
+	graph.byNode[resolvedKey.A] = append(graph.byNode[resolvedKey.A], re)
+	graph.byNode[resolvedKey.B] = append(graph.byNode[resolvedKey.B], re)
+
+	// Ambiguous edge has EARLIER LastSeen.
+	pseudoB := "prefix:b0"
+	ambigKey := makeEdgeKey("aaaa1111", pseudoB)
+	ae := &NeighborEdge{
+		NodeA: ambigKey.A, NodeB: "",
+		Prefix: "b0", Count: 100,
+		FirstSeen: earlier.Add(-24 * time.Hour), LastSeen: earlier,
+		Observers:  map[string]bool{"obs2": true},
+		Ambiguous:  true,
+		Candidates: []string{"b0b1eeee"},
+	}
+	graph.edges[ambigKey] = ae
+	graph.byNode["aaaa1111"] = append(graph.byNode["aaaa1111"], ae)
+
+	resolveAmbiguousEdges(pm, graph)
+
+	graph.mu.RLock()
+	defer graph.mu.RUnlock()
+
+	e := graph.edges[resolvedKey]
+	if e == nil {
+		t.Fatal("resolved edge missing")
+	}
+	if !e.LastSeen.Equal(later) {
+		t.Errorf("expected LastSeen=%v (higher), got %v", later, e.LastSeen)
+	}
+	if !e.FirstSeen.Equal(earlier.Add(-24 * time.Hour)) {
+		t.Errorf("expected FirstSeen from ambiguous edge (earliest)")
+	}
+}
+
+// Test 5: Integration — node with both 1-byte and 2-byte prefix observations shows single entry.
+func TestIntegration_DualPrefixSingleNeighbor(t *testing.T) {
+	nodeA := nodeInfo{PublicKey: "aaaa1111aaaa1111", Name: "NodeA", HasGPS: true, Lat: 45.0, Lon: -122.0}
+	nodeB := nodeInfo{PublicKey: "b0b1eeeeb0b1eeee", Name: "NodeB", HasGPS: true, Lat: 45.1, Lon: -122.1}
+	nodeB2 := nodeInfo{PublicKey: "b0c2ffffb0c2ffff", Name: "NodeB2", HasGPS: true, Lat: 10.0, Lon: 10.0}
+	observer := nodeInfo{PublicKey: "cccc3333cccc3333", Name: "Observer"}
+
+	ts := time.Now().UTC().Format(time.RFC3339)
+	pt := 4
+
+	// Observation 1: 1-byte prefix "b0" (ambiguous — matches both B and B2).
+	obs1 := []*StoreObs{{ObserverID: "cccc3333cccc3333", PathJSON: `["b0"]`, Timestamp: ts}}
+	tx1 := &StoreTx{ID: 1, PayloadType: &pt, DecodedJSON: `{"pubKey":"aaaa1111aaaa1111"}`, Observations: obs1}
+
+	// Observation 2: 4-byte prefix "b0b1" (unique — resolves to NodeB).
+	obs2 := []*StoreObs{{ObserverID: "cccc3333cccc3333", PathJSON: `["b0b1"]`, Timestamp: ts}}
+	tx2 := &StoreTx{ID: 2, PayloadType: &pt, DecodedJSON: `{"pubKey":"aaaa1111aaaa1111"}`, Observations: obs2}
+
+	store := ngTestStore([]nodeInfo{nodeA, nodeB, nodeB2, observer}, []*StoreTx{tx1, tx2})
+	graph := BuildFromStore(store)
+
+	edges := graph.Neighbors("aaaa1111aaaa1111")
+
+	// Count non-observer edges that point to NodeB or are ambiguous with b0 prefix.
+	resolvedToB := 0
+	ambiguousB0 := 0
+	for _, e := range edges {
+		other := e.NodeA
+		if strings.EqualFold(other, "aaaa1111aaaa1111") {
+			other = e.NodeB
+		}
+		if strings.EqualFold(other, "b0b1eeeeb0b1eeee") {
+			resolvedToB++
+		}
+		if e.Ambiguous && e.Prefix == "b0" {
+			ambiguousB0++
+		}
+	}
+
+	if ambiguousB0 > 0 {
+		t.Errorf("expected no ambiguous b0 edges after Phase 1.5, got %d", ambiguousB0)
+	}
+	if resolvedToB != 1 {
+		t.Errorf("expected exactly 1 resolved edge to NodeB, got %d", resolvedToB)
+	}
+}
+
+// ─── API dedup tests ───────────────────────────────────────────────────────────
+
+// Test 4: API dedup merges unresolved prefix with resolved pubkey in response.
+func TestDedupPrefixEntries_MergesUnresolved(t *testing.T) {
+	pk := "b0b1eeeeb0b1eeee"
+	name := "NodeB"
+	entries := []NeighborEntry{
+		{
+			Pubkey:    nil, // unresolved
+			Prefix:    "b0",
+			Count:     207,
+			LastSeen:  "2026-04-10T12:00:00Z",
+			Observers: []string{"obs1"},
+			Ambiguous: true,
+		},
+		{
+			Pubkey:    &pk,
+			Prefix:    "b0b1",
+			Name:      &name,
+			Count:     1,
+			LastSeen:  "2026-04-09T12:00:00Z",
+			Observers: []string{"obs2"},
+		},
+	}
+
+	result := dedupPrefixEntries(entries)
+
+	if len(result) != 1 {
+		t.Fatalf("expected 1 entry after dedup, got %d", len(result))
+	}
+	if result[0].Pubkey == nil || *result[0].Pubkey != pk {
+		t.Error("expected resolved entry to remain")
+	}
+	if result[0].Count != 208 { // 1 + 207
+		t.Errorf("expected merged count 208, got %d", result[0].Count)
+	}
+	if result[0].LastSeen != "2026-04-10T12:00:00Z" {
+		t.Errorf("expected higher LastSeen, got %s", result[0].LastSeen)
+	}
+	// Both observers should be present.
+	obsMap := make(map[string]bool)
+	for _, o := range result[0].Observers {
+		obsMap[o] = true
+	}
+	if !obsMap["obs1"] || !obsMap["obs2"] {
+		t.Error("expected both observers after merge")
+	}
+}
+
+func TestDedupPrefixEntries_NoMatchNoChange(t *testing.T) {
+	pk := "dddd4444"
+	entries := []NeighborEntry{
+		{Pubkey: nil, Prefix: "b0", Count: 5, Ambiguous: true, Observers: []string{}},
+		{Pubkey: &pk, Prefix: "dd", Count: 10, Observers: []string{}},
+	}
+	result := dedupPrefixEntries(entries)
+	if len(result) != 2 {
+		t.Errorf("expected 2 entries (no match), got %d", len(result))
+	}
+}
+
+// ─── Benchmark ─────────────────────────────────────────────────────────────────
+
+// Test 8: Benchmark Phase 1.5 with 500+ ambiguous edges to verify <100ms.
+func BenchmarkResolveAmbiguousEdges_500(b *testing.B) {
+	// Create 600 nodes and 500 ambiguous edges.
+	var nodes []nodeInfo
+	for i := 0; i < 600; i++ {
+		pk := strings.ToLower(strings.Replace(
+			strings.Replace(
+				strings.Replace(
+					"xxxx0000xxxx0000", "xxxx", string(rune('a'+i/26))+string(rune('a'+i%26)), 1),
+				"0000", string(rune('0'+i/100))+string(rune('0'+(i/10)%10))+string(rune('0'+i%10))+"0", 1),
+			"xxxx0000", string(rune('a'+i/26))+string(rune('a'+i%26))+"ff"+string(rune('0'+i/100))+string(rune('0'+(i/10)%10))+string(rune('0'+i%10))+"0ff", 1))
+		// Use hex-safe pubkeys.
+		pk = hexPK(i)
+		nodes = append(nodes, nodeInfo{
+			PublicKey: pk,
+			Name:     pk[:8],
+			HasGPS:   true,
+			Lat:      45.0 + float64(i)*0.01,
+			Lon:      -122.0 + float64(i)*0.01,
+		})
+	}
+	pm := buildPrefixMap(nodes)
+
+	b.ResetTimer()
+	for n := 0; n < b.N; n++ {
+		graph := NewNeighborGraph()
+		// Create 500 ambiguous edges.
+		for i := 0; i < 500; i++ {
+			knownPK := nodes[0].PublicKey
+			prefix := strings.ToLower(nodes[i+1].PublicKey[:2])
+			pseudoB := "prefix:" + prefix
+			key := makeEdgeKey(strings.ToLower(knownPK), pseudoB)
+			graph.edges[key] = &NeighborEdge{
+				NodeA:      key.A,
+				NodeB:      "",
+				Prefix:     prefix,
+				Count:      10,
+				FirstSeen:  time.Now(),
+				LastSeen:   time.Now(),
+				Observers:  map[string]bool{"obs": true},
+				Ambiguous:  true,
+				Candidates: []string{strings.ToLower(nodes[i+1].PublicKey)},
+			}
+			graph.byNode[strings.ToLower(knownPK)] = append(
+				graph.byNode[strings.ToLower(knownPK)], graph.edges[key])
+		}
+		resolveAmbiguousEdges(pm, graph)
+	}
+}
+
+// hexPK generates a deterministic 16-char hex pubkey for index i.
+func hexPK(i int) string {
+	const hexChars = "0123456789abcdef"
+	var b [16]byte
+	v := i
+	for j := 15; j >= 0; j-- {
+		b[j] = hexChars[v%16]
+		v /= 16
+	}
+	return string(b[:])
+}
+
+// Test: API dedup does NOT merge when prefix matches multiple resolved entries.
+func TestDedupPrefixEntries_MultiMatchNoMerge(t *testing.T) {
+	pk1 := "b0b1eeeeb0b1eeee"
+	pk2 := "b0c2ffffb0c2ffff"
+	name1 := "NodeB1"
+	name2 := "NodeB2"
+	entries := []NeighborEntry{
+		{
+			Pubkey:    nil, // unresolved
+			Prefix:    "b0",
+			Count:     100,
+			LastSeen:  "2026-04-10T12:00:00Z",
+			Observers: []string{"obs1"},
+			Ambiguous: true,
+		},
+		{
+			Pubkey:    &pk1,
+			Prefix:    "b0b1",
+			Name:      &name1,
+			Count:     5,
+			LastSeen:  "2026-04-09T12:00:00Z",
+			Observers: []string{"obs2"},
+		},
+		{
+			Pubkey:    &pk2,
+			Prefix:    "b0c2",
+			Name:      &name2,
+			Count:     3,
+			LastSeen:  "2026-04-08T12:00:00Z",
+			Observers: []string{"obs3"},
+		},
+	}
+
+	result := dedupPrefixEntries(entries)
+
+	if len(result) != 3 {
+		t.Fatalf("expected 3 entries (no merge for ambiguous prefix), got %d", len(result))
+	}
+	// Counts should be unchanged.
+	for _, e := range result {
+		if e.Pubkey != nil && *e.Pubkey == pk1 && e.Count != 5 {
+			t.Errorf("pk1 count should be unchanged at 5, got %d", e.Count)
+		}
+		if e.Pubkey != nil && *e.Pubkey == pk2 && e.Count != 3 {
+			t.Errorf("pk2 count should be unchanged at 3, got %d", e.Count)
+		}
+	}
+}

cmd/server/neighbor_graph.go

@@ -166,7 +166,7 @@ func BuildFromStoreWithLog(store *PacketStore, enableLog bool) *NeighborGraph {
 
 	// Phase 1: Extract edges from every transmission + observation.
 	for _, tx := range packets {
-		isAdvert := tx.PayloadType != nil && *tx.PayloadType == 4
+		isAdvert := tx.PayloadType != nil && *tx.PayloadType == PayloadADVERT
 		fromNode := extractFromNode(tx)
 		// Pre-compute lowered originator once per tx (not per observation).
 		fromLower := ""
@@ -206,6 +206,9 @@ func BuildFromStoreWithLog(store *PacketStore, enableLog bool) *NeighborGraph {
 		}
 	}
 
+	// Phase 1.5: Resolve ambiguous edges using full graph context.
+	resolveAmbiguousEdges(pm, g)
+
 	// Phase 2: Disambiguation via Jaccard similarity.
 	g.disambiguate()
 
@@ -343,6 +346,71 @@ func (g *NeighborGraph) upsertEdgeWithCandidates(knownPK, prefix string, candida
 	}
 }
 
+// ─── Phase 1.5: Context-based resolution of ambiguous edges ────────────────────
+
+// resolveAmbiguousEdges attempts to resolve ambiguous prefix edges using the
+// fully-built graph context. Called after Phase 1 (edge collection) completes
+// so that affinity and geo proximity tiers have full neighbor data.
+func resolveAmbiguousEdges(pm *prefixMap, graph *NeighborGraph) {
+	// Step 1: Collect ambiguous edges under read lock.
+	graph.mu.RLock()
+	type ambiguousEntry struct {
+		key       edgeKey
+		edge      *NeighborEdge
+		knownNode string
+		prefix    string
+	}
+	var ambiguous []ambiguousEntry
+	for key, e := range graph.edges {
+		if !e.Ambiguous {
+			continue
+		}
+		knownNode := e.NodeA
+		if strings.HasPrefix(e.NodeA, "prefix:") {
+			knownNode = e.NodeB
+		}
+		if knownNode == "" {
+			continue
+		}
+		ambiguous = append(ambiguous, ambiguousEntry{key, e, knownNode, e.Prefix})
+	}
+	graph.mu.RUnlock()
+
+	// Step 2: Resolve each (no lock needed — resolveWithContext takes its own RLock).
+	type resolution struct {
+		ambiguousEntry
+		resolvedPK string
+	}
+	var resolutions []resolution
+	for _, ae := range ambiguous {
+		resolved, confidence, _ := pm.resolveWithContext(ae.prefix, []string{ae.knownNode}, graph)
+		if resolved == nil || confidence == "no_match" || confidence == "first_match" || confidence == "gps_preference" {
+			continue
+		}
+		rpk := strings.ToLower(resolved.PublicKey)
+		if rpk == ae.knownNode {
+			continue // self-edge guard
+		}
+		resolutions = append(resolutions, resolution{ae, rpk})
+	}
+
+	// Step 3: Apply resolutions under write lock.
+	if len(resolutions) == 0 {
+		return
+	}
+	graph.mu.Lock()
+	for _, r := range resolutions {
+		// Verify edge still exists and is still ambiguous (could have been
+		// resolved by a prior iteration if two ambiguous edges resolve to same target).
+		e, ok := graph.edges[r.key]
+		if !ok || !e.Ambiguous {
+			continue
+		}
+		graph.resolveEdge(r.key, e, r.knownNode, r.resolvedPK)
+	}
+	graph.mu.Unlock()
+}
+
 // ─── Disambiguation ────────────────────────────────────────────────────────────
 
 // disambiguate resolves ambiguous edges using Jaccard similarity of neighbor sets.
@@ -542,3 +610,24 @@ func minLen(s string, n int) int {
 	}
 	return n
 }
+
+// PruneOlderThan removes all edges with LastSeen before cutoff.
+// Returns the number of edges removed.
+func (g *NeighborGraph) PruneOlderThan(cutoff time.Time) int {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+
+	pruned := 0
+	for key, edge := range g.edges {
+		if edge.LastSeen.Before(cutoff) {
+			// Remove from byNode index
+			g.removeFromByNode(edge.NodeA, edge)
+			if edge.NodeB != "" {
+				g.removeFromByNode(edge.NodeB, edge)
+			}
+			delete(g.edges, key)
+			pruned++
+		}
+	}
+	return pruned
+}

cmd/server/neighbor_persist.go

@@ -343,112 +343,175 @@ func unmarshalResolvedPath(s string) []*string {
 	return result
 }
 
-// backfillResolvedPaths resolves paths for all observations that have NULL resolved_path.
-func backfillResolvedPaths(store *PacketStore, dbPath string) int {
-	// Collect pending observations and snapshot immutable fields under read lock.
-	// graph is set in main.go before backfill is called; nil-safe throughout (review item #6).
+
+// backfillResolvedPathsAsync processes observations with NULL resolved_path in
+// chunks, yielding between batches so HTTP handlers remain responsive. It sets
+// store.backfillComplete when finished and re-picks best observations for any
+// transmissions affected by newly resolved paths.
+func backfillResolvedPathsAsync(store *PacketStore, dbPath string, chunkSize int, yieldDuration time.Duration, backfillHours int) {
+	defer func() {
+		if r := recover(); r != nil {
+			log.Printf("[store] backfillResolvedPathsAsync panic recovered: %v", r)
+		}
+	}()
+	// Collect ALL pending obs refs upfront in one pass under a single RLock (fix A).
 	type obsRef struct {
-		obsID      int
-		pathJSON   string
-		observerID string
-		txJSON     string // snapshot of DecodedJSON for extractFromNode
+		obsID       int
+		pathJSON    string
+		observerID  string
+		txJSON      string
 		payloadType *int
+		txHash      string // to re-pick best obs
 	}
+
+	cutoff := time.Now().UTC().Add(-time.Duration(backfillHours) * time.Hour)
+
 	store.mu.RLock()
 	pm := store.nodePM
-	graph := store.graph
-	var pending []obsRef
+	var allPending []obsRef
 	for _, tx := range store.packets {
+		// Skip transmissions older than the backfill window.
+		if tx.FirstSeen != "" {
+			if ts, err := time.Parse(time.RFC3339Nano, tx.FirstSeen); err == nil && ts.Before(cutoff) {
+				continue
+			}
+			// Also try the common SQLite format
+			if ts, err := time.Parse("2006-01-02 15:04:05", tx.FirstSeen); err == nil && ts.Before(cutoff) {
+				continue
+			}
+		}
 		for _, obs := range tx.Observations {
 			if obs.ResolvedPath == nil && obs.PathJSON != "" && obs.PathJSON != "[]" {
-				pending = append(pending, obsRef{
+				allPending = append(allPending, obsRef{
 					obsID:       obs.ID,
 					pathJSON:    obs.PathJSON,
 					observerID:  obs.ObserverID,
 					txJSON:      tx.DecodedJSON,
 					payloadType: tx.PayloadType,
+					txHash:      tx.Hash,
 				})
 			}
 		}
 	}
 	store.mu.RUnlock()
 
-	if len(pending) == 0 || pm == nil {
-		return 0
+	totalPending := len(allPending)
+	if totalPending == 0 || pm == nil {
+		store.backfillComplete.Store(true)
+		log.Printf("[store] async resolved_path backfill: nothing to do")
+		return
 	}
 
-	// Resolve paths outside the lock — resolvePathForObs only reads pm and graph.
-	type resolved struct {
-		obsID  int
-		rp     []*string
-		rpJSON string
+	store.backfillTotal.Store(int64(totalPending))
+	store.backfillProcessed.Store(0)
+	log.Printf("[store] async resolved_path backfill starting: %d observations", totalPending)
+
+	// Open RW connection once before the chunk loop (fix B).
+	var rw *sql.DB
+	if dbPath != "" {
+		var err error
+		rw, err = openRW(dbPath)
+		if err != nil {
+			log.Printf("[store] async backfill: open rw error: %v", err)
+		}
 	}
-	var results []resolved
-	for _, ref := range pending {
-		// Build a minimal StoreTx for extractFromNode (only needs DecodedJSON + PayloadType).
-		fakeTx := &StoreTx{DecodedJSON: ref.txJSON, PayloadType: ref.payloadType}
-		rp := resolvePathForObs(ref.pathJSON, ref.observerID, fakeTx, pm, graph)
-		if len(rp) > 0 {
-			rpJSON := marshalResolvedPath(rp)
-			if rpJSON != "" {
-				results = append(results, resolved{ref.obsID, rp, rpJSON})
+	defer func() {
+		if rw != nil {
+			rw.Close()
+		}
+	}()
+
+	totalProcessed := 0
+	for totalProcessed < totalPending {
+		end := totalProcessed + chunkSize
+		if end > totalPending {
+			end = totalPending
+		}
+		chunk := allPending[totalProcessed:end]
+
+		// Re-read graph under RLock at the start of each chunk so we pick up
+		// a freshly-built graph once the background build goroutine completes,
+		// instead of using the potentially-empty graph captured at cold start.
+		store.mu.RLock()
+		graph := store.graph
+		store.mu.RUnlock()
+
+		// Resolve paths outside any lock.
+		type resolved struct {
+			obsID  int
+			rp     []*string
+			rpJSON string
+			txHash string
+		}
+		var results []resolved
+		for _, ref := range chunk {
+			fakeTx := &StoreTx{DecodedJSON: ref.txJSON, PayloadType: ref.payloadType}
+			rp := resolvePathForObs(ref.pathJSON, ref.observerID, fakeTx, pm, graph)
+			if len(rp) > 0 {
+				rpJSON := marshalResolvedPath(rp)
+				if rpJSON != "" {
+					results = append(results, resolved{ref.obsID, rp, rpJSON, ref.txHash})
+				}
 			}
 		}
-	}
 
-	if len(results) == 0 {
-		return 0
-	}
+		// Persist to SQLite using the shared connection.
+		if len(results) > 0 && rw != nil {
+			sqlTx, err := rw.Begin()
+			if err != nil {
+				log.Printf("[store] async backfill: begin tx error: %v", err)
+			} else {
+				stmt, err := sqlTx.Prepare("UPDATE observations SET resolved_path = ? WHERE id = ?")
+				if err != nil {
+					log.Printf("[store] async backfill: prepare error: %v", err)
+					sqlTx.Rollback()
+				} else {
+					var execErr error
+					for _, r := range results {
+						if _, e := stmt.Exec(r.rpJSON, r.obsID); e != nil && execErr == nil {
+							execErr = e
+						}
+					}
+					if execErr != nil {
+						log.Printf("[store] async backfill: exec error (first): %v", execErr)
+					}
+					stmt.Close()
+					if err := sqlTx.Commit(); err != nil {
+						log.Printf("[store] async backfill: commit error: %v", err)
+					}
+				}
+			}
 
-	// Persist to SQLite (no lock needed — separate RW connection).
-	rw, err := openRW(dbPath)
-	if err != nil {
-		log.Printf("[store] backfill: open rw error: %v", err)
-		return 0
-	}
-	defer rw.Close()
-
-	sqlTx, err := rw.Begin()
-	if err != nil {
-		log.Printf("[store] backfill: begin tx error: %v", err)
-		return 0
-	}
-	defer sqlTx.Rollback()
-
-	stmt, err := sqlTx.Prepare("UPDATE observations SET resolved_path = ? WHERE id = ?")
-	if err != nil {
-		log.Printf("[store] backfill: prepare error: %v", err)
-		return 0
-	}
-	defer stmt.Close()
-
-	var firstErr error
-	for _, r := range results {
-		if _, err := stmt.Exec(r.rpJSON, r.obsID); err != nil && firstErr == nil {
-			firstErr = err
+			// Update in-memory state and re-pick best observation under a single
+			// write lock. The per-tx pickBestObservation is O(observations) which is
+			// typically <10 per tx — negligible cost vs. the race risk of splitting
+			// the lock (pollAndMerge can append to tx.Observations concurrently).
+			store.mu.Lock()
+			affectedSet := make(map[string]bool)
+			for _, r := range results {
+				if obs, ok := store.byObsID[r.obsID]; ok {
+					obs.ResolvedPath = r.rp
+				}
+				if !affectedSet[r.txHash] {
+					affectedSet[r.txHash] = true
+					if tx, ok := store.byHash[r.txHash]; ok {
+						pickBestObservation(tx)
+					}
+				}
+			}
+			store.mu.Unlock()
 		}
-	}
-	if firstErr != nil {
-		log.Printf("[store] backfill resolved_path exec error (first): %v", firstErr)
+
+		totalProcessed += len(chunk)
+		store.backfillProcessed.Store(int64(totalProcessed))
+		pct := float64(totalProcessed) / float64(totalPending) * 100
+		log.Printf("[store] backfill progress: %d/%d observations (%.1f%%)", totalProcessed, totalPending, pct)
+
+		time.Sleep(yieldDuration)
 	}
 
-	if err := sqlTx.Commit(); err != nil {
-		log.Printf("[store] backfill: commit error: %v", err)
-		return 0
-	}
-
-	// Update in-memory state under write lock.
-	store.mu.Lock()
-	count := 0
-	for _, r := range results {
-		if obs, ok := store.byObsID[r.obsID]; ok {
-			obs.ResolvedPath = r.rp
-			count++
-		}
-	}
-	store.mu.Unlock()
-
-	return count
+	store.backfillComplete.Store(true)
+	log.Printf("[store] async resolved_path backfill complete: %d observations processed", totalProcessed)
 }
 
 // ─── Shared helpers ────────────────────────────────────────────────────────────
@@ -462,7 +525,7 @@ type edgeCandidate struct {
 // For ADVERTs: originator↔path[0] (if unambiguous). For ALL types: observer↔path[last] (if unambiguous).
 // Also handles zero-hop ADVERTs (originator↔observer direct link).
 func extractEdgesFromObs(obs *StoreObs, tx *StoreTx, pm *prefixMap) []edgeCandidate {
-	isAdvert := tx.PayloadType != nil && *tx.PayloadType == 4
+	isAdvert := tx.PayloadType != nil && *tx.PayloadType == PayloadADVERT
 	fromNode := extractFromNode(tx)
 	path := parsePathJSON(obs.PathJSON)
 	observerPK := strings.ToLower(obs.ObserverID)
@@ -521,11 +584,48 @@ func extractEdgesFromObs(obs *StoreObs, tx *StoreTx, pm *prefixMap) []edgeCandid
 
 // openRW opens a read-write SQLite connection (same pattern as PruneOldPackets).
 func openRW(dbPath string) (*sql.DB, error) {
-	dsn := fmt.Sprintf("file:%s?_journal_mode=WAL&_busy_timeout=10000", dbPath)
+	dsn := fmt.Sprintf("file:%s?_journal_mode=WAL", dbPath)
 	rw, err := sql.Open("sqlite", dsn)
 	if err != nil {
 		return nil, err
 	}
 	rw.SetMaxOpenConns(1)
+	// DSN _busy_timeout may not be honored by all drivers; set via PRAGMA
+	// to guarantee SQLite retries for up to 5s before returning SQLITE_BUSY.
+	if _, err := rw.Exec("PRAGMA busy_timeout = 5000"); err != nil {
+		rw.Close()
+		return nil, fmt.Errorf("set busy_timeout: %w", err)
+	}
 	return rw, nil
 }
+
+// PruneNeighborEdges removes edges older than maxAgeDays from both SQLite and
+// the in-memory graph. Uses openRW internally because the shared database.conn
+// is opened with mode=ro and DELETEs would silently fail.
+func PruneNeighborEdges(dbPath string, graph *NeighborGraph, maxAgeDays int) (int, error) {
+	cutoff := time.Now().UTC().Add(-time.Duration(maxAgeDays) * 24 * time.Hour)
+
+	// 1. Prune from SQLite using a read-write connection
+	var dbPruned int64
+	rw, err := openRW(dbPath)
+	if err != nil {
+		return 0, fmt.Errorf("prune neighbor_edges: open rw: %w", err)
+	}
+	defer rw.Close()
+	res, err := rw.Exec("DELETE FROM neighbor_edges WHERE last_seen < ?", cutoff.Format(time.RFC3339))
+	if err != nil {
+		return 0, fmt.Errorf("prune neighbor_edges: %w", err)
+	}
+	dbPruned, _ = res.RowsAffected()
+
+	// 2. Prune from in-memory graph
+	memPruned := 0
+	if graph != nil {
+		memPruned = graph.PruneOlderThan(cutoff)
+	}
+
+	if dbPruned > 0 || memPruned > 0 {
+		log.Printf("[neighbor-prune] removed %d DB rows, %d in-memory edges older than %d days", dbPruned, memPruned, maxAgeDays)
+	}
+	return int(dbPruned), nil
+}

cmd/server/neighbor_persist_test.go

@@ -27,7 +27,7 @@ func createTestDBWithSchema(t *testing.T) (*DB, string) {
 		id INTEGER PRIMARY KEY AUTOINCREMENT,
 		raw_hex TEXT, hash TEXT UNIQUE, first_seen TEXT,
 		route_type INTEGER, payload_type INTEGER, payload_version INTEGER,
-		decoded_json TEXT
+		decoded_json TEXT, channel_hash TEXT DEFAULT NULL
 	)`)
 	conn.Exec(`CREATE TABLE observers (
 		id TEXT PRIMARY KEY, name TEXT, iata TEXT
@@ -532,3 +532,31 @@ func TestPersistSemaphoreTryAcquireSkipsBatch(t *testing.T) {
 
 	<-persistSem // release
 }
+
+func TestOpenRW_BusyTimeout(t *testing.T) {
+	dir := t.TempDir()
+	dbPath := filepath.Join(dir, "test.db")
+
+	// Create the DB file first
+	db, err := sql.Open("sqlite", "file:"+dbPath+"?_journal_mode=WAL")
+	if err != nil {
+		t.Fatal(err)
+	}
+	db.Exec("CREATE TABLE dummy (id INTEGER)")
+	db.Close()
+
+	// Open via openRW and verify busy_timeout is set
+	rw, err := openRW(dbPath)
+	if err != nil {
+		t.Fatalf("openRW failed: %v", err)
+	}
+	defer rw.Close()
+
+	var timeout int
+	if err := rw.QueryRow("PRAGMA busy_timeout").Scan(&timeout); err != nil {
+		t.Fatalf("query busy_timeout: %v", err)
+	}
+	if timeout != 5000 {
+		t.Errorf("expected busy_timeout=5000, got %d", timeout)
+	}
+}

cmd/server/openapi.go

@@ -0,0 +1,359 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"sort"
+	"strings"
+
+	"github.com/gorilla/mux"
+)
+
+// routeMeta holds metadata for a single API route.
+type routeMeta struct {
+	Summary     string   `json:"summary"`
+	Description string   `json:"description,omitempty"`
+	Tag         string   `json:"tag"`
+	Auth        bool     `json:"auth,omitempty"`
+	QueryParams []paramMeta `json:"queryParams,omitempty"`
+}
+
+type paramMeta struct {
+	Name        string `json:"name"`
+	Description string `json:"description"`
+	Required    bool   `json:"required,omitempty"`
+	Type        string `json:"type"` // "string", "integer", "boolean"
+}
+
+// routeDescriptions returns metadata for all known API routes.
+// Key format: "METHOD /path/pattern"
+func routeDescriptions() map[string]routeMeta {
+	return map[string]routeMeta{
+		// Config
+		"GET /api/config/cache":      {Summary: "Get cache configuration", Tag: "config"},
+		"GET /api/config/client":     {Summary: "Get client configuration", Tag: "config"},
+		"GET /api/config/regions":    {Summary: "Get configured regions", Tag: "config"},
+		"GET /api/config/theme":      {Summary: "Get theme configuration", Description: "Returns color maps, CSS variables, and theme defaults.", Tag: "config"},
+		"GET /api/config/map":        {Summary: "Get map configuration", Tag: "config"},
+		"GET /api/config/geo-filter": {Summary: "Get geo-filter configuration", Tag: "config"},
+
+		// Admin / system
+		"GET /api/health":     {Summary: "Health check", Description: "Returns server health, uptime, and memory stats.", Tag: "admin"},
+		"GET /api/stats":      {Summary: "Network statistics", Description: "Returns aggregate stats (node counts, packet counts, observer counts). Cached for 10s.", Tag: "admin"},
+		"GET /api/perf":       {Summary: "Performance statistics", Description: "Returns per-endpoint request timing and slow query log.", Tag: "admin"},
+		"POST /api/perf/reset": {Summary: "Reset performance stats", Tag: "admin", Auth: true},
+		"POST /api/admin/prune": {Summary: "Prune old data", Description: "Deletes packets and nodes older than the configured retention period.", Tag: "admin", Auth: true},
+		"GET /api/debug/affinity": {Summary: "Debug neighbor affinity scores", Tag: "admin", Auth: true},
+
+		// Packets
+		"GET /api/packets": {Summary: "List packets", Description: "Returns decoded packets with filtering, sorting, and pagination.", Tag: "packets",
+			QueryParams: []paramMeta{
+				{Name: "limit", Description: "Max packets to return", Type: "integer"},
+				{Name: "offset", Description: "Pagination offset", Type: "integer"},
+				{Name: "sort", Description: "Sort field", Type: "string"},
+				{Name: "order", Description: "Sort order (asc/desc)", Type: "string"},
+				{Name: "type", Description: "Filter by packet type", Type: "string"},
+				{Name: "observer", Description: "Filter by observer ID", Type: "string"},
+				{Name: "timeRange", Description: "Time range filter (e.g. 1h, 24h, 7d)", Type: "string"},
+				{Name: "search", Description: "Full-text search", Type: "string"},
+				{Name: "groupByHash", Description: "Group duplicate packets by hash", Type: "boolean"},
+			}},
+		"POST /api/packets":              {Summary: "Ingest a packet", Description: "Submit a raw packet for decoding and storage.", Tag: "packets", Auth: true},
+		"GET /api/packets/{id}":          {Summary: "Get packet detail", Tag: "packets"},
+		"GET /api/packets/timestamps":    {Summary: "Get packet timestamp ranges", Tag: "packets"},
+		"POST /api/packets/observations": {Summary: "Batch submit observations", Description: "Submit multiple observer sightings for existing packets.", Tag: "packets"},
+
+		// Decode
+		"POST /api/decode": {Summary: "Decode a raw packet", Description: "Decodes a hex-encoded packet without storing it.", Tag: "packets"},
+
+		// Nodes
+		"GET /api/nodes": {Summary: "List nodes", Description: "Returns all known mesh nodes with status and metadata.", Tag: "nodes",
+			QueryParams: []paramMeta{
+				{Name: "role", Description: "Filter by node role", Type: "string"},
+				{Name: "status", Description: "Filter by status (active/stale/offline)", Type: "string"},
+			}},
+		"GET /api/nodes/search":           {Summary: "Search nodes", Description: "Search nodes by name or public key prefix.", Tag: "nodes", QueryParams: []paramMeta{{Name: "q", Description: "Search query", Type: "string", Required: true}}},
+		"GET /api/nodes/bulk-health":       {Summary: "Bulk node health", Description: "Returns health status for all nodes in one call.", Tag: "nodes"},
+		"GET /api/nodes/network-status":    {Summary: "Network status summary", Description: "Returns counts of active, stale, and offline nodes.", Tag: "nodes"},
+		"GET /api/nodes/{pubkey}":          {Summary: "Get node detail", Description: "Returns full detail for a single node by public key.", Tag: "nodes"},
+		"GET /api/nodes/{pubkey}/health":   {Summary: "Get node health", Tag: "nodes"},
+		"GET /api/nodes/{pubkey}/paths":    {Summary: "Get node routing paths", Tag: "nodes"},
+		"GET /api/nodes/{pubkey}/analytics": {Summary: "Get node analytics", Description: "Per-node packet counts, timing, and RF stats.", Tag: "nodes"},
+		"GET /api/nodes/{pubkey}/neighbors": {Summary: "Get node neighbors", Description: "Returns neighbor nodes with affinity scores.", Tag: "nodes"},
+
+		// Analytics
+		"GET /api/analytics/rf":               {Summary: "RF analytics", Description: "SNR/RSSI distributions and statistics.", Tag: "analytics"},
+		"GET /api/analytics/topology":          {Summary: "Network topology", Description: "Hop-count distribution and route analysis.", Tag: "analytics"},
+		"GET /api/analytics/channels":          {Summary: "Channel analytics", Description: "Message counts and activity per channel.", Tag: "analytics"},
+		"GET /api/analytics/distance":          {Summary: "Distance analytics", Description: "Geographic distance calculations between nodes.", Tag: "analytics"},
+		"GET /api/analytics/hash-sizes":        {Summary: "Hash size analysis", Description: "Distribution of hash prefix sizes across the network.", Tag: "analytics"},
+		"GET /api/analytics/hash-collisions":   {Summary: "Hash collision detection", Description: "Identifies nodes sharing hash prefixes.", Tag: "analytics"},
+		"GET /api/analytics/subpaths":          {Summary: "Subpath analysis", Description: "Common routing subpaths through the mesh.", Tag: "analytics"},
+		"GET /api/analytics/subpaths-bulk":     {Summary: "Bulk subpath analysis", Tag: "analytics"},
+		"GET /api/analytics/subpath-detail":    {Summary: "Subpath detail", Tag: "analytics"},
+		"GET /api/analytics/neighbor-graph":    {Summary: "Neighbor graph", Description: "Full neighbor affinity graph for visualization.", Tag: "analytics"},
+
+		// Channels
+		"GET /api/channels":                 {Summary: "List channels", Description: "Returns known mesh channels with message counts.", Tag: "channels"},
+		"GET /api/channels/{hash}/messages": {Summary: "Get channel messages", Description: "Returns messages for a specific channel.", Tag: "channels"},
+
+		// Observers
+		"GET /api/observers":                    {Summary: "List observers", Description: "Returns all known packet observers/gateways.", Tag: "observers"},
+		"GET /api/observers/{id}":               {Summary: "Get observer detail", Tag: "observers"},
+		"GET /api/observers/{id}/metrics":       {Summary: "Get observer metrics", Description: "Packet rates, uptime, and performance metrics.", Tag: "observers"},
+		"GET /api/observers/{id}/analytics":     {Summary: "Get observer analytics", Tag: "observers"},
+		"GET /api/observers/metrics/summary":    {Summary: "Observer metrics summary", Description: "Aggregate metrics across all observers.", Tag: "observers"},
+
+		// Misc
+		"GET /api/resolve-hops":      {Summary: "Resolve hop path", Description: "Resolves hash prefixes in a hop path to node names. Returns affinity scores and best candidates.", Tag: "nodes", QueryParams: []paramMeta{{Name: "hops", Description: "Comma-separated hop hash prefixes", Type: "string", Required: true}}},
+		"GET /api/traces/{hash}":     {Summary: "Get packet traces", Description: "Returns all observer sightings for a packet hash.", Tag: "packets"},
+		"GET /api/iata-coords":       {Summary: "Get IATA airport coordinates", Description: "Returns lat/lon for known airport codes (used for observer positioning).", Tag: "config"},
+		"GET /api/audio-lab/buckets": {Summary: "Audio lab frequency buckets", Description: "Returns frequency bucket data for audio analysis.", Tag: "analytics"},
+	}
+}
+
+// buildOpenAPISpec constructs an OpenAPI 3.0 spec by walking the mux router.
+func buildOpenAPISpec(router *mux.Router, version string) map[string]interface{} {
+	descriptions := routeDescriptions()
+
+	// Collect routes from the router
+	type routeInfo struct {
+		path    string
+		method  string
+		authReq bool
+	}
+	var routes []routeInfo
+
+	router.Walk(func(route *mux.Route, router *mux.Router, ancestors []*mux.Route) error {
+		path, err := route.GetPathTemplate()
+		if err != nil {
+			return nil
+		}
+		if !strings.HasPrefix(path, "/api/") {
+			return nil
+		}
+		// Skip the spec/docs endpoints themselves
+		if path == "/api/spec" || path == "/api/docs" {
+			return nil
+		}
+		methods, err := route.GetMethods()
+		if err != nil {
+			return nil
+		}
+		for _, m := range methods {
+			routes = append(routes, routeInfo{path: path, method: m})
+		}
+		return nil
+	})
+
+	// Sort routes for deterministic output
+	sort.Slice(routes, func(i, j int) bool {
+		if routes[i].path != routes[j].path {
+			return routes[i].path < routes[j].path
+		}
+		return routes[i].method < routes[j].method
+	})
+
+	// Build paths object
+	paths := make(map[string]interface{})
+	tagSet := make(map[string]bool)
+
+	for _, ri := range routes {
+		key := ri.method + " " + ri.path
+		meta, hasMeta := descriptions[key]
+
+		// Convert mux path params {name} to OpenAPI {name} (same format, convenient)
+		openAPIPath := ri.path
+
+		// Build operation
+		op := map[string]interface{}{
+			"summary": func() string {
+				if hasMeta {
+					return meta.Summary
+				}
+				return ri.path
+			}(),
+			"responses": map[string]interface{}{
+				"200": map[string]interface{}{
+					"description": "Success",
+					"content": map[string]interface{}{
+						"application/json": map[string]interface{}{
+							"schema": map[string]interface{}{"type": "object"},
+						},
+					},
+				},
+			},
+		}
+
+		if hasMeta {
+			if meta.Description != "" {
+				op["description"] = meta.Description
+			}
+			if meta.Tag != "" {
+				op["tags"] = []string{meta.Tag}
+				tagSet[meta.Tag] = true
+			}
+			if meta.Auth {
+				op["security"] = []map[string]interface{}{
+					{"ApiKeyAuth": []string{}},
+				}
+			}
+
+			// Add query parameters
+			if len(meta.QueryParams) > 0 {
+				params := make([]interface{}, 0, len(meta.QueryParams))
+				for _, qp := range meta.QueryParams {
+					p := map[string]interface{}{
+						"name":     qp.Name,
+						"in":       "query",
+						"required": qp.Required,
+						"schema":   map[string]interface{}{"type": qp.Type},
+					}
+					if qp.Description != "" {
+						p["description"] = qp.Description
+					}
+					params = append(params, p)
+				}
+				op["parameters"] = params
+			}
+		}
+
+		// Extract path parameters from {name} patterns
+		pathParams := extractPathParams(openAPIPath)
+		if len(pathParams) > 0 {
+			existing, _ := op["parameters"].([]interface{})
+			for _, pp := range pathParams {
+				existing = append(existing, map[string]interface{}{
+					"name":     pp,
+					"in":       "path",
+					"required": true,
+					"schema":   map[string]interface{}{"type": "string"},
+				})
+			}
+			op["parameters"] = existing
+		}
+
+		// Add to paths
+		methodLower := strings.ToLower(ri.method)
+		if _, ok := paths[openAPIPath]; !ok {
+			paths[openAPIPath] = make(map[string]interface{})
+		}
+		paths[openAPIPath].(map[string]interface{})[methodLower] = op
+	}
+
+	// Build tags array (sorted)
+	tagOrder := []string{"admin", "analytics", "channels", "config", "nodes", "observers", "packets"}
+	tagDescriptions := map[string]string{
+		"admin":     "Server administration and diagnostics",
+		"analytics": "Network analytics and statistics",
+		"channels":  "Mesh channel operations",
+		"config":    "Server configuration",
+		"nodes":     "Mesh node operations",
+		"observers": "Packet observer/gateway operations",
+		"packets":   "Packet capture and decoding",
+	}
+	var tags []interface{}
+	for _, t := range tagOrder {
+		if tagSet[t] {
+			tags = append(tags, map[string]interface{}{
+				"name":        t,
+				"description": tagDescriptions[t],
+			})
+		}
+	}
+
+	spec := map[string]interface{}{
+		"openapi": "3.0.3",
+		"info": map[string]interface{}{
+			"title":       "CoreScope API",
+			"description": "MeshCore network analyzer — packet capture, node tracking, and mesh analytics.",
+			"version":     version,
+			"license": map[string]interface{}{
+				"name": "MIT",
+			},
+		},
+		"paths": paths,
+		"tags":  tags,
+		"components": map[string]interface{}{
+			"securitySchemes": map[string]interface{}{
+				"ApiKeyAuth": map[string]interface{}{
+					"type": "apiKey",
+					"in":   "header",
+					"name": "X-API-Key",
+				},
+			},
+		},
+	}
+
+	return spec
+}
+
+// extractPathParams returns parameter names from a mux-style path like /api/nodes/{pubkey}.
+func extractPathParams(path string) []string {
+	var params []string
+	for {
+		start := strings.Index(path, "{")
+		if start == -1 {
+			break
+		}
+		end := strings.Index(path[start:], "}")
+		if end == -1 {
+			break
+		}
+		params = append(params, path[start+1:start+end])
+		path = path[start+end+1:]
+	}
+	return params
+}
+
+// handleOpenAPISpec serves the OpenAPI 3.0 spec as JSON.
+// The router is injected via RegisterRoutes storing it on the Server.
+func (s *Server) handleOpenAPISpec(w http.ResponseWriter, r *http.Request) {
+	spec := buildOpenAPISpec(s.router, s.version)
+
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.Header().Set("Access-Control-Allow-Origin", "*")
+	enc := json.NewEncoder(w)
+	enc.SetIndent("", "  ")
+	if err := enc.Encode(spec); err != nil {
+		http.Error(w, fmt.Sprintf("failed to encode spec: %v", err), http.StatusInternalServerError)
+	}
+}
+
+// handleSwaggerUI serves a minimal Swagger UI page.
+func (s *Server) handleSwaggerUI(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	fmt.Fprint(w, swaggerUIHTML)
+}
+
+const swaggerUIHTML = `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <title>CoreScope API — Swagger UI</title>
+  <link rel="stylesheet" href="https://unpkg.com/swagger-ui-dist@5/swagger-ui.css">
+  <style>
+    html { box-sizing: border-box; overflow-y: scroll; }
+    *, *:before, *:after { box-sizing: inherit; }
+    body { margin: 0; background: #fafafa; }
+    .topbar { display: none; }
+  </style>
+</head>
+<body>
+  <div id="swagger-ui"></div>
+  <script src="https://unpkg.com/swagger-ui-dist@5/swagger-ui-bundle.js"></script>
+  <script>
+    SwaggerUIBundle({
+      url: '/api/spec',
+      dom_id: '#swagger-ui',
+      deepLinking: true,
+      presets: [
+        SwaggerUIBundle.presets.apis,
+        SwaggerUIBundle.SwaggerUIStandalonePreset
+      ],
+      layout: 'BaseLayout'
+    });
+  </script>
+</body>
+</html>`

cmd/server/openapi_test.go

@@ -0,0 +1,142 @@
+package main
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestOpenAPISpecEndpoint(t *testing.T) {
+	_, r := setupTestServer(t)
+
+	req := httptest.NewRequest("GET", "/api/spec", nil)
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d", w.Code)
+	}
+
+	ct := w.Header().Get("Content-Type")
+	if ct != "application/json; charset=utf-8" {
+		t.Errorf("unexpected content-type: %s", ct)
+	}
+
+	var spec map[string]interface{}
+	if err := json.Unmarshal(w.Body.Bytes(), &spec); err != nil {
+		t.Fatalf("invalid JSON: %v", err)
+	}
+
+	// Check required OpenAPI fields
+	if spec["openapi"] != "3.0.3" {
+		t.Errorf("expected openapi 3.0.3, got %v", spec["openapi"])
+	}
+
+	info, ok := spec["info"].(map[string]interface{})
+	if !ok {
+		t.Fatal("missing info object")
+	}
+	if info["title"] != "CoreScope API" {
+		t.Errorf("unexpected title: %v", info["title"])
+	}
+
+	paths, ok := spec["paths"].(map[string]interface{})
+	if !ok {
+		t.Fatal("missing paths object")
+	}
+
+	// Should have at least 20 paths
+	if len(paths) < 20 {
+		t.Errorf("expected at least 20 paths, got %d", len(paths))
+	}
+
+	// Check a known path exists
+	if _, ok := paths["/api/nodes"]; !ok {
+		t.Error("missing /api/nodes path")
+	}
+	if _, ok := paths["/api/packets"]; !ok {
+		t.Error("missing /api/packets path")
+	}
+
+	// Check tags exist
+	tags, ok := spec["tags"].([]interface{})
+	if !ok || len(tags) == 0 {
+		t.Error("missing or empty tags")
+	}
+
+	// Check security schemes
+	components, ok := spec["components"].(map[string]interface{})
+	if !ok {
+		t.Fatal("missing components")
+	}
+	schemes, ok := components["securitySchemes"].(map[string]interface{})
+	if !ok {
+		t.Fatal("missing securitySchemes")
+	}
+	if _, ok := schemes["ApiKeyAuth"]; !ok {
+		t.Error("missing ApiKeyAuth security scheme")
+	}
+
+	// Spec should NOT contain /api/spec or /api/docs (self-referencing)
+	if _, ok := paths["/api/spec"]; ok {
+		t.Error("/api/spec should not appear in the spec")
+	}
+	if _, ok := paths["/api/docs"]; ok {
+		t.Error("/api/docs should not appear in the spec")
+	}
+}
+
+func TestSwaggerUIEndpoint(t *testing.T) {
+	_, r := setupTestServer(t)
+
+	req := httptest.NewRequest("GET", "/api/docs", nil)
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d", w.Code)
+	}
+
+	ct := w.Header().Get("Content-Type")
+	if ct != "text/html; charset=utf-8" {
+		t.Errorf("unexpected content-type: %s", ct)
+	}
+
+	body := w.Body.String()
+	if len(body) < 100 {
+		t.Error("response too short for Swagger UI HTML")
+	}
+	if !strings.Contains(body, "swagger-ui") {
+		t.Error("response doesn't contain swagger-ui reference")
+	}
+	if !strings.Contains(body, "/api/spec") {
+		t.Error("response doesn't point to /api/spec")
+	}
+}
+
+func TestExtractPathParams(t *testing.T) {
+	tests := []struct {
+		path   string
+		expect []string
+	}{
+		{"/api/nodes", nil},
+		{"/api/nodes/{pubkey}", []string{"pubkey"}},
+		{"/api/channels/{hash}/messages", []string{"hash"}},
+	}
+	for _, tt := range tests {
+		got := extractPathParams(tt.path)
+		if len(got) != len(tt.expect) {
+			t.Errorf("extractPathParams(%q) = %v, want %v", tt.path, got, tt.expect)
+			continue
+		}
+		for i := range got {
+			if got[i] != tt.expect[i] {
+				t.Errorf("extractPathParams(%q)[%d] = %q, want %q", tt.path, i, got[i], tt.expect[i])
+			}
+		}
+	}
+}
+
+

cmd/server/routes.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"crypto/subtle"
 	"database/sql"
 	"encoding/json"
 	"fmt"
@@ -42,6 +43,9 @@ type Server struct {
 	// Neighbor affinity graph (lazy-built, cached with TTL)
 	neighborMu    sync.Mutex
 	neighborGraph *NeighborGraph
+
+	// Router reference for OpenAPI spec generation
+	router *mux.Router
 }
 
 // PerfStats tracks request performance.
@@ -98,9 +102,13 @@ func (s *Server) getMemStats() runtime.MemStats {
 
 // RegisterRoutes sets up all HTTP routes on the given router.
 func (s *Server) RegisterRoutes(r *mux.Router) {
+	s.router = r
 	// Performance instrumentation middleware
 	r.Use(s.perfMiddleware)
 
+	// Backfill status header middleware
+	r.Use(s.backfillStatusMiddleware)
+
 	// Config endpoints
 	r.HandleFunc("/api/config/cache", s.handleConfigCache).Methods("GET")
 	r.HandleFunc("/api/config/client", s.handleConfigClient).Methods("GET")
@@ -134,6 +142,9 @@ func (s *Server) RegisterRoutes(r *mux.Router) {
 	r.HandleFunc("/api/nodes/{pubkey}/health", s.handleNodeHealth).Methods("GET")
 	r.HandleFunc("/api/nodes/{pubkey}/paths", s.handleNodePaths).Methods("GET")
 	r.HandleFunc("/api/nodes/{pubkey}/analytics", s.handleNodeAnalytics).Methods("GET")
+	r.HandleFunc("/api/nodes/clock-skew", s.handleFleetClockSkew).Methods("GET")
+	r.HandleFunc("/api/nodes/{pubkey}/clock-skew", s.handleNodeClockSkew).Methods("GET")
+	r.HandleFunc("/api/observers/clock-skew", s.handleObserverClockSkew).Methods("GET")
 	r.HandleFunc("/api/nodes/{pubkey}/neighbors", s.handleNodeNeighbors).Methods("GET")
 	r.HandleFunc("/api/nodes/{pubkey}", s.handleNodeDetail).Methods("GET")
 	r.HandleFunc("/api/nodes", s.handleNodes).Methods("GET")
@@ -162,6 +173,21 @@ func (s *Server) RegisterRoutes(r *mux.Router) {
 	r.HandleFunc("/api/traces/{hash}", s.handleTraces).Methods("GET")
 	r.HandleFunc("/api/iata-coords", s.handleIATACoords).Methods("GET")
 	r.HandleFunc("/api/audio-lab/buckets", s.handleAudioLabBuckets).Methods("GET")
+
+	// OpenAPI spec + Swagger UI
+	r.HandleFunc("/api/spec", s.handleOpenAPISpec).Methods("GET")
+	r.HandleFunc("/api/docs", s.handleSwaggerUI).Methods("GET")
+}
+
+func (s *Server) backfillStatusMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if s.store != nil && s.store.backfillComplete.Load() {
+			w.Header().Set("X-CoreScope-Status", "ready")
+		} else {
+			w.Header().Set("X-CoreScope-Status", "backfilling")
+		}
+		next.ServeHTTP(w, r)
+	})
 }
 
 func (s *Server) perfMiddleware(next http.Handler) http.Handler {
@@ -224,10 +250,15 @@ func (s *Server) requireAPIKey(next http.Handler) http.Handler {
 			writeError(w, http.StatusForbidden, "write endpoints disabled — set apiKey in config.json")
 			return
 		}
-		if r.Header.Get("X-API-Key") != s.cfg.APIKey {
+		key := r.Header.Get("X-API-Key")
+		if !constantTimeEqual(key, s.cfg.APIKey) {
 			writeError(w, http.StatusUnauthorized, "unauthorized")
 			return
 		}
+		if IsWeakAPIKey(key) {
+			writeError(w, http.StatusForbidden, "forbidden")
+			return
+		}
 		next.ServeHTTP(w, r)
 	})
 }
@@ -418,10 +449,12 @@ func (s *Server) handleHealth(w http.ResponseWriter, r *http.Request) {
 	// Real packet store stats
 	pktCount := 0
 	var pktEstMB float64
+	var pktTrackedMB float64
 	if s.store != nil {
 		ps := s.store.GetPerfStoreStatsTyped()
 		pktCount = ps.TotalLoaded
 		pktEstMB = ps.EstimatedMB
+		pktTrackedMB = ps.TrackedMB
 	}
 
 	// Real cache stats
@@ -487,6 +520,7 @@ func (s *Server) handleHealth(w http.ResponseWriter, r *http.Request) {
 		PacketStore: HealthPacketStoreStats{
 			Packets:     pktCount,
 			EstimatedMB: pktEstMB,
+			TrackedMB:   pktTrackedMB,
 		},
 		Perf: HealthPerfStats{
 			TotalRequests: int(perfRequests),
@@ -521,6 +555,19 @@ func (s *Server) handleStats(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	counts := s.db.GetRoleCounts()
+
+	// Compute backfill progress
+	backfilling := s.store != nil && !s.store.backfillComplete.Load()
+	var backfillProgress float64
+	if backfilling && s.store != nil && s.store.backfillTotal.Load() > 0 {
+		backfillProgress = float64(s.store.backfillProcessed.Load()) / float64(s.store.backfillTotal.Load())
+		if backfillProgress > 1 {
+			backfillProgress = 1
+		}
+	} else if !backfilling {
+		backfillProgress = 1
+	}
+
 	resp := &StatsResponse{
 		TotalPackets:       stats.TotalPackets,
 		TotalTransmissions: &stats.TotalTransmissions,
@@ -540,6 +587,8 @@ func (s *Server) handleStats(w http.ResponseWriter, r *http.Request) {
 			Companions: counts["companions"],
 			Sensors:    counts["sensors"],
 		},
+		Backfilling:      backfilling,
+		BackfillProgress: backfillProgress,
 	}
 
 	s.statsMu.Lock()
@@ -887,7 +936,7 @@ func (s *Server) handleDecode(w http.ResponseWriter, r *http.Request) {
 		writeError(w, 400, "hex is required")
 		return
 	}
-	decoded, err := DecodePacket(hexStr)
+	decoded, err := DecodePacket(hexStr, true)
 	if err != nil {
 		writeError(w, 400, err.Error())
 		return
@@ -919,7 +968,7 @@ func (s *Server) handlePostPacket(w http.ResponseWriter, r *http.Request) {
 		writeError(w, 400, "hex is required")
 		return
 	}
-	decoded, err := DecodePacket(hexStr)
+	decoded, err := DecodePacket(hexStr, false)
 	if err != nil {
 		writeError(w, 400, err.Error())
 		return
@@ -1133,6 +1182,17 @@ func (s *Server) handleNodePaths(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
+	// Post-filter: verify target node actually appears in each candidate's resolved_path.
+	// The byPathHop index uses short prefixes which can collide (e.g. "c0" matches multiple nodes).
+	// We lean on resolved_path (from neighbor affinity graph) to disambiguate.
+	filtered := candidates[:0] // reuse backing array
+	for _, tx := range candidates {
+		if nodeInResolvedPath(tx, lowerPK) {
+			filtered = append(filtered, tx)
+		}
+	}
+	candidates = filtered
+
 	type pathAgg struct {
 		Hops       []PathHopResp
 		Count      int
@@ -1258,6 +1318,36 @@ func (s *Server) handleNodeAnalytics(w http.ResponseWriter, r *http.Request) {
 	writeError(w, 404, "Not found")
 }
 
+func (s *Server) handleNodeClockSkew(w http.ResponseWriter, r *http.Request) {
+	pubkey := mux.Vars(r)["pubkey"]
+	if s.store == nil {
+		writeError(w, 404, "Not found")
+		return
+	}
+	result := s.store.GetNodeClockSkew(pubkey)
+	if result == nil {
+		writeError(w, 404, "No clock skew data for this node")
+		return
+	}
+	writeJSON(w, result)
+}
+
+func (s *Server) handleObserverClockSkew(w http.ResponseWriter, r *http.Request) {
+	if s.store == nil {
+		writeJSON(w, []ObserverCalibration{})
+		return
+	}
+	writeJSON(w, s.store.GetObserverCalibrations())
+}
+
+func (s *Server) handleFleetClockSkew(w http.ResponseWriter, r *http.Request) {
+	if s.store == nil {
+		writeJSON(w, []*NodeClockSkew{})
+		return
+	}
+	writeJSON(w, s.store.GetFleetClockSkew())
+}
+
 // --- Analytics Handlers ---
 
 func (s *Server) handleAnalyticsRF(w http.ResponseWriter, r *http.Request) {
@@ -1598,18 +1688,35 @@ func (s *Server) handleResolveHops(w http.ResponseWriter, r *http.Request) {
 }
 
 func (s *Server) handleChannels(w http.ResponseWriter, r *http.Request) {
-	if s.store != nil {
-		region := r.URL.Query().Get("region")
-		channels := s.store.GetChannels(region)
+	region := r.URL.Query().Get("region")
+	includeEncrypted := r.URL.Query().Get("includeEncrypted") == "true"
+	// Prefer DB for full history (in-memory store has limited retention)
+	if s.db != nil {
+		channels, err := s.db.GetChannels(region)
+		if err != nil {
+			writeError(w, 500, err.Error())
+			return
+		}
+		if includeEncrypted {
+			encrypted, err := s.db.GetEncryptedChannels(region)
+			if err != nil {
+				log.Printf("WARN GetEncryptedChannels: %v", err)
+			} else {
+				channels = append(channels, encrypted...)
+			}
+		}
 		writeJSON(w, ChannelListResponse{Channels: channels})
 		return
 	}
-	channels, err := s.db.GetChannels()
-	if err != nil {
-		writeError(w, 500, err.Error())
+	if s.store != nil {
+		channels := s.store.GetChannels(region)
+		if includeEncrypted {
+			channels = append(channels, s.store.GetEncryptedChannels(region)...)
+		}
+		writeJSON(w, ChannelListResponse{Channels: channels})
 		return
 	}
-	writeJSON(w, ChannelListResponse{Channels: channels})
+	writeJSON(w, ChannelListResponse{Channels: []map[string]interface{}{}})
 }
 
 func (s *Server) handleChannelMessages(w http.ResponseWriter, r *http.Request) {
@@ -1617,17 +1724,22 @@ func (s *Server) handleChannelMessages(w http.ResponseWriter, r *http.Request) {
 	limit := queryInt(r, "limit", 100)
 	offset := queryInt(r, "offset", 0)
 	region := r.URL.Query().Get("region")
+	// Prefer DB for full history (in-memory store has limited retention)
+	if s.db != nil {
+		messages, total, err := s.db.GetChannelMessages(hash, limit, offset, region)
+		if err != nil {
+			writeError(w, 500, err.Error())
+			return
+		}
+		writeJSON(w, ChannelMessagesResponse{Messages: messages, Total: total})
+		return
+	}
 	if s.store != nil {
 		messages, total := s.store.GetChannelMessages(hash, limit, offset, region)
 		writeJSON(w, ChannelMessagesResponse{Messages: messages, Total: total})
 		return
 	}
-	messages, total, err := s.db.GetChannelMessages(hash, limit, offset, region)
-	if err != nil {
-		writeError(w, 500, err.Error())
-		return
-	}
-	writeJSON(w, ChannelMessagesResponse{Messages: messages, Total: total})
+	writeJSON(w, ChannelMessagesResponse{Messages: []map[string]interface{}{}, Total: 0})
 }
 
 func (s *Server) handleObservers(w http.ResponseWriter, r *http.Request) {
@@ -2281,3 +2393,8 @@ func (s *Server) handleAdminPrune(w http.ResponseWriter, r *http.Request) {
 	log.Printf("[prune] deleted %d transmissions older than %d days", n, days)
 	writeJSON(w, map[string]interface{}{"deleted": n, "days": days})
 }
+
+// constantTimeEqual compares two strings in constant time to prevent timing attacks.
+func constantTimeEqual(a, b string) bool {
+	return subtle.ConstantTimeCompare([]byte(a), []byte(b)) == 1
+}

cmd/server/routes_test.go

@@ -6,6 +6,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"strconv"
+	"strings"
 	"testing"
 	"time"
 
@@ -47,7 +48,7 @@ func setupTestServerWithAPIKey(t *testing.T, apiKey string) (*Server, *mux.Route
 }
 
 func TestWriteEndpointsRequireAPIKey(t *testing.T) {
-	_, router := setupTestServerWithAPIKey(t, "test-secret")
+	_, router := setupTestServerWithAPIKey(t, "test-secret-key-strong-enough")
 
 	t.Run("missing key returns 401", func(t *testing.T) {
 		req := httptest.NewRequest("POST", "/api/perf/reset", nil)
@@ -65,7 +66,7 @@ func TestWriteEndpointsRequireAPIKey(t *testing.T) {
 
 	t.Run("wrong key returns 401", func(t *testing.T) {
 		req := httptest.NewRequest("POST", "/api/perf/reset", nil)
-		req.Header.Set("X-API-Key", "wrong-secret")
+		req.Header.Set("X-API-Key", "wrong-secret-key-strong-enough")
 		w := httptest.NewRecorder()
 		router.ServeHTTP(w, req)
 		if w.Code != http.StatusUnauthorized {
@@ -75,7 +76,7 @@ func TestWriteEndpointsRequireAPIKey(t *testing.T) {
 
 	t.Run("correct key passes", func(t *testing.T) {
 		req := httptest.NewRequest("POST", "/api/perf/reset", nil)
-		req.Header.Set("X-API-Key", "test-secret")
+		req.Header.Set("X-API-Key", "test-secret-key-strong-enough")
 		w := httptest.NewRecorder()
 		router.ServeHTTP(w, req)
 		if w.Code != http.StatusOK {
@@ -169,6 +170,9 @@ func TestHealthEndpoint(t *testing.T) {
 	if _, ok := pktStore["estimatedMB"]; !ok {
 		t.Error("expected estimatedMB in packetStore")
 	}
+	if _, ok := pktStore["trackedMB"]; !ok {
+		t.Error("expected trackedMB in packetStore")
+	}
 
 	// Verify eventLoop (GC pause metrics matching Node.js shape)
 	el, ok := body["eventLoop"].(map[string]interface{})
@@ -773,6 +777,67 @@ func TestNodeHealthNotFound(t *testing.T) {
 	}
 }
 
+// TestNodeHealthPartialFromPackets verifies that a node with packets in the
+// in-memory store but no DB entry returns a partial 200 response instead of 404.
+// This is the fix for issue #665 (companion nodes without adverts).
+func TestNodeHealthPartialFromPackets(t *testing.T) {
+	srv, router := setupTestServer(t)
+
+	// Inject a packet into byNode for a pubkey that doesn't exist in the nodes table
+	ghostPubkey := "ghost_companion_no_advert"
+	now := time.Now().UTC().Format(time.RFC3339)
+	snr := 5.0
+	srv.store.mu.Lock()
+	if srv.store.byNode == nil {
+		srv.store.byNode = make(map[string][]*StoreTx)
+	}
+	if srv.store.nodeHashes == nil {
+		srv.store.nodeHashes = make(map[string]map[string]bool)
+	}
+	srv.store.byNode[ghostPubkey] = []*StoreTx{
+		{Hash: "abc123", FirstSeen: now, SNR: &snr, ObservationCount: 1},
+	}
+	srv.store.nodeHashes[ghostPubkey] = map[string]bool{"abc123": true}
+	srv.store.mu.Unlock()
+
+	req := httptest.NewRequest("GET", "/api/nodes/"+ghostPubkey+"/health", nil)
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+
+	if w.Code != 200 {
+		t.Fatalf("expected 200 for ghost companion, got %d (body: %s)", w.Code, w.Body.String())
+	}
+
+	var body map[string]interface{}
+	if err := json.Unmarshal(w.Body.Bytes(), &body); err != nil {
+		t.Fatalf("json unmarshal: %v", err)
+	}
+
+	// Should have a synthetic node stub
+	node, ok := body["node"].(map[string]interface{})
+	if !ok || node == nil {
+		t.Fatal("expected node in response")
+	}
+	if node["role"] != "unknown" {
+		t.Errorf("expected role=unknown, got %v", node["role"])
+	}
+	if node["public_key"] != ghostPubkey {
+		t.Errorf("expected public_key=%s, got %v", ghostPubkey, node["public_key"])
+	}
+
+	// Should have stats from the packet
+	stats, ok := body["stats"].(map[string]interface{})
+	if !ok || stats == nil {
+		t.Fatal("expected stats in response")
+	}
+	if stats["totalPackets"] != 1.0 { // JSON numbers are float64
+		t.Errorf("expected totalPackets=1, got %v", stats["totalPackets"])
+	}
+	if stats["lastHeard"] == nil {
+		t.Error("expected lastHeard to be set")
+	}
+}
+
 func TestBulkHealthEndpoint(t *testing.T) {
 	_, router := setupTestServer(t)
 	req := httptest.NewRequest("GET", "/api/nodes/bulk-health?limit=10", nil)
@@ -2154,8 +2219,8 @@ pk := "abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890"
 db.conn.Exec("INSERT OR IGNORE INTO nodes (public_key, name, role) VALUES (?, 'TestNode', 'repeater')", pk)
 
 decoded := `{"name":"TestNode","pubKey":"` + pk + `"}`
-raw1 := "04" + "00" + "aabb"
-raw2 := "04" + "40" + "aabb"
+raw1 := "11" + "01" + "aabb"
+raw2 := "11" + "41" + "aabb"
 
 payloadType := 4
 for i := 0; i < 3; i++ {
@@ -2202,8 +2267,8 @@ pk := "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
 db.conn.Exec("INSERT OR IGNORE INTO nodes (public_key, name, role) VALUES (?, 'Repeater2B', 'repeater')", pk)
 
 decoded := `{"name":"Repeater2B","pubKey":"` + pk + `"}`
-raw1byte := "04" + "00" + "aabb" // pathByte=0x00 → hashSize=1 (direct send, no hops)
-raw2byte := "04" + "40" + "aabb" // pathByte=0x40 → hashSize=2
+raw1byte := "11" + "01" + "aabb" // FLOOD, pathByte=0x01 → hashSize=1
+raw2byte := "11" + "41" + "aabb" // FLOOD, pathByte=0x41 → hashSize=2
 
 payloadType := 4
 // 1 packet with hashSize=1, 4 packets with hashSize=2 (latest is 2-byte)
@@ -2245,8 +2310,8 @@ func TestGetNodeHashSizeInfoLatestWins(t *testing.T) {
 	db.conn.Exec("INSERT OR IGNORE INTO nodes (public_key, name, role) VALUES (?, 'LatestWins', 'repeater')", pk)
 
 	decoded := `{"name":"LatestWins","pubKey":"` + pk + `"}`
-	raw1byte := "04" + "00" + "aabb" // pathByte=0x00 → hashSize=1
-	raw2byte := "04" + "40" + "aabb" // pathByte=0x40 → hashSize=2
+	raw1byte := "11" + "01" + "aabb" // FLOOD, pathByte=0x01 → hashSize=1
+	raw2byte := "11" + "41" + "aabb" // FLOOD, pathByte=0x41 → hashSize=2
 
 	payloadType := 4
 	// 4 historical 1-byte adverts, then 1 recent 2-byte advert (latest).
@@ -2451,6 +2516,7 @@ func TestHashAnalyticsZeroHopAdvert(t *testing.T) {
 
 	pk := "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"
 	db.conn.Exec("INSERT OR IGNORE INTO nodes (public_key, name, role) VALUES (?, 'ZeroHop', 'repeater')", pk)
+	store.InvalidateNodeCache()
 
 	decoded := `{"name":"ZeroHop","pubKey":"` + pk + `"}`
 	// header 0x05 → routeType=1 (FLOOD), pathByte=0x00 → hashSize=1
@@ -2504,6 +2570,11 @@ func TestAnalyticsHashSizeSameNameDifferentPubkey(t *testing.T) {
 	pk1 := "aaaa111122223333444455556666777788889999aaaabbbbccccddddeeee1111"
 	pk2 := "aaaa111122223333444455556666777788889999aaaabbbbccccddddeeee2222"
 
+	// Insert both nodes as repeaters so they appear in distributionByRepeaters.
+	db.conn.Exec("INSERT OR IGNORE INTO nodes (public_key, name, role) VALUES (?, 'SameName', 'repeater')", pk1)
+	db.conn.Exec("INSERT OR IGNORE INTO nodes (public_key, name, role) VALUES (?, 'SameName', 'repeater')", pk2)
+	store.InvalidateNodeCache()
+
 	decoded1 := `{"name":"SameName","pubKey":"` + pk1 + `"}`
 	decoded2 := `{"name":"SameName","pubKey":"` + pk2 + `"}`
 
@@ -3186,7 +3257,7 @@ func TestHashCollisionsClassification(t *testing.T) {
 }
 
 func TestHashCollisionsCacheTTL(t *testing.T) {
-	// Issue #420: collision cache should use dedicated TTL (60s), not rfCacheTTL (15s)
+	// Issue #420: collision cache should use dedicated TTL, default 3600s (1 hour)
 	db := setupTestDB(t)
 	seedTestData(t, db)
 	store := NewPacketStore(db, nil)
@@ -3194,8 +3265,8 @@ func TestHashCollisionsCacheTTL(t *testing.T) {
 		t.Fatalf("store.Load failed: %v", err)
 	}
 
-	if store.collisionCacheTTL != 60*time.Second {
-		t.Errorf("expected collisionCacheTTL=60s, got %v", store.collisionCacheTTL)
+	if store.collisionCacheTTL != 3600*time.Second {
+		t.Errorf("expected collisionCacheTTL=3600s, got %v", store.collisionCacheTTL)
 	}
 	if store.rfCacheTTL != 15*time.Second {
 		t.Errorf("expected rfCacheTTL=15s, got %v", store.rfCacheTTL)
@@ -3532,6 +3603,122 @@ func TestNodePathsEndpointUsesIndex(t *testing.T) {
 	}
 }
 
+func TestNodePathsPrefixCollisionFilter(t *testing.T) {
+	// Two nodes share the "aa" prefix: TestRepeater (aabbccdd11223344) and a
+	// second node (aacafe0000000000). Packets whose resolved_path points to
+	// the second node must NOT appear when querying TestRepeater's paths.
+	srv, router := setupTestServer(t)
+
+	// Manually inject a transmission whose raw path contains "aa" but whose
+	// resolved_path points to the other node (aacafe0000000000).
+	now := time.Now().UTC()
+	recent := now.Add(-30 * time.Minute).Format(time.RFC3339)
+	recentEpoch := now.Add(-30 * time.Minute).Unix()
+
+	// Insert a second node with the same 2-char prefix
+	srv.db.conn.Exec(`INSERT OR IGNORE INTO nodes (public_key, name, role, last_seen, first_seen, advert_count)
+		VALUES ('aacafe0000000000', 'CollisionNode', 'repeater', ?, '2026-01-01T00:00:00Z', 5)`, recent)
+
+	// Insert a transmission with path hop "aa" that resolves to the OTHER node
+	srv.db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
+		VALUES ('FF01', 'collision_test_hash', ?, 1, 4, '{}')`, recent)
+	// Get its ID
+	var collisionTxID int
+	srv.db.conn.QueryRow(`SELECT id FROM transmissions WHERE hash='collision_test_hash'`).Scan(&collisionTxID)
+
+	srv.db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp, resolved_path)
+		VALUES (?, 1, 10.0, -90, '["aa","bb"]', ?, '["aacafe0000000000","eeff00112233aabb"]')`,
+		collisionTxID, recentEpoch)
+
+	// Reload store to pick up new data
+	store := NewPacketStore(srv.db, nil)
+	if err := store.Load(); err != nil {
+		t.Fatalf("store.Load failed: %v", err)
+	}
+	srv.store = store
+
+	// Query paths for TestRepeater — should NOT include the collision packet
+	req := httptest.NewRequest("GET", "/api/nodes/aabbccdd11223344/paths", nil)
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+
+	if w.Code != 200 {
+		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
+	}
+
+	var resp struct {
+		Paths              []json.RawMessage `json:"paths"`
+		TotalTransmissions int               `json:"totalTransmissions"`
+	}
+	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("bad JSON: %v", err)
+	}
+
+	// The collision packet should be filtered out. Only transmission 1 (and 3
+	// if prefix matches) should remain — but transmission 3 has path "cc" and
+	// resolved_path pointing to TestRoom, so only tx 1 should match.
+	// Check that collision_test_hash is not in any path group.
+	bodyStr := w.Body.String()
+	if strings.Contains(bodyStr, "collision_test_hash") {
+		t.Error("collision packet should have been filtered out but appeared in response")
+	}
+
+	// Query paths for CollisionNode — should include the collision packet
+	req2 := httptest.NewRequest("GET", "/api/nodes/aacafe0000000000/paths", nil)
+	w2 := httptest.NewRecorder()
+	router.ServeHTTP(w2, req2)
+
+	if w2.Code != 200 {
+		t.Fatalf("expected 200 for CollisionNode, got %d: %s", w2.Code, w2.Body.String())
+	}
+
+	body2 := w2.Body.String()
+	if !strings.Contains(body2, "collision_test_hash") {
+		t.Error("collision packet should appear for CollisionNode but was missing")
+	}
+}
+
+func TestNodeInResolvedPath(t *testing.T) {
+	target := "aabbccdd11223344"
+
+	// Case 1: tx.ResolvedPath contains target
+	pk := "aabbccdd11223344"
+	tx1 := &StoreTx{ResolvedPath: []*string{&pk}}
+	if !nodeInResolvedPath(tx1, target) {
+		t.Error("should match when ResolvedPath contains target")
+	}
+
+	// Case 2: tx.ResolvedPath contains different node
+	other := "aacafe0000000000"
+	tx2 := &StoreTx{ResolvedPath: []*string{&other}}
+	if nodeInResolvedPath(tx2, target) {
+		t.Error("should not match when ResolvedPath contains different node")
+	}
+
+	// Case 3: nil ResolvedPath — should match (no data to disambiguate, keep it)
+	tx3 := &StoreTx{}
+	if !nodeInResolvedPath(tx3, target) {
+		t.Error("should match when ResolvedPath is nil (no data to disambiguate)")
+	}
+
+	// Case 4: ResolvedPath with nil elements only — has data but no match
+	tx4 := &StoreTx{ResolvedPath: []*string{nil, nil}}
+	if nodeInResolvedPath(tx4, target) {
+		t.Error("should not match when all ResolvedPath elements are nil")
+	}
+
+	// Case 5: target in observation but not in tx.ResolvedPath
+	tx5 := &StoreTx{
+		ResolvedPath: []*string{&other},
+		Observations: []*StoreObs{
+			{ResolvedPath: []*string{&pk}},
+		},
+	}
+	if !nodeInResolvedPath(tx5, target) {
+		t.Error("should match when observation's ResolvedPath contains target")
+	}
+}
+
 func TestPathHopIndexIncrementalUpdate(t *testing.T) {
 	// Test that addTxToPathHopIndex and removeTxFromPathHopIndex work correctly
 	idx := make(map[string][]*StoreTx)

cmd/server/testdata/golden/shapes.json

@@ -916,6 +916,9 @@
           },
           "estimatedMB": {
             "type": "number"
+          },
+          "trackedMB": {
+            "type": "number"
           }
         }
       },

cmd/server/touch_last_seen_test.go

@@ -0,0 +1,137 @@
+package main
+
+import (
+	"database/sql"
+	"testing"
+	"time"
+
+	_ "modernc.org/sqlite"
+)
+
+func TestTouchNodeLastSeen_UpdatesDB(t *testing.T) {
+	db := setupTestDB(t)
+	defer db.Close()
+
+	// Insert a node with no last_seen
+	db.conn.Exec("INSERT INTO nodes (public_key, name, role) VALUES (?, ?, ?)", "abc123", "relay1", "REPEATER")
+
+	err := db.TouchNodeLastSeen("abc123", "2026-04-12T04:00:00Z")
+	if err != nil {
+		t.Fatalf("TouchNodeLastSeen returned error: %v", err)
+	}
+
+	var lastSeen sql.NullString
+	db.conn.QueryRow("SELECT last_seen FROM nodes WHERE public_key = ?", "abc123").Scan(&lastSeen)
+	if !lastSeen.Valid || lastSeen.String != "2026-04-12T04:00:00Z" {
+		t.Fatalf("expected last_seen=2026-04-12T04:00:00Z, got %v", lastSeen)
+	}
+}
+
+func TestTouchNodeLastSeen_DoesNotGoBackwards(t *testing.T) {
+	db := setupTestDB(t)
+	defer db.Close()
+
+	db.conn.Exec("INSERT INTO nodes (public_key, name, role, last_seen) VALUES (?, ?, ?, ?)",
+		"abc123", "relay1", "REPEATER", "2026-04-12T05:00:00Z")
+
+	// Try to set an older timestamp
+	err := db.TouchNodeLastSeen("abc123", "2026-04-12T04:00:00Z")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	var lastSeen string
+	db.conn.QueryRow("SELECT last_seen FROM nodes WHERE public_key = ?", "abc123").Scan(&lastSeen)
+	if lastSeen != "2026-04-12T05:00:00Z" {
+		t.Fatalf("last_seen went backwards: got %s", lastSeen)
+	}
+}
+
+func TestTouchNodeLastSeen_NonExistentNode(t *testing.T) {
+	db := setupTestDB(t)
+	defer db.Close()
+
+	// Should not error for non-existent node
+	err := db.TouchNodeLastSeen("nonexistent", "2026-04-12T04:00:00Z")
+	if err != nil {
+		t.Fatalf("unexpected error for non-existent node: %v", err)
+	}
+}
+
+func TestTouchRelayLastSeen_Debouncing(t *testing.T) {
+	db := setupTestDB(t)
+	defer db.Close()
+
+	db.conn.Exec("INSERT INTO nodes (public_key, name, role) VALUES (?, ?, ?)", "relay1", "R1", "REPEATER")
+
+	s := &PacketStore{
+		db:              db,
+		lastSeenTouched: make(map[string]time.Time),
+	}
+
+	pk := "relay1"
+	tx := &StoreTx{
+		ResolvedPath: []*string{&pk},
+	}
+
+	now := time.Now()
+	s.touchRelayLastSeen(tx, now)
+
+	// Verify it was written
+	var lastSeen sql.NullString
+	db.conn.QueryRow("SELECT last_seen FROM nodes WHERE public_key = ?", "relay1").Scan(&lastSeen)
+	if !lastSeen.Valid {
+		t.Fatal("expected last_seen to be set after first touch")
+	}
+
+	// Reset last_seen to check debounce prevents second write
+	db.conn.Exec("UPDATE nodes SET last_seen = NULL WHERE public_key = ?", "relay1")
+
+	// Call again within 5 minutes — should be debounced (no write)
+	s.touchRelayLastSeen(tx, now.Add(2*time.Minute))
+
+	db.conn.QueryRow("SELECT last_seen FROM nodes WHERE public_key = ?", "relay1").Scan(&lastSeen)
+	if lastSeen.Valid {
+		t.Fatal("expected debounce to prevent second write within 5 minutes")
+	}
+
+	// Call after 5 minutes — should write again
+	s.touchRelayLastSeen(tx, now.Add(6*time.Minute))
+	db.conn.QueryRow("SELECT last_seen FROM nodes WHERE public_key = ?", "relay1").Scan(&lastSeen)
+	if !lastSeen.Valid {
+		t.Fatal("expected write after debounce interval expired")
+	}
+}
+
+func TestTouchRelayLastSeen_SkipsNilResolvedPath(t *testing.T) {
+	db := setupTestDB(t)
+	defer db.Close()
+
+	s := &PacketStore{
+		db:              db,
+		lastSeenTouched: make(map[string]time.Time),
+	}
+
+	// tx with nil entries and empty resolved_path
+	tx := &StoreTx{
+		ResolvedPath: []*string{nil, nil},
+	}
+
+	// Should not panic or error
+	s.touchRelayLastSeen(tx, time.Now())
+}
+
+func TestTouchRelayLastSeen_NilDB(t *testing.T) {
+	s := &PacketStore{
+		db:              nil,
+		lastSeenTouched: make(map[string]time.Time),
+	}
+
+	pk := "abc"
+	tx := &StoreTx{
+		ResolvedPath: []*string{&pk},
+	}
+
+	// Should not panic with nil db
+	s.touchRelayLastSeen(tx, time.Now())
+}

cmd/server/tracked_bytes_test.go

@@ -0,0 +1,168 @@
+package main
+
+import (
+	"testing"
+	"time"
+)
+
+// TestEstimateStoreTxBytes_ReasonableValues verifies the estimate function
+// returns reasonable values for different packet sizes.
+func TestEstimateStoreTxBytes_ReasonableValues(t *testing.T) {
+	tx := &StoreTx{
+		Hash:        "abcdef1234567890",
+		RawHex:      "deadbeef",
+		DecodedJSON: `{"type":"GRP_TXT"}`,
+		PathJSON:    `["hop1","hop2","hop3"]`,
+		parsedPath:  []string{"hop1", "hop2", "hop3"},
+		pathParsed:  true,
+	}
+	got := estimateStoreTxBytes(tx)
+
+	// Should be at least base (384) + maps (200) + indexes + path/subpath costs
+	if got < 700 {
+		t.Errorf("estimate too low for 3-hop tx: %d", got)
+	}
+	if got > 5000 {
+		t.Errorf("estimate unreasonably high for 3-hop tx: %d", got)
+	}
+}
+
+// TestEstimateStoreTxBytes_ManyHopsSubpaths verifies that packets with many
+// hops estimate significantly more due to O(path²) subpath index entries.
+func TestEstimateStoreTxBytes_ManyHopsSubpaths(t *testing.T) {
+	tx2 := &StoreTx{
+		Hash:       "aabb",
+		parsedPath: []string{"a", "b"},
+		pathParsed: true,
+	}
+	tx10 := &StoreTx{
+		Hash:       "aabb",
+		parsedPath: []string{"a", "b", "c", "d", "e", "f", "g", "h", "i", "j"},
+		pathParsed: true,
+	}
+	est2 := estimateStoreTxBytes(tx2)
+	est10 := estimateStoreTxBytes(tx10)
+
+	// 10 hops → 45 subpath combos × 40 = 1800 bytes just for subpaths
+	if est10 <= est2 {
+		t.Errorf("10-hop (%d) should estimate more than 2-hop (%d)", est10, est2)
+	}
+	if est10 < est2+1500 {
+		t.Errorf("10-hop (%d) should estimate at least 1500 more than 2-hop (%d)", est10, est2)
+	}
+}
+
+// TestEstimateStoreObsBytes_WithResolvedPath verifies that observations with
+// ResolvedPath estimate more than those without.
+func TestEstimateStoreObsBytes_WithResolvedPath(t *testing.T) {
+	s1, s2, s3 := "node1", "node2", "node3"
+
+	obsNoRP := &StoreObs{
+		ObserverID: "obs1",
+		PathJSON:   `["a","b"]`,
+	}
+	obsWithRP := &StoreObs{
+		ObserverID:   "obs1",
+		PathJSON:     `["a","b"]`,
+		ResolvedPath: []*string{&s1, &s2, &s3},
+	}
+
+	estNo := estimateStoreObsBytes(obsNoRP)
+	estWith := estimateStoreObsBytes(obsWithRP)
+
+	if estWith <= estNo {
+		t.Errorf("obs with ResolvedPath (%d) should estimate more than without (%d)", estWith, estNo)
+	}
+}
+
+// TestEstimateStoreObsBytes_ManyObservations verifies that 15 observations
+// estimate significantly more than 1.
+func TestEstimateStoreObsBytes_ManyObservations(t *testing.T) {
+	est1 := estimateStoreObsBytes(&StoreObs{ObserverID: "a", PathJSON: `["x"]`})
+	est15 := int64(0)
+	for i := 0; i < 15; i++ {
+		est15 += estimateStoreObsBytes(&StoreObs{ObserverID: "a", PathJSON: `["x"]`})
+	}
+	if est15 <= est1*10 {
+		t.Errorf("15 obs total (%d) should be >10x single obs (%d)", est15, est1)
+	}
+}
+
+// TestTrackedBytesMatchesSumAfterInsert verifies that trackedBytes equals the
+// sum of individual estimates after inserting packets via makeTestStore.
+func TestTrackedBytesMatchesSumAfterInsert(t *testing.T) {
+	store := makeTestStore(20, time.Now().Add(-2*time.Hour), 5)
+
+	// Manually compute trackedBytes as sum of estimates
+	var expectedSum int64
+	for _, tx := range store.packets {
+		expectedSum += estimateStoreTxBytes(tx)
+		for _, obs := range tx.Observations {
+			expectedSum += estimateStoreObsBytes(obs)
+		}
+	}
+
+	if store.trackedBytes != expectedSum {
+		t.Errorf("trackedBytes=%d, expected sum=%d", store.trackedBytes, expectedSum)
+	}
+}
+
+// TestEvictionTriggersWithImprovedEstimates verifies that eviction triggers
+// at the right point with the improved (higher) estimates.
+func TestEvictionTriggersWithImprovedEstimates(t *testing.T) {
+	store := makeTestStore(100, time.Now().Add(-10*time.Hour), 5)
+
+	// trackedBytes for 100 packets is small — artificially set maxMemoryMB
+	// so highWatermark is just below trackedBytes to trigger eviction.
+	highWatermarkBytes := store.trackedBytes - 1000
+	if highWatermarkBytes < 1 {
+		highWatermarkBytes = 1
+	}
+	// maxMemoryMB * 1048576 = highWatermark, so maxMemoryMB = ceil(highWatermarkBytes / 1048576)
+	// But that'll be 0 for small values. Instead, directly set trackedBytes high.
+	store.trackedBytes = 6 * 1048576 // 6MB
+	store.maxMemoryMB = 3            // 3MB limit
+
+	beforeCount := len(store.packets)
+	store.RunEviction()
+	afterCount := len(store.packets)
+
+	if afterCount >= beforeCount {
+		t.Errorf("expected eviction to remove packets: before=%d, after=%d, trackedBytes=%d, maxMB=%d",
+			beforeCount, afterCount, store.trackedBytes, store.maxMemoryMB)
+	}
+	// trackedBytes should have decreased
+	if store.trackedBytes >= 6*1048576 {
+		t.Errorf("trackedBytes should have decreased after eviction")
+	}
+}
+
+// BenchmarkEstimateStoreTxBytes verifies the estimate function is fast.
+func BenchmarkEstimateStoreTxBytes(b *testing.B) {
+	tx := &StoreTx{
+		Hash:        "abcdef1234567890",
+		RawHex:      "deadbeefdeadbeef",
+		DecodedJSON: `{"type":"GRP_TXT","payload":"hello"}`,
+		PathJSON:    `["hop1","hop2","hop3","hop4","hop5"]`,
+		parsedPath:  []string{"hop1", "hop2", "hop3", "hop4", "hop5"},
+		pathParsed:  true,
+	}
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		estimateStoreTxBytes(tx)
+	}
+}
+
+// BenchmarkEstimateStoreObsBytes verifies the obs estimate function is fast.
+func BenchmarkEstimateStoreObsBytes(b *testing.B) {
+	s := "resolvedNodePubkey123456"
+	obs := &StoreObs{
+		ObserverID:   "observer1234",
+		PathJSON:     `["a","b","c"]`,
+		ResolvedPath: []*string{&s, &s, &s},
+	}
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		estimateStoreObsBytes(obs)
+	}
+}

cmd/server/types.go

@@ -68,6 +68,8 @@ type StatsResponse struct {
 	Commit             string     `json:"commit"`
 	BuildTime          string     `json:"buildTime"`
 	Counts             RoleCounts `json:"counts"`
+	Backfilling        bool       `json:"backfilling"`
+	BackfillProgress   float64    `json:"backfillProgress"`
 }
 
 // ─── Health ────────────────────────────────────────────────────────────────────
@@ -113,6 +115,7 @@ type WebSocketStatsResp struct {
 type HealthPacketStoreStats struct {
 	Packets     int     `json:"packets"`
 	EstimatedMB float64 `json:"estimatedMB"`
+	TrackedMB   float64 `json:"trackedMB"`
 }
 
 type SlowQuery struct {
@@ -172,6 +175,8 @@ type PerfPacketStoreStats struct {
 	SqliteOnly        bool               `json:"sqliteOnly"`
 	MaxPackets        int                `json:"maxPackets"`
 	EstimatedMB       float64            `json:"estimatedMB"`
+	TrackedMB         float64            `json:"trackedMB"`
+	AvgBytesPerPacket int64              `json:"avgBytesPerPacket"`
 	MaxMB             int                `json:"maxMB"`
 	Indexes           PacketStoreIndexes `json:"indexes"`
 }
@@ -464,6 +469,7 @@ type NodeAnalyticsResponse struct {
 	PeerInteractions    []PeerInteraction       `json:"peerInteractions"`
 	UptimeHeatmap       []HeatmapCell           `json:"uptimeHeatmap"`
 	ComputedStats       ComputedNodeStats       `json:"computedStats"`
+	ClockSkew           *NodeClockSkew          `json:"clockSkew,omitempty"`
 }
 
 // ─── Analytics — RF ────────────────────────────────────────────────────────────

config.example.json

@@ -8,13 +8,15 @@
   },
   "https": {
     "cert": "/path/to/cert.pem",
-    "key": "/path/to/key.pem"
+    "key": "/path/to/key.pem",
+    "_comment": "TLS cert/key paths for direct HTTPS. Most deployments use Caddy (included in Docker) for auto-TLS instead."
   },
   "branding": {
     "siteName": "CoreScope",
     "tagline": "Real-time MeshCore LoRa mesh network analyzer",
     "logoUrl": null,
-    "faviconUrl": null
+    "faviconUrl": null,
+    "_comment": "Customize site name, tagline, logo, and favicon. logoUrl/faviconUrl can be absolute URLs or relative paths."
   },
   "theme": {
     "accent": "#4a9eff",
@@ -23,38 +25,75 @@
     "navBg2": "#1a1a2e",
     "statusGreen": "#45644c",
     "statusYellow": "#b08b2d",
-    "statusRed": "#b54a4a"
+    "statusRed": "#b54a4a",
+    "_comment": "CSS color overrides. Use the in-app Theme Customizer for live preview, then export values here."
   },
   "nodeColors": {
     "repeater": "#dc2626",
     "companion": "#2563eb",
     "room": "#16a34a",
     "sensor": "#d97706",
-    "observer": "#8b5cf6"
+    "observer": "#8b5cf6",
+    "_comment": "Marker/badge colors per node role. Used on map, nodes list, and live feed."
   },
   "home": {
     "heroTitle": "CoreScope",
     "heroSubtitle": "Find your nodes to start monitoring them.",
     "steps": [
-      { "emoji": "📡", "title": "Connect", "description": "Link your node to the mesh" },
-      { "emoji": "🔍", "title": "Monitor", "description": "Watch packets flow in real-time" },
-      { "emoji": "📊", "title": "Analyze", "description": "Understand your network's health" }
+      {
+        "emoji": "\ud83d\udce1",
+        "title": "Connect",
+        "description": "Link your node to the mesh"
+      },
+      {
+        "emoji": "\ud83d\udd0d",
+        "title": "Monitor",
+        "description": "Watch packets flow in real-time"
+      },
+      {
+        "emoji": "\ud83d\udcca",
+        "title": "Analyze",
+        "description": "Understand your network's health"
+      }
     ],
     "checklist": [
-      { "question": "How do I add my node?", "answer": "Search for your node name or paste your public key." },
-      { "question": "What regions are covered?", "answer": "Check the map page to see active observers and nodes." }
+      {
+        "question": "How do I add my node?",
+        "answer": "Search for your node name or paste your public key."
+      },
+      {
+        "question": "What regions are covered?",
+        "answer": "Check the map page to see active observers and nodes."
+      }
     ],
     "footerLinks": [
-      { "label": "📦 Packets", "url": "#/packets" },
-      { "label": "🗺️ Network Map", "url": "#/map" },
-      { "label": "🔴 Live", "url": "#/live" },
-      { "label": "📡 All Nodes", "url": "#/nodes" },
-      { "label": "💬 Channels", "url": "#/channels" }
-    ]
+      {
+        "label": "\ud83d\udce6 Packets",
+        "url": "#/packets"
+      },
+      {
+        "label": "\ud83d\uddfa\ufe0f Network Map",
+        "url": "#/map"
+      },
+      {
+        "label": "\ud83d\udd34 Live",
+        "url": "#/live"
+      },
+      {
+        "label": "\ud83d\udce1 All Nodes",
+        "url": "#/nodes"
+      },
+      {
+        "label": "\ud83d\udcac Channels",
+        "url": "#/channels"
+      }
+    ],
+    "_comment": "Customize the landing page hero, onboarding steps, FAQ, and footer links."
   },
   "mqtt": {
     "broker": "mqtt://localhost:1883",
-    "topic": "meshcore/+/+/packets"
+    "topic": "meshcore/+/+/packets",
+    "_comment": "Legacy single-broker config. Prefer mqttSources[] for multiple brokers."
   },
   "mqttSources": [
     {
@@ -86,7 +125,7 @@
     }
   ],
   "channelKeys": {
-    "public": "8b3387e9c5cdea6ac9e5edbaa115cd72"
+    "Public": "8b3387e9c5cdea6ac9e5edbaa115cd72"
   },
   "hashChannels": [
     "#LongFast",
@@ -114,6 +153,16 @@
     ],
     "zoom": 9
   },
+  "geo_filter": {
+    "polygon": [
+      [37.80, -122.52],
+      [37.80, -121.80],
+      [37.20, -121.80],
+      [37.20, -122.52]
+    ],
+    "bufferKm": 20,
+    "_comment": "Optional. Restricts ingestion and API responses to nodes within the polygon + bufferKm. Polygon is an array of [lat, lon] pairs (minimum 3). Use tools/geofilter-builder.html to draw a polygon visually. Remove this section to disable filtering. Nodes with no GPS fix are always allowed through."
+  },
   "regions": {
     "SJC": "San Jose, US",
     "SFO": "San Francisco, US",
@@ -150,11 +199,26 @@
     "timezone": "local",
     "formatPreset": "iso",
     "customFormat": "",
-    "allowCustomFormat": false
+    "allowCustomFormat": false,
+    "_comment": "defaultMode: ago|local|iso. timezone: local|utc. formatPreset: iso|us|eu. customFormat: strftime-style (requires allowCustomFormat: true)."
   },
   "packetStore": {
     "maxMemoryMB": 1024,
     "estimatedPacketBytes": 450,
     "_comment": "In-memory packet store. maxMemoryMB caps RAM usage. All packets loaded on startup, served from RAM."
-  }
-}
+  },
+  "resolvedPath": {
+    "backfillHours": 24,
+    "_comment": "How far back (hours) the async backfill scans for observations with NULL resolved_path. Default: 24. Set higher to backfill older data, lower to speed up startup."
+  },
+  "neighborGraph": {
+    "maxAgeDays": 5,
+    "_comment": "Neighbor edges older than this many days are pruned on startup and daily. Default: 5."
+  },
+  "_comment_mqttSources": "Each source connects to an MQTT broker. topics: what to subscribe to. iataFilter: only ingest packets from these regions (optional).",
+  "_comment_channelKeys": "Hex keys for decrypting channel messages. Key name = channel display name. public channel key is well-known.",
+  "_comment_hashChannels": "Channel names whose keys are derived via SHA256. Key = SHA256(name)[:16]. Listed here so the ingestor can auto-derive keys.",
+  "_comment_defaultRegion": "IATA code shown by default in region filters.",
+  "_comment_mapDefaults": "Initial map center [lat, lon] and zoom level.",
+  "_comment_regions": "IATA code to display name mapping. Packets are tagged with region codes by MQTT topic structure."
+}

docker-compose.example.yml

@@ -0,0 +1,20 @@
+# CoreScope — simple deployment using pre-built image from GHCR
+# Usage: docker compose -f docker-compose.example.yml up -d
+# Docs:  https://github.com/Kpa-clawbot/CoreScope/blob/master/DEPLOY.md
+
+services:
+  corescope:
+    image: ghcr.io/kpa-clawbot/corescope:latest
+    ports:
+      - "${HTTP_PORT:-80}:80"
+    volumes:
+      - ${DATA_DIR:-./data}:/app/data
+    environment:
+      - DISABLE_CADDY=${DISABLE_CADDY:-true}
+      - DISABLE_MOSQUITTO=${DISABLE_MOSQUITTO:-false}
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/stats"]
+      interval: 30s
+      timeout: 5s
+      retries: 3

docker-compose.staging.yml

@@ -15,15 +15,11 @@ services:
     restart: unless-stopped
     stop_grace_period: 30s
     stop_signal: SIGTERM
-    deploy:
-      resources:
-        limits:
-          memory: 3g
     extra_hosts:
       - "host.docker.internal:host-gateway"
     ports:
-      - "${STAGING_GO_HTTP_PORT:-82}:80"
-      - "${STAGING_GO_MQTT_PORT:-1885}:1883"
+      - "${STAGING_GO_HTTP_PORT:-80}:80"
+      - "${STAGING_GO_MQTT_PORT:-1883}:1883"
       - "6060:6060"   # pprof server
       - "6061:6061"   # pprof ingestor
     volumes:
@@ -33,6 +29,7 @@ services:
       - NODE_ENV=staging
       - ENABLE_PPROF=true
       - DISABLE_MOSQUITTO=${DISABLE_MOSQUITTO:-false}
+      - DISABLE_CADDY=${DISABLE_CADDY:-false}
     healthcheck:
       test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/stats"]
       interval: 30s

docker-compose.yml

@@ -29,6 +29,7 @@ services:
     environment:
       - NODE_ENV=production
       - DISABLE_MOSQUITTO=${DISABLE_MOSQUITTO:-false}
+      - DISABLE_CADDY=${DISABLE_CADDY:-false}
     healthcheck:
       test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/stats"]
       interval: 30s

docker/entrypoint-go.sh

@@ -14,10 +14,24 @@ if [ -f /app/data/theme.json ]; then
   ln -sf /app/data/theme.json /app/theme.json
 fi
 
+# Source .env from data volume if present (works with any launch method)
+if [ -f /app/data/.env ]; then
+  set -a
+  . /app/data/.env
+  set +a
+fi
+
 SUPERVISORD_CONF="/etc/supervisor/conf.d/supervisord.conf"
-if [ "${DISABLE_MOSQUITTO:-false}" = "true" ]; then
+if [ "${DISABLE_MOSQUITTO:-false}" = "true" ] && [ "${DISABLE_CADDY:-false}" = "true" ]; then
+  echo "[config] internal MQTT broker disabled (DISABLE_MOSQUITTO=true)"
+  echo "[config] Caddy reverse proxy disabled (DISABLE_CADDY=true)"
+  SUPERVISORD_CONF="/etc/supervisor/conf.d/supervisord-no-mosquitto-no-caddy.conf"
+elif [ "${DISABLE_MOSQUITTO:-false}" = "true" ]; then
   echo "[config] internal MQTT broker disabled (DISABLE_MOSQUITTO=true)"
   SUPERVISORD_CONF="/etc/supervisor/conf.d/supervisord-no-mosquitto.conf"
+elif [ "${DISABLE_CADDY:-false}" = "true" ]; then
+  echo "[config] Caddy reverse proxy disabled (DISABLE_CADDY=true)"
+  SUPERVISORD_CONF="/etc/supervisor/conf.d/supervisord-no-caddy.conf"
 fi
 
 exec /usr/bin/supervisord -c "$SUPERVISORD_CONF"

docker/supervisord-go-no-caddy.conf

@@ -0,0 +1,43 @@
+[supervisord]
+nodaemon=true
+user=root
+logfile=/dev/stdout
+logfile_maxbytes=0
+pidfile=/var/run/supervisord.pid
+
+[program:mosquitto]
+command=/usr/sbin/mosquitto -c /etc/mosquitto/mosquitto.conf
+autostart=true
+autorestart=true
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+[program:corescope-ingestor]
+command=/app/corescope-ingestor -config /app/config.json
+directory=/app
+autostart=true
+autorestart=true
+startretries=10
+startsecs=2
+stopsignal=TERM
+stopwaitsecs=20
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+[program:corescope-server]
+command=/app/corescope-server -config-dir /app -db /app/data/meshcore.db -public /app/public -port 3000
+directory=/app
+autostart=true
+autorestart=true
+startretries=10
+startsecs=2
+stopsignal=TERM
+stopwaitsecs=20
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0

docker/supervisord-go-no-mosquitto-no-caddy.conf

@@ -0,0 +1,34 @@
+[supervisord]
+nodaemon=true
+user=root
+logfile=/dev/stdout
+logfile_maxbytes=0
+pidfile=/var/run/supervisord.pid
+
+[program:corescope-ingestor]
+command=/app/corescope-ingestor -config /app/config.json
+directory=/app
+autostart=true
+autorestart=true
+startretries=10
+startsecs=2
+stopsignal=TERM
+stopwaitsecs=20
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+[program:corescope-server]
+command=/app/corescope-server -config-dir /app -db /app/data/meshcore.db -public /app/public -port 3000
+directory=/app
+autostart=true
+autorestart=true
+startretries=10
+startsecs=2
+stopsignal=TERM
+stopwaitsecs=20
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0

docs/deployment.md

@@ -0,0 +1,496 @@
+# CoreScope Deployment Guide
+
+Comprehensive guide to deploying and operating CoreScope. For a quick start, see [DEPLOY.md](../DEPLOY.md).
+
+## Table of Contents
+
+- [System Requirements](#system-requirements)
+- [Docker Deployment](#docker-deployment)
+- [Configuration Reference](#configuration-reference)
+- [MQTT Setup](#mqtt-setup)
+- [TLS / HTTPS](#tls--https)
+- [Monitoring & Health Checks](#monitoring--health-checks)
+- [Backup & Restore](#backup--restore)
+- [Troubleshooting](#troubleshooting)
+
+---
+
+## System Requirements
+
+| Resource | Minimum | Recommended |
+|----------|---------|-------------|
+| RAM | 256 MB | 512 MB+ |
+| Disk | 500 MB (image + DB) | 2 GB+ for long-term data |
+| CPU | 1 core | 2+ cores |
+| Architecture | `linux/amd64`, `linux/arm64` | — |
+| Docker | 20.10+ | Latest stable |
+
+CoreScope runs well on Raspberry Pi 4/5 (ARM64). The Go server uses ~300 MB RAM for 56K+ packets.
+
+---
+
+## Docker Deployment
+
+### Quick Start (one command)
+
+```bash
+docker run -d --name corescope \
+  -p 80:80 \
+  -v corescope-data:/app/data \
+  ghcr.io/kpa-clawbot/corescope:latest
+```
+
+Open `http://localhost` — you'll see an empty dashboard ready to receive packets.
+
+No `config.json` is required. The server starts with sensible defaults:
+- HTTP on port 3000 (Caddy proxies port 80 → 3000 internally)
+- Internal Mosquitto MQTT broker on port 1883
+- Ingestor connects to `mqtt://localhost:1883` automatically
+- SQLite database at `/app/data/meshcore.db`
+
+### Full `docker run` Reference (recommended)
+
+The bare `docker run` command is the primary deployment method. One image, documented parameters — run it however you want.
+
+```bash
+docker run -d --name corescope \
+  --restart=unless-stopped \
+  -p 80:80 -p 443:443 -p 1883:1883 \
+  -e DISABLE_MOSQUITTO=false \
+  -e DISABLE_CADDY=false \
+  -v /your/data:/app/data \
+  -v /your/Caddyfile:/etc/caddy/Caddyfile:ro \
+  -v /your/caddy-data:/data/caddy \
+  ghcr.io/kpa-clawbot/corescope:latest
+```
+
+#### Parameters
+
+| Parameter | Required | Description |
+|-----------|----------|-------------|
+| `-p 80:80` | Yes | HTTP web UI |
+| `-p 443:443` | No | HTTPS (only if using built-in Caddy with a domain) |
+| `-p 1883:1883` | No | MQTT broker (expose if external gateways connect directly) |
+| `-v /your/data:/app/data` | Yes | Persistent data: SQLite DB, config.json, theme.json |
+| `-v /your/Caddyfile:/etc/caddy/Caddyfile:ro` | No | Custom Caddyfile for HTTPS |
+| `-v /your/caddy-data:/data/caddy` | No | Caddy TLS certificate storage |
+| `-e DISABLE_MOSQUITTO=true` | No | Skip the internal Mosquitto broker (use your own) |
+| `-e DISABLE_CADDY=true` | No | Skip the built-in Caddy reverse proxy |
+| `-e MQTT_BROKER=mqtt://host:1883` | No | Override MQTT broker URL |
+
+#### `/app/data/.env` convenience file
+
+Instead of passing `-e` flags, you can drop a `.env` file in your data volume:
+
+```bash
+# /your/data/.env
+DISABLE_MOSQUITTO=true
+DISABLE_CADDY=true
+MQTT_BROKER=mqtt://my-broker:1883
+```
+
+The entrypoint sources this file before starting services. This works with any launch method (`docker run`, compose, or manage.sh).
+
+### Docker Compose (legacy alternative)
+
+Docker Compose files are maintained for backward compatibility but are no longer the recommended approach.
+
+```bash
+curl -sL https://raw.githubusercontent.com/Kpa-clawbot/CoreScope/master/docker-compose.example.yml \
+  -o docker-compose.yml
+docker compose up -d
+```
+
+#### Compose environment variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `HTTP_PORT` | `80` | Host port for the web UI |
+| `DATA_DIR` | `./data` | Host path for persistent data |
+| `DISABLE_MOSQUITTO` | `false` | Set `true` to use an external MQTT broker |
+| `DISABLE_CADDY` | `false` | Set `true` to skip the built-in Caddy proxy |
+
+### manage.sh (legacy alternative)
+
+The `manage.sh` wrapper script provides a setup wizard and convenience commands. It uses Docker Compose internally. See [DEPLOY.md](../DEPLOY.md) for usage. New deployments should prefer bare `docker run`.
+
+### Image tags
+
+| Tag | Use case |
+|-----|----------|
+| `v3.4.1` | Pinned release — recommended for production |
+| `v3.4` | Latest patch in the v3.4.x series |
+| `v3` | Latest minor+patch in v3.x |
+| `latest` | Latest release tag |
+| `edge` | Built from master on every push — unstable |
+
+### Updating
+
+```bash
+docker compose pull
+docker compose up -d
+```
+
+For `docker run` users:
+
+```bash
+docker pull ghcr.io/kpa-clawbot/corescope:latest
+docker stop corescope && docker rm corescope
+docker run -d --name corescope ... # same flags as before
+```
+
+Data is preserved in the volume — updates are non-destructive.
+
+---
+
+## Configuration Reference
+
+CoreScope uses a layered configuration system (highest priority wins):
+
+1. **Environment variables** — `MQTT_BROKER`, `DB_PATH`, etc.
+2. **`/app/data/config.json`** — full config file (volume-mounted)
+3. **Built-in defaults** — work out of the box with no config
+
+### Environment variable overrides
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `MQTT_BROKER` | `mqtt://localhost:1883` | MQTT broker URL (overrides config file) |
+| `MQTT_TOPIC` | `meshcore/#` | MQTT topic subscription pattern |
+| `DB_PATH` | `data/meshcore.db` | SQLite database path |
+| `DISABLE_MOSQUITTO` | `false` | Skip the internal Mosquitto broker |
+| `DISABLE_CADDY` | `false` | Skip the built-in Caddy reverse proxy |
+
+### config.json
+
+For advanced configuration, create a `config.json` and mount it at `/app/data/config.json`:
+
+```bash
+docker run -d --name corescope \
+  -p 80:80 \
+  -v corescope-data:/app/data \
+  -v ./config.json:/app/data/config.json:ro \
+  ghcr.io/kpa-clawbot/corescope:latest
+```
+
+See `config.example.json` in the repository for all available options including:
+- MQTT sources (multiple brokers)
+- Channel encryption keys
+- Branding and theming
+- Health thresholds
+- Region filters
+- Retention policies
+- Geo-filtering
+
+---
+
+## MQTT Setup
+
+CoreScope receives MeshCore packets via MQTT. The container ships with an internal Mosquitto broker — no setup needed for basic use.
+
+### Internal broker (default)
+
+The built-in Mosquitto broker listens on port 1883 inside the container. Point your MeshCore gateways at it:
+
+```bash
+# Expose MQTT port for external gateways
+docker run -d --name corescope \
+  -p 80:80 -p 1883:1883 \
+  -v corescope-data:/app/data \
+  ghcr.io/kpa-clawbot/corescope:latest
+```
+
+### External broker
+
+To use your own MQTT broker (Mosquitto, EMQX, HiveMQ, etc.):
+
+1. Disable the internal broker:
+   ```bash
+   -e DISABLE_MOSQUITTO=true
+   ```
+
+2. Point the ingestor at your broker:
+   ```bash
+   -e MQTT_BROKER=mqtt://your-broker:1883
+   ```
+
+   Or via `config.json`:
+   ```json
+   {
+     "mqttSources": [
+       {
+         "name": "my-broker",
+         "broker": "mqtt://your-broker:1883",
+         "username": "user",
+         "password": "pass",
+         "topics": ["meshcore/#"]
+       }
+     ]
+   }
+   ```
+
+### Multiple brokers
+
+CoreScope can connect to multiple MQTT brokers simultaneously:
+
+```json
+{
+  "mqttSources": [
+    {
+      "name": "local",
+      "broker": "mqtt://localhost:1883",
+      "topics": ["meshcore/#"]
+    },
+    {
+      "name": "remote",
+      "broker": "mqtts://remote-broker:8883",
+      "username": "reader",
+      "password": "secret",
+      "topics": ["meshcore/+/+/packets"]
+    }
+  ]
+}
+```
+
+### MQTT topic format
+
+MeshCore gateways typically publish to `meshcore/<gateway>/<region>/packets`. The default subscription `meshcore/#` catches all of them.
+
+---
+
+## TLS / HTTPS
+
+### Option 1: External reverse proxy (recommended)
+
+Run CoreScope behind nginx, Traefik, or Cloudflare Tunnel for TLS termination:
+
+```nginx
+# nginx example
+server {
+    listen 443 ssl;
+    server_name corescope.example.com;
+
+    ssl_certificate /etc/ssl/certs/corescope.pem;
+    ssl_certificate_key /etc/ssl/private/corescope.key;
+
+    location / {
+        proxy_pass http://localhost:80;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+    }
+}
+```
+
+The `Upgrade` and `Connection` headers are required for WebSocket support.
+
+### Option 2: Built-in Caddy (auto-TLS)
+
+The container includes Caddy for automatic Let's Encrypt certificates:
+
+1. Create a Caddyfile:
+   ```
+   corescope.example.com {
+     reverse_proxy localhost:3000
+   }
+   ```
+
+2. Mount it and expose TLS ports:
+   ```bash
+   docker run -d --name corescope \
+     -p 80:80 -p 443:443 \
+     -v corescope-data:/app/data \
+     -v caddy-certs:/data/caddy \
+     -v ./Caddyfile:/etc/caddy/Caddyfile:ro \
+     ghcr.io/kpa-clawbot/corescope:latest
+   ```
+
+Caddy handles certificate issuance and renewal automatically.
+
+---
+
+## API Documentation
+
+CoreScope auto-generates an OpenAPI 3.0 specification from its route definitions. The spec is always in sync with the running server — no manual maintenance required.
+
+### Endpoints
+
+| URL | Description |
+|-----|-------------|
+| `/api/spec` | OpenAPI 3.0 JSON schema — machine-readable API definition |
+| `/api/docs` | Interactive Swagger UI — browse and test all 40+ endpoints |
+
+### Usage
+
+**Browse the API interactively:**
+```
+http://your-instance/api/docs
+```
+
+**Fetch the spec programmatically:**
+```bash
+curl http://your-instance/api/spec | jq .
+```
+
+**For bot/integration developers:** The spec includes all request parameters, response schemas, and example values. Import it into Postman, Insomnia, or any OpenAPI-compatible tool.
+
+### Public instance
+The live instance at [analyzer.00id.net](https://analyzer.00id.net) has all API endpoints publicly accessible:
+- Spec: [analyzer.00id.net/api/spec](https://analyzer.00id.net/api/spec)
+- Docs: [analyzer.00id.net/api/docs](https://analyzer.00id.net/api/docs)
+
+---
+
+## Monitoring & Health Checks
+
+### Docker health check
+
+The container includes a built-in health check that hits `/api/stats`:
+
+```bash
+docker inspect --format='{{.State.Health.Status}}' corescope
+```
+
+Docker reports `healthy` or `unhealthy` automatically. The check runs every 30 seconds.
+
+### Manual health check
+
+```bash
+curl -f http://localhost/api/stats
+```
+
+Returns JSON with packet counts, node counts, and version info:
+
+```json
+{
+  "totalPackets": 56234,
+  "totalNodes": 142,
+  "totalObservers": 12,
+  "packetsLastHour": 830,
+  "packetsLast24h": 19644,
+  "engine": "go",
+  "version": "v3.4.1"
+}
+```
+
+### Log monitoring
+
+```bash
+# All logs
+docker compose logs -f
+
+# Server only
+docker compose logs -f | grep '\[server\]'
+
+# Ingestor only
+docker compose logs -f | grep '\[ingestor\]'
+```
+
+### Resource monitoring
+
+```bash
+docker stats corescope
+```
+
+---
+
+## Backup & Restore
+
+### Backup
+
+All persistent data lives in `/app/data`. The critical file is the SQLite database:
+
+```bash
+# Copy from the Docker volume
+docker cp corescope:/app/data/meshcore.db ./backup-$(date +%Y%m%d).db
+
+# Or if using a bind mount
+cp ./data/meshcore.db ./backup-$(date +%Y%m%d).db
+```
+
+Optional files to back up:
+- `config.json` — custom configuration
+- `theme.json` — custom theme/branding
+
+### Restore
+
+```bash
+# Stop the container
+docker stop corescope
+
+# Replace the database
+docker cp ./backup.db corescope:/app/data/meshcore.db
+
+# Restart
+docker start corescope
+```
+
+### Automated backups
+
+```bash
+# cron: daily backup at 3 AM, keep 7 days
+0 3 * * * docker cp corescope:/app/data/meshcore.db /backups/corescope-$(date +\%Y\%m\%d).db && find /backups -name "corescope-*.db" -mtime +7 -delete
+```
+
+---
+
+## Troubleshooting
+
+### Container starts but dashboard is empty
+
+This is normal on first start with no MQTT sources configured. The dashboard shows data once packets arrive via MQTT. Either:
+- Point a MeshCore gateway at the container's MQTT broker (port 1883)
+- Configure an external MQTT source in `config.json`
+
+### "no MQTT connections established" in logs
+
+The ingestor couldn't connect to any MQTT broker. Check:
+1. Is the internal Mosquitto running? (`DISABLE_MOSQUITTO` should be `false`)
+2. Is the external broker reachable? Test with `mosquitto_sub -h broker -t meshcore/#`
+3. Are credentials correct in `config.json`?
+
+### WebSocket disconnects / real-time updates stop
+
+If behind a reverse proxy, ensure WebSocket upgrade headers are forwarded:
+```nginx
+proxy_http_version 1.1;
+proxy_set_header Upgrade $http_upgrade;
+proxy_set_header Connection "upgrade";
+```
+
+Also check proxy timeouts — set them to at least 300s for long-lived WebSocket connections.
+
+### High memory usage
+
+The in-memory packet store grows with retained packets. Configure retention limits in `config.json`:
+
+```json
+{
+  "packetStore": {
+    "retentionHours": 24,
+    "maxMemoryMB": 512
+  },
+  "retention": {
+    "nodeDays": 7,
+    "packetDays": 30
+  }
+}
+```
+
+### Database locked errors
+
+SQLite doesn't support concurrent writers well. Ensure only one CoreScope instance accesses the database file. If running multiple containers, each needs its own database.
+
+### Container unhealthy
+
+Check logs: `docker compose logs --tail 50`. Common causes:
+- Port 3000 already in use inside the container
+- Database file permissions (must be writable by the container user)
+- Corrupted database — restore from backup
+
+### ARM / Raspberry Pi issues
+
+- Use `linux/arm64` images (Pi 4 and 5). Pi 3 (armv7) is not supported.
+- First pull may be slow — the multi-arch manifest selects the right image automatically.
+- If memory is tight, set `packetStore.maxMemoryMB` to limit RAM usage.

docs/release-notes/v3.5.0.md

@@ -0,0 +1,135 @@
+# CoreScope v3.5.0 🚀
+
+The "stop building from source and start analyzing your mesh" release. 95 commits.
+
+---
+
+## 🐳 Pre-built Docker Images
+
+CoreScope now ships as a ready-to-run Docker image on GitHub Container Registry. No cloning, no building, no dependencies — just pull and run.
+
+```bash
+docker run -d --name corescope -p 80:80 -p 443:443 -p 1883:1883 \
+  -v corescope-data:/app/data \
+  ghcr.io/kpa-clawbot/corescope:v3.5.0
+```
+
+**Using HTTPS with a custom domain?** Mount your Caddyfile and certs directory:
+```bash
+docker run -d --name corescope -p 80:80 -p 443:443 -p 1883:1883 \
+  -v /your/data:/app/data \
+  -v /your/Caddyfile:/etc/caddy/Caddyfile:ro \
+  -v /your/caddy-data:/data/caddy \
+  ghcr.io/kpa-clawbot/corescope:v3.5.0
+```
+Caddy auto-provisions Let's Encrypt certs. Your Caddyfile just needs:
+```
+yourdomain.example.com {
+    reverse_proxy localhost:3000
+}
+```
+
+That's it. Zero config required — MQTT broker, Caddy HTTPS, and SQLite are built in.
+
+**Already running CoreScope?**
+```bash
+# 1. Find your running container name
+docker ps --format '{{.Names}}'
+
+# 2. Stop and remove it
+docker stop <container-name> && docker rm <container-name>
+
+# 3. Pull the pre-built image
+docker pull ghcr.io/kpa-clawbot/corescope:v3.5.0
+
+# 4. Run with your existing data directory
+docker run -d --name corescope -p 80:80 -p 443:443 -p 1883:1883 \
+  -v /your/data:/app/data \
+  -v /your/Caddyfile:/etc/caddy/Caddyfile:ro \
+  -v /your/caddy-data:/data/caddy \
+  ghcr.io/kpa-clawbot/corescope:v3.5.0
+```
+Your data volume stays. Nothing to migrate.
+
+Tags: `v3.5.0` (this release) · `latest` (latest tagged release) · `edge` (master tip, for testing). Env: `DISABLE_CADDY=true` / `DISABLE_MOSQUITTO=true` if you bring your own.
+
+---
+
+## ⚡ 83% Faster
+
+35 performance commits. Packets endpoint p50 dropped from 16.7ms → 2.7ms. Server now serves HTTP within 2 minutes on *any* DB size — async background backfill means you're never staring at a loading screen. N+1 API calls killed everywhere. Prefix map memory cut 10x. WebSocket renders batched via rAF.
+
+---
+
+## 🔬 RF Health Dashboard
+
+New Analytics tab. Per-observer noise floor as color-coded columns (green/yellow/red), airtime utilization, error rates, battery levels. Click any observer for the full breakdown. Region-filterable. This is the beginning of making CoreScope more than just a packet viewer.
+
+---
+
+## 🗺️ See Where Traces Actually Go
+
+Send a trace → watch it on the live map. Solid animated line shows how far it got. Dashed ghost shows where it didn't reach. Finally know *where* your trace failed, not just *that* it failed.
+
+---
+
+## 📊 Things That Were Lying To You
+
+- "By Repeaters" was counting companions. Fixed.
+- Zero-hop adverts claimed "1 byte hash" when the hash size was unknowable. Fixed.
+- "Packets through this node" showed packets through a *different* node with the same prefix. Fixed — now uses the neighbor affinity graph.
+- Table sorting on nodes/neighbors/observers silently did nothing. Fixed.
+
+---
+
+## 🔗 Deep Links · 🎨 Channel Colors · 📱 Mobile · 🔑 Security
+
+**Deep links** — every page state goes in the URL. Share a link to a specific node, filter, or analytics tab.
+
+**Channel colors** — click the color dot next to any channel, pick from 8 colors, see it highlighted across the feed. Persists in localStorage.
+
+**Distance units** — km, miles, or auto-detect from locale. Customizer → Display.
+
+**Mobile** — 44px touch targets, ARIA labels, responsive breakpoints.
+
+**Security** — weak API keys rejected at startup. License: GPL v3.
+
+---
+
+## 📡 Full API Documentation
+
+Every endpoint is now documented with an auto-generated OpenAPI 3.0 spec — always in sync with the running server.
+
+- **Interactive Swagger UI:** [analyzer.00id.net/api/docs](https://analyzer.00id.net/api/docs) — browse and test all 40+ endpoints
+- **Machine-readable spec:** [analyzer.00id.net/api/spec](https://analyzer.00id.net/api/spec) — import into Postman, Insomnia, or use for bot/integration development
+
+On your own instance: `/api/docs` and `/api/spec`.
+
+---
+
+## 🐛 14 Bugs Squashed
+
+Live map crash, zero-hop hash lies, animation freezes, repeater miscounts, prefix collisions, dead channel picker, invisible buttons, broken sorting, memory leak, and more.
+
+---
+
+## Upgrade
+
+```bash
+docker stop <container-name> && docker rm <container-name>
+docker pull ghcr.io/kpa-clawbot/corescope:v3.5.0
+
+# HTTP only:
+docker run -d --name corescope -p 80:80 -p 1883:1883 \
+  -v /your/data:/app/data \
+  ghcr.io/kpa-clawbot/corescope:v3.5.0
+
+# With HTTPS (custom domain):
+docker run -d --name corescope -p 80:80 -p 443:443 -p 1883:1883 \
+  -v /your/data:/app/data \
+  -v /your/Caddyfile:/etc/caddy/Caddyfile:ro \
+  -v /your/caddy-data:/data/caddy \
+  ghcr.io/kpa-clawbot/corescope:v3.5.0
+```
+
+First start backfills `resolved_path` in the background. No downtime. No breaking changes.

docs/specs/rf-health-dashboard.md

@@ -431,6 +431,10 @@ Note: No hardcoded duty cycle limit line on charts. Duty cycle regulations vary
 - All charts time-aligned, sharing X-axis, reboot markers spanning all charts
 - Tests: delta computation, reboot handling, counter reset, gap insertion, downsampling, error rate calculation
 
+#### M2 feedback improvements (post-M2)
+- **Auto-scale airtime Y-axis**: clamp to min/max of actual data values (20% headroom, min 1%) instead of fixed 0-100%, matching noise floor chart behavior. Increases data-ink ratio for low-activity nodes.
+- **Hover tooltips on all chart data points**: invisible SVG circles with `<title>` elements on every data point across all 4 charts (noise floor, airtime, error rate, battery). Shows exact value + UTC timestamp on hover. Detail-on-demand without cluttering the chart.
+
 ### M3: Pattern detection
 - Implement after operators have used raw charts (M1–M2) and provided feedback
 - Jammer detection (NF spike + RX drop)

docs/specs/table-sorting.md

@@ -0,0 +1,144 @@
+# Table Sorting Consistency Spec (#620)
+
+## Problem
+
+CoreScope has 20+ data tables. Only 2 are sortable (nodes list, channel activity). Those 2 use incompatible implementations — different property names (`column`/`direction` vs `col`/`dir`), different data attributes (`data-sort` vs `data-sort-col`), different function signatures. The remaining 18+ tables, including the packets table (30K+ rows), have zero sorting.
+
+This violates AGENTS.md DRY rules and frustrates users who can see data but can't reorder it.
+
+## Solution
+
+One shared `TableSort` module. Every data table uses it. Same UX everywhere.
+
+## Shared Utility Design
+
+### Module: `public/table-sort.js`
+
+IIFE pattern (like `channel-colors.js`). No dependencies. No build step.
+
+```js
+window.TableSort = (function() {
+  return { init, sort, destroy };
+})();
+```
+
+### API
+
+```js
+TableSort.init(tableEl, {
+  defaultColumn: 'last_seen',     // initial sort column
+  defaultDirection: 'desc',       // 'asc' or 'desc'
+  storageKey: 'nodes-sort',       // localStorage key (optional)
+  comparators: {                  // custom comparators for non-string columns
+    time: (a, b) => ...,
+    snr:  (a, b) => ...,
+  },
+  onSort: (column, direction) => {} // callback after sort completes
+});
+```
+
+### How It Works
+
+1. Scans `<th>` elements for `data-sort="columnName"` attribute
+2. Attaches click handlers — click toggles asc/desc
+3. On sort: reads `<td data-value="...">` (raw sortable value) from each row
+4. Sorts rows in-place via DOM reorder (no innerHTML rebuild — important for 30K rows)
+5. Updates visual indicator and `aria-sort` on active `<th>`
+
+### Visual Indicator
+
+Active column header gets `▲` (ascending) or `▼` (descending) appended as a `<span class="sort-arrow">`. Inactive columns show no arrow. CSS class `.sort-active` on the active `<th>`.
+
+### Built-in Comparators
+
+| Type | Detected From | Behavior |
+|------|--------------|----------|
+| `numeric` | `data-type="number"` on `<th>` | `Number(a) - Number(b)`, NaN sorts last |
+| `text` | default | `localeCompare` |
+| `date` | `data-type="date"` | Parse as timestamp, numeric compare |
+| `dbm` | `data-type="dbm"` | Strip " dBm" suffix, numeric compare |
+
+Custom comparators in `options.comparators` override built-in types.
+
+### Accessibility
+
+- `aria-sort="ascending"`, `"descending"`, or `"none"` on every sortable `<th>`
+- `role="columnheader"` (already implicit for `<th>`)
+- `cursor: pointer` and `:hover` style on sortable headers
+- Keyboard: sortable headers are focusable, Enter/Space triggers sort
+
+### Performance (Critical for Packets Table)
+
+- Sort via DOM node reorder (`appendChild` loop), not `innerHTML`. Browser batches reflows.
+- `data-value` attributes hold raw values — no parsing during sort.
+- For 30K rows: expected sort time ~100-200ms (single `Array.sort` + DOM reorder). If >500ms, add a virtual scroll layer in a follow-up — but don't pre-optimize.
+- No re-render of row content. Sort only changes order.
+
+## Milestones
+
+### M1: Shared utility + packets table
+- Create `public/table-sort.js`
+- Unit tests: `test-table-sort.js` (Node.js, jsdom or vm.createContext)
+- Integrate with packets table (highest impact — 30K rows, currently unsortable)
+- Default sort: time descending
+- Columns: all current packets columns (Region, Time, Hash, Size, HB, Type, Observer, Path, Rpt, Details)
+- Browser validation: sort 30K rows, verify <500ms
+
+### M2: Nodes list + node detail tables
+- Migrate nodes list from custom sort to `TableSort.init()`
+- Add sorting to neighbor table (side pane + detail page)
+- Add sorting to observer stats table (detail page)
+- Remove old `sortState`/`sortArrow` code from `nodes.js`
+
+### M3: Analytics tables
+- Hash collisions tables (node table, sizes table, collision prefixes)
+- RF statistics table
+- Route frequency, co-appearance, topology tables
+- Node health tables (top by packets/SNR/observers, recently active)
+- Distance tables (by link type, top 20 longest)
+- Per-node analytics: peer contacts
+
+### M4: Channels list + observers list + comparison table
+- Channel activity table: migrate from custom sort to `TableSort.init()`
+- Remove old `_channelSortState` code from `analytics.js`
+- Observers list table
+- Comparison table (`compare.js`)
+
+### M5: Cleanup
+- Remove all old sorting code (both implementations)
+- Verify no dead CSS/JS from old sort code
+- Final consistency audit: every data table uses `TableSort.init()`
+
+### Out of Scope
+- `packets.js` hex breakdown (structural decode, fixed order)
+- `audio-lab.js` debug tables (not user-facing)
+- Virtual scroll / pagination (separate issue if perf requires it)
+
+## Testing
+
+### Unit Tests (`test-table-sort.js`)
+- Numeric sort ascending/descending
+- Text sort with localeCompare
+- Date sort
+- dBm sort (strip suffix)
+- Custom comparator override
+- NaN/null/undefined sort to end
+- Toggle direction on repeated click
+- `aria-sort` attribute updates
+- localStorage persistence (read + write)
+- `data-value` attribute used over text content
+
+### Integration (per milestone)
+- Playwright test: click column header, verify row order changes
+- Playwright test: click again, verify direction toggles
+- Playwright test: visual indicator present on active column
+
+### Performance
+- Unit test: sort 30K mock rows in <500ms (assert timing)
+- Required per AGENTS.md: perf claims need proof
+
+## Migration Path
+
+Existing sort code in `nodes.js` and `analytics.js` will be replaced, not wrapped. Both current implementations are <100 lines each — replacing is simpler than adapting. The shared utility subsumes all their functionality.
+
+Old localStorage keys (`nodes-sort-*`, channel sort state) should be migrated or cleared on first use of the new utility.

docs/specs/timestamp-filters.md

@@ -0,0 +1,266 @@
+# Timestamp-Based Packet Filters
+
+**Issue:** #289  
+**Status:** Draft  
+**Depends on:** #286 (timestamp display config)
+
+## Summary
+
+Extend the existing filter engine (`packet-filter.js`) with a `time` field type supporting absolute ISO timestamps, relative durations, and range expressions. The filter compiles date expressions to epoch milliseconds at parse time so per-packet evaluation is a single numeric comparison — no date parsing in the hot path.
+
+## Syntax
+
+### Absolute (ISO 8601)
+
+```
+time > "2024-01-01T00:00:00Z"
+time <= "2024-06-15"
+time == "2024-03-01"
+```
+
+Quoted strings after `time` are parsed as dates. Partial dates (`"2024-01-01"`) are treated as midnight UTC. All absolute values are interpreted as UTC regardless of the user's display preference.
+
+### Relative
+
+```
+time > 2h ago
+time > 30m ago
+time > 7d ago
+```
+
+The lexer recognizes `<number><unit> ago` as a relative time literal. Supported units: `s` (seconds), `m` (minutes), `h` (hours), `d` (days). At compile time, the relative offset is resolved to an absolute epoch ms value (`Date.now() - offset`). This means a compiled filter's relative thresholds are frozen at compile time — recompile to refresh.
+
+### Shorthand
+
+```
+time.ago < 30m
+time.ago < 2h
+```
+
+`time.ago` resolves to `Date.now() - packet.timestamp`. The comparison value is a duration literal (`30m`, `2h`, `7d`). This is syntactic sugar and semantically equivalent to the relative form but reads more naturally for "show me recent packets."
+
+### Range
+
+```
+time between "2024-01-01" "2024-01-02"
+time between 1h ago 30m ago
+```
+
+`between` is a ternary operator: `field between <low> <high>`. Compiles to `low <= field && field <= high`. Both bounds are inclusive.
+
+### Combinable with existing filters
+
+```
+type == Advert && time > 1h ago
+snr > 5 && time between "2024-01-01" "2024-01-02"
+(type == GRP_TXT || type == TXT_MSG) && time.ago < 30m
+```
+
+## Grammar Extension
+
+### New token types
+
+| Token | Pattern | Example |
+|-------|---------|---------|
+| `DURATION` | `/^\d+[smhd]$/` | `30m`, `2h`, `7d` |
+| `AGO` | keyword `ago` | `ago` |
+| `BETWEEN` | keyword `between` | `between` |
+
+### Lexer changes
+
+1. After reading an identifier that matches `\d+[smhd]`, emit `DURATION` token instead of `FIELD`.
+2. Recognize `ago` and `between` as keywords (like `and`/`or`).
+
+### Parser changes
+
+In `parseComparison()`:
+
+1. **Relative time:** If field is `time` and value tokens are `DURATION AGO`, compute `Date.now() - durationToMs(duration)` and store as a numeric epoch ms value in the AST node.
+2. **Absolute time:** If field is `time` and value is a `STRING`, attempt `new Date(value).getTime()`. If `NaN`, return parse error. Store epoch ms.
+3. **`time.ago` shorthand:** If field is `time.ago`, the value is a `DURATION`. Store the duration in ms. At evaluation, compute `now - packet_ts` and compare against the duration.
+4. **`between`:** If operator token is `BETWEEN`, consume two values (same type resolution as above). Emit `{ type: 'between', field, low, high }`.
+
+### AST node shapes
+
+```js
+// Absolute/relative (pre-resolved to epoch ms)
+{ type: 'comparison', field: 'time', op: '>', value: 1704067200000 }
+
+// time.ago (duration in ms)
+{ type: 'comparison', field: 'time.ago', op: '<', value: 1800000 }
+
+// between (both bounds as epoch ms)
+{ type: 'between', field: 'time', low: 1704067200000, high: 1704153600000 }
+```
+
+## Field Resolution
+
+Add to `resolveField()`:
+
+```js
+if (field === 'time') return packet.timestamp;  // epoch ms
+if (field === 'time.ago') return Date.now() - packet.timestamp;
+```
+
+`packet.timestamp` is the packet's capture time in epoch milliseconds. This field already exists in the data model (populated from the DB `created_at` column).
+
+## Time Semantics
+
+- **Filter expressions:** Always UTC. `"2024-01-01"` means `2024-01-01T00:00:00Z`.
+- **Display:** Follows the user's timestamp config from #286 (UTC/local/relative).
+- **Relative times:** Computed against `Date.now()` at compile time. The compiled filter is a snapshot — if the filter stays active for hours, relative thresholds drift. This is acceptable; filters are typically short-lived or recompiled on interaction.
+
+**No timezone specifiers in the filter syntax.** UTC only. This avoids ambiguity and parsing complexity. Users who think in local time can use the relative syntax (`time > 2h ago`) which is timezone-agnostic.
+
+## Performance
+
+### Compile-time work (once)
+
+- Parse date strings → epoch ms via `new Date().getTime()` (~1μs per date)
+- Parse duration strings → ms via multiplication (~0ns, trivial arithmetic)
+- Relative `ago` → `Date.now() - offset` (~0ns)
+
+### Per-packet evaluation (hot path)
+
+- `time` comparison: one numeric read + one numeric compare. Same cost as `snr > 5`.
+- `time.ago`: one subtraction + one compare. Two arithmetic ops. **Important:** cache `Date.now()` once per filter pass (e.g., in a closure variable set before iterating packets), not per-packet. 30K `Date.now()` calls are ~1ms but it's a pointless syscall tax.
+- `between`: two numeric compares.
+
+**No `Date` objects created per packet. No string parsing per packet. No regex per packet.**
+
+At 30K packets, the time filter adds ~0.1ms total to filter evaluation — dominated by the existing field resolution and AST walk overhead. No measurable regression.
+
+### Implementation note: `between` as sugar
+
+`between` should compile to `{ type: 'and', left: { type: 'comparison', field, op: '>=', value: low }, right: { type: 'comparison', field, op: '<=', value: high } }` — reusing existing comparison evaluation. No new AST node type, no new evaluator branch. The parser desugars it; the evaluator never sees `between`.
+
+### Implementation note: `time.ago` and `Date.now()` caching
+
+The `compile()` function should return a filter that accepts an optional `now` parameter:
+
+```js
+var compiled = compile('time.ago < 30m');
+var now = Date.now();
+packets.filter(function(p) { return compiled.filter(p, now); });
+```
+
+If `now` is not passed, `Date.now()` is called once on the first invocation and reused for the entire filter pass. This avoids 30K syscalls and ensures consistent evaluation within a single pass.
+
+## Carmack Review Notes
+
+Reviewed with a performance-first lens (30K+ packets, real-time updates):
+
+1. **✅ No allocations in hot path.** All date parsing happens at compile time. Per-packet evaluation is pure numeric comparison — same cost as existing `snr > 5` filters.
+
+2. **⚠️ `Date.now()` per-packet for `time.ago`.** Fixed above — cache once per filter pass via optional `now` parameter or closure. Without this, 30K packets × `Date.now()` = ~1ms wasted on a monotonic clock syscall that returns the same value.
+
+3. **✅ `between` as sugar, not a new node type.** Desugar in the parser to reuse existing `and` + `comparison` nodes. Zero new code paths in the evaluator = zero new bugs in the evaluator.
+
+4. **✅ Parser complexity is bounded.** Three new token types, one new keyword. The parser remains LL(1) — no backtracking, no ambiguity. `DURATION AGO` is a clear two-token lookahead only when field is `time`.
+
+5. **✅ Memory impact negligible.** Compiled time filters add one or two floats to the AST. At 16 bytes per node, even complex expressions with multiple time clauses are <100 bytes.
+
+6. **⚠️ Compiled filter staleness for relative times.** Spec acknowledges this. Acceptable for a web UI where filters are recompiled on user interaction. If filters persist across long WebSocket sessions, consider recompiling on a timer (every 60s). This is a future concern, not a blocker.
+
+7. **✅ No regex in hot path.** Duration parsing uses a simple char check on the last character + `parseInt`. Cheaper than any regex.
+
+A compiled time filter adds one or two 64-bit float values to the AST. Negligible — roughly 16 bytes per time comparison node.
+
+## URL Integration
+
+Time filters appear in the URL hash query string like any other filter:
+
+```
+#/packets?filter=time%20%3E%201h%20ago
+#/packets?filter=type%20%3D%3D%20Advert%20%26%26%20time%20%3E%20%222024-01-01%22
+```
+
+The filter text is URL-encoded and round-trips through `encodeURIComponent`/`decodeURIComponent`. No special handling needed — the existing filter-in-URL mechanism (#286 or current) works unchanged.
+
+For convenience, a future milestone could add dedicated `timeFrom`/`timeTo` query params that inject into the filter, but this is not required for the initial implementation.
+
+## Wireshark Compatibility
+
+| Wireshark syntax | CoreScope equivalent | Notes |
+|------------------|---------------------|-------|
+| `frame.time >= "2024-01-01"` | `time >= "2024-01-01"` | We use `time` instead of `frame.time` for brevity. Could alias `frame.time` → `time` later. |
+| `frame.time_relative < 60` | `time.ago < 60s` | Wireshark uses seconds float; we use duration literals |
+| `frame.time_delta` | Not supported | Inter-packet delta is a different feature |
+
+We intentionally diverge from Wireshark where their syntax is verbose or requires pcap-specific concepts. CoreScope's filter language prioritizes brevity and readability for a web UI. A `frame.time` alias for `time` can be added trivially in the field resolver if users request it.
+
+## Milestones
+
+### M1: Core time filtering (parser + evaluator)
+- Add `DURATION`, `AGO`, `BETWEEN` tokens to lexer
+- Extend parser for `time` field special handling
+- Add `time` and `time.ago` to `resolveField()`
+- Implement `between` AST node evaluation
+- Unit tests: absolute, relative, ago, between, combined with existing filters, edge cases (bad dates, invalid units)
+- **Test:** filter 30K packets by time in <50ms (assert in test)
+
+### M2: UI integration
+- Filter bar autocomplete hints for time syntax
+- Help tooltip / cheat sheet update with time examples
+- Verify URL round-trip with time filters
+- Playwright E2E test: enter time filter, verify packet list updates
+
+### M3: Polish
+- `frame.time` alias
+- Error messages for common mistakes ("did you mean `time > 1h ago`?")
+- Consider dedicated time range picker UI widget (out of scope for this spec)
+
+## Testing
+
+### Unit tests (add to `test-packet-filter.js`)
+
+```js
+// Absolute time
+c = compile('time > "2024-01-01"');
+assert(c.filter({ timestamp: new Date('2024-06-01').getTime() }), 'after 2024-01-01');
+assert(!c.filter({ timestamp: new Date('2023-06-01').getTime() }), 'before 2024-01-01');
+
+// Relative time
+c = compile('time > 1h ago');
+assert(c.filter({ timestamp: Date.now() - 30 * 60000 }), '30m ago passes 1h filter');
+assert(!c.filter({ timestamp: Date.now() - 2 * 3600000 }), '2h ago fails 1h filter');
+
+// time.ago shorthand
+c = compile('time.ago < 30m');
+assert(c.filter({ timestamp: Date.now() - 10 * 60000 }), '10m ago < 30m');
+assert(!c.filter({ timestamp: Date.now() - 60 * 60000 }), '60m ago not < 30m');
+
+// between
+c = compile('time between "2024-01-01" "2024-01-02"');
+assert(c.filter({ timestamp: new Date('2024-01-01T12:00:00Z').getTime() }), 'in range');
+assert(!c.filter({ timestamp: new Date('2024-01-03').getTime() }), 'out of range');
+
+// Combined
+c = compile('type == Advert && time > 1h ago');
+assert(c.filter({ payload_type: 4, timestamp: Date.now() - 1000 }), 'combined pass');
+assert(!c.filter({ payload_type: 4, timestamp: Date.now() - 7200000 }), 'combined fail time');
+assert(!c.filter({ payload_type: 1, timestamp: Date.now() - 1000 }), 'combined fail type');
+
+// Error cases
+c = compile('time > "not-a-date"');
+assert(c.error, 'invalid date string');
+
+c = compile('time > 5x ago');
+assert(c.error, 'invalid duration unit');
+
+// Performance
+var start = Date.now();
+c = compile('time > 1h ago && type == Advert');
+var packets = [];
+for (var i = 0; i < 30000; i++) {
+  packets.push({ payload_type: i % 5, timestamp: Date.now() - i * 1000 });
+}
+packets.forEach(function(p) { c.filter(p); });
+assert(Date.now() - start < 50, 'filter 30K packets in <50ms');
+```
+
+### Playwright tests
+
+- Enter `time > 1h ago` in filter bar → verify packet count decreases
+- Enter invalid time filter → verify error message appears
+- Reload page with time filter in URL → verify filter is applied

docs/superpowers/plans/2026-04-05-deep-linking-p1.md

@@ -0,0 +1,674 @@
+# Deep Linking P1 Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Make P1 UI states in nodes, packets, and channels URL-addressable so they survive refresh and can be shared.
+
+**Architecture:** Each page reads URL params from `location.hash.split('?')[1]` on init (router strips query string before passing `routeParam`, so pages must read `location.hash` directly). State changes call `history.replaceState` to keep the URL in sync. localStorage remains the fallback default; URL params override when present.
+
+**Tech Stack:** Vanilla JS (ES5/6), browser History API, URLSearchParams
+
+---
+
+## Files Changed
+
+| File | Changes |
+|---|---|
+| `public/region-filter.js` | Add `setSelected(codesArray)`, track `_container` for re-render |
+| `public/nodes.js` | Read `?tab=`/`?search=` on init; `updateNodesUrl()` on tab/search change; expose `buildNodesQuery` on `window` |
+| `public/packets.js` | Read `?timeWindow=`/`?region=` on init; `updatePacketsUrl()` on timeWindow/region change; expose `buildPacketsUrl` on `window` |
+| `public/channels.js` | Read `?node=` on init; update URL in `showNodeDetail`/`closeNodeDetail` |
+| `test-frontend-helpers.js` | Add unit tests for `buildNodesQuery` and `buildPacketsUrl` |
+| `test-e2e-playwright.js` | Add Playwright tests: tab URL persistence, timeWindow URL persistence |
+
+---
+
+## Task 1: Add `setSelected` to RegionFilter
+
+**Files:**
+- Modify: `public/region-filter.js`
+
+- [ ] **Step 1: Write the failing unit test**
+
+Add to `test-frontend-helpers.js` before the `// ===== SUMMARY =====` line:
+
+```javascript
+// ===== REGION-FILTER.JS: setSelected =====
+console.log('\n=== region-filter.js: setSelected ===');
+{
+  const ctx = makeSandbox();
+  ctx.fetch = () => Promise.resolve({ json: () => Promise.resolve({ 'US-SFO': 'San Jose', 'US-LAX': 'Los Angeles' }) });
+  loadInCtx(ctx, 'public/region-filter.js');
+
+  const RF = ctx.RegionFilter;
+  RF.init(document.createElement('div'));
+
+  test('setSelected sets region codes', async () => {
+    await RF.init(document.createElement('div'));
+    RF.setSelected(['US-SFO', 'US-LAX']);
+    assert.strictEqual(RF.getRegionParam(), 'US-SFO,US-LAX');
+  });
+
+  test('setSelected with null clears selection', async () => {
+    await RF.init(document.createElement('div'));
+    RF.setSelected(['US-SFO']);
+    RF.setSelected(null);
+    assert.strictEqual(RF.getRegionParam(), '');
+  });
+
+  test('setSelected with empty array clears selection', async () => {
+    await RF.init(document.createElement('div'));
+    RF.setSelected(['US-SFO']);
+    RF.setSelected([]);
+    assert.strictEqual(RF.getRegionParam(), '');
+  });
+}
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+```bash
+node test-frontend-helpers.js 2>&1 | grep -A2 "setSelected"
+```
+
+Expected: `❌ setSelected sets region codes: RF.setSelected is not a function`
+
+- [ ] **Step 3: Add `_container` tracking and `setSelected` to region-filter.js**
+
+In `region-filter.js`, add `var _container = null;` after the existing module-level vars (after line 9 `var _listeners = [];`):
+
+```javascript
+  var _listeners = [];
+  var _container = null;   // ← add this line
+  var _loaded = false;
+```
+
+In `initFilter`, save the container:
+
+```javascript
+  async function initFilter(container, opts) {
+    _container = container;          // ← add this line
+    if (opts && opts.dropdown) container._forceDropdown = true;
+    await fetchRegions();
+    render(container);
+  }
+```
+
+Add `setSelected` function before `// Expose globally`:
+
+```javascript
+  /** Override selected regions (e.g. from URL param). Persists to localStorage and re-renders. */
+  function setSelected(codesArray) {
+    _selected = (codesArray && codesArray.length > 0) ? new Set(codesArray) : null;
+    saveToStorage();
+    if (_container) render(_container);
+  }
+```
+
+Add `setSelected` to the public API object:
+
+```javascript
+  window.RegionFilter = {
+    init: initFilter,
+    render: render,
+    getSelected: getSelected,
+    getRegionParam: getRegionParam,
+    regionQueryString: regionQueryString,
+    onChange: onChange,
+    offChange: offChange,
+    fetchRegions: fetchRegions,
+    setSelected: setSelected,    // ← add this line
+  };
+```
+
+- [ ] **Step 4: Run test to verify it passes**
+
+```bash
+node test-frontend-helpers.js 2>&1 | grep -E "(setSelected|FAIL|passed|failed)"
+```
+
+Expected: 3 passing `setSelected` tests, overall pass.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add public/region-filter.js test-frontend-helpers.js
+git commit -m "feat: add RegionFilter.setSelected for URL param initialization (#536)"
+```
+
+---
+
+## Task 2: nodes.js — tab and search deep linking
+
+**Files:**
+- Modify: `public/nodes.js`
+- Test: `test-frontend-helpers.js`
+- Test: `test-e2e-playwright.js`
+
+- [ ] **Step 1: Write the unit test (add to test-frontend-helpers.js)**
+
+Add before the `// ===== SUMMARY =====` line:
+
+```javascript
+// ===== NODES.JS: buildNodesQuery =====
+console.log('\n=== nodes.js: buildNodesQuery ===');
+{
+  const ctx = makeSandbox();
+  loadInCtx(ctx, 'public/roles.js');
+  loadInCtx(ctx, 'public/app.js');
+
+  // Provide required globals for nodes.js IIFE to execute
+  ctx.registerPage = () => {};
+  ctx.RegionFilter = { init: () => Promise.resolve(), onChange: () => () => {}, offChange: () => {}, getSelected: () => null, getRegionParam: () => '' };
+  ctx.onWS = () => {};
+  ctx.offWS = () => {};
+  ctx.debouncedOnWS = () => () => {};
+  ctx.invalidateApiCache = () => {};
+  ctx.favStar = () => '';
+  ctx.bindFavStars = () => {};
+  ctx.getFavorites = () => [];
+  ctx.isFavorite = () => false;
+  ctx.connectWS = () => {};
+  ctx.HopResolver = { init: () => {}, resolve: () => ({}), ready: () => false };
+  ctx.initTabBar = () => {};
+  ctx.debounce = (fn) => fn;
+  ctx.copyToClipboard = () => {};
+  ctx.api = () => Promise.resolve({});
+  ctx.escapeHtml = (s) => s;
+  ctx.timeAgo = () => '';
+  ctx.formatTimestampWithTooltip = () => '';
+  ctx.getTimestampMode = () => 'ago';
+  ctx.CLIENT_TTL = {};
+  ctx.qrcode = null;
+
+  try {
+    const src = fs.readFileSync('public/nodes.js', 'utf8');
+    vm.runInContext(src, ctx);
+    for (const k of Object.keys(ctx.window)) ctx[k] = ctx.window[k];
+  } catch (e) {
+    console.log('  ⚠️ nodes.js sandbox load failed:', e.message.slice(0, 120));
+  }
+
+  const buildNodesQuery = ctx.buildNodesQuery;
+
+  if (buildNodesQuery) {
+    test('buildNodesQuery: all tab + no search = empty', () => {
+      assert.strictEqual(buildNodesQuery('all', ''), '');
+    });
+    test('buildNodesQuery: repeater tab only', () => {
+      assert.strictEqual(buildNodesQuery('repeater', ''), '?tab=repeater');
+    });
+    test('buildNodesQuery: search only (all tab)', () => {
+      assert.strictEqual(buildNodesQuery('all', 'foo'), '?search=foo');
+    });
+    test('buildNodesQuery: tab + search combined', () => {
+      assert.strictEqual(buildNodesQuery('companion', 'bar'), '?tab=companion&search=bar');
+    });
+    test('buildNodesQuery: null search treated as empty', () => {
+      assert.strictEqual(buildNodesQuery('all', null), '');
+    });
+    test('buildNodesQuery: sensor tab', () => {
+      assert.strictEqual(buildNodesQuery('sensor', ''), '?tab=sensor');
+    });
+  } else {
+    console.log('  ⚠️ buildNodesQuery not exposed — skipping');
+  }
+}
+```
+
+- [ ] **Step 2: Run test to verify it fails (or skips)**
+
+```bash
+node test-frontend-helpers.js 2>&1 | grep -A3 "buildNodesQuery"
+```
+
+Expected: `⚠️ buildNodesQuery not exposed — skipping`
+
+- [ ] **Step 3: Add URL param reading and helpers to nodes.js**
+
+**3a.** Add `buildNodesQuery` and `updateNodesUrl` functions inside the nodes.js IIFE, after the `TABS` definition (around line 86, before `function renderNodeTimestampHtml`):
+
+```javascript
+  function buildNodesQuery(tab, searchStr) {
+    var parts = [];
+    if (tab && tab !== 'all') parts.push('tab=' + encodeURIComponent(tab));
+    if (searchStr) parts.push('search=' + encodeURIComponent(searchStr));
+    return parts.length ? '?' + parts.join('&') : '';
+  }
+  window.buildNodesQuery = buildNodesQuery;
+
+  function updateNodesUrl() {
+    history.replaceState(null, '', '#/nodes' + buildNodesQuery(activeTab, search));
+  }
+```
+
+**3b.** In the list-view branch of `init` (after the `return;` that ends the full-screen block at line 317), add URL param reading before `app.innerHTML`:
+
+```javascript
+    // Read URL params for list view (router strips query string from routeParam)
+    const _listUrlParams = new URLSearchParams(location.hash.split('?')[1] || '');
+    const _urlTab = _listUrlParams.get('tab');
+    const _urlSearch = _listUrlParams.get('search');
+    if (_urlTab && TABS.some(function(t) { return t.key === _urlTab; })) activeTab = _urlTab;
+    if (_urlSearch) search = _urlSearch;
+
+    app.innerHTML = `<div class="nodes-page">
+```
+
+**3c.** After `app.innerHTML = ...` (after the closing backtick at line ~330), populate the search input:
+
+```javascript
+    if (search) {
+      var _si = document.getElementById('nodeSearch');
+      if (_si) _si.value = search;
+    }
+```
+
+**3d.** In the search input event listener (around line 335), add `updateNodesUrl()`:
+
+```javascript
+    document.getElementById('nodeSearch').addEventListener('input', debounce(e => {
+      search = e.target.value;
+      updateNodesUrl();
+      loadNodes();
+    }, 250));
+```
+
+**3e.** In the tab click handler inside `renderLeft` (around line 875), add `updateNodesUrl()`:
+
+```javascript
+      btn.addEventListener('click', () => { activeTab = btn.dataset.tab; updateNodesUrl(); loadNodes(); });
+```
+
+- [ ] **Step 4: Run unit tests**
+
+```bash
+node test-frontend-helpers.js 2>&1 | grep -E "(buildNodesQuery|✅|❌)" | grep -v "helpers"
+```
+
+Expected: 6 passing `buildNodesQuery` tests.
+
+- [ ] **Step 5: Write Playwright test (add to test-e2e-playwright.js)**
+
+Add before the closing `await browser.close()` line:
+
+```javascript
+  // --- Group: Deep linking (#536) ---
+
+  // Test: nodes tab deep link
+  await test('Nodes tab deep link restores active tab', async () => {
+    await page.goto(BASE + '#/nodes?tab=repeater', { waitUntil: 'domcontentloaded' });
+    await page.waitForSelector('.node-tab', { timeout: 8000 });
+    const activeTab = await page.$('.node-tab.active');
+    assert(activeTab, 'No active tab found');
+    const tabText = await activeTab.textContent();
+    assert(tabText.includes('Repeater'), `Expected Repeater tab active, got: ${tabText}`);
+    const url = page.url();
+    assert(url.includes('tab=repeater'), `URL should contain tab=repeater, got: ${url}`);
+  });
+
+  // Test: nodes tab click updates URL
+  await test('Nodes tab click updates URL', async () => {
+    await page.goto(BASE + '#/nodes', { waitUntil: 'domcontentloaded' });
+    await page.waitForSelector('.node-tab', { timeout: 8000 });
+    const roomTab = await page.$('.node-tab[data-tab="room"]');
+    if (roomTab) {
+      await roomTab.click();
+      await page.waitForTimeout(300);
+      const url = page.url();
+      assert(url.includes('tab=room'), `URL should contain tab=room after click, got: ${url}`);
+    }
+  });
+```
+
+- [ ] **Step 6: Run full test suite**
+
+```bash
+node test-frontend-helpers.js
+```
+
+Expected: all tests pass.
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add public/nodes.js test-frontend-helpers.js test-e2e-playwright.js
+git commit -m "feat: deep link nodes tab and search query (#536)"
+```
+
+---
+
+## Task 3: packets.js — timeWindow and region deep linking
+
+**Files:**
+- Modify: `public/packets.js`
+- Test: `test-frontend-helpers.js`
+- Test: `test-e2e-playwright.js`
+
+> Depends on Task 1 (RegionFilter.setSelected).
+
+- [ ] **Step 1: Write the unit test**
+
+Add to `test-frontend-helpers.js` before `// ===== SUMMARY =====`:
+
+```javascript
+// ===== PACKETS.JS: buildPacketsUrl =====
+console.log('\n=== packets.js: buildPacketsUrl ===');
+{
+  // Test the pure helper function
+  // (loaded via packets.js after it exposes window.buildPacketsUrl)
+  const ctx = makeSandbox();
+  loadInCtx(ctx, 'public/roles.js');
+  loadInCtx(ctx, 'public/app.js');
+
+  ctx.registerPage = () => {};
+  ctx.RegionFilter = { init: () => Promise.resolve(), onChange: () => () => {}, offChange: () => {}, getSelected: () => null, getRegionParam: () => '', setSelected: () => {} };
+  ctx.onWS = () => {};
+  ctx.offWS = () => {};
+  ctx.debouncedOnWS = () => () => {};
+  ctx.invalidateApiCache = () => {};
+  ctx.api = () => Promise.resolve({});
+  ctx.observerMap = new Map();
+  ctx.getParsedPath = () => [];
+  ctx.getParsedDecoded = () => ({});
+  ctx.clearParsedCache = () => {};
+  ctx.escapeHtml = (s) => s;
+  ctx.timeAgo = () => '';
+  ctx.formatTimestampWithTooltip = () => '';
+  ctx.getTimestampMode = () => 'ago';
+  ctx.copyToClipboard = () => {};
+  ctx.CLIENT_TTL = {};
+  ctx.debounce = (fn) => fn;
+  ctx.initTabBar = () => {};
+
+  try {
+    const src = fs.readFileSync('public/packet-helpers.js', 'utf8');
+    vm.runInContext(src, ctx);
+    for (const k of Object.keys(ctx.window)) ctx[k] = ctx.window[k];
+    const src2 = fs.readFileSync('public/packets.js', 'utf8');
+    vm.runInContext(src2, ctx);
+    for (const k of Object.keys(ctx.window)) ctx[k] = ctx.window[k];
+  } catch (e) {
+    console.log('  ⚠️ packets.js sandbox load failed:', e.message.slice(0, 120));
+  }
+
+  const buildPacketsUrl = ctx.buildPacketsUrl;
+
+  if (buildPacketsUrl) {
+    test('buildPacketsUrl: default (15min, no region) = bare #/packets', () => {
+      assert.strictEqual(buildPacketsUrl(15, ''), '#/packets');
+    });
+    test('buildPacketsUrl: non-default timeWindow', () => {
+      assert.strictEqual(buildPacketsUrl(60, ''), '#/packets?timeWindow=60');
+    });
+    test('buildPacketsUrl: region only', () => {
+      assert.strictEqual(buildPacketsUrl(15, 'US-SFO'), '#/packets?region=US-SFO');
+    });
+    test('buildPacketsUrl: timeWindow + region', () => {
+      assert.strictEqual(buildPacketsUrl(30, 'US-SFO,US-LAX'), '#/packets?timeWindow=30&region=US-SFO%2CUS-LAX');
+    });
+    test('buildPacketsUrl: timeWindow=0 treated as default', () => {
+      assert.strictEqual(buildPacketsUrl(0, ''), '#/packets');
+    });
+  } else {
+    console.log('  ⚠️ buildPacketsUrl not exposed — skipping');
+  }
+}
+```
+
+- [ ] **Step 2: Run to verify it skips**
+
+```bash
+node test-frontend-helpers.js 2>&1 | grep -A2 "buildPacketsUrl"
+```
+
+Expected: `⚠️ buildPacketsUrl not exposed — skipping`
+
+- [ ] **Step 3: Add helpers and URL param reading to packets.js**
+
+**3a.** Add `buildPacketsUrl` and `updatePacketsUrl` inside the packets.js IIFE, after the existing constants at the top (around line 36, after `let showHexHashes`):
+
+```javascript
+  function buildPacketsUrl(timeWindowMin, regionParam) {
+    var parts = [];
+    if (timeWindowMin && timeWindowMin !== 15) parts.push('timeWindow=' + timeWindowMin);
+    if (regionParam) parts.push('region=' + encodeURIComponent(regionParam));
+    return '#/packets' + (parts.length ? '?' + parts.join('&') : '');
+  }
+  window.buildPacketsUrl = buildPacketsUrl;
+
+  function updatePacketsUrl() {
+    history.replaceState(null, '', buildPacketsUrl(savedTimeWindowMin, RegionFilter.getRegionParam()));
+  }
+```
+
+**3b.** In the `init` function (around line 263), add URL param reading after the existing `routeParam`/`directObsId` parsing and before `app.innerHTML`:
+
+```javascript
+    // Read URL params for filter state (router strips query from routeParam; read from location.hash)
+    var _initUrlParams = new URLSearchParams(location.hash.split('?')[1] || '');
+    var _urlTimeWindow = Number(_initUrlParams.get('timeWindow'));
+    if (Number.isFinite(_urlTimeWindow) && _urlTimeWindow > 0) {
+      savedTimeWindowMin = _urlTimeWindow;
+      localStorage.setItem('meshcore-time-window', String(_urlTimeWindow));
+    }
+    var _urlRegion = _initUrlParams.get('region');
+    if (_urlRegion) {
+      RegionFilter.setSelected(_urlRegion.split(',').filter(Boolean));
+    }
+
+    app.innerHTML = `<div class="split-layout detail-collapsed">
+```
+
+**3c.** In the time window change handler (around line 865), add `updatePacketsUrl()`:
+
+```javascript
+    fTimeWindow.addEventListener('change', () => {
+      savedTimeWindowMin = Number(fTimeWindow.value);
+      if (!Number.isFinite(savedTimeWindowMin) || savedTimeWindowMin <= 0) savedTimeWindowMin = 15;
+      localStorage.setItem('meshcore-time-window', fTimeWindow.value);
+      updatePacketsUrl();
+      loadPackets();
+    });
+```
+
+**3d.** In the RegionFilter.onChange callback (around line 719), add `updatePacketsUrl()`:
+
+```javascript
+    RegionFilter.onChange(function() { updatePacketsUrl(); loadPackets(); });
+```
+
+- [ ] **Step 4: Run unit tests**
+
+```bash
+node test-frontend-helpers.js 2>&1 | grep -E "(buildPacketsUrl|✅|❌)" | grep -v "helpers"
+```
+
+Expected: 5 passing `buildPacketsUrl` tests.
+
+- [ ] **Step 5: Write Playwright test (add to test-e2e-playwright.js, inside the deep-linking group)**
+
+```javascript
+  // Test: packets timeWindow deep link
+  await test('Packets timeWindow deep link restores dropdown', async () => {
+    await page.goto(BASE + '#/packets?timeWindow=60', { waitUntil: 'domcontentloaded' });
+    await page.waitForSelector('#fTimeWindow', { timeout: 8000 });
+    const val = await page.$eval('#fTimeWindow', el => el.value);
+    assert(val === '60', `Expected timeWindow dropdown = 60, got: ${val}`);
+    const url = page.url();
+    assert(url.includes('timeWindow=60'), `URL should still contain timeWindow=60, got: ${url}`);
+  });
+
+  // Test: timeWindow change updates URL
+  await test('Packets timeWindow change updates URL', async () => {
+    await page.goto(BASE + '#/packets', { waitUntil: 'domcontentloaded' });
+    await page.waitForSelector('#fTimeWindow', { timeout: 8000 });
+    await page.selectOption('#fTimeWindow', '30');
+    await page.waitForTimeout(300);
+    const url = page.url();
+    assert(url.includes('timeWindow=30'), `URL should contain timeWindow=30 after change, got: ${url}`);
+  });
+```
+
+- [ ] **Step 6: Run full test suite**
+
+```bash
+node test-frontend-helpers.js
+```
+
+Expected: all tests pass.
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add public/packets.js test-frontend-helpers.js test-e2e-playwright.js
+git commit -m "feat: deep link packets timeWindow and region filter (#536)"
+```
+
+---
+
+## Task 4: channels.js — node panel deep linking
+
+**Files:**
+- Modify: `public/channels.js`
+
+No unit tests needed for this task — the URL manipulation is side-effectful (DOM + History API). Playwright tests cover it.
+
+- [ ] **Step 1: Write the Playwright test (add to test-e2e-playwright.js, inside the deep-linking group)**
+
+```javascript
+  // Test: channels selected channel survives refresh (already implemented, verify it still works)
+  await test('Channels channel selection is URL-addressable', async () => {
+    await page.goto(BASE + '#/channels', { waitUntil: 'domcontentloaded' });
+    await page.waitForSelector('.ch-item', { timeout: 8000 }).catch(() => null);
+    const firstChannel = await page.$('.ch-item');
+    if (firstChannel) {
+      await firstChannel.click();
+      await page.waitForTimeout(500);
+      const url = page.url();
+      assert(url.includes('#/channels/') || url.includes('#/channels'), `URL should reflect channel selection, got: ${url}`);
+    }
+  });
+```
+
+- [ ] **Step 2: Update `showNodeDetail` to write `?node=` to the URL**
+
+In `channels.js`, in `showNodeDetail` (around line 171), add the URL update right after `selectedNode = name;`:
+
+```javascript
+  async function showNodeDetail(name) {
+    _nodePanelTrigger = document.activeElement;
+    if (_focusTrapCleanup) { _focusTrapCleanup(); _focusTrapCleanup = null; }
+    const node = await lookupNode(name);
+    selectedNode = name;
+    var _chBase = selectedHash ? '#/channels/' + encodeURIComponent(selectedHash) : '#/channels';
+    history.replaceState(null, '', _chBase + '?node=' + encodeURIComponent(name));
+
+    let panel = document.getElementById('chNodePanel');
+```
+
+- [ ] **Step 3: Update `closeNodeDetail` to strip `?node=` from the URL**
+
+In `closeNodeDetail` (around line 232), add URL restore right after `selectedNode = null;`:
+
+```javascript
+  function closeNodeDetail() {
+    if (_focusTrapCleanup) { _focusTrapCleanup(); _focusTrapCleanup = null; }
+    const panel = document.getElementById('chNodePanel');
+    if (panel) panel.classList.remove('open');
+    selectedNode = null;
+    var _chRestoreUrl = selectedHash ? '#/channels/' + encodeURIComponent(selectedHash) : '#/channels';
+    history.replaceState(null, '', _chRestoreUrl);
+    if (_nodePanelTrigger && typeof _nodePanelTrigger.focus === 'function') {
+```
+
+- [ ] **Step 4: Read `?node=` on init and auto-open panel**
+
+In `channels.js` `init` (line 316), add URL param reading at the very top of the function (before `app.innerHTML`):
+
+```javascript
+  function init(app, routeParam) {
+    var _initUrlParams = new URLSearchParams(location.hash.split('?')[1] || '');
+    var _pendingNode = _initUrlParams.get('node');
+
+    app.innerHTML = `<div class="ch-layout">
+```
+
+Then update the `loadChannels().then(...)` call (around line 350) to auto-open the node panel:
+
+```javascript
+    loadChannels().then(async function () {
+      if (routeParam) await selectChannel(routeParam);
+      if (_pendingNode) showNodeDetail(_pendingNode);
+    });
+```
+
+- [ ] **Step 5: Run full test suite**
+
+```bash
+node test-frontend-helpers.js
+```
+
+Expected: all tests pass (no channels unit tests, but regression tests still pass).
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add public/channels.js
+git commit -m "feat: deep link channels node panel via ?node= (#536)"
+```
+
+---
+
+## Task 5: Run E2E Playwright tests
+
+- [ ] **Step 1: Start the local server**
+
+```bash
+cd cmd/server && go run . &
+```
+
+Wait for it to be ready (check `http://localhost:3000`).
+
+- [ ] **Step 2: Run Playwright tests**
+
+```bash
+node test-e2e-playwright.js
+```
+
+Expected: all tests pass including the new deep-linking group.
+
+- [ ] **Step 3: If any deep-linking test fails, debug**
+
+Common failures:
+- Selector `.node-tab.active` not found: check that nodes.js correctly reads `?tab=` from URL before rendering
+- `#fTimeWindow` value wrong: check that `savedTimeWindowMin` is overridden before the DOM is built
+- URL doesn't update: check `history.replaceState` calls in the change handlers
+
+- [ ] **Step 4: Final commit (if any fixes needed)**
+
+```bash
+git add public/nodes.js public/packets.js public/channels.js
+git commit -m "fix: deep linking E2E adjustments (#536)"
+```
+
+---
+
+## Self-Review
+
+**Spec coverage check:**
+- ✅ P1: Nodes role tab → Task 2
+- ✅ P1: Packets time window → Task 3
+- ✅ P1: Packets region filter → Task 3 (depends on Task 1)
+- ✅ P1: Channels selected channel → Already implemented via `#/channels/{hash}` (verified in channels.js init line 351)
+- ✅ P1: Channels node panel → Task 4
+- ✅ P2+ items → explicitly out of scope per issue
+
+**Architecture note:** The router in `app.js` strips the query string at line 422 (`const route = hash.split('?')[0]`) before computing `basePage` and `routeParam`. Therefore `#/nodes?tab=repeater` gives `routeParam=null` (not `?tab=repeater`). All pages must read URL params from `location.hash` directly, not from `routeParam`. This is the established pattern in `analytics.js` and `nodes.js` (section scroll).
+
+**Placeholder scan:** No TBDs, no "implement later", all code blocks complete. ✅
+
+**Type consistency:**
+- `buildNodesQuery(tab, searchStr)` — used consistently in `updateNodesUrl()` and in tests ✅
+- `buildPacketsUrl(timeWindowMin, regionParam)` — used consistently in `updatePacketsUrl()` and in tests ✅
+- `RegionFilter.setSelected(codesArray)` — defined in Task 1, used in Task 3 ✅

docs/test-plans/v3.4.2-manual-validation.md

@@ -0,0 +1,162 @@
+# v3.4.2 Manual Validation Checklist
+
+**Tester:** _______________
+**Staging:** http://20.109.157.39
+**Prod:** https://analyzer.00id.net (READ ONLY — do not deploy until staging passes)
+**Browser:** Chrome + Firefox + Safari (mobile for responsive items)
+**Time estimate:** ~45 minutes
+
+---
+
+## 🔴 HIGH RISK — Test First
+
+### 1. Zero-hop hash size display (#649, #653)
+- [ ] Go to Packets page, find a DIRECT advert (route_type=2, 0 hops)
+- [ ] Open packet detail — hash size should say "Unknown (zero-hop)" or be hidden, NOT "1 byte"
+- [ ] Check "Path Length" field shows `hash_count=0 (direct advert)` 
+- [ ] Find a FLOOD advert with 0 hops — it SHOULD show hash size (this is different from DIRECT)
+
+### 2. TRACE packet real path (#651, #656)
+- [ ] Send a trace from your companion
+- [ ] Watch Live map — the animated dot should only travel along completed hops (solid line)
+- [ ] Unreached hops should show as dashed/ghosted line at reduced opacity
+- [ ] If trace completes fully, entire path should be solid
+- [ ] Ghost line should auto-clean after ~10 seconds
+
+### 3. "Paths through this node" accuracy (#655, #658)
+- [ ] Go to: http://20.109.157.39/#/nodes/c0dedad4208acb6cbe44b848943fc6d3c5d43cf38a21e48b43826a70862980e4
+- [ ] Check "Packets through this node" — packets should actually have this node in their path
+- [ ] Compare with a node that shares a 2-char prefix (e.g. C0ffee SF) — they should show DIFFERENT packets
+- [ ] Spot-check 3-4 packets: click through, verify path contains the node
+
+### 4. Hash Stats "By Repeaters" (#652, #654)
+- [ ] Go to Analytics → Hash Stats
+- [ ] "By Repeaters" section should only show repeater-role nodes
+- [ ] Compare count in "Multi-Byte Hash Adopters" vs "By Repeaters" — adopters may include companions, repeaters section should not
+- [ ] Check that companions/rooms/sensors are excluded from the repeater distribution
+
+### 5. Noise floor column chart (#600, #659)
+- [ ] Go to Analytics → RF Health
+- [ ] Noise floor chart should show vertical color-coded bars, NOT a line
+- [ ] Green bars (< -100 dBm), yellow (-100 to -85), red (≥ -85)
+- [ ] Hover over a bar — tooltip should show exact dBm + timestamp
+- [ ] Check with only 1 observer selected — chart should still render (division by zero edge case)
+- [ ] Reboot markers (if any) should show as vertical dashed lines
+
+### 6. Async backfill on startup
+- [ ] SSH to staging: `ssh -i ~/.ssh/id_ed25519 runner@20.109.157.39`
+- [ ] `docker restart corescope-staging-go`
+- [ ] Within 30 seconds, hit `curl http://localhost:82/api/stats` — should return data (not hang)
+- [ ] Check `backfilling` and `backfillProgress` fields in stats response
+- [ ] Server should be serving HTTP while backfill runs in background
+
+---
+
+## 🟡 MEDIUM RISK — Features
+
+### 7. Distance unit preference (#621, #646)
+- [ ] Go to Customizer → Display tab
+- [ ] Change distance unit to "mi" — all distances should show in miles
+- [ ] Change to "km" — all distances should show in km
+- [ ] Change to "auto" — should use locale (US = miles, EU = km)
+- [ ] Check Analytics page distances update after customizer change (no page reload needed)
+- [ ] Check Node detail → Neighbors table distances
+- [ ] Very small distances (<0.1 mi) should show in feet, not "0.0 mi"
+
+### 8. Panel corner toggle (#608, #657)
+- [ ] Go to Live map page
+- [ ] Each panel (feed, legend, node detail) should have a small corner-toggle button
+- [ ] Click the button — panel should snap to next corner (TL → TR → BR → BL)
+- [ ] Refresh page — panel positions should persist (localStorage)
+- [ ] Move two panels to same corner — collision avoidance should skip to next free corner
+- [ ] On mobile viewport (<768px?) — toggle buttons should be hidden
+
+### 9. Deep linking (#536, #618)
+- [ ] Navigate to Nodes page, click a node → URL should update with pubkey hash
+- [ ] Copy URL, open in new tab → should land on same node
+- [ ] Apply packet filters → URL hash should include filter params
+- [ ] Channels page: select a node → URL should reflect selection
+- [ ] Analytics tabs: switch tabs → URL should include tab name
+- [ ] Share a deep link with someone — they should see the same view
+
+### 10. Sortable tables (#620, #638, #639)
+- [ ] Nodes list: click column headers — should sort ascending/descending
+- [ ] Sort indicator (arrow) should be visible on active column
+- [ ] Node detail → Neighbors table: sortable
+- [ ] Node detail → Observers table: sortable
+- [ ] Packets table: sortable by column headers
+
+### 11. Channel color highlighting (#271, #607, #611)
+- [ ] Go to Channels page
+- [ ] Assign a color to a channel using the color picker
+- [ ] Feed rows should highlight with that color
+- [ ] Change color — should update immediately
+- [ ] Refresh — color assignment should persist
+
+### 12. Collapsible panels (#606)
+- [ ] Live map: panels should have collapse/expand toggle
+- [ ] Collapsed panel should show just the header
+- [ ] State should persist across page navigations
+
+### 13. Mobile accessibility (#630, #633)
+- [ ] Open staging on phone (or Chrome DevTools mobile emulation)
+- [ ] Touch targets should be at least 44×44px
+- [ ] Channel color picker should work on mobile
+- [ ] No horizontal scroll on any page
+- [ ] ARIA labels present on interactive elements (inspect with accessibility tools)
+
+### 14. Map byte-size filter (#565, #568)
+- [ ] Go to Map page
+- [ ] Find the byte-size filter control
+- [ ] Filter by packet size — map should update to show only matching packets
+- [ ] Clear filter — all packets should return
+
+### 15. API key security (#532, #628)
+- [ ] Try accessing a write endpoint without API key — should be blocked
+- [ ] Try with a weak key (e.g., "test", "admin") — should be rejected at startup
+- [ ] Check staging logs for API key warning: `docker logs corescope-staging-go 2>&1 | grep -i "apiKey\|api_key\|security"`
+
+### 16. OpenAPI/Swagger (#530, #632)
+- [ ] Hit http://20.109.157.39/api/spec — should return valid OpenAPI 3.0 spec
+- [ ] Hit http://20.109.157.39/api/docs — should show Swagger UI
+- [ ] Try an endpoint from Swagger UI — should work
+
+---
+
+## 🟢 LOW RISK — Verify Quickly
+
+### 17. View Route on Map button
+- [ ] Go to any packet detail page
+- [ ] Click "View Route on Map" — should navigate to map with route highlighted
+
+### 18. og-image compression
+- [ ] Check page source or network tab — og-image.png should be < 300KB (was 1.1MB)
+
+### 19. Prefix Tool
+- [ ] Analytics → Prefix Tool tab should load
+- [ ] Should show collision data
+
+### 20. License
+- [ ] Check repo footer/LICENSE — should be GPL v3
+
+### 21. Docker DISABLE_CADDY
+- [ ] (If testable) Set DISABLE_CADDY=true — Caddy should not start
+
+### 22. Region filter on RF Health
+- [ ] RF Health tab: change region filter — charts should update
+
+---
+
+## 🏁 Sign-off
+
+| Section | Status | Notes |
+|---------|--------|-------|
+| High risk (1-6) | ☐ | |
+| Medium risk (7-16) | ☐ | |
+| Low risk (17-22) | ☐ | |
+| **Overall** | ☐ | |
+
+**Tested by:** _______________  
+**Date:** _______________  
+**Staging version:** `curl -s http://20.109.157.39/api/stats | jq .version`  
+**Ready for release:** ☐ Yes / ☐ No — blockers: _______________

docs/test-plans/v3.4.2-release-test-plan.md

@@ -0,0 +1,309 @@
+# v3.4.2 Release Test Plan
+
+**Scope:** 90 commits since v3.4.1 (84 files, +14,931 / -1,005)  
+**Categories:** 19 perf, 19 feat, 18 fix, 15 docs, 3 chore, 1 test, 1 refactor, 1 ci  
+**Date:** 2026-04-08
+
+---
+
+## A. Automated Tests — Verify All Pass
+
+### Go Backend
+```bash
+cd cmd/server && go test -race -count=1 ./...
+cd cmd/ingestor && go test -race -count=1 ./...
+```
+
+**Test files (27 total):**
+
+| File | Tests For |
+|------|-----------|
+| `cmd/server/decoder_test.go` | Hash size zero-hop, TRACE hopsCompleted, transport direct |
+| `cmd/server/backfill_async_test.go` | **NEW** — Async chunked backfill |
+| `cmd/server/eviction_test.go` | Memory eviction with runtime heap stats |
+| `cmd/server/apikey_security_test.go` | **NEW** — Weak/default API key rejection |
+| `cmd/server/openapi_test.go` | **NEW** — OpenAPI spec generation |
+| `cmd/server/routes_test.go` | Batch observations endpoint, subpaths-bulk, expand=observations |
+| `cmd/server/cache_invalidation_test.go` | cacheTTL config wiring |
+| `cmd/server/config_knobs_test.go` | cacheTTLSec helper |
+| `cmd/server/helpers_test.go` | constantTimeEqual, IsWeakAPIKey |
+| `cmd/server/obs_dedup_test.go` | UniqueObserverCount tracking |
+| `cmd/server/neighbor_*.go` (4 files) | Neighbor graph, affinity, persistence |
+| `cmd/server/perfstats_race_test.go` | Perf stats concurrency |
+| `cmd/server/resolve_context_test.go` | Resolved path filtering |
+| `cmd/server/advert_pubkey_test.go` | Advert pubkey tracking |
+| `cmd/server/db_test.go` | SQLite operations |
+| `cmd/server/config_test.go` | Config loading |
+| `cmd/server/coverage_test.go` | Coverage helpers |
+| `cmd/server/parity_test.go` | Go/JS decoder parity |
+| `cmd/server/websocket_test.go` | WebSocket broadcast |
+| `cmd/ingestor/decoder_test.go` | Ingestor decoder (hash size zero-hop) |
+| `cmd/ingestor/db_test.go` | Ingestor DB writes |
+| `cmd/ingestor/config_test.go` | Ingestor config |
+| `cmd/ingestor/main_test.go` | Ingestor entry |
+| `cmd/ingestor/coverage_boost_test.go` | Coverage helpers |
+
+### Frontend Unit Tests
+```bash
+node test-packet-filter.js
+node test-aging.js
+node test-frontend-helpers.js
+node test-table-sort.js          # NEW — shared table sort utility
+node test-channel-colors.js      # NEW — channel color model
+node test-panel-corner.js        # NEW — panel corner toggle
+node test-packets.js             # NEW — packets page logic
+node test-hop-resolver-affinity.js
+node test-customizer-v2.js
+node test-live.js
+node test-live-dedup.js
+```
+
+### E2E / Playwright
+```bash
+BASE_URL=http://localhost:13581 node test-e2e-playwright.js
+```
+
+**Expected:** All existing tests pass + new tests added for sortable tables, deep linking, collapsible panels.
+
+---
+
+## B. Manual Browser Verification
+
+### B1. HIGH RISK — Data Correctness
+
+| # | Feature | Page | What to Check |
+|---|---------|------|---------------|
+| 1 | Hash size zero-hop | Packets detail | Find a direct (route_type=0) packet → hash_size should show 0, not a bogus computed value |
+| 2 | TRACE hopsCompleted | Packets detail / Live map | Find a TRACE packet → verify `hopsCompleted` shows in decoded JSON, live map shows real path length vs intended |
+| 3 | Transport direct hash size | Packets detail | Find route_type=RouteTransportDirect packet → hash_size=0 |
+| 4 | resolved_path filtering | Node detail → Paths tab | Verify path-hop candidates use resolved_path, no prefix collision false positives |
+| 5 | Hash stats repeater filter | Analytics → Hash Issues | "By Repeaters" should only show nodes with repeater role, not companions/sensors |
+| 6 | Async chunked backfill | Server startup | Start server with large DB → verify HTTP serves within 2 minutes, `X-CoreScope-Status: backfilling` header present, then transitions to `ready` |
+| 7 | Memory eviction (heap stats) | Admin/stats | Verify `/api/stats` shows realistic memory numbers from runtime heap, not the old estimation |
+| 8 | Distance/subpath/path-hop indexes | Analytics → Distances, Subpaths | Verify analytics data matches v3.4.1 output (no missing or extra entries) |
+| 9 | cacheTTL config wiring | Config | Set `cacheTTL.analyticsHashSizes: 300` in config → verify collision cache respects it |
+
+### B2. MEDIUM RISK — User-Facing Features
+
+| # | Feature | Page | What to Check |
+|---|---------|------|---------------|
+| 10 | Distance unit preference | Nodes detail, Map | Toggle km/mi/auto in settings → distances update throughout UI |
+| 11 | Panel corner toggle | Live page | Click corner toggle → panel moves to opposite corner, persists on reload |
+| 12 | Noise floor column chart | Analytics → RF | Verify column chart renders with color-coded thresholds, hover shows values |
+| 13 | Deep linking UI states | All pages | Navigate to `#/nodes?tab=neighbors`, `#/packets?observer=X`, `#/channels?node=Y` → correct state loads. Copy URL, open in new tab → same state |
+| 14 | Sortable tables | Nodes list, Neighbors, Observers | Click column headers → sort asc/desc, indicator arrow shows, persists correctly |
+| 15 | Channel color highlighting | Channels, Live feed | Assign color to channel → feed rows show that color, persists on reload |
+| 16 | Mobile accessibility | All pages (phone viewport) | Touch targets ≥44px, ARIA labels present, small viewport doesn't overflow |
+| 17 | Collapsible panels | Live map | Collapse/expand panels, medium breakpoint auto-collapses, state persists |
+| 18 | Byte-size map filter | Map page | Filter by byte size → markers update correctly |
+| 19 | OpenAPI/Swagger | `/api/spec`, `/api/docs` | Spec loads valid JSON, Swagger UI renders and all endpoints are documented |
+| 20 | API key rejection | Protected endpoints | Send weak key (e.g. "changeme", "test123") → 403 forbidden |
+| 21 | Channel color picker mobile | Channels (phone viewport) | Color picker usable on touch, doesn't overflow |
+| 22 | RF Health dashboard | Analytics → RF Health | Observer metrics grid, airtime charts, battery charts, error rate, region filter |
+| 23 | Prefix Tool tab | Analytics → Prefix Tool | Renders correctly, collision data consistent with Hash Issues |
+| 24 | View Route on Map | Packet detail page | Button works and shows route on map |
+
+### B3. LOWER RISK — Performance (Verify No Regressions)
+
+| # | Feature | Page | What to Check |
+|---|---------|------|---------------|
+| 25 | Incremental DOM diff | Packets (30K+) | Virtual scroll renders smoothly, no visible flicker |
+| 26 | Coalesced WS renders | Live page | Rapid packets don't cause frame drops (rAF coalescing) |
+| 27 | Marker reposition on zoom | Map | Zoom/resize → markers move smoothly, no full rebuild flash |
+| 28 | Parallel replay fetches | Live → VCR | Replay loads quickly (parallel observation fetches) |
+| 29 | Batch observations API | Packets page (sort change) | Changing sort fetches observations in batch (network tab: 1 POST not N GETs) |
+| 30 | Client-side network status | Analytics | No separate API call for network status |
+| 31 | og-image compression | `/og-image.png` | Verify loads, ~235KB not ~1.1MB |
+
+---
+
+## C. API Regression Tests
+
+Run against a local server with test-fixture DB:
+
+```bash
+BASE=http://localhost:13581
+
+# Core endpoints — verify response shape
+curl -s "$BASE/api/stats" | jq '.totalPackets, .backfilling, .backfillProgress'
+curl -s "$BASE/api/packets?limit=5" | jq '.packets[0] | keys'
+curl -s "$BASE/api/packets?limit=5&expand=observations" | jq '.packets[0].observations | length'
+curl -s "$BASE/api/nodes?limit=5" | jq '.[0] | keys'
+
+# New endpoints
+curl -s -X POST "$BASE/api/packets/observations" \
+  -H 'Content-Type: application/json' \
+  -d '{"hashes":["test123"]}' | jq '.results | keys'
+
+curl -s "$BASE/api/analytics/subpaths-bulk?hops=A,B&hops=B,C" | jq 'keys'
+
+curl -s "$BASE/api/observers/metrics/summary" | jq 'type'
+curl -s "$BASE/api/spec" | jq '.openapi'
+curl -s "$BASE/api/docs" | head -5  # Should return HTML
+
+# Backfill status header
+curl -sI "$BASE/api/stats" | grep X-CoreScope-Status
+
+# API key rejection
+curl -s -H 'X-API-Key: changeme' "$BASE/api/debug/vars" | jq '.error'
+curl -s -H 'X-API-Key: test' "$BASE/api/debug/vars" | jq '.error'
+
+# Existing endpoints — verify not broken
+curl -s "$BASE/api/analytics/rf?timeRange=24h" | jq 'keys'
+curl -s "$BASE/api/analytics/hash-sizes" | jq 'type'
+curl -s "$BASE/api/analytics/distances" | jq 'type'
+curl -s "$BASE/api/analytics/subpaths" | jq 'type'
+curl -s "$BASE/api/channels" | jq 'type'
+curl -s "$BASE/api/config/client" | jq 'keys'
+```
+
+### Expected response shape changes from v3.4.1:
+- `/api/stats` now includes `backfilling` (bool) and `backfillProgress` (float 0-1)
+- `/api/packets` no longer strips observations by default (lazy via `ExpandObservations` flag) — verify `observations` key absent without `expand=observations`
+- Decoded packets with route_type=direct now have `hashSize: 0`
+- TRACE packets now have `path.hopsCompleted` field
+
+---
+
+## D. Performance Regression Tests
+
+### D1. Server Startup Time
+```bash
+# Start server with production-size DB (~30K packets)
+# Measure time from process start to first successful HTTP response
+time curl -s http://localhost:13581/api/stats > /dev/null
+# Target: < 2 minutes (async backfill requirement)
+```
+
+### D2. Go Benchmarks
+```bash
+cd cmd/server && go test -bench=. -benchmem -count=3
+```
+Key benchmarks to compare with v3.4.1 baseline:
+- `BenchmarkQueryPackets` — should not regress with new indexes
+- `BenchmarkEvictStale` — batch removal from secondary indexes
+- `BenchmarkGetStoreStats` — 2 concurrent queries vs 5 sequential
+- `BenchmarkIngestNew` — additional index maintenance overhead
+
+### D3. Frontend Performance
+- Open Packets page with 30K+ packets → measure initial render time (DevTools Performance tab)
+- Scroll rapidly through virtual scroll → should maintain 60fps
+- Switch sort column on packets → single batch POST, not N+1 GETs
+- Open Analytics page → no redundant API calls in network tab
+
+### D4. Memory Usage
+- After loading 30K packets, check `/api/stats` memory figure
+- Compare with v3.4.1 baseline (prefix map cap at 8 chars should reduce ~10x)
+- Verify eviction triggers at correct memory threshold using runtime heap stats
+
+---
+
+## E. Infrastructure / Deployment Tests
+
+### E1. Docker Build
+```bash
+docker build -t corescope:test .
+docker run --rm -p 13581:13581 corescope:test
+# Verify: container starts, HTTP responds, WebSocket connects
+```
+
+### E2. GHCR Publish (CI)
+- Verify CI publishes to `ghcr.io/kpa-clawbot/corescope`
+- Verify tags: `edge` (master), `vX.Y.Z` (release)
+
+### E3. Staging Deploy
+```bash
+# Verify staging compose works with standard ports
+docker compose -f docker-compose.staging.yml up -d
+# Check: no 3GB memory limit, standard port binding
+```
+
+### E4. DISABLE_CADDY
+```bash
+docker run --rm -e DISABLE_CADDY=true corescope:test
+# Verify: Caddy not started, Go server serves directly
+```
+
+### E5. CI Pipeline
+- Verify consolidated pipeline: build → publish GHCR → deploy staging
+- Verify runs on `meshcore-runner-2`
+
+---
+
+## F. Edge Cases & Integration Tests
+
+### F1. Cross-Feature Interactions
+| Scenario | Risk |
+|----------|------|
+| Deep link to sorted table → sort state matches URL params | Medium |
+| Channel color + deep link → color persists in linked URL | Medium |
+| Panel corner toggle + collapsible panels → both states persist independently | Low |
+| Distance unit pref + neighbor table sort by distance → sort uses correct unit | Medium |
+| Noise floor chart + region filter → chart respects filter | Medium |
+| Byte-size map filter + channel color highlighting → both active simultaneously | Low |
+
+### F2. Data Correctness Edge Cases
+| Scenario | Risk |
+|----------|------|
+| Zero-hop TRACE packet (should NOT reset hashSize — TRACE exemption) | **High** |
+| Packet with all hops having same 2-char prefix → resolved_path filtering prevents false match | **High** |
+| Node that switches role (repeater → companion) → hash stats updates | Medium |
+| Backfill interrupted mid-chunk (server restart) → resumes or completes on next start | Medium |
+| Empty DB startup → no errors, backfill completes instantly | Low |
+| DB with 100K+ packets → async backfill doesn't OOM, progress reported | **High** |
+
+### F3. Concurrency / Race Conditions
+| Scenario | Risk |
+|----------|------|
+| Concurrent API requests during backfill → no deadlock (lock ordering documented) | **High** |
+| Eviction running while analytics query in progress → no stale pointer panic | **High** |
+| Multiple WebSocket clients during high ingest rate → coalesced broadcasts don't drop | Medium |
+| `time.NewTicker` cleanup on graceful shutdown (replaced `time.Tick`) | Low |
+
+### F4. API Key Security
+| Scenario | Expected |
+|----------|----------|
+| No API key configured → write endpoints disabled | 403 "write endpoints disabled" |
+| Weak key "changeme" → rejected even if configured | 403 "forbidden" |
+| Timing-safe comparison → no timing oracle | Constant-time via `crypto/subtle` |
+| Empty string key → rejected | 401 "unauthorized" |
+
+### F5. Browser Compatibility
+- Test on Chrome, Firefox, Safari (latest)
+- Test on iOS Safari, Android Chrome
+- Verify touch targets on mobile (44px minimum)
+- Verify ARIA labels with screen reader
+
+---
+
+## G. Test Coverage Gaps — Action Items
+
+| Gap | Priority | Action |
+|-----|----------|--------|
+| No automated test for distance unit preference rendering | Medium | Add Playwright test |
+| No automated test for noise floor column chart | Medium | Add Playwright test |
+| No automated test for deep link state restoration | **High** | Add Playwright tests for each deep-linkable state |
+| No automated test for channel color persistence | Medium | `test-channel-colors.js` covers model; need Playwright for UI |
+| No automated test for mobile viewport behavior | Medium | Add Playwright test with mobile viewport |
+| No automated test for backfill progress header | Low | Add to `routes_test.go` |
+| No automated test for `time.NewTicker` cleanup | Low | Add to graceful shutdown test |
+| Observer metrics endpoints not covered in route tests | Medium | Add to `routes_test.go` |
+| Subpaths-bulk endpoint needs test | Medium | Add to `routes_test.go` |
+| No load test for batch observations endpoint (200 hash limit) | Low | Add boundary test |
+
+---
+
+## H. Release Checklist
+
+- [ ] All Go tests pass with `-race` flag
+- [ ] All frontend unit tests pass
+- [ ] Playwright E2E tests pass
+- [ ] Manual browser verification (Section B) complete
+- [ ] API regression tests (Section C) pass
+- [ ] Docker build succeeds
+- [ ] Staging deploy verified
+- [ ] No console errors on any page
+- [ ] Performance spot-checks (Section D) — no regressions
+- [ ] Coverage badges updated (backend ≥85%, frontend ≥42%)
+- [ ] CHANGELOG updated
+- [ ] Tag `v3.4.2` created

docs/user-guide/configuration.md

@@ -176,6 +176,19 @@ Lower values = fresher data but more server load.
 
 Provide cert and key paths to enable HTTPS.
 
+## Geographic filtering
+
+```json
+"geo_filter": {
+  "polygon": [[51.55, 3.80], [51.55, 5.90], [50.65, 5.90], [50.65, 3.80]],
+  "bufferKm": 20
+}
+```
+
+Restricts ingestion and API responses to nodes within the polygon plus a buffer margin. Remove the block to disable filtering. Nodes with no GPS fix always pass through.
+
+See [Geographic Filtering](geofilter.md) for the full guide including the visual polygon builder and the prune script for cleaning up historical data.
+
 ## Home page
 
 The `home` section customizes the onboarding experience. See `config.example.json` for the full structure including `steps`, `checklist`, and `footerLinks`.

docs/user-guide/customization.md

@@ -66,6 +66,12 @@ Click **Import JSON** and paste a previously exported theme. The customizer load
 
 Click **Reset to Defaults** to restore all settings to the built-in defaults.
 
+## GeoFilter Builder
+
+The Export tab includes a **GeoFilter Builder →** link. Click it to open a Leaflet map where you can draw a polygon boundary for your deployment area. The tool generates a `geo_filter` block you can paste directly into `config.json`.
+
+See [Geographic Filtering](geofilter.md) for full details on what geo filtering does and how to configure it.
+
 ## How it works
 
 The customizer writes CSS custom properties (variables) to override the defaults. Exported JSON maps directly to the `theme`, `nodeColors`, `branding`, and `home` sections of [config.json](configuration.md).

docs/user-guide/faq.md

@@ -52,3 +52,14 @@ CoreScope uses URL hashes for deep linking. Copy the URL from your browser — i
 - `#/packets/abc123` — a specific packet
 - `#/analytics?tab=collisions` — the hash issues tab
 - `#/nodes/pubkey123` — a specific node's detail page
+
+### Where is the API documentation?
+
+CoreScope auto-generates an OpenAPI 3.0 specification from its route definitions:
+
+- **Interactive docs (Swagger UI):** `/api/docs` — browse and test all 40+ endpoints from your browser
+- **Machine-readable spec:** `/api/spec` — import into Postman, Insomnia, or any OpenAPI tool
+
+The spec is always in sync with the running server. No manual maintenance needed.
+
+On the public instance: [analyzer.00id.net/api/docs](https://analyzer.00id.net/api/docs)

docs/user-guide/geofilter.md

@@ -0,0 +1,114 @@
+# Geographic Filtering
+
+CoreScope supports geographic filtering to restrict which nodes are ingested and returned in API responses. This is useful for public-facing deployments that should only show activity in a specific region.
+
+## How it works
+
+Geographic filtering operates at two levels:
+
+- **Ingest time** — ADVERT packets carrying GPS coordinates are rejected by the ingestor if the node falls outside the configured area. The node never reaches the database.
+- **API responses** — Nodes already in the database are filtered from the `/api/nodes` response if they fall outside the area. This covers nodes ingested before the filter was configured.
+
+Nodes with no GPS fix (`lat=0, lon=0` or missing coordinates) always pass the filter regardless of configuration.
+
+## Configuration
+
+Add a `geo_filter` block to `config.json`:
+
+```json
+"geo_filter": {
+  "polygon": [
+    [51.55, 3.80],
+    [51.55, 5.90],
+    [50.65, 5.90],
+    [50.65, 3.80]
+  ],
+  "bufferKm": 20
+}
+```
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `polygon` | `[[lat, lon], ...]` | Array of at least 3 coordinate pairs defining the boundary |
+| `bufferKm` | number | Extra distance (km) around the polygon edge that is also accepted. `0` = exact boundary |
+
+Both the server and the ingestor read `geo_filter` from `config.json`. Restart both after changing this section.
+
+To disable filtering entirely, remove the `geo_filter` block.
+
+### Legacy bounding box
+
+An older bounding box format is also supported as a fallback when no `polygon` is present:
+
+```json
+"geo_filter": {
+  "latMin": 50.65,
+  "latMax": 51.55,
+  "lonMin": 3.80,
+  "lonMax": 5.90
+}
+```
+
+Prefer the polygon format — it supports irregular shapes and the `bufferKm` margin.
+
+## API endpoint
+
+The current geo filter configuration is exposed at:
+
+```
+GET /api/config/geo-filter
+```
+
+The frontend reads this endpoint to display the active filter. No authentication is required (the endpoint returns config, not private data).
+
+## GeoFilter Builder
+
+The simplest way to create a polygon is the included visual builder:
+
+**File:** `tools/geofilter-builder.html`
+
+Open it directly in a browser — it runs entirely client-side, no server required:
+
+```bash
+# From the project root
+open tools/geofilter-builder.html          # macOS
+xdg-open tools/geofilter-builder.html     # Linux
+start tools/geofilter-builder.html        # Windows
+```
+
+**Workflow:**
+
+1. The map opens centered on Belgium by default. Navigate to your region.
+2. Click on the map to add polygon vertices. Each click adds a numbered point.
+3. Add at least 3 points to form a closed polygon.
+4. Adjust **Buffer km** (default 20) to add a margin around the polygon edge.
+5. The generated JSON block appears at the bottom of the page — copy it directly into `config.json`.
+6. Use **↩ Undo** to remove the last point, **✕ Clear** to start over.
+
+The output is a complete `{ "geo_filter": { ... } }` block ready to paste into `config.json`.
+
+## Cleaning up historical nodes
+
+The ingestor prevents new out-of-bounds nodes from being ingested, but it does not retroactively remove nodes that were stored before the filter was configured. For that, use the prune script.
+
+**File:** `scripts/prune-nodes-outside-geo-filter.py`
+
+```bash
+# Dry run — shows what would be deleted without making any changes
+python3 scripts/prune-nodes-outside-geo-filter.py --dry-run
+
+# Default paths: /app/data/meshcore.db and /app/config.json
+python3 scripts/prune-nodes-outside-geo-filter.py
+
+# Custom paths
+python3 scripts/prune-nodes-outside-geo-filter.py /path/to/meshcore.db \
+  --config /path/to/config.json
+
+# In Docker — run inside the container
+docker exec -it meshcore-analyzer \
+  python3 /app/scripts/prune-nodes-outside-geo-filter.py --dry-run
+```
+
+The script reads `geo_filter.polygon` and `geo_filter.bufferKm` from config, lists the nodes that fall outside, then asks for `yes` confirmation before deleting. Nodes without coordinates are always kept.
+
+This is a **one-time migration tool** — run it once after first configuring `geo_filter` to clean up pre-filter data. The ingestor handles all subsequent filtering automatically at ingest time.

internal/channel/channel.go

@@ -0,0 +1,98 @@
+// Package channel provides MeshCore hashtag channel key derivation,
+// decryption (HMAC-SHA256 MAC + AES-128-ECB), and plaintext parsing.
+package channel
+
+import (
+	"crypto/aes"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/binary"
+	"fmt"
+	"strings"
+	"unicode/utf8"
+)
+
+// DeriveKey derives an AES-128 key from a channel name (e.g. "#wardriving").
+// Returns 16 bytes: SHA-256(channelName)[:16].
+func DeriveKey(channelName string) []byte {
+	h := sha256.Sum256([]byte(channelName))
+	return h[:16]
+}
+
+// ChannelHash returns the 1-byte channel hash used as the first byte of GRP_TXT payloads.
+// It is the first byte of SHA-256 of the 16-byte key.
+func ChannelHash(key []byte) byte {
+	h := sha256.Sum256(key)
+	return h[0]
+}
+
+// Decrypt verifies the 2-byte HMAC-SHA256 MAC and performs AES-128-ECB decryption.
+// mac must be exactly 2 bytes. ciphertext must be a multiple of 16 bytes.
+// Returns the plaintext and true if MAC verification succeeded, or nil and false otherwise.
+func Decrypt(key []byte, mac []byte, ciphertext []byte) ([]byte, bool) {
+	if len(key) != 16 || len(mac) != 2 || len(ciphertext) == 0 || len(ciphertext)%aes.BlockSize != 0 {
+		return nil, false
+	}
+
+	// 32-byte channel secret: 16-byte key + 16 zero bytes
+	channelSecret := make([]byte, 32)
+	copy(channelSecret, key)
+
+	// Verify HMAC-SHA256 (first 2 bytes must match)
+	h := hmac.New(sha256.New, channelSecret)
+	h.Write(ciphertext)
+	calculatedMac := h.Sum(nil)
+	if calculatedMac[0] != mac[0] || calculatedMac[1] != mac[1] {
+		return nil, false
+	}
+
+	// AES-128-ECB decrypt
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, false
+	}
+	plaintext := make([]byte, len(ciphertext))
+	for i := 0; i < len(ciphertext); i += aes.BlockSize {
+		block.Decrypt(plaintext[i:i+aes.BlockSize], ciphertext[i:i+aes.BlockSize])
+	}
+
+	return plaintext, true
+}
+
+// ParsePlaintext parses decrypted plaintext into timestamp, sender, and message.
+// Format: timestamp(4 LE) + flags(1) + "sender: message\0..."
+func ParsePlaintext(plaintext []byte) (timestamp uint32, sender string, message string, err error) {
+	if len(plaintext) < 5 {
+		return 0, "", "", fmt.Errorf("plaintext too short (%d bytes)", len(plaintext))
+	}
+
+	timestamp = binary.LittleEndian.Uint32(plaintext[0:4])
+	text := string(plaintext[5:])
+	if idx := strings.IndexByte(text, 0); idx >= 0 {
+		text = text[:idx]
+	}
+
+	if !utf8.ValidString(text) || countNonPrintable(text) > 2 {
+		return 0, "", "", fmt.Errorf("decrypted text contains non-printable characters")
+	}
+
+	// Parse "sender: message" format
+	if colonIdx := strings.Index(text, ": "); colonIdx > 0 && colonIdx < 50 {
+		potentialSender := text[:colonIdx]
+		if !strings.ContainsAny(potentialSender, ":[]") {
+			return timestamp, potentialSender, text[colonIdx+2:], nil
+		}
+	}
+
+	return timestamp, "", text, nil
+}
+
+func countNonPrintable(s string) int {
+	count := 0
+	for _, r := range s {
+		if r < 32 && r != '\n' && r != '\r' && r != '\t' {
+			count++
+		}
+	}
+	return count
+}

internal/channel/channel_test.go

@@ -0,0 +1,161 @@
+package channel
+
+import (
+	"crypto/aes"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"testing"
+)
+
+func TestDeriveKey(t *testing.T) {
+	key := DeriveKey("#wardriving")
+	h := sha256.Sum256([]byte("#wardriving"))
+	expected := h[:16]
+	if len(key) != 16 {
+		t.Fatalf("key length %d, want 16", len(key))
+	}
+	for i := range key {
+		if key[i] != expected[i] {
+			t.Fatalf("DeriveKey mismatch at byte %d", i)
+		}
+	}
+}
+
+func TestChannelHash(t *testing.T) {
+	key := DeriveKey("#wardriving")
+	ch := ChannelHash(key)
+	h := sha256.Sum256(key)
+	if ch != h[0] {
+		t.Fatalf("ChannelHash %02x, want %02x", ch, h[0])
+	}
+}
+
+func testECBEncrypt(t *testing.T, key, plaintext []byte) []byte {
+	t.Helper()
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ct := make([]byte, len(plaintext))
+	for i := 0; i < len(plaintext); i += aes.BlockSize {
+		block.Encrypt(ct[i:i+aes.BlockSize], plaintext[i:i+aes.BlockSize])
+	}
+	return ct
+}
+
+func testComputeMAC(key, ciphertext []byte) []byte {
+	secret := make([]byte, 32)
+	copy(secret, key)
+	h := hmac.New(sha256.New, secret)
+	h.Write(ciphertext)
+	sum := h.Sum(nil)
+	return sum[:2]
+}
+
+func TestDecryptValidMAC(t *testing.T) {
+	key := DeriveKey("#test")
+	padded := make([]byte, 16)
+	copy(padded, []byte{0x01, 0x00, 0x00, 0x00, 0x00})
+	ciphertext := testECBEncrypt(t, key, padded)
+	mac := testComputeMAC(key, ciphertext)
+
+	result, ok := Decrypt(key, mac, ciphertext)
+	if !ok {
+		t.Fatal("Decrypt returned false for valid MAC")
+	}
+	if len(result) != 16 {
+		t.Fatalf("result length %d, want 16", len(result))
+	}
+}
+
+func TestDecryptInvalidMAC(t *testing.T) {
+	key := DeriveKey("#test")
+	ciphertext := make([]byte, 16)
+	mac := []byte{0xFF, 0xFF}
+	_, ok := Decrypt(key, mac, ciphertext)
+	if ok {
+		t.Fatal("Decrypt should reject wrong MAC")
+	}
+}
+
+func TestDecryptWrongChannel(t *testing.T) {
+	key1 := DeriveKey("#channel1")
+	key2 := DeriveKey("#channel2")
+	padded := make([]byte, 16)
+	copy(padded, []byte{0x01, 0x00, 0x00, 0x00, 0x00, 'h', 'i'})
+	ciphertext := testECBEncrypt(t, key1, padded)
+	mac := testComputeMAC(key1, ciphertext)
+
+	_, ok := Decrypt(key2, mac, ciphertext)
+	if ok {
+		t.Fatal("Decrypt should reject wrong channel key")
+	}
+}
+
+func TestParsePlaintext(t *testing.T) {
+	plain := []byte{100, 0, 0, 0, 0}
+	plain = append(plain, []byte("Alice: Hello\x00")...)
+	ts, sender, msg, err := ParsePlaintext(plain)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if ts != 100 {
+		t.Fatalf("timestamp %d, want 100", ts)
+	}
+	if sender != "Alice" {
+		t.Fatalf("sender %q, want Alice", sender)
+	}
+	if msg != "Hello" {
+		t.Fatalf("message %q, want Hello", msg)
+	}
+}
+
+func TestParsePlaintextNoSender(t *testing.T) {
+	plain := []byte{1, 0, 0, 0, 0}
+	plain = append(plain, []byte("just a message\x00")...)
+	_, sender, msg, err := ParsePlaintext(plain)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if sender != "" {
+		t.Fatalf("sender %q, want empty", sender)
+	}
+	if msg != "just a message" {
+		t.Fatalf("message %q", msg)
+	}
+}
+
+func TestDeriveKeyMatchesIngestor(t *testing.T) {
+	channelName := "#MeshCore"
+	key := DeriveKey(channelName)
+	hexKey := hex.EncodeToString(key)
+	h := sha256.Sum256([]byte(channelName))
+	expected := hex.EncodeToString(h[:16])
+	if hexKey != expected {
+		t.Fatalf("key hex %s != expected %s", hexKey, expected)
+	}
+}
+
+func TestRoundTrip(t *testing.T) {
+	key := DeriveKey("#test")
+	original := make([]byte, 32)
+	copy(original, []byte{0x64, 0x00, 0x00, 0x00, 0x00})
+	copy(original[5:], []byte("Bob: world\x00"))
+
+	ciphertext := testECBEncrypt(t, key, original)
+	mac := testComputeMAC(key, ciphertext)
+
+	plaintext, ok := Decrypt(key, mac, ciphertext)
+	if !ok {
+		t.Fatal("round-trip MAC failed")
+	}
+
+	ts, sender, msg, err := ParsePlaintext(plaintext)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if ts != 100 || sender != "Bob" || msg != "world" {
+		t.Fatalf("got ts=%d sender=%q msg=%q", ts, sender, msg)
+	}
+}

internal/channel/go.mod

@@ -0,0 +1,3 @@
+module github.com/meshcore-analyzer/channel
+
+go 1.22

internal/sigvalidate/go.mod

@@ -0,0 +1,3 @@
+module github.com/meshcore-analyzer/sigvalidate
+
+go 1.22

internal/sigvalidate/sigvalidate.go

@@ -0,0 +1,27 @@
+// Package sigvalidate provides ed25519 signature validation for MeshCore advert packets.
+package sigvalidate
+
+import (
+	"crypto/ed25519"
+	"encoding/binary"
+	"fmt"
+)
+
+// ValidateAdvert verifies the ed25519 signature on a MeshCore advert.
+// pubKey must be 32 bytes, signature must be 64 bytes.
+// The signed message is: pubKey (32) + timestamp (4 LE) + appdata.
+func ValidateAdvert(pubKey, signature []byte, timestamp uint32, appdata []byte) (bool, error) {
+	if len(pubKey) != 32 {
+		return false, fmt.Errorf("invalid pubkey length: %d", len(pubKey))
+	}
+	if len(signature) != 64 {
+		return false, fmt.Errorf("invalid signature length: %d", len(signature))
+	}
+
+	message := make([]byte, 32+4+len(appdata))
+	copy(message[0:32], pubKey)
+	binary.LittleEndian.PutUint32(message[32:36], timestamp)
+	copy(message[36:], appdata)
+
+	return ed25519.Verify(ed25519.PublicKey(pubKey), message, signature), nil
+}

internal/sigvalidate/sigvalidate_test.go

@@ -0,0 +1,63 @@
+package sigvalidate
+
+import (
+	"crypto/ed25519"
+	"encoding/binary"
+	"testing"
+)
+
+func TestValidateAdvert_ValidSignature(t *testing.T) {
+	pub, priv, err := ed25519.GenerateKey(nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var timestamp uint32 = 1234567890
+	appdata := []byte{0x02, 0x10, 0x20}
+
+	// Build the signed message: pubKey + timestamp(LE) + appdata
+	msg := make([]byte, 32+4+len(appdata))
+	copy(msg[0:32], pub)
+	binary.LittleEndian.PutUint32(msg[32:36], timestamp)
+	copy(msg[36:], appdata)
+
+	sig := ed25519.Sign(priv, msg)
+
+	valid, err := ValidateAdvert([]byte(pub), sig, timestamp, appdata)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !valid {
+		t.Fatal("expected valid signature")
+	}
+}
+
+func TestValidateAdvert_InvalidSignature(t *testing.T) {
+	pub, _, err := ed25519.GenerateKey(nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	badSig := make([]byte, 64)
+	valid, err := ValidateAdvert([]byte(pub), badSig, 100, []byte{0x01})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if valid {
+		t.Fatal("expected invalid signature")
+	}
+}
+
+func TestValidateAdvert_BadPubkeyLength(t *testing.T) {
+	_, err := ValidateAdvert([]byte{1, 2, 3}, make([]byte, 64), 0, nil)
+	if err == nil {
+		t.Fatal("expected error for short pubkey")
+	}
+}
+
+func TestValidateAdvert_BadSignatureLength(t *testing.T) {
+	_, err := ValidateAdvert(make([]byte, 32), []byte{1, 2, 3}, 0, nil)
+	if err == nil {
+		t.Fatal("expected error for short signature")
+	}
+}

public/app.js

@@ -104,6 +104,46 @@ function timeAgo(iso) {
   return value + suffix + ' ago';
 }
 
+function getHashParams() {
+  return new URLSearchParams(location.hash.split('?')[1] || '');
+}
+
+function getDistanceUnit() {
+  var stored = localStorage.getItem('meshcore-distance-unit');
+  if (stored === 'km') return 'km';
+  if (stored === 'mi') return 'mi';
+  // 'auto' or no value — locale detection
+  var milesLocales = ['en-us', 'en-gb'];
+  var lang = (typeof navigator !== 'undefined' && navigator.language || '').toLowerCase();
+  for (var i = 0; i < milesLocales.length; i++) {
+    if (lang === milesLocales[i] || lang.startsWith(milesLocales[i] + '-')) return 'mi';
+  }
+  return 'km';
+}
+window.getDistanceUnit = getDistanceUnit;
+
+function formatDistance(km) {
+  if (km == null || isNaN(+km)) return '—';
+  var d = +km;
+  var unit = getDistanceUnit();
+  if (unit === 'mi') {
+    var mi = d / 1.60934;
+    if (mi < 0.1) return Math.round(mi * 5280) + ' ft';
+    return mi.toFixed(1) + ' mi';
+  }
+  if (d < 1) return Math.round(d * 1000) + ' m';
+  return d.toFixed(1) + ' km';
+}
+window.formatDistance = formatDistance;
+
+function formatDistanceRound(km) {
+  if (km == null || isNaN(+km)) return '—';
+  var unit = getDistanceUnit();
+  if (unit === 'mi') return Math.round(+km / 1.60934) + ' mi';
+  return Math.round(+km) + ' km';
+}
+window.formatDistanceRound = formatDistanceRound;
+
 function getTimestampMode() {
   const saved = localStorage.getItem('meshcore-timestamp-mode');
   if (saved === 'ago' || saved === 'absolute') return saved;
@@ -472,6 +512,12 @@ function navigate() {
     const ms = performance.now() - t0;
     if (ms > 100) console.warn(`[SLOW PAGE] ${basePage} init took ${Math.round(ms)}ms`);
     app.classList.remove('page-enter'); void app.offsetWidth; app.classList.add('page-enter');
+    // #630-7: SPA focus management — move focus to first heading or main content
+    requestAnimationFrame(function() {
+      var heading = app.querySelector('h1, h2, h3, [role="heading"]');
+      if (heading) { heading.setAttribute('tabindex', '-1'); heading.focus({ preventScroll: true }); }
+      else { app.setAttribute('tabindex', '-1'); app.focus({ preventScroll: true }); }
+    });
   } else {
     app.innerHTML = `<div style="padding:40px;text-align:center;color:#6b7280"><h2>${route}</h2><p>Page not yet implemented.</p></div>`;
   }

public/channel-color-picker.js

@@ -0,0 +1,273 @@
+/**
+ * Channel Color Picker — Simplified popover with 8-color constrained palette (#674)
+ *
+ * Click a color dot next to channel names (channels page, live feed) to open picker.
+ * Right-click on live feed items retained as power-user shortcut (desktop only).
+ * No long-press. No custom color input. 8 preset colors.
+ *
+ * Uses ChannelColors.set/get/remove from channel-colors.js.
+ */
+(function() {
+  'use strict';
+
+  // 8 maximally-distinct colors on dark backgrounds (#674 Tufte spec)
+  var CHANNEL_PALETTE = [
+    '#ef4444', // red
+    '#f97316', // orange
+    '#eab308', // yellow
+    '#22c55e', // green
+    '#06b6d4', // cyan
+    '#3b82f6', // blue
+    '#8b5cf6', // violet
+    '#ec4899'  // pink
+  ];
+
+  var popoverEl = null;
+  var currentChannel = null;
+
+  function createPopover() {
+    if (popoverEl) return popoverEl;
+    var el = document.createElement('div');
+    el.className = 'cc-picker-popover';
+    el.setAttribute('role', 'dialog');
+    el.setAttribute('aria-label', 'Channel color picker');
+    el.style.display = 'none';
+    el.innerHTML =
+      '<div class="cc-picker-swatches" role="group" aria-label="Color swatches"></div>' +
+      '<button class="cc-picker-clear">Clear color</button>';
+
+    // Build swatches
+    var swatchContainer = el.querySelector('.cc-picker-swatches');
+    for (var i = 0; i < CHANNEL_PALETTE.length; i++) {
+      var sw = document.createElement('button');
+      sw.className = 'cc-swatch';
+      sw.style.background = CHANNEL_PALETTE[i];
+      sw.setAttribute('data-color', CHANNEL_PALETTE[i]);
+      sw.setAttribute('aria-label', CHANNEL_PALETTE[i]);
+      sw.title = CHANNEL_PALETTE[i];
+      sw.setAttribute('tabindex', '0');
+      swatchContainer.appendChild(sw);
+    }
+
+    // Event: swatch click
+    swatchContainer.addEventListener('click', function(e) {
+      var btn = e.target.closest('.cc-swatch');
+      if (!btn) return;
+      assignColor(btn.getAttribute('data-color'));
+    });
+
+    // Keyboard navigation for swatches
+    swatchContainer.addEventListener('keydown', function(e) {
+      var btn = e.target.closest('.cc-swatch');
+      if (!btn) return;
+      var swatches = swatchContainer.querySelectorAll('.cc-swatch');
+      var idx = Array.prototype.indexOf.call(swatches, btn);
+      if (idx < 0) return;
+      var next = -1;
+      if (e.key === 'ArrowRight' || e.key === 'ArrowDown') next = (idx + 1) % swatches.length;
+      else if (e.key === 'ArrowLeft' || e.key === 'ArrowUp') next = (idx - 1 + swatches.length) % swatches.length;
+      else if (e.key === 'Enter' || e.key === ' ') { assignColor(btn.getAttribute('data-color')); e.preventDefault(); return; }
+      if (next >= 0) { swatches[next].focus(); e.preventDefault(); }
+    });
+
+    // Event: clear
+    el.querySelector('.cc-picker-clear').addEventListener('click', function() {
+      if (currentChannel && window.ChannelColors) {
+        window.ChannelColors.remove(currentChannel);
+        refreshVisibleRows();
+      }
+      hidePopover();
+    });
+
+    // Prevent right-click on the popover itself
+    el.addEventListener('contextmenu', function(e) { e.preventDefault(); });
+
+    document.body.appendChild(el);
+    popoverEl = el;
+    return el;
+  }
+
+  function assignColor(color) {
+    if (currentChannel && window.ChannelColors) {
+      window.ChannelColors.set(currentChannel, color);
+      refreshVisibleRows();
+    }
+    hidePopover();
+  }
+
+  function showPopover(channel, x, y) {
+    var el = createPopover();
+    currentChannel = channel;
+
+    // Highlight current color
+    var current = window.ChannelColors ? window.ChannelColors.get(channel) : null;
+    var swatches = el.querySelectorAll('.cc-swatch');
+    for (var i = 0; i < swatches.length; i++) {
+      swatches[i].classList.toggle('cc-swatch-active', swatches[i].getAttribute('data-color') === current);
+    }
+
+    // Show/hide clear button
+    el.querySelector('.cc-picker-clear').style.display = current ? '' : 'none';
+
+    // Position
+    el.style.display = '';
+    var isTouch = window.matchMedia('(pointer: coarse)').matches;
+    if (!isTouch) {
+      el.style.left = '0';
+      el.style.top = '0';
+      var rect = el.getBoundingClientRect();
+      var pw = rect.width;
+      var ph = rect.height;
+      var vw = window.innerWidth;
+      var vh = window.innerHeight;
+      var finalX = x + pw > vw ? Math.max(0, vw - pw - 8) : x;
+      var finalY = y + ph > vh ? Math.max(0, vh - ph - 8) : y;
+      el.style.left = finalX + 'px';
+      el.style.top = finalY + 'px';
+    }
+
+    // Lock background scroll while popover is open
+    document.body.style.overflow = 'hidden';
+
+    // Focus first swatch for keyboard accessibility
+    var firstSwatch = el.querySelector('.cc-swatch');
+    if (firstSwatch) setTimeout(function() { firstSwatch.focus(); }, 0);
+
+    // Listen for outside click / Escape
+    setTimeout(function() {
+      document.addEventListener('click', onOutsideClick, true);
+      document.addEventListener('keydown', onEscape, true);
+    }, 0);
+  }
+
+  function hidePopover() {
+    if (popoverEl) popoverEl.style.display = 'none';
+    currentChannel = null;
+    document.body.style.overflow = '';
+    document.removeEventListener('click', onOutsideClick, true);
+    document.removeEventListener('keydown', onEscape, true);
+  }
+
+  function onOutsideClick(e) {
+    if (popoverEl && !popoverEl.contains(e.target)) {
+      hidePopover();
+    }
+  }
+
+  function onEscape(e) {
+    if (e.key === 'Escape') {
+      hidePopover();
+      e.stopPropagation();
+    }
+    // Trap Tab within the popover
+    if (e.key === 'Tab' && popoverEl && popoverEl.style.display !== 'none') {
+      var focusable = popoverEl.querySelectorAll('button, [tabindex]');
+      if (focusable.length === 0) return;
+      var first = focusable[0];
+      var last = focusable[focusable.length - 1];
+      if (e.shiftKey && document.activeElement === first) {
+        last.focus(); e.preventDefault();
+      } else if (!e.shiftKey && document.activeElement === last) {
+        first.focus(); e.preventDefault();
+      }
+    }
+  }
+
+  /** Refresh channel color styles on all visible feed items, channel list, and packet rows. */
+  function refreshVisibleRows() {
+    if (!window.ChannelColors) return;
+
+    // Live feed items
+    var feedItems = document.querySelectorAll('.live-feed-item');
+    for (var i = 0; i < feedItems.length; i++) {
+      var item = feedItems[i];
+      var ch = item._ccChannel;
+      if (!ch) continue;
+      var color = window.ChannelColors.get(ch);
+      item.style.borderLeft = color ? '3px solid ' + color : '';
+    }
+
+    // Update color dots everywhere
+    var dots = document.querySelectorAll('.ch-color-dot');
+    for (var j = 0; j < dots.length; j++) {
+      var dot = dots[j];
+      var dotCh = dot.getAttribute('data-channel');
+      if (!dotCh) continue;
+      var dotColor = window.ChannelColors.get(dotCh);
+      dot.style.background = dotColor || '';
+    }
+
+    // Channel list items — update border
+    var chItems = document.querySelectorAll('.ch-item[data-hash]');
+    for (var k = 0; k < chItems.length; k++) {
+      var chItem = chItems[k];
+      var hash = chItem.getAttribute('data-hash');
+      if (!hash) continue;
+      var chColor = window.ChannelColors.get(hash);
+      chItem.style.borderLeft = chColor ? '3px solid ' + chColor : '';
+    }
+
+    // Packets table — trigger re-render via custom event
+    document.dispatchEvent(new CustomEvent('channel-colors-changed'));
+  }
+
+  /**
+   * Install context-menu (right-click) handler on the live feed.
+   * No long-press — color dots handle mobile interaction.
+   */
+  function installLiveFeedHandlers() {
+    var feed = document.getElementById('liveFeed');
+    if (!feed) return;
+
+    // Click on color dot opens picker (#674)
+    feed.addEventListener('click', function(e) {
+      var dot = e.target.closest('.feed-color-dot');
+      if (!dot) return;
+      e.stopPropagation();
+      var ch = dot.getAttribute('data-channel');
+      if (ch) showPopover(ch, e.clientX, e.clientY);
+    });
+
+    feed.addEventListener('contextmenu', function(e) {
+      var item = e.target.closest('.live-feed-item');
+      if (!item || !item._ccChannel) return;
+      e.preventDefault();
+      showPopover(item._ccChannel, e.clientX, e.clientY);
+    });
+  }
+
+  /**
+   * Install context-menu handler on the packets table.
+   */
+  function installPacketsTableHandlers() {
+    var table = document.getElementById('packetsTableBody');
+    if (!table) return;
+
+    table.addEventListener('contextmenu', function(e) {
+      var row = e.target.closest('tr');
+      if (!row) return;
+      var chanTag = row.querySelector('.chan-tag');
+      if (chanTag) {
+        var ch = chanTag.textContent.trim();
+        if (ch) {
+          e.preventDefault();
+          showPopover(ch, e.clientX, e.clientY);
+          return;
+        }
+      }
+    });
+  }
+
+  // Export
+  window.ChannelColorPicker = {
+    install: function() {
+      installLiveFeedHandlers();
+      installPacketsTableHandlers();
+    },
+    installLiveFeed: installLiveFeedHandlers,
+    installPacketsTable: installPacketsTableHandlers,
+    show: showPopover,
+    hide: hidePopover,
+    PALETTE: CHANNEL_PALETTE
+  };
+})();

public/channel-colors.js

@@ -94,8 +94,8 @@
     if (!channel) return '';
     var color = getChannelColor(channel);
     if (!color) return '';
-    // 4px left border + 10% opacity background tint
-    return 'border-left:4px solid ' + color + ';background:' + color + '1a;';
+    // 3px left border only — minimal Tufte-style encoding (#674)
+    return 'border-left:3px solid ' + color + ';';
   }
 
   // Export to window for use by live.js and packets.js

public/channel-decrypt.js

@@ -0,0 +1,295 @@
+/**
+ * Client-side MeshCore channel decryption module.
+ *
+ * Implements the same crypto as internal/channel/channel.go:
+ *   - Key derivation: SHA-256("#channelname")[:16]
+ *   - Channel hash: SHA-256(key)[0]
+ *   - MAC: HMAC-SHA256 with 32-byte secret (key + 16 zero bytes), truncated to 2 bytes
+ *   - Encryption: AES-128-ECB (block-by-block)
+ *   - Plaintext: timestamp(4 LE) + flags(1) + "sender: message\0"
+ *
+ * Keys NEVER leave the browser. No fetch/XHR/network calls in this module.
+ */
+/* eslint-disable no-var */
+window.ChannelDecrypt = (function () {
+  'use strict';
+
+  var STORAGE_KEY = 'corescope_channel_keys';
+  var CACHE_KEY = 'corescope_channel_cache';
+
+  // ---- Hex utilities ----
+
+  function bytesToHex(bytes) {
+    var hex = '';
+    for (var i = 0; i < bytes.length; i++) {
+      hex += (bytes[i] < 16 ? '0' : '') + bytes[i].toString(16);
+    }
+    return hex;
+  }
+
+  function hexToBytes(hex) {
+    var bytes = new Uint8Array(hex.length / 2);
+    for (var i = 0; i < hex.length; i += 2) {
+      bytes[i / 2] = parseInt(hex.substring(i, i + 2), 16);
+    }
+    return bytes;
+  }
+
+  // ---- Key derivation ----
+
+  /**
+   * Derive AES-128 key from channel name: SHA-256("#channelname")[:16].
+   * @param {string} channelName - e.g. "#LongFast"
+   * @returns {Promise<Uint8Array>} 16-byte key
+   */
+  async function deriveKey(channelName) {
+    var enc = new TextEncoder();
+    var hash = await crypto.subtle.digest('SHA-256', enc.encode(channelName));
+    return new Uint8Array(hash).slice(0, 16);
+  }
+
+  /**
+   * Compute the 1-byte channel hash: SHA-256(key)[0].
+   * @param {Uint8Array} key - 16-byte key
+   * @returns {Promise<number>} single byte (0-255)
+   */
+  async function computeChannelHash(key) {
+    var hash = await crypto.subtle.digest('SHA-256', key);
+    return new Uint8Array(hash)[0];
+  }
+
+  // ---- AES-128-ECB via Web Crypto (CBC with zero IV, block-by-block) ----
+
+  /**
+   * Decrypt AES-128-ECB by decrypting each 16-byte block independently
+   * using AES-CBC with a zero IV (equivalent to ECB for single blocks).
+   * @param {Uint8Array} key - 16-byte AES key
+   * @param {Uint8Array} ciphertext - must be multiple of 16 bytes
+   * @returns {Promise<Uint8Array>} plaintext
+   */
+  async function decryptECB(key, ciphertext) {
+    if (ciphertext.length === 0 || ciphertext.length % 16 !== 0) {
+      return null;
+    }
+    var cryptoKey = await crypto.subtle.importKey(
+      'raw', key, { name: 'AES-CBC' }, false, ['decrypt']
+    );
+    var zeroIV = new Uint8Array(16);
+    var plaintext = new Uint8Array(ciphertext.length);
+
+    for (var i = 0; i < ciphertext.length; i += 16) {
+      var block = ciphertext.slice(i, i + 16);
+      // Append a dummy block (16 bytes of 0x10 = PKCS7 padding for empty next block)
+      // so Web Crypto doesn't complain about padding
+      var padded = new Uint8Array(32);
+      padded.set(block, 0);
+      // Second block is PKCS7 padding: 16 bytes of 0x10
+      for (var j = 16; j < 32; j++) padded[j] = 16;
+
+      var decrypted = await crypto.subtle.decrypt(
+        { name: 'AES-CBC', iv: zeroIV }, cryptoKey, padded
+      );
+      var decBytes = new Uint8Array(decrypted);
+      plaintext.set(decBytes.slice(0, 16), i);
+    }
+
+    return plaintext;
+  }
+
+  // ---- MAC verification ----
+
+  /**
+   * Verify HMAC-SHA256 MAC (first 2 bytes) using 32-byte secret (key + 16 zero bytes).
+   * @param {Uint8Array} key - 16-byte AES key
+   * @param {Uint8Array} ciphertext - encrypted data
+   * @param {string} macHex - 4-char hex string (2 bytes)
+   * @returns {Promise<boolean>}
+   */
+  async function verifyMAC(key, ciphertext, macHex) {
+    // Build 32-byte channel secret: key + 16 zero bytes
+    var secret = new Uint8Array(32);
+    secret.set(key, 0);
+    // remaining 16 bytes are already 0
+
+    var cryptoKey = await crypto.subtle.importKey(
+      'raw', secret, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']
+    );
+    var sig = await crypto.subtle.sign('HMAC', cryptoKey, ciphertext);
+    var sigBytes = new Uint8Array(sig);
+
+    var macBytes = hexToBytes(macHex);
+    return sigBytes[0] === macBytes[0] && sigBytes[1] === macBytes[1];
+  }
+
+  // ---- Plaintext parsing ----
+
+  /**
+   * Parse decrypted plaintext: timestamp(4 LE) + flags(1) + "sender: message\0..."
+   * @param {Uint8Array} plaintext
+   * @returns {{ timestamp: number, flags: number, sender: string, message: string } | null}
+   */
+  function parsePlaintext(plaintext) {
+    if (!plaintext || plaintext.length < 5) return null;
+
+    var timestamp = plaintext[0] | (plaintext[1] << 8) | (plaintext[2] << 16) | ((plaintext[3] << 24) >>> 0);
+    var flags = plaintext[4];
+
+    // Extract text up to first null byte
+    var textBytes = plaintext.slice(5);
+    var nullIdx = -1;
+    for (var i = 0; i < textBytes.length; i++) {
+      if (textBytes[i] === 0) { nullIdx = i; break; }
+    }
+    var text = new TextDecoder().decode(nullIdx >= 0 ? textBytes.slice(0, nullIdx) : textBytes);
+
+    // Count non-printable characters
+    var nonPrintable = 0;
+    for (var c = 0; c < text.length; c++) {
+      var code = text.charCodeAt(c);
+      if (code < 32 && code !== 10 && code !== 13 && code !== 9) nonPrintable++;
+    }
+    if (nonPrintable > 2) return null;
+
+    // Parse "sender: message" format
+    var colonIdx = text.indexOf(': ');
+    if (colonIdx > 0 && colonIdx < 50) {
+      var potentialSender = text.substring(0, colonIdx);
+      if (potentialSender.indexOf(':') < 0 && potentialSender.indexOf('[') < 0 && potentialSender.indexOf(']') < 0) {
+        return { timestamp: timestamp, flags: flags, sender: potentialSender, message: text.substring(colonIdx + 2) };
+      }
+    }
+
+    return { timestamp: timestamp, flags: flags, sender: '', message: text };
+  }
+
+  // ---- Full decrypt pipeline ----
+
+  /**
+   * Verify MAC, decrypt, and parse a single packet.
+   * @param {Uint8Array} keyBytes - 16-byte key
+   * @param {string} macHex - 4-char hex MAC
+   * @param {string} encryptedHex - hex-encoded ciphertext
+   * @returns {Promise<{ sender: string, message: string, timestamp: number } | null>}
+   */
+  async function decrypt(keyBytes, macHex, encryptedHex) {
+    var ciphertext = hexToBytes(encryptedHex);
+    if (ciphertext.length === 0 || ciphertext.length % 16 !== 0) return null;
+
+    var macOk = await verifyMAC(keyBytes, ciphertext, macHex);
+    if (!macOk) return null;
+
+    var plaintext = await decryptECB(keyBytes, ciphertext);
+    if (!plaintext) return null;
+
+    return parsePlaintext(plaintext);
+  }
+
+  // Alias used by channels.js
+  var decryptPacket = decrypt;
+
+  // ---- Key storage (localStorage) ----
+
+  function saveKey(channelName, keyHex) {
+    var keys = getKeys();
+    keys[channelName] = keyHex;
+    try { localStorage.setItem(STORAGE_KEY, JSON.stringify(keys)); } catch (e) { /* quota */ }
+  }
+
+  // Alias used by channels.js
+  var storeKey = saveKey;
+
+  function getKeys() {
+    try {
+      var raw = localStorage.getItem(STORAGE_KEY);
+      return raw ? JSON.parse(raw) : {};
+    } catch (e) { return {}; }
+  }
+
+  // Alias used by channels.js
+  var getStoredKeys = getKeys;
+
+  function removeKey(channelName) {
+    var keys = getKeys();
+    delete keys[channelName];
+    try { localStorage.setItem(STORAGE_KEY, JSON.stringify(keys)); } catch (e) { /* quota */ }
+    // Also clear cached messages for this channel
+    clearChannelCache(channelName);
+  }
+
+  /** Remove cached messages for a specific channel (by name or hash). */
+  function clearChannelCache(channelKey) {
+    try {
+      var cache = JSON.parse(localStorage.getItem(CACHE_KEY) || '{}');
+      delete cache[channelKey];
+      localStorage.setItem(CACHE_KEY, JSON.stringify(cache));
+    } catch (e) { /* quota */ }
+  }
+
+  // ---- Message cache (localStorage) ----
+
+  function cacheMessages(channelHash, messages) {
+    try {
+      var cache = JSON.parse(localStorage.getItem(CACHE_KEY) || '{}');
+      cache[channelHash] = { messages: messages, ts: Date.now() };
+      localStorage.setItem(CACHE_KEY, JSON.stringify(cache));
+    } catch (e) { /* quota */ }
+  }
+
+  function getCachedMessages(channelHash) {
+    try {
+      var cache = JSON.parse(localStorage.getItem(CACHE_KEY) || '{}');
+      var entry = cache[channelHash];
+      return entry ? entry.messages : null;
+    } catch (e) { return null; }
+  }
+
+  // Cache with lastTimestamp and count (used by channels.js via getCache/setCache)
+  var MAX_CACHED_MESSAGES = 1000;
+
+  function setCache(key, messages, lastTimestamp, totalCount) {
+    try {
+      // Enforce cache size limit: only keep most recent MAX_CACHED_MESSAGES
+      var toStore = messages;
+      if (messages.length > MAX_CACHED_MESSAGES) {
+        toStore = messages.slice(messages.length - MAX_CACHED_MESSAGES);
+      }
+      var cache = JSON.parse(localStorage.getItem(CACHE_KEY) || '{}');
+      cache[key] = {
+        messages: toStore,
+        lastTimestamp: lastTimestamp,
+        count: totalCount || toStore.length,
+        ts: Date.now()
+      };
+      localStorage.setItem(CACHE_KEY, JSON.stringify(cache));
+    } catch (e) { /* quota */ }
+  }
+
+  function getCache(key) {
+    try {
+      var cache = JSON.parse(localStorage.getItem(CACHE_KEY) || '{}');
+      return cache[key] || null;
+    } catch (e) { return null; }
+  }
+
+  return {
+    deriveKey: deriveKey,
+    decrypt: decrypt,
+    decryptPacket: decryptPacket,
+    decryptECB: decryptECB,
+    verifyMAC: verifyMAC,
+    parsePlaintext: parsePlaintext,
+    computeChannelHash: computeChannelHash,
+    bytesToHex: bytesToHex,
+    hexToBytes: hexToBytes,
+    saveKey: saveKey,
+    storeKey: storeKey,
+    getKeys: getKeys,
+    getStoredKeys: getStoredKeys,
+    removeKey: removeKey,
+    clearChannelCache: clearChannelCache,
+    cacheMessages: cacheMessages,
+    getCachedMessages: getCachedMessages,
+    setCache: setCache,
+    getCache: getCache
+  };
+})();

public/channels.js

@@ -171,8 +171,11 @@
   async function showNodeDetail(name) {
     _nodePanelTrigger = document.activeElement;
     if (_focusTrapCleanup) { _focusTrapCleanup(); _focusTrapCleanup = null; }
+    var _capturedHash = selectedHash;
     const node = await lookupNode(name);
     selectedNode = name;
+    var _chBase = _capturedHash ? '#/channels/' + encodeURIComponent(_capturedHash) : '#/channels';
+    history.replaceState(null, '', _chBase + '?node=' + encodeURIComponent(name));
 
     let panel = document.getElementById('chNodePanel');
     if (!panel) {
@@ -234,6 +237,8 @@
     const panel = document.getElementById('chNodePanel');
     if (panel) panel.classList.remove('open');
     selectedNode = null;
+    var _chRestoreUrl = selectedHash ? '#/channels/' + encodeURIComponent(selectedHash) : '#/channels';
+    history.replaceState(null, '', _chRestoreUrl);
     if (_nodePanelTrigger && typeof _nodePanelTrigger.focus === 'function') {
       _nodePanelTrigger.focus();
       _nodePanelTrigger = null;
@@ -313,11 +318,313 @@
 
   let regionChangeHandler = null;
 
+  // --- Client-side channel decryption (#725 M2) ---
+
+  // Check if input is a valid hex string (32 hex chars = 16 bytes)
+  function isHexKey(val) {
+    return /^[0-9a-fA-F]{32}$/.test(val);
+  }
+
+  // Show status message in the add-channel form (#759)
+  var statusTimer = null;
+  function showAddStatus(msg, type) {
+    var el = document.getElementById('chAddStatus');
+    if (!el) return;
+    el.textContent = msg;
+    el.className = 'ch-add-status ch-add-status--' + (type || 'info');
+    el.style.display = '';
+    clearTimeout(statusTimer);
+    if (type !== 'loading') {
+      statusTimer = setTimeout(function () { el.style.display = 'none'; }, 5000);
+    }
+  }
+
+  // Add a user channel by name (#channelname) or hex key
+  async function addUserChannel(val) {
+    var displayName = val.startsWith('#') ? val : (isHexKey(val) ? val.substring(0, 8) + '…' : '#' + val);
+    showAddStatus('Decrypting ' + displayName + ' messages…', 'loading');
+    var channelName, keyHex;
+    try {
+      if (val.startsWith('#')) {
+        channelName = val;
+        var keyBytes = await ChannelDecrypt.deriveKey(channelName);
+        keyHex = ChannelDecrypt.bytesToHex(keyBytes);
+      } else if (isHexKey(val)) {
+        keyHex = val.toLowerCase();
+        channelName = 'psk:' + keyHex.substring(0, 8);
+      } else {
+        // Try with # prefix if user forgot
+        channelName = '#' + val;
+        var keyBytes2 = await ChannelDecrypt.deriveKey(channelName);
+        keyHex = ChannelDecrypt.bytesToHex(keyBytes2);
+      }
+
+      ChannelDecrypt.storeKey(channelName, keyHex);
+
+      // Compute channel hash byte to find matching encrypted channels
+      var keyBytes3 = ChannelDecrypt.hexToBytes(keyHex);
+      var hashByte = await ChannelDecrypt.computeChannelHash(keyBytes3);
+
+      // Add to sidebar or merge with existing encrypted channel
+      mergeUserChannels();
+      renderChannelList();
+
+      // Auto-select and start decrypting
+      var targetHash = 'user:' + channelName;
+      // Check if there's an existing encrypted channel with this hash byte
+      var existingEncrypted = channels.find(function (ch) {
+        return ch.encrypted && String(ch.hash) === String(hashByte);
+      });
+      if (existingEncrypted) {
+        targetHash = existingEncrypted.hash;
+      }
+      await selectChannel(targetHash, { userKey: keyHex, channelHashByte: hashByte, channelName: channelName });
+
+      // Show success feedback (#759)
+      var msgCount = document.querySelectorAll('#chMessages .ch-msg').length;
+      var userDisplay = channelName.startsWith('psk:') ? 'Custom channel (' + channelName.substring(4) + ')' : channelName;
+      if (msgCount > 0) {
+        showAddStatus('Added ' + userDisplay + ' — ' + msgCount + ' messages decrypted', 'success');
+      } else {
+        showAddStatus('No messages found for ' + userDisplay, 'warn');
+      }
+    } catch (err) {
+      showAddStatus('Failed to decrypt', 'error');
+    }
+  }
+
+  // Merge user-stored keys into the channel list
+  function mergeUserChannels() {
+    var keys = ChannelDecrypt.getStoredKeys();
+    var names = Object.keys(keys);
+    for (var i = 0; i < names.length; i++) {
+      var name = names[i];
+      // Check if channel already exists by name
+      var exists = channels.some(function (ch) {
+        return ch.name === name || ch.hash === name || ch.hash === ('user:' + name);
+      });
+      if (!exists) {
+        channels.push({
+          hash: 'user:' + name,
+          name: name,
+          messageCount: 0,
+          lastActivityMs: 0,
+          lastSender: '',
+          lastMessage: 'Encrypted — click to decrypt',
+          encrypted: true,
+          userAdded: true
+        });
+      }
+    }
+  }
+
+  // Fetch and decrypt GRP_TXT packets client-side (M5: delta fetch + cache)
+  async function fetchAndDecryptChannel(keyHex, channelHashByte, channelName, opts) {
+    opts = opts || {};
+    var keyBytes = ChannelDecrypt.hexToBytes(keyHex);
+
+    // M5: Check cache first — serve cached messages immediately
+    var cacheKey = channelName || String(channelHashByte);
+    var cached = ChannelDecrypt.getCache(cacheKey);
+    var cachedMsgs = cached ? cached.messages : [];
+    var lastTs = cached ? cached.lastTimestamp : '';
+    var cachedCount = cached ? (cached.count || 0) : 0;
+
+    // If we have cached messages and caller wants instant render, return them first
+    if (cachedMsgs.length > 0 && !opts.forceFullDecrypt) {
+      // Signal caller to render cache immediately, then do delta fetch
+      if (opts.onCacheHit) opts.onCacheHit(cachedMsgs);
+    }
+
+    // Fetch packets from API — get all payload_type=5 (GRP_TXT/CHAN)
+    var rp = RegionFilter.getRegionParam();
+    var qs = rp ? '&region=' + encodeURIComponent(rp) : '';
+    var data;
+    try {
+      data = await api('/packets?limit=1000&payloadType=5' + qs, { ttl: 10000 });
+    } catch (e) {
+      return { messages: cachedMsgs, error: 'Failed to fetch packets: ' + e.message, fromCache: cachedMsgs.length > 0 };
+    }
+
+    var packets = data.packets || [];
+    // Filter for GRP_TXT (encrypted) packets matching our channel hash byte
+    var candidates = [];
+    for (var i = 0; i < packets.length; i++) {
+      var p = packets[i];
+      var dj;
+      try { dj = typeof p.decoded_json === 'string' ? JSON.parse(p.decoded_json) : p.decoded_json; }
+      catch (e) { continue; }
+      if (!dj) continue;
+
+      if (dj.type === 'CHAN' && dj.channel === channelName) {
+        candidates.push({ type: 'already_decrypted', decoded: dj, packet: p });
+      } else if (dj.type === 'GRP_TXT' && dj.encryptedData && dj.mac) {
+        if (dj.channelHash === channelHashByte) {
+          candidates.push({ type: 'encrypted', decoded: dj, packet: p });
+        }
+      }
+    }
+
+    // M5: Cache invalidation — if total candidate count changed, re-decrypt everything
+    var totalCandidates = candidates.length;
+    var needFullDecrypt = (totalCandidates !== cachedCount) || opts.forceFullDecrypt;
+
+    // M5: Delta fetch — only decrypt packets newer than lastTs
+    if (!needFullDecrypt && cachedMsgs.length > 0 && lastTs) {
+      // Filter candidates to only those newer than cached lastTimestamp
+      var newCandidates = candidates.filter(function (c) {
+        var ts = c.packet.first_seen || c.packet.timestamp || '';
+        return ts > lastTs;
+      });
+
+      if (newCandidates.length === 0) {
+        // Nothing new — return cache as-is
+        return { messages: cachedMsgs, fromCache: true };
+      }
+
+      // Decrypt only new candidates
+      var newDecrypted = await decryptCandidates(keyBytes, newCandidates);
+      if (newDecrypted.wrongKey) {
+        return { messages: cachedMsgs, wrongKey: true };
+      }
+
+      // Merge: cached + new, deduplicate by packetHash, sort chronologically
+      var merged = deduplicateAndMerge(cachedMsgs, newDecrypted.messages);
+      var newLastTs = merged.length ? merged[merged.length - 1].timestamp : lastTs;
+      ChannelDecrypt.setCache(cacheKey, merged, newLastTs, totalCandidates);
+      return { messages: merged, deltaCount: newDecrypted.messages.length };
+    }
+
+    if (candidates.length === 0) {
+      return { messages: cachedMsgs, empty: true };
+    }
+
+    // Full decrypt
+    var result = await decryptCandidates(keyBytes, candidates);
+    if (result.wrongKey) {
+      return { messages: result.messages, wrongKey: true };
+    }
+
+    var decrypted = result.messages;
+    // Sort chronologically (oldest first)
+    decrypted.sort(function (a, b) {
+      var ta = a.timestamp || '';
+      var tb = b.timestamp || '';
+      return ta.localeCompare(tb);
+    });
+
+    // M5: Cache results
+    var newLastTimestamp = decrypted.length ? decrypted[decrypted.length - 1].timestamp : '';
+    ChannelDecrypt.setCache(cacheKey, decrypted, newLastTimestamp, totalCandidates);
+
+    return { messages: decrypted };
+  }
+
+  /** Decrypt an array of candidate packets. Returns { messages, wrongKey }. */
+  async function decryptCandidates(keyBytes, candidates) {
+    // Sort newest first for progressive rendering
+    candidates.sort(function (a, b) {
+      var ta = a.packet.first_seen || a.packet.timestamp || '';
+      var tb = b.packet.first_seen || b.packet.timestamp || '';
+      return tb.localeCompare(ta);
+    });
+
+    var decrypted = [];
+    var macFailCount = 0;
+    var macCheckCount = 0;
+
+    for (var j = 0; j < candidates.length; j++) {
+      var c = candidates[j];
+
+      if (c.type === 'already_decrypted') {
+        var d = c.decoded;
+        var sender = d.sender || 'Unknown';
+        var text = d.text || '';
+        var ci = text.indexOf(': ');
+        if (ci > 0 && ci < 50 && text.substring(0, ci) === sender) {
+          text = text.substring(ci + 2);
+        }
+        decrypted.push({
+          sender: sender, text: text,
+          timestamp: c.packet.first_seen || c.packet.timestamp,
+          sender_timestamp: d.sender_timestamp || null,
+          packetHash: c.packet.hash, packetId: c.packet.id,
+          hops: d.path_len || 0, snr: c.packet.snr || null,
+          observers: c.packet.observer_name ? [c.packet.observer_name] : [],
+          repeats: 1
+        });
+        continue;
+      }
+
+      macCheckCount++;
+      var result = await ChannelDecrypt.decryptPacket(keyBytes, c.decoded.mac, c.decoded.encryptedData);
+      if (result) {
+        macFailCount = 0;
+        decrypted.push({
+          sender: result.sender, text: result.message,
+          timestamp: c.packet.first_seen || c.packet.timestamp,
+          sender_timestamp: result.timestamp || null,
+          packetHash: c.packet.hash, packetId: c.packet.id,
+          hops: 0, snr: c.packet.snr || null,
+          observers: c.packet.observer_name ? [c.packet.observer_name] : [],
+          repeats: 1
+        });
+      } else {
+        macFailCount++;
+        if (macCheckCount >= 10 && macFailCount >= macCheckCount) {
+          return { messages: decrypted, wrongKey: true };
+        }
+      }
+    }
+
+    return { messages: decrypted, wrongKey: false };
+  }
+
+  /** Merge cached and new messages, deduplicate by packetHash, sort chronologically. */
+  function deduplicateAndMerge(cached, newMsgs) {
+    var seen = {};
+    var merged = [];
+    // Add cached first
+    for (var i = 0; i < cached.length; i++) {
+      var key = cached[i].packetHash || ('idx:' + i);
+      if (!seen[key]) { seen[key] = true; merged.push(cached[i]); }
+    }
+    // Add new
+    for (var j = 0; j < newMsgs.length; j++) {
+      var key2 = newMsgs[j].packetHash || ('new:' + j);
+      if (!seen[key2]) { seen[key2] = true; merged.push(newMsgs[j]); }
+    }
+    merged.sort(function (a, b) {
+      var ta = a.timestamp || '';
+      var tb = b.timestamp || '';
+      return ta.localeCompare(tb);
+    });
+    return merged;
+  }
+
   function init(app, routeParam) {
+    var _initUrlParams = getHashParams();
+    var _pendingNode = _initUrlParams.get('node');
+
     app.innerHTML = `<div class="ch-layout">
       <div class="ch-sidebar" aria-label="Channel list">
         <div class="ch-sidebar-header">
           <div class="ch-sidebar-title"><span class="ch-icon">💬</span> Channels</div>
+          <label class="ch-encrypted-toggle" title="Show encrypted channels (no key configured)">
+            <input type="checkbox" id="chShowEncrypted"> <span class="ch-toggle-label">🔒 No key</span>
+          </label>
+        </div>
+        <div class="ch-key-input-wrap" style="padding:4px 8px">
+          <form id="chKeyForm" autocomplete="off" class="ch-add-form">
+            <div class="ch-add-row">
+              <input type="text" id="chKeyInput" class="ch-key-input"
+                     placeholder="#channelname"
+                     aria-label="Channel name or hex key" spellcheck="false">
+              <button type="submit" class="ch-add-btn" title="Add channel">+</button>
+            </div>
+            <div class="ch-add-hint">e.g. #LongFast or 32-char hex key — decrypted in your browser.</div>
+            <div id="chAddStatus" class="ch-add-status" style="display:none"></div>
+          </form>
         </div>
         <div id="chRegionFilter" class="region-filter-container" style="padding:0 8px"></div>
         <div class="ch-channel-list" id="chList" role="listbox" aria-label="Channels">
@@ -339,6 +646,17 @@
     </div>`;
 
     RegionFilter.init(document.getElementById('chRegionFilter'));
+
+    // Encrypted channels toggle (#727)
+    var showEncryptedCb = document.getElementById('chShowEncrypted');
+    var showEncrypted = localStorage.getItem('channels-show-encrypted') === 'true';
+    showEncryptedCb.checked = showEncrypted;
+    showEncryptedCb.addEventListener('change', function () {
+      showEncrypted = showEncryptedCb.checked;
+      localStorage.setItem('channels-show-encrypted', showEncrypted ? 'true' : 'false');
+      loadChannels(true);
+    });
+
     regionChangeHandler = RegionFilter.onChange(function () {
       loadChannels(true).then(async function () {
         if (!selectedHash) return;
@@ -346,9 +664,40 @@
       });
     });
 
+    // Channel key input handler (#725 M2, improved UX #759)
+    var chKeyForm = document.getElementById('chKeyForm');
+    if (chKeyForm) {
+      var submitHandler = async function (e) {
+        e.preventDefault();
+        var input = document.getElementById('chKeyInput');
+        var val = (input.value || '').trim();
+        if (!val) return;
+        input.value = '';
+        await addUserChannel(val);
+      };
+      chKeyForm.addEventListener('submit', submitHandler);
+      var chKeyInput = document.getElementById('chKeyInput');
+      if (chKeyInput) {
+        chKeyInput.addEventListener('focus', function () {
+          var st = document.getElementById('chAddStatus');
+          if (st) { st.style.display = 'none'; clearTimeout(statusTimer); statusTimer = null; }
+        });
+      }
+    }
+
+    // Auto-enable encrypted toggle if deep-linking to an encrypted channel
+    if (routeParam && routeParam.startsWith('enc_') && !showEncrypted) {
+      showEncrypted = true;
+      showEncryptedCb.checked = true;
+      localStorage.setItem('channels-show-encrypted', 'true');
+    }
+
     loadObserverRegions();
-    loadChannels().then(() => {
-      if (routeParam) selectChannel(routeParam);
+    loadChannels().then(async function () {
+      // Also load user-added encrypted channels into the sidebar
+      mergeUserChannels();
+      if (routeParam) await selectChannel(routeParam);
+      if (_pendingNode && _pendingNode.length < 200) await showNodeDetail(_pendingNode);
     });
 
     // #89: Sidebar resize handle
@@ -394,6 +743,37 @@
 
     // Event delegation for channel selection (touch-friendly)
     document.getElementById('chList').addEventListener('click', (e) => {
+      // M4: Remove channel button
+      const removeBtn = e.target.closest('[data-remove-channel]');
+      if (removeBtn) {
+        e.stopPropagation();
+        var channelHash = removeBtn.getAttribute('data-remove-channel');
+        if (!channelHash) return;
+        var chName = channelHash.startsWith('user:') ? channelHash.substring(5) : channelHash;
+        if (!confirm('Remove channel "' + chName + '"? This will clear saved keys and cached messages.')) return;
+        ChannelDecrypt.removeKey(chName);
+        // Remove from channels array
+        channels = channels.filter(function (c) { return c.hash !== channelHash; });
+        if (selectedHash === channelHash) {
+          selectedHash = null;
+          messages = [];
+          history.replaceState(null, '', '#/channels');
+          var msgEl2 = document.getElementById('chMessages');
+          if (msgEl2) msgEl2.innerHTML = '<div class="ch-empty">Choose a channel from the sidebar to view messages</div>';
+          var header2 = document.getElementById('chHeader');
+          if (header2) header2.querySelector('.ch-header-text').textContent = 'Select a channel';
+        }
+        renderChannelList();
+        return;
+      }
+      // Color dot click — open picker, don't select channel
+      const dot = e.target.closest('.ch-color-dot');
+      if (dot && window.ChannelColorPicker) {
+        e.stopPropagation();
+        var ch = dot.getAttribute('data-channel');
+        if (ch) ChannelColorPicker.show(ch, e.clientX, e.clientY);
+        return;
+      }
       const item = e.target.closest('.ch-item[data-hash]');
       if (item) selectChannel(item.dataset.hash);
     });
@@ -635,7 +1015,11 @@
   async function loadChannels(silent) {
     try {
       const rp = RegionFilter.getRegionParam();
-      const qs = rp ? '?region=' + encodeURIComponent(rp) : '';
+      var showEnc = localStorage.getItem('channels-show-encrypted') === 'true';
+      var params = [];
+      if (rp) params.push('region=' + encodeURIComponent(rp));
+      if (showEnc) params.push('includeEncrypted=true');
+      const qs = params.length ? '?' + params.join('&') : '';
       const data = await api('/channels' + qs, { ttl: CLIENT_TTL.channels });
       channels = (data.channels || []).map(ch => {
         ch.lastActivityMs = ch.lastActivity ? new Date(ch.lastActivity).getTime() : 0;
@@ -662,21 +1046,33 @@
     });
 
     el.innerHTML = sorted.map(ch => {
-      const name = ch.name || `Channel ${formatHashHex(ch.hash)}`;
-      const color = getChannelColor(ch.hash);
+      const isEncrypted = ch.encrypted === true;
+      const name = isEncrypted ? (ch.name || 'Unknown') : (ch.name || `Channel ${formatHashHex(ch.hash)}`);
+      const color = isEncrypted ? 'var(--text-muted, #6b7280)' : getChannelColor(ch.hash);
       const time = ch.lastActivityMs ? formatSecondsAgo(Math.floor((Date.now() - ch.lastActivityMs) / 1000)) : '';
-      const preview = ch.lastSender && ch.lastMessage
-        ? `${ch.lastSender}: ${truncate(ch.lastMessage, 28)}`
-        : `${ch.messageCount} messages`;
+      const preview = isEncrypted
+        ? `${ch.messageCount} encrypted messages (no key configured)`
+        : ch.lastSender && ch.lastMessage
+          ? `${ch.lastSender}: ${truncate(ch.lastMessage, 28)}`
+          : `${ch.messageCount} messages`;
       const sel = selectedHash === ch.hash ? ' selected' : '';
-      const abbr = name.startsWith('#') ? name.slice(0, 3) : name.slice(0, 2).toUpperCase();
+      const encClass = isEncrypted ? ' ch-encrypted' : '';
+      const abbr = isEncrypted ? '🔒' : (name.startsWith('#') ? name.slice(0, 3) : name.slice(0, 2).toUpperCase());
+      // Channel color dot for color picker (#674)
+      const chColor = window.ChannelColors ? window.ChannelColors.get(ch.hash) : null;
+      const dotStyle = chColor ? ` style="background:${chColor}"` : '';
+      // Left border for assigned color
+      const borderStyle = chColor ? ` style="border-left:3px solid ${chColor}"` : '';
+      // M4: Remove button for user-added channels
+      const removeBtn = ch.userAdded ? ' <button class="ch-remove-btn" data-remove-channel="' + escapeHtml(ch.hash) + '" title="Remove channel" aria-label="Remove ' + escapeHtml(name) + '">✕</button>' : '';
 
-      return `<button class="ch-item${sel}" data-hash="${ch.hash}" type="button" role="option" aria-selected="${selectedHash === ch.hash ? 'true' : 'false'}" aria-label="${escapeHtml(name)}">
-        <div class="ch-badge" style="background:${color}" aria-hidden="true">${escapeHtml(abbr)}</div>
+      return `<button class="ch-item${sel}${encClass}" data-hash="${ch.hash}"${borderStyle} type="button" role="option" aria-selected="${selectedHash === ch.hash ? 'true' : 'false'}" aria-label="${escapeHtml(name)}"${isEncrypted ? ' data-encrypted="true"' : ''}>
+        <div class="ch-badge" style="background:${color}" aria-hidden="true">${isEncrypted ? '🔒' : escapeHtml(abbr)}</div>
         <div class="ch-item-body">
           <div class="ch-item-top">
             <span class="ch-item-name">${escapeHtml(name)}</span>
-            <span class="ch-item-time" data-channel-hash="${ch.hash}">${time}</span>
+            <span class="ch-color-dot" data-channel="${escapeHtml(ch.hash)}"${dotStyle} title="Change channel color" aria-label="Change color for ${escapeHtml(name)}"></span>
+            <span class="ch-item-time" data-channel-hash="${ch.hash}">${time}</span>${removeBtn}
           </div>
           <div class="ch-item-preview">${escapeHtml(preview)}</div>
         </div>
@@ -684,7 +1080,7 @@
     }).join('');
   }
 
-  async function selectChannel(hash) {
+  async function selectChannel(hash, decryptOpts) {
     const rp = RegionFilter.getRegionParam() || '';
     const request = beginMessageRequest(hash, rp);
     selectedHash = hash;
@@ -699,6 +1095,73 @@
     document.querySelector('.ch-layout')?.classList.add('ch-show-main');
 
     const msgEl = document.getElementById('chMessages');
+
+    // Shared helper: fetch, decrypt, and render messages for a channel key (M5: cache-first)
+    async function decryptAndRender(keyHex, channelHashByte, channelName) {
+      msgEl.innerHTML = '<div class="ch-loading">Decrypting messages…</div>';
+      var result = await fetchAndDecryptChannel(keyHex, channelHashByte, channelName, {
+        onCacheHit: function (cachedMsgs) {
+          // M5: Render cached messages immediately while delta fetch runs
+          messages = cachedMsgs;
+          if (messages.length > 0) {
+            header.querySelector('.ch-header-text').textContent = name + ' — ' + messages.length + ' messages (cached)';
+            renderMessages();
+            scrollToBottom();
+          }
+        }
+      });
+      if (isStaleMessageRequest(request)) return true;
+      if (result.wrongKey) {
+        msgEl.innerHTML = '<div class="ch-empty ch-wrong-key">🔒 Key does not match — no messages could be decrypted</div>';
+        return true;
+      }
+      if (result.error) {
+        msgEl.innerHTML = '<div class="ch-empty">' + escapeHtml(result.error) + '</div>';
+        return true;
+      }
+      messages = result.messages || [];
+      if (messages.length === 0) {
+        msgEl.innerHTML = '<div class="ch-empty">No encrypted messages found for this channel</div>';
+      } else {
+        header.querySelector('.ch-header-text').textContent = `${name} — ${messages.length} messages (decrypted)`;
+        renderMessages();
+        scrollToBottom();
+      }
+      return true;
+    }
+
+    // Client-side decryption path (#725 M2)
+    if (decryptOpts && decryptOpts.userKey) {
+      await decryptAndRender(decryptOpts.userKey, decryptOpts.channelHashByte, decryptOpts.channelName);
+      return;
+    }
+
+    // Check if this is a user-added channel that needs decryption
+    var storedKeys = typeof ChannelDecrypt !== 'undefined' ? ChannelDecrypt.getStoredKeys() : {};
+    if (hash.startsWith('user:')) {
+      var chName = hash.substring(5);
+      if (storedKeys[chName]) {
+        var keyHex = storedKeys[chName];
+        var keyBytes = ChannelDecrypt.hexToBytes(keyHex);
+        var hashByte = await ChannelDecrypt.computeChannelHash(keyBytes);
+        await decryptAndRender(keyHex, hashByte, chName);
+        return;
+      }
+    }
+
+    // Also check if an encrypted channel hash matches a stored key
+    if (ch && ch.encrypted) {
+      for (var kn in storedKeys) {
+        var kh = storedKeys[kn];
+        var kb = ChannelDecrypt.hexToBytes(kh);
+        var hb = await ChannelDecrypt.computeChannelHash(kb);
+        if (String(hb) === String(hash) || String(ch.hash) === String(hb)) {
+          await decryptAndRender(kh, hb, kn);
+          return;
+        }
+      }
+    }
+
     msgEl.innerHTML = '<div class="ch-loading">Loading messages…</div>';
 
     try {
@@ -720,6 +1183,9 @@
 
   async function refreshMessages(opts) {
     if (!selectedHash) return;
+    // Skip refresh for encrypted channels — no messages to fetch
+    var selCh = channels.find(function (c) { return c.hash === selectedHash; });
+    if (selCh && selCh.encrypted) return;
     opts = opts || {};
     const msgEl = document.getElementById('chMessages');
     if (!msgEl) return;

public/customize-v2.js

@@ -33,9 +33,10 @@
     'meshcore-live-heatmap-opacity'
   ];
 
-  var VALID_SECTIONS = ['branding', 'theme', 'themeDark', 'nodeColors', 'typeColors', 'home', 'timestamps', 'heatmapOpacity', 'liveHeatmapOpacity'];
+  var VALID_SECTIONS = ['branding', 'theme', 'themeDark', 'nodeColors', 'typeColors', 'home', 'timestamps', 'heatmapOpacity', 'liveHeatmapOpacity', 'distanceUnit'];
   var OBJECT_SECTIONS = ['branding', 'theme', 'themeDark', 'nodeColors', 'typeColors', 'home', 'timestamps'];
   var SCALAR_SECTIONS = ['heatmapOpacity', 'liveHeatmapOpacity'];
+  var DISTANCE_UNIT_VALUES = ['km', 'mi', 'auto'];
 
   // CSS variable mapping (theme key → CSS custom property)
   var THEME_CSS_MAP = {
@@ -503,6 +504,11 @@
       localStorage.setItem('meshcore-live-heatmap-opacity', effectiveConfig.liveHeatmapOpacity);
     }
 
+    // Distance unit → sync to localStorage for all pages
+    if (typeof effectiveConfig.distanceUnit === 'string' && DISTANCE_UNIT_VALUES.indexOf(effectiveConfig.distanceUnit) >= 0) {
+      localStorage.setItem('meshcore-distance-unit', effectiveConfig.distanceUnit);
+    }
+
     // Nav gradient
     if (themeSection.navBg) {
       var nav = document.querySelector('.top-nav');
@@ -744,6 +750,10 @@
           }
         }
       }
+      // Validate distanceUnit
+      if (key === 'distanceUnit' && DISTANCE_UNIT_VALUES.indexOf(obj[key]) === -1) {
+        errors.push('Invalid distanceUnit: "' + obj[key] + '" — must be km, mi, or auto');
+      }
     }
     return { valid: errors.length === 0, errors: errors };
   }
@@ -895,7 +905,7 @@
       { id: 'theme', label: '🎨', title: 'Theme', badge: _tabBadge(isDarkMode() ? 'themeDark' : 'theme') },
       { id: 'nodes', label: '🎯', title: 'Colors', badge: (function () { var n = _countOverrides('nodeColors') + _countOverrides('typeColors'); return n ? ' <span class="cv2-tab-badge">' + n + '</span>' : ''; })() },
       { id: 'home', label: '🏠', title: 'Home', badge: _tabBadge('home') },
-      { id: 'display', label: '🖥️', title: 'Display', badge: _tabBadge('timestamps') },
+      { id: 'display', label: '🖥️', title: 'Display', badge: (function () { var n = _countOverrides('timestamps') + (_isOverridden(null, 'distanceUnit') ? 1 : 0); return n ? ' <span class="cv2-tab-badge">' + n + '</span>' : ''; })() },
       { id: 'export', label: '📤', title: 'Export' }
     ];
     return '<div class="cust-tabs">' + tabs.map(function (t) {
@@ -1059,6 +1069,7 @@
 
   function _renderDisplay() {
     var eff = _getEffective();
+    var distUnit = typeof eff.distanceUnit === 'string' && DISTANCE_UNIT_VALUES.indexOf(eff.distanceUnit) >= 0 ? eff.distanceUnit : 'auto';
     var ts = (eff.timestamps) || {};
     var tsMode = ts.defaultMode === 'absolute' ? 'absolute' : 'ago';
     var tsTz = ts.timezone === 'utc' ? 'utc' : 'local';
@@ -1086,6 +1097,13 @@
           '<option value="locale"' + (tsFmt === 'locale' ? ' selected' : '') + '>Locale (browser)</option></select></div>' +
       (canCustom ? '<div class="cust-field" data-ts-abs="custom"' + showAbs + '><label>Custom Format' + _overrideDot('timestamps', 'customFormat') + '</label>' +
         '<input type="text" data-cv2-field="timestamps.customFormat" value="' + escAttr(customFmt) + '" placeholder="YYYY-MM-DD HH:mm:ss"></div>' : '') +
+      '<p class="cust-section-title" style="font-size:14px;margin:16px 0 8px">Distances</p>' +
+      '<div class="cust-field"><label>Distance Unit' + _overrideDot(null, 'distanceUnit') + '</label>' +
+        '<select data-cv2-select="distanceUnit" style="width:100%;padding:6px 8px;border:1px solid var(--border);border-radius:6px;background:var(--input-bg);color:var(--text)">' +
+          '<option value="auto"' + (distUnit === 'auto' ? ' selected' : '') + '>Auto (browser locale)</option>' +
+          '<option value="km"' + (distUnit === 'km' ? ' selected' : '') + '>Kilometers (km)</option>' +
+          '<option value="mi"' + (distUnit === 'mi' ? ' selected' : '') + '>Miles (mi)</option>' +
+        '</select></div>' +
     '</div>';
   }
 
@@ -1155,6 +1173,10 @@
       '<details style="margin-top:12px"><summary style="font-size:12px;font-weight:600;cursor:pointer;color:var(--text-muted)">Raw JSON</summary>' +
         '<textarea id="cv2ExportJson" style="width:100%;min-height:200px;font-family:var(--mono);font-size:12px;background:var(--surface-1);border:1px solid var(--border);border-radius:6px;padding:12px;color:var(--text);resize:vertical;box-sizing:border-box;margin-top:8px">' + esc(json) + '</textarea>' +
       '</details>' +
+      '<p class="cust-section-title" style="margin-top:20px">Tools</p>' +
+      '<p style="font-size:12px;color:var(--text-muted);margin-bottom:10px">Server-side configuration helpers.</p>' +
+      '<a href="/geofilter-builder.html" target="_blank" style="display:inline-block;padding:7px 14px;background:var(--surface-1);border:1px solid var(--border);border-radius:6px;color:var(--accent);font-size:13px;text-decoration:none;font-weight:500">🗺️ GeoFilter Builder →</a>' +
+      '<p style="font-size:11px;color:var(--text-muted);margin-top:6px">Draw a polygon on the map to generate a <code style="font-family:var(--mono)">geo_filter</code> block for <code style="font-family:var(--mono)">config.json</code>.</p>' +
     '</div>';
   }
 
@@ -1324,12 +1346,16 @@
     container.querySelectorAll('[data-cv2-select]').forEach(function (sel) {
       sel.addEventListener('change', function () {
         var parts = sel.dataset.cv2Select.split('.');
-        setOverride(parts[0], parts[1], sel.value);
-        // Show/hide absolute-only fields
-        if (parts[1] === 'defaultMode') {
-          container.querySelectorAll('[data-ts-abs]').forEach(function (el) {
-            el.style.display = sel.value === 'absolute' ? '' : 'none';
-          });
+        if (parts.length === 1) {
+          setOverride(null, parts[0], sel.value);
+        } else {
+          setOverride(parts[0], parts[1], sel.value);
+          // Show/hide absolute-only fields
+          if (parts[1] === 'defaultMode') {
+            container.querySelectorAll('[data-ts-abs]').forEach(function (el) {
+              el.style.display = sel.value === 'absolute' ? '' : 'none';
+            });
+          }
         }
         window.dispatchEvent(new CustomEvent('timestamp-mode-changed'));
       });

public/drag-manager.js

@@ -0,0 +1,216 @@
+/* drag-manager.js — Free-form panel dragging (#608 M1)
+ * State machine: IDLE → PENDING → DRAGGING → IDLE
+ * Pointer events on .panel-header, transform: translate() during drag,
+ * snap-to-edge on release, z-index on focus, viewport % persistence.
+ */
+(function () {
+  'use strict';
+
+  var DEAD_ZONE = 5;      // px — disambiguate click vs drag
+  var SNAP_THRESHOLD = 20; // px — snap to edge on release
+  var SNAP_MARGIN = 12;    // px — margin when snapped
+
+  function DragManager() {
+    this.state = 'IDLE';
+    this.activePanel = null;
+    this.startX = 0;
+    this.startY = 0;
+    this.panelStartX = 0;
+    this.panelStartY = 0;
+    this.preTransform = '';
+    this.enabled = true;
+    this.zCounter = 1000;
+    this._panels = [];
+    this._onKeyDown = this._handleKeyDown.bind(this);
+  }
+
+  DragManager.prototype.register = function (panel) {
+    if (!panel) return;
+    var header = panel.querySelector('.panel-header');
+    if (!header) return;
+    this._panels.push(panel);
+    var self = this;
+
+    header.addEventListener('pointerdown', function (e) {
+      if (!self.enabled) return;
+      if (e.button !== 0) return;
+      if (e.target.closest('button')) return;
+      e.preventDefault();
+      header.setPointerCapture(e.pointerId);
+
+      self.state = 'PENDING';
+      self.activePanel = panel;
+      self.startX = e.clientX;
+      self.startY = e.clientY;
+
+      var rect = panel.getBoundingClientRect();
+      self.panelStartX = rect.left;
+      self.panelStartY = rect.top;
+      self.preTransform = panel.style.transform || '';
+      document.addEventListener('keydown', self._onKeyDown);
+    });
+
+    header.addEventListener('pointermove', function (e) {
+      if (self.state === 'IDLE') return;
+      if (self.activePanel !== panel) return;
+      var dx = e.clientX - self.startX;
+      var dy = e.clientY - self.startY;
+
+      if (self.state === 'PENDING') {
+        if (Math.hypot(dx, dy) < DEAD_ZONE) return;
+        self.state = 'DRAGGING';
+        panel.classList.add('is-dragging');
+        panel.style.zIndex = ++self.zCounter;
+        self._detachFromCorner(panel);
+      }
+
+      panel.style.transform = 'translate(' + dx + 'px, ' + dy + 'px)';
+    });
+
+    header.addEventListener('pointerup', function (e) {
+      if (self.activePanel !== panel) return;
+      header.releasePointerCapture(e.pointerId);
+      if (self.state === 'DRAGGING') {
+        panel.classList.remove('is-dragging');
+        self._finalizePosition(panel);
+      }
+      self._reset();
+    });
+
+    header.addEventListener('pointercancel', function () {
+      if (self.activePanel !== panel) return;
+      panel.classList.remove('is-dragging');
+      if (self.state === 'DRAGGING') {
+        self._finalizePosition(panel);
+      }
+      self._reset();
+    });
+  };
+
+  DragManager.prototype._handleKeyDown = function (e) {
+    if (e.key === 'Escape' && this.state === 'DRAGGING' && this.activePanel) {
+      this.activePanel.classList.remove('is-dragging');
+      this.activePanel.style.transform = this.preTransform;
+      // Revert: re-attach to corner if it was cornered before
+      var saved = localStorage.getItem('panel-drag-' + this.activePanel.id);
+      if (!saved) {
+        // Was in corner mode — restore corner CSS
+        delete this.activePanel.dataset.dragged;
+        this.activePanel.style.top = '';
+        this.activePanel.style.left = '';
+        this.activePanel.style.right = '';
+        this.activePanel.style.bottom = '';
+        this.activePanel.style.transform = '';
+        // Re-apply corner position from M0
+        var corner = localStorage.getItem('panel-corner-' + this.activePanel.id);
+        if (corner) this.activePanel.setAttribute('data-position', corner);
+      } else {
+        // Was already dragged — revert to pre-drag position
+        this.activePanel.style.transform = 'none';
+      }
+      this._reset();
+    }
+  };
+
+  DragManager.prototype._reset = function () {
+    document.removeEventListener('keydown', this._onKeyDown);
+    this.state = 'IDLE';
+    this.activePanel = null;
+  };
+
+  DragManager.prototype._detachFromCorner = function (panel) {
+    var rect = panel.getBoundingClientRect();
+    panel.removeAttribute('data-position');
+    panel.dataset.dragged = 'true';
+    panel.style.position = 'fixed';
+    panel.style.top = rect.top + 'px';
+    panel.style.left = rect.left + 'px';
+    panel.style.right = 'auto';
+    panel.style.bottom = 'auto';
+    panel.style.transform = 'none';
+  };
+
+  DragManager.prototype._finalizePosition = function (panel) {
+    var rect = panel.getBoundingClientRect();
+    var vw = window.innerWidth;
+    var vh = window.innerHeight;
+
+    var x = Math.max(0, Math.min(rect.left, vw - 40));
+    var y = Math.max(0, Math.min(rect.top, vh - 40));
+
+    // Snap to edge
+    if (x < SNAP_THRESHOLD) x = SNAP_MARGIN;
+    if (y < SNAP_THRESHOLD) y = SNAP_MARGIN;
+    if (x + rect.width > vw - SNAP_THRESHOLD) x = vw - rect.width - SNAP_MARGIN;
+    if (y + rect.height > vh - SNAP_THRESHOLD) y = vh - rect.height - SNAP_MARGIN;
+
+    panel.style.top = y + 'px';
+    panel.style.left = x + 'px';
+    panel.style.transform = 'none';
+
+    this._persist(panel.id, x / vw, y / vh);
+  };
+
+  DragManager.prototype._persist = function (id, xPct, yPct) {
+    try {
+      localStorage.setItem('panel-drag-' + id,
+        JSON.stringify({ xPct: xPct, yPct: yPct }));
+    } catch (_) { /* quota exceeded — silent */ }
+  };
+
+  DragManager.prototype.enable = function () { this.enabled = true; };
+  DragManager.prototype.disable = function () {
+    this.enabled = false;
+    if (this.state !== 'IDLE' && this.activePanel) {
+      this.activePanel.classList.remove('is-dragging');
+      this._reset();
+    }
+  };
+
+  DragManager.prototype.restorePositions = function () {
+    var panels = this._panels;
+    for (var i = 0; i < panels.length; i++) {
+      var panel = panels[i];
+      var raw = localStorage.getItem('panel-drag-' + panel.id);
+      if (!raw) continue;
+      try {
+        var pos = JSON.parse(raw);
+        var x = pos.xPct * window.innerWidth;
+        var y = pos.yPct * window.innerHeight;
+        panel.removeAttribute('data-position');
+        panel.dataset.dragged = 'true';
+        panel.style.position = 'fixed';
+        panel.style.top = y + 'px';
+        panel.style.left = x + 'px';
+        panel.style.right = 'auto';
+        panel.style.bottom = 'auto';
+        panel.style.transform = 'none';
+      } catch (_) {
+        localStorage.removeItem('panel-drag-' + panel.id);
+      }
+    }
+  };
+
+  DragManager.prototype.handleResize = function () {
+    var panels = document.querySelectorAll('.live-overlay[data-dragged="true"]');
+    for (var i = 0; i < panels.length; i++) {
+      var panel = panels[i];
+      var rect = panel.getBoundingClientRect();
+      var vw = window.innerWidth;
+      var vh = window.innerHeight;
+      var x = rect.left, y = rect.top, moved = false;
+      if (rect.right > vw) { x = vw - rect.width - SNAP_MARGIN; moved = true; }
+      if (rect.bottom > vh) { y = vh - rect.height - SNAP_MARGIN; moved = true; }
+      if (x < 0) { x = SNAP_MARGIN; moved = true; }
+      if (y < 0) { y = SNAP_MARGIN; moved = true; }
+      if (moved) {
+        panel.style.left = x + 'px';
+        panel.style.top = y + 'px';
+        this._persist(panel.id, x / vw, y / vh);
+      }
+    }
+  };
+
+  // Export
+  window.DragManager = DragManager;
+})();

public/geofilter-builder.html

@@ -0,0 +1,170 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>GeoFilter Builder — CoreScope</title>
+<link rel="stylesheet" href="https://unpkg.com/leaflet@1.9.4/dist/leaflet.css"/>
+<script src="https://unpkg.com/leaflet@1.9.4/dist/leaflet.js"></script>
+<style>
+  * { box-sizing: border-box; margin: 0; padding: 0; }
+  body { font-family: system-ui, sans-serif; background: #1a1a2e; color: #e0e0e0; height: 100vh; display: flex; flex-direction: column; }
+  header { padding: 12px 16px; background: #0f0f23; border-bottom: 1px solid #333; display: flex; align-items: center; gap: 16px; flex-wrap: wrap; }
+  header h1 { font-size: 1rem; font-weight: 600; color: #4a9eff; white-space: nowrap; }
+  .controls { display: flex; gap: 8px; flex-wrap: wrap; }
+  button { padding: 6px 14px; border: none; border-radius: 6px; cursor: pointer; font-size: 0.85rem; font-weight: 500; }
+  #btnUndo  { background: #333; color: #ccc; }
+  #btnClear { background: #5a2020; color: #ffaaaa; }
+  #btnUndo:hover  { background: #444; }
+  #btnClear:hover { background: #7a2020; }
+  .hint { font-size: 0.8rem; color: #888; margin-left: auto; }
+  #map { flex: 1; }
+  #output-panel { background: #0f0f23; border-top: 1px solid #333; padding: 12px 16px; display: flex; gap: 12px; align-items: flex-start; }
+  #output-panel label { font-size: 0.75rem; color: #888; white-space: nowrap; padding-top: 6px; }
+  #output { flex: 1; background: #111; border: 1px solid #333; border-radius: 6px; padding: 10px 12px; font-family: monospace; font-size: 0.78rem; color: #7ec8e3; white-space: pre; overflow-x: auto; min-height: 54px; max-height: 140px; overflow-y: auto; cursor: text; }
+  #output.empty { color: #555; font-style: italic; }
+  #btnCopy { padding: 6px 14px; background: #1a4a7a; color: #7ec8e3; border-radius: 6px; border: none; cursor: pointer; font-size: 0.85rem; white-space: nowrap; align-self: flex-end; }
+  #btnCopy:hover { background: #2a6aaa; }
+  #btnCopy.copied { background: #1a6a3a; color: #7effa0; }
+  #counter { font-size: 0.8rem; color: #888; padding-top: 6px; white-space: nowrap; }
+  .bufferRow { display: flex; align-items: center; gap: 8px; }
+  .bufferRow label { font-size: 0.85rem; color: #aaa; }
+  .bufferRow input { width: 60px; padding: 5px 8px; background: #222; border: 1px solid #444; border-radius: 6px; color: #eee; font-size: 0.85rem; }
+  #help-bar { background: #0f0f23; padding: 6px 16px; font-size: 0.75rem; color: #666; border-top: 1px solid #222; }
+  #help-bar a { color: #4a9eff; text-decoration: none; }
+  #help-bar a:hover { text-decoration: underline; }
+  #back-link { font-size: 0.8rem; color: #4a9eff; text-decoration: none; white-space: nowrap; }
+  #back-link:hover { text-decoration: underline; }
+</style>
+</head>
+<body>
+
+<header>
+  <a href="/" id="back-link">← CoreScope</a>
+  <h1>GeoFilter Builder</h1>
+  <div class="controls">
+    <button id="btnUndo">↩ Undo</button>
+    <button id="btnClear">✕ Clear</button>
+  </div>
+  <div class="bufferRow">
+    <label for="bufferKm">Buffer km:</label>
+    <!-- Extra margin (km) outside the polygon edge that still passes the filter -->
+    <input type="number" id="bufferKm" value="20" min="0" max="500"/>
+  </div>
+  <span class="hint">Click on the map to add polygon points</span>
+</header>
+
+<div id="map"></div>
+
+<!-- Output panel: shows the geo_filter JSON block ready to paste into config.json -->
+<div id="output-panel">
+  <label>config.json</label>
+  <div id="output" class="empty">Add at least 3 points to generate config…</div>
+  <div style="display:flex;flex-direction:column;gap:8px;align-items:flex-end">
+    <span id="counter">0 points</span>
+    <button id="btnCopy">Copy</button>
+  </div>
+</div>
+
+<!-- Instructions: paste the output into config.json as a top-level "geo_filter" key, then restart the server -->
+<div id="help-bar">
+  Copy the JSON above → paste as a top-level key in <code>config.json</code> → restart the server.
+  Nodes with no GPS fix always pass through. Remove the <code>geo_filter</code> block to disable filtering.
+  &nbsp;·&nbsp; <a href="https://github.com/Kpa-clawbot/CoreScope/blob/master/docs/user-guide/geofilter.md" target="_blank">Documentation ↗</a>
+</div>
+
+<script>
+const map = L.map('map').setView([50.5, 4.4], 8);
+
+L.tileLayer('https://{s}.basemaps.cartocdn.com/dark_all/{z}/{x}/{y}{r}.png', {
+  attribution: '© OpenStreetMap © CartoDB',
+  maxZoom: 19
+}).addTo(map);
+
+let points = [];
+let markers = [];
+let polygon = null;
+let closingLine = null;
+
+function latLonPair(latlng) {
+  return [parseFloat(latlng.lat.toFixed(6)), parseFloat(latlng.lng.toFixed(6))];
+}
+
+function render() {
+  // Remove existing polygon and closing line
+  if (polygon) { map.removeLayer(polygon); polygon = null; }
+  if (closingLine) { map.removeLayer(closingLine); closingLine = null; }
+
+  if (points.length >= 3) {
+    polygon = L.polygon(points, {
+      color: '#4a9eff', weight: 2, fillColor: '#4a9eff', fillOpacity: 0.12
+    }).addTo(map);
+  } else if (points.length === 2) {
+    closingLine = L.polyline(points, { color: '#4a9eff', weight: 2, dashArray: '5,5' }).addTo(map);
+  }
+
+  updateOutput();
+}
+
+function updateOutput() {
+  const el = document.getElementById('output');
+  const counter = document.getElementById('counter');
+  counter.textContent = points.length + ' point' + (points.length !== 1 ? 's' : '');
+
+  if (points.length < 3) {
+    el.textContent = 'Add at least 3 points to generate config…';
+    el.classList.add('empty');
+    return;
+  }
+  el.classList.remove('empty');
+
+  const bufferKm = parseFloat(document.getElementById('bufferKm').value) || 0;
+  // Output format: { "geo_filter": { "bufferKm": N, "polygon": [[lat,lon], ...] } }
+  // Paste this as a top-level key in config.json
+  const config = { bufferKm, polygon: points };
+  el.textContent = JSON.stringify({ geo_filter: config }, null, 2);
+}
+
+map.on('click', function(e) {
+  const pt = latLonPair(e.latlng);
+  points.push(pt);
+
+  const idx = points.length;
+  const marker = L.circleMarker(e.latlng, {
+    radius: 6, color: '#4a9eff', weight: 2, fillColor: '#4a9eff', fillOpacity: 0.9
+  }).addTo(map).bindTooltip(String(idx), { permanent: true, direction: 'top', offset: [0, -8], className: 'pt-label' });
+  markers.push(marker);
+
+  render();
+});
+
+document.getElementById('btnUndo').addEventListener('click', function() {
+  if (!points.length) return;
+  points.pop();
+  const m = markers.pop();
+  if (m) map.removeLayer(m);
+  render();
+});
+
+document.getElementById('btnClear').addEventListener('click', function() {
+  points = [];
+  markers.forEach(m => map.removeLayer(m));
+  markers = [];
+  render();
+});
+
+document.getElementById('bufferKm').addEventListener('input', updateOutput);
+
+document.getElementById('btnCopy').addEventListener('click', function() {
+  if (points.length < 3) return;
+  const text = document.getElementById('output').textContent;
+  navigator.clipboard.writeText(text).then(() => {
+    const btn = document.getElementById('btnCopy');
+    btn.textContent = 'Copied!';
+    btn.classList.add('copied');
+    setTimeout(() => { btn.textContent = 'Copy'; btn.classList.remove('copied'); }, 2000);
+  });
+});
+</script>
+</body>
+</html>

public/home.js

@@ -302,14 +302,19 @@
             <button class="mnc-btn" data-action="packets" data-key="${mn.pubkey}">View packets →</button>
           </div>
         </div>`;
-      } catch {
+      } catch (err) {
+        const is404 = err && err.message && err.message.includes('404');
+        const statusIcon = is404 ? '📡' : '❓';
+        const statusMsg = is404
+          ? 'Waiting for first advert — this node has been seen in channel messages but hasn\u2019t advertised yet'
+          : 'Could not load data';
         return `<div class="my-node-card silent" data-key="${mn.pubkey}" tabindex="0" role="button">
           <div class="mnc-header">
-            <div class="mnc-status">❓</div>
+            <div class="mnc-status">${statusIcon}</div>
             <div class="mnc-name">${escapeHtml(mn.name || truncate(mn.pubkey, 12))}</div>
             <button class="mnc-remove" data-key="${mn.pubkey}" title="Remove" aria-label="Remove ${escapeAttr(mn.name || truncate(mn.pubkey, 12))} from My Mesh">✕</button>
           </div>
-          <div class="mnc-status-text">Could not load data</div>
+          <div class="mnc-status-text">${statusMsg}</div>
         </div>`;
       }
     }));

public/index.html

@@ -92,13 +92,17 @@
   <script src="hop-display.js?v=__BUST__"></script>
   <script src="app.js?v=__BUST__"></script>
   <script src="home.js?v=__BUST__"></script>
+  <script src="table-sort.js?v=__BUST__"></script>
   <script src="packet-filter.js?v=__BUST__"></script>
   <script src="packet-helpers.js?v=__BUST__"></script>
+  <script src="channel-decrypt.js?v=__BUST__"></script>
   <script src="channel-colors.js?v=__BUST__"></script>
+  <script src="channel-color-picker.js?v=__BUST__"></script>
   <script src="packets.js?v=__BUST__"></script>
   <script src="geo-filter-overlay.js?v=__BUST__"></script>
   <script src="map.js?v=__BUST__" onerror="console.error('Failed to load:', this.src)"></script>
   <script src="channels.js?v=__BUST__" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="table-sort.js?v=__BUST__"></script>
   <script src="nodes.js?v=__BUST__" onerror="console.error('Failed to load:', this.src)"></script>
   <script src="traces.js?v=__BUST__" onerror="console.error('Failed to load:', this.src)"></script>
   <script src="analytics.js?v=__BUST__" onerror="console.error('Failed to load:', this.src)"></script>
@@ -106,6 +110,7 @@
   <script src="audio-v1-constellation.js?v=__BUST__" onerror="console.error('Failed to load:', this.src)"></script>
   <script src="audio-v2-constellation.js?v=__BUST__" onerror="console.error('Failed to load:', this.src)"></script>
   <script src="audio-lab.js?v=__BUST__" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="drag-manager.js?v=__BUST__" onerror="console.error('Failed to load:', this.src)"></script>
   <script src="live.js?v=__BUST__" onerror="console.error('Failed to load:', this.src)"></script>
   <script src="observers.js?v=__BUST__" onerror="console.error('Failed to load:', this.src)"></script>
   <script src="observer-detail.js?v=__BUST__" onerror="console.error('Failed to load:', this.src)"></script>

public/live.css

@@ -19,6 +19,36 @@
   position: absolute;
   z-index: 1000;
   pointer-events: auto;
+  display: flex;
+  flex-direction: column;
+}
+
+/* ---- Panel header (non-scrolling) ---- */
+.panel-header {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  flex-shrink: 0;
+  padding: 4px 6px;
+}
+
+/* ---- Panel content (scrollable) ---- */
+.panel-content {
+  flex: 1;
+  overflow-y: auto;
+  min-height: 0;
+}
+
+.live-feed .panel-content {
+  display: flex;
+  flex-direction: column;
+  gap: 1px;
+}
+
+.live-legend .panel-content {
+  display: flex;
+  flex-direction: column;
+  gap: 3px;
 }
 
 /* ---- Header / Stats ---- */
@@ -106,7 +136,6 @@
   right: 12px;
   width: 320px;
   max-height: calc(100vh - 140px);
-  overflow-y: auto;
   background: color-mix(in srgb, var(--surface-1) 95%, transparent);
   backdrop-filter: blur(12px);
   border-radius: 10px;
@@ -126,16 +155,12 @@
   left: 12px;
   width: 360px;
   max-height: 340px;
-  overflow-y: auto;
   background: color-mix(in srgb, var(--surface-1) 92%, transparent);
   backdrop-filter: blur(12px);
   border-radius: 10px;
   border: 1px solid var(--border);
   box-shadow: 0 4px 24px rgba(0, 0, 0, 0.5);
   padding: 6px;
-  display: flex;
-  flex-direction: column;
-  gap: 1px;
 }
 
 .live-feed-item {
@@ -198,9 +223,6 @@
   box-shadow: 0 4px 24px rgba(0, 0, 0, 0.5);
   color: var(--text-muted);
   font-size: 11px;
-  display: flex;
-  flex-direction: column;
-  gap: 3px;
   transition: opacity 0.3s, transform 0.3s;
 }
 
@@ -778,3 +800,89 @@
 }
 .nav-pin-btn:hover { opacity: 0.8; }
 .nav-pin-btn.pinned { opacity: 1; filter: drop-shadow(0 0 4px rgba(59,130,246,0.5)); }
+
+/* ========== Panel Corner Positioning (#608 M0) ========== */
+/* Corner positions — applied via data-position attribute on .live-overlay panels */
+.live-overlay[data-position="tl"] { top: 64px; left: 12px; bottom: auto; right: auto; }
+.live-overlay[data-position="tr"] { top: 64px; right: 12px; bottom: auto; left: auto; }
+.live-overlay[data-position="bl"] { bottom: 58px; left: 12px; top: auto; right: auto; }
+.live-overlay[data-position="br"] { bottom: 58px; right: 12px; top: auto; left: auto; }
+
+/* Override hide animations for positioned panels — slide toward nearest edge */
+.live-overlay[data-position="tl"].hidden,
+.live-overlay[data-position="bl"].hidden { transform: translateX(-100%); }
+.live-overlay[data-position="tr"].hidden,
+.live-overlay[data-position="br"].hidden { transform: translateX(100%); }
+.live-overlay[data-position].hidden { opacity: 0; pointer-events: none; visibility: hidden; }
+
+/* Corner toggle button */
+.panel-corner-btn {
+  width: 28px;
+  height: 28px;
+  padding: 0;
+  border: none;
+  background: transparent;
+  color: var(--text-muted);
+  cursor: pointer;
+  opacity: 0.6;
+  transition: opacity 0.15s, background 0.15s;
+  font-size: 14px;
+  line-height: 28px;
+  text-align: center;
+  flex-shrink: 0;
+  border-radius: 4px;
+}
+.panel-corner-btn:hover { opacity: 1; background: color-mix(in srgb, var(--text) 12%, transparent); }
+.panel-corner-btn:focus-visible {
+  opacity: 1;
+  outline: 2px solid var(--accent);
+  outline-offset: 2px;
+  border-radius: 3px;
+}
+
+/* On mobile, corner toggle is not useful (panels are hidden or bottom-sheet) */
+@media (max-width: 640px) {
+  .panel-corner-btn { display: none !important; }
+  .live-overlay[data-position] {
+    top: unset !important; bottom: unset !important;
+    left: unset !important; right: unset !important;
+  }
+}
+
+
+/* ── Drag Manager (#608 M1) ── */
+
+/* Panel header as drag handle — desktop pointer devices only */
+@media (pointer: fine) {
+  .live-overlay .panel-header {
+    cursor: grab;
+    user-select: none;
+    touch-action: none;
+  }
+  .live-overlay.is-dragging .panel-header {
+    cursor: grabbing;
+  }
+  .live-overlay .panel-header:hover {
+    background: var(--bg-hover, rgba(255, 255, 255, 0.03));
+  }
+}
+
+/* Panel during drag */
+.live-overlay.is-dragging {
+  opacity: 0.92;
+  box-shadow: 0 8px 32px rgba(0, 0, 0, 0.5);
+  will-change: transform;
+  transition: none !important;
+}
+
+/* Freely placed panel — no corner transition animations */
+.live-overlay[data-dragged="true"] {
+  transition: none;
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .live-overlay.is-dragging,
+  .live-overlay[data-dragged="true"] {
+    transition: none;
+  }
+}

public/live.js

@@ -30,6 +30,7 @@
   let _lcdClockInterval = null;
   let _rateCounterInterval = null;
   let _pruneInterval = null;
+  let _feedTimestampInterval = null;
   let activeNodeDetailKey = null;
 
   // === VCR State Machine ===
@@ -58,6 +59,92 @@
     REQUEST: '❓', RESPONSE: '📨', TRACE: '🔍', PATH: '🛤️'
   };
 
+  /* ---- Panel Corner Positioning (#608 M0) ---- */
+  var PANEL_DEFAULTS = { liveFeed: 'bl', liveLegend: 'br', liveNodeDetail: 'tr' };
+  var CORNER_CYCLE = ['tl', 'tr', 'br', 'bl'];
+  var CORNER_ARROWS = { tl: '↘', tr: '↙', bl: '↗', br: '↖' };
+  var CORNER_LABELS = { tl: 'top-left', tr: 'top-right', bl: 'bottom-left', br: 'bottom-right' };
+  var PANEL_NAMES = { liveFeed: 'Feed', liveLegend: 'Legend', liveNodeDetail: 'Node detail' };
+
+  function getPanelPositions() {
+    var pos = {};
+    for (var id in PANEL_DEFAULTS) {
+      try { pos[id] = localStorage.getItem('panel-corner-' + id) || PANEL_DEFAULTS[id]; }
+      catch (_) { pos[id] = PANEL_DEFAULTS[id]; }
+    }
+    return pos;
+  }
+
+  function nextAvailableCorner(panelId, desired, allPositions) {
+    var idx = CORNER_CYCLE.indexOf(desired);
+    for (var i = 0; i < 4; i++) {
+      var candidate = CORNER_CYCLE[(idx + i) % 4];
+      var occupied = false;
+      for (var otherId in allPositions) {
+        if (otherId !== panelId && allPositions[otherId] === candidate) { occupied = true; break; }
+      }
+      if (!occupied) return candidate;
+    }
+    return desired; // all occupied (impossible with 3 panels, 4 corners)
+  }
+
+  function applyPanelPosition(id, corner) {
+    var el = document.getElementById(id);
+    if (!el) return;
+    el.setAttribute('data-position', corner);
+    var btn = el.querySelector('.panel-corner-btn');
+    if (btn) {
+      btn.textContent = CORNER_ARROWS[corner];
+      btn.setAttribute('aria-label',
+        'Move ' + (PANEL_NAMES[id] || 'panel') + ' to next corner (currently ' + CORNER_LABELS[corner] + ')');
+    }
+  }
+
+  function initPanelPositions() {
+    var positions = getPanelPositions();
+    for (var id in positions) {
+      applyPanelPosition(id, positions[id]);
+    }
+    // Wire up click handlers on corner buttons
+    var btns = document.querySelectorAll('.panel-corner-btn[data-panel]');
+    for (var i = 0; i < btns.length; i++) {
+      btns[i].addEventListener('click', function(e) {
+        e.stopPropagation();
+        var panelId = this.getAttribute('data-panel');
+        onCornerClick(panelId);
+      });
+    }
+  }
+
+  function onCornerClick(panelId) {
+    var positions = getPanelPositions();
+    var current = positions[panelId];
+    var nextIdx = (CORNER_CYCLE.indexOf(current) + 1) % 4;
+    var next = nextAvailableCorner(panelId, CORNER_CYCLE[nextIdx], positions);
+    try { localStorage.setItem('panel-corner-' + panelId, next); } catch (_) { /* quota */ }
+    applyPanelPosition(panelId, next);
+    // Announce for screen readers
+    var announce = document.getElementById('panelPositionAnnounce');
+    if (announce) announce.textContent = (PANEL_NAMES[panelId] || 'Panel') + ' moved to ' + CORNER_LABELS[next];
+  }
+
+  function resetPanelPositions() {
+    for (var id in PANEL_DEFAULTS) {
+      try { localStorage.removeItem('panel-corner-' + id); } catch (_) { /* ignore */ }
+      applyPanelPosition(id, PANEL_DEFAULTS[id]);
+    }
+  }
+
+  // Export for testing
+  if (typeof window !== 'undefined') {
+    window._panelCorner = {
+      PANEL_DEFAULTS: PANEL_DEFAULTS, CORNER_CYCLE: CORNER_CYCLE,
+      getPanelPositions: getPanelPositions, nextAvailableCorner: nextAvailableCorner,
+      applyPanelPosition: applyPanelPosition, onCornerClick: onCornerClick,
+      resetPanelPositions: resetPanelPositions
+    };
+  }
+
   function formatLiveTimestampHtml(isoLike) {
     if (typeof formatTimestampWithTooltip !== 'function' || typeof getTimestampMode !== 'function') {
       return escapeHtml(typeof timeAgo === 'function' ? timeAgo(isoLike) : '—');
@@ -755,15 +842,26 @@
           </div>
         </div>
         <div class="live-overlay live-feed" id="liveFeed">
-          <button class="feed-hide-btn" id="feedHideBtn" title="Hide feed">✕</button>
+          <div class="panel-header">
+            <button class="panel-corner-btn" data-panel="liveFeed" title="Move panel to next corner" aria-label="Move panel to next corner">◫</button>
+            <button class="feed-hide-btn" id="feedHideBtn" title="Hide feed">✕</button>
+          </div>
+          <div class="panel-content" aria-live="polite" aria-relevant="additions" role="log"></div>
         </div>
         <button class="feed-show-btn hidden" id="feedShowBtn" title="Show feed">📋</button>
         <div class="live-overlay live-node-detail hidden" id="liveNodeDetail">
-          <button class="feed-hide-btn" id="nodeDetailClose" title="Close">✕</button>
-          <div id="nodeDetailContent"></div>
+          <div class="panel-header">
+            <button class="panel-corner-btn" data-panel="liveNodeDetail" title="Move panel to next corner" aria-label="Move panel to next corner">◫</button>
+            <button class="feed-hide-btn" id="nodeDetailClose" title="Close">✕</button>
+          </div>
+          <div class="panel-content" id="nodeDetailContent"></div>
         </div>
         <button class="legend-toggle-btn" id="legendToggleBtn" aria-label="Show legend" title="Show legend">🎨</button>
         <div class="live-overlay live-legend" id="liveLegend" role="region" aria-label="Map legend">
+          <div class="panel-header">
+            <button class="panel-corner-btn" data-panel="liveLegend" title="Move panel to next corner" aria-label="Move panel to next corner">◫</button>
+          </div>
+          <div class="panel-content">
           <h3 class="legend-title">PACKET TYPES</h3>
           <ul class="legend-list">
             <li><span class="live-dot" style="background:${TYPE_COLORS.ADVERT}" aria-hidden="true"></span> Advert — Node advertisement</li>
@@ -774,9 +872,11 @@
           </ul>
           <h3 class="legend-title" style="margin-top:8px">NODE ROLES</h3>
           <ul class="legend-list" id="roleLegendList"></ul>
+          </div>
         </div>
 
         <!-- VCR Bar -->
+        <div class="sr-only" id="panelPositionAnnounce" aria-live="polite"></div>
         <div class="vcr-bar" id="vcrBar">
           <div class="vcr-controls">
             <button id="vcrRewindBtn" class="vcr-btn" title="Rewind" aria-label="Rewind">⏪</button>
@@ -1060,6 +1160,50 @@
     }
 
     // Populate role legend from shared roles.js
+    // Initialize panel corner positions (#608 M0)
+    initPanelPositions();
+
+    // Initialize DragManager for free-form panel dragging (#608 M1)
+    if (window.DragManager) {
+      var dragMgr = new DragManager();
+      var dragPanels = ['liveFeed', 'liveLegend', 'liveNodeDetail'];
+      for (var di = 0; di < dragPanels.length; di++) {
+        dragMgr.register(document.getElementById(dragPanels[di]));
+      }
+      dragMgr.restorePositions();
+
+      // Responsive gate: disable drag below medium breakpoint or on touch
+      var dragMql = window.matchMedia('(pointer: fine) and (min-width: 768px)');
+      function onDragMediaChange(e) {
+        if (!e.matches) {
+          // Revert dragged panels to corner positions
+          document.querySelectorAll('.live-overlay[data-dragged="true"]').forEach(function (p) {
+            delete p.dataset.dragged;
+            p.style.transform = '';
+            p.style.top = '';
+            p.style.left = '';
+            p.style.right = '';
+            p.style.bottom = '';
+          });
+          initPanelPositions();
+          dragMgr.disable();
+        } else {
+          dragMgr.enable();
+          dragMgr.restorePositions();
+        }
+      }
+      dragMql.addEventListener('change', onDragMediaChange);
+      // Initial check
+      if (!dragMql.matches) dragMgr.disable();
+
+      // Resize clamping (debounced)
+      var resizeTimer = null;
+      window.addEventListener('resize', function () {
+        clearTimeout(resizeTimer);
+        resizeTimer = setTimeout(function () { dragMgr.handleResize(); }, 200);
+      });
+    }
+
     const roleLegendList = document.getElementById('roleLegendList');
     if (roleLegendList) {
       for (const role of (window.ROLE_SORT || ['repeater', 'companion', 'room', 'sensor', 'observer'])) {
@@ -1233,6 +1377,13 @@
     // Prune stale nodes every 60 seconds
     _pruneInterval = setInterval(pruneStaleNodes, 60000);
 
+    // Refresh relative timestamps in feed every 10 seconds (#701)
+    _feedTimestampInterval = setInterval(function() {
+      document.querySelectorAll('.feed-time[data-ts]').forEach(function(el) {
+        el.innerHTML = formatLiveTimestampHtml(Number(el.dataset.ts));
+      });
+    }, 10000);
+
     // Auto-hide nav with pin toggle (#62)
     const topNav = document.querySelector('.top-nav');
     if (topNav) { topNav.style.position = 'fixed'; topNav.style.width = '100%'; topNav.style.zIndex = '1100'; }
@@ -1323,7 +1474,7 @@
       let html = `
         <div style="padding:16px;">
           <div style="display:flex;align-items:center;gap:8px;margin-bottom:12px;">
-            <span class="${statusDot}" style="font-size:18px">●</span>
+            <span class="${statusDot}" style="font-size:18px" aria-hidden="true">●</span>
             <h3 style="margin:0;font-size:16px;font-weight:700;">${escapeHtml(n.name || 'Unknown')}</h3>
           </div>
           <div style="margin-bottom:12px;">
@@ -1502,7 +1653,9 @@
   function rebuildFeedList() {
     const feed = document.getElementById('liveFeed');
     if (!feed) return;
-    feed.querySelectorAll('.live-feed-item').forEach(el => el.remove());
+    const feedContent = feed.querySelector('.panel-content');
+    if (!feedContent) return;
+    feedContent.querySelectorAll('.live-feed-item').forEach(el => el.remove());
     feedDedup.clear();
 
     // Aggregate VCR buffer by hash, then create one feed item per unique hash
@@ -1550,6 +1703,10 @@
       const hopStr = longestHops.length ? `<span class="feed-hops">${longestHops.length}⇢</span>` : '';
       const obsBadge = group.count > 1 ? `<span class="badge badge-obs" style="font-size:10px;margin-left:4px">👁 ${group.count}</span>` : '';
 
+      var _ccPayload = (pkt.decoded || {}).payload || {};
+      var _ccChan1 = (typeName === 'GRP_TXT' || typeName === 'CHAN') ? (_ccPayload.channel || null) : null;
+      var dotHtml1 = _ccChan1 ? _feedColorDot(_ccChan1) : '';
+
       const item = document.createElement('div');
       item.className = 'live-feed-item';
       item.setAttribute('tabindex', '0');
@@ -1559,12 +1716,13 @@
       item.innerHTML = `
         <span class="feed-icon" style="color:${color}">${icon}</span>
         <span class="feed-type" style="color:${color}">${typeName}</span>
-        ${transportBadge(pkt.route_type)}${hopStr}${obsBadge}
+        ${dotHtml1}${transportBadge(pkt.route_type)}${hopStr}${obsBadge}
         <span class="feed-text">${escapeHtml(preview)}</span>
-        <span class="feed-time">${formatLiveTimestampHtml(group.latestTs || Date.now())}</span>
+        <span class="feed-time" data-ts="${group.latestTs || Date.now()}">${formatLiveTimestampHtml(group.latestTs || Date.now())}</span>
       `;
+      if (_ccChan1) item._ccChannel = _ccChan1; // channel color picker (#674)
       item.addEventListener('click', () => showFeedCard(item, pkt, color));
-      feed.appendChild(item);
+      feedContent.appendChild(item);
 
       // Register in dedup map so replay and live updates work
       if (group.hash) {
@@ -1898,11 +2056,66 @@
         }
       }
       firstPathDone = true;
-      animatePath(allPaths[ai].hopPositions, typeName, color, allPaths[ai].raw, onHop);
+      // For TRACE packets, split at hopsCompleted: solid for completed, dashed for remaining
+      var hopsCompleted = decoded.path && decoded.path.hopsCompleted;
+      if (typeName === 'TRACE' && hopsCompleted != null && hopsCompleted < allPaths[ai].hopPositions.length) {
+        var completedPositions = allPaths[ai].hopPositions.slice(0, hopsCompleted + 1);
+        var remainingPositions = allPaths[ai].hopPositions.slice(hopsCompleted);
+        if (completedPositions.length >= 2) {
+          animatePath(completedPositions, typeName, color, allPaths[ai].raw, onHop);
+        } else if (completedPositions.length === 1) {
+          pulseNode(completedPositions[0].key, completedPositions[0].pos, typeName);
+        }
+        if (remainingPositions.length >= 2) {
+          drawDashedPath(remainingPositions, color);
+        }
+      } else {
+        animatePath(allPaths[ai].hopPositions, typeName, color, allPaths[ai].raw, onHop);
+      }
+    }
+  }
+
+  // Draw a static dashed/ghosted line for unreached TRACE hops
+  function drawDashedPath(hopPositions, color) {
+    var GHOST_TIMEOUT_MS = 10000;
+    var ghostColor = getComputedStyle(document.documentElement).getPropertyValue('--trace-ghost-color').trim() || '#94a3b8';
+    if (!pathsLayer) return;
+    for (var i = 0; i < hopPositions.length - 1; i++) {
+      var from = hopPositions[i].pos;
+      var to = hopPositions[i + 1].pos;
+      var line = L.polyline([from, to], {
+        color: color, weight: 2, opacity: 0.25, dashArray: '6, 8'
+      }).addTo(pathsLayer);
+      // Pulse the unreached hop nodes as ghost markers
+      if (i > 0) {
+        var hp = hopPositions[i];
+        if (!nodeMarkers[hp.key]) {
+          var ghost = L.circleMarker(hp.pos, {
+            radius: 3, fillColor: ghostColor, fillOpacity: 0.2, color: color, weight: 1, opacity: 0.3
+          }).addTo(pathsLayer);
+          setTimeout((function(g) { return function() { if (pathsLayer.hasLayer(g)) pathsLayer.removeLayer(g); }; })(ghost), GHOST_TIMEOUT_MS);
+        }
+      }
+      // Remove dashed line after timeout
+      setTimeout((function(l) { return function() { if (pathsLayer.hasLayer(l)) pathsLayer.removeLayer(l); }; })(line), GHOST_TIMEOUT_MS);
+    }
+    // Ghost marker for the final unreached hop
+    var last = hopPositions[hopPositions.length - 1];
+    if (!nodeMarkers[last.key]) {
+      var ghostEnd = L.circleMarker(last.pos, {
+        radius: 4, fillColor: ghostColor, fillOpacity: 0.25, color: color, weight: 1, opacity: 0.35
+      }).addTo(pathsLayer);
+      setTimeout(function() { if (pathsLayer.hasLayer(ghostEnd)) pathsLayer.removeLayer(ghostEnd); }, GHOST_TIMEOUT_MS);
     }
   }
 
   function resolveHopPositions(hops, payload, resolvedPath) {
+    // Hoist sender GPS guard once — reject (0,0) as "no GPS"
+    const hasValidGps = payload.lat != null && payload.lon != null
+      && !(payload.lat === 0 && payload.lon === 0);
+    const senderLat = hasValidGps ? payload.lat : null;
+    const senderLon = hasValidGps ? payload.lon : null;
+
     // Prefer server-side resolved_path when available
     var resolvedMap;
     if (resolvedPath && resolvedPath.length === hops.length && window.HopResolver && HopResolver.ready()) {
@@ -1910,19 +2123,14 @@
       // Fill in any null entries from client-side fallback, preserving sender GPS context
       var nullHops = hops.filter(function(h, i) { return !resolvedPath[i] && !resolvedMap[h]; });
       if (nullHops.length) {
-        const originLat = payload.lat != null && !(payload.lat === 0 && payload.lon === 0) ? payload.lat : null;
-        const originLon = payload.lon != null && !(payload.lon === 0 && payload.lon === 0) ? payload.lon : null;
-        var fallback = HopResolver.resolve(nullHops, originLat, originLon, null, null, null);
+        var fallback = HopResolver.resolve(nullHops, senderLat, senderLon, null, null, null);
         for (var k in fallback) resolvedMap[k] = fallback[k];
       }
     } else {
       // Delegate to shared HopResolver (from hop-resolver.js) instead of reimplementing
-      const originLat = payload.lat != null && !(payload.lat === 0 && payload.lon === 0) ? payload.lat : null;
-      const originLon = payload.lon != null && !(payload.lon === 0 && payload.lon === 0) ? payload.lon : null;
-
       // Use HopResolver if available and initialized, otherwise fall back to simple lookup
       resolvedMap = (window.HopResolver && HopResolver.ready())
-        ? HopResolver.resolve(hops, originLat, originLon, null, null, null)
+        ? HopResolver.resolve(hops, senderLat, senderLon, null, null, null)
         : {};
     }
 
@@ -1941,7 +2149,7 @@
     });
 
     // Add sender position as anchor if available
-    if (payload.pubKey && originLat != null) {
+    if (payload.pubKey && senderLat != null) {
       const existing = raw.find(p => p.key === payload.pubKey);
       if (!existing) {
         raw.unshift({ key: payload.pubKey, pos: [payload.lat, payload.lon], name: payload.name || payload.pubKey.slice(0, 8), known: true });
@@ -2499,9 +2707,22 @@
   function _getChannelStyle(pkt) {
     if (!window.ChannelColors) return '';
     var d = pkt.decoded || {};
-    var h = d.header || {};
     var p = d.payload || {};
-    return window.ChannelColors.getRowStyle(h.payloadTypeName || '', p.channelName || null);
+    var typeName = p.type || (d.header || {}).payloadTypeName || '';
+    var ch = p.channel || null;
+    return window.ChannelColors.getRowStyle(typeName, ch);
+  }
+
+  /** Build a clickable 12×12 color dot for a channel feed item (#674). */
+  function _feedColorDot(channel) {
+    if (!channel || !window.ChannelColors) return '';
+    var c = window.ChannelColors.get(channel);
+    var bg = c || 'transparent';
+    var border = c ? c : 'var(--border-color, #555)';
+    var style = c
+      ? 'background:' + bg + ';border:1px solid ' + border
+      : 'background:transparent;border:1px dashed ' + border;
+    return '<span class="feed-color-dot" data-channel="' + escapeHtml(channel) + '" style="display:inline-block;width:12px;height:12px;border-radius:50%;' + style + ';cursor:pointer;vertical-align:middle;margin-left:4px;flex-shrink:0" title="Set color for ' + escapeHtml(channel) + '"></span>';
   }
 
   function addFeedItemDOM(icon, typeName, payload, hops, color, pkt, feed) {
@@ -2509,6 +2730,10 @@
     const preview = text ? ' ' + (text.length > 35 ? text.slice(0, 35) + '…' : text) : '';
     const hopStr = hops.length ? `<span class="feed-hops">${hops.length}⇢</span>` : '';
     const obsBadge = pkt.observation_count > 1 ? `<span class="badge badge-obs" style="font-size:10px;margin-left:4px">👁 ${pkt.observation_count}</span>` : '';
+    const anomalyIcon = (pkt.decoded && pkt.decoded.anomaly) ? '<span title="Anomaly detected" style="margin-left:4px">⚠️</span>' : '';
+    var _ccPayload2 = (pkt.decoded || {}).payload || {};
+    var _ccChan = (typeName === 'GRP_TXT' || typeName === 'CHAN') ? (_ccPayload2.channel || null) : null;
+    var dotHtml = _ccChan ? _feedColorDot(_ccChan) : '';
     const item = document.createElement('div');
     item.className = 'live-feed-item';
     item.setAttribute('tabindex', '0');
@@ -2520,10 +2745,11 @@
     item.innerHTML = `
       <span class="feed-icon" style="color:${color}">${icon}</span>
       <span class="feed-type" style="color:${color}">${typeName}</span>
-      ${transportBadge(pkt.route_type)}${hopStr}${obsBadge}
+      ${dotHtml}${transportBadge(pkt.route_type)}${hopStr}${obsBadge}${anomalyIcon}
       <span class="feed-text">${escapeHtml(preview)}</span>
-      <span class="feed-time">${formatLiveTimestampHtml(pkt._ts || Date.now())}</span>
+      <span class="feed-time" data-ts="${pkt._ts || Date.now()}">${formatLiveTimestampHtml(pkt._ts || Date.now())}</span>
     `;
+    if (_ccChan) item._ccChannel = _ccChan; // channel color picker (#674)
     item.addEventListener('click', () => showFeedCard(item, pkt, color));
     feed.appendChild(item);
   }
@@ -2536,7 +2762,8 @@
   const DEDUP_WINDOW = 30000;
 
   function addFeedItem(icon, typeName, payload, hops, color, pkt) {
-    const feed = document.getElementById('liveFeed');
+    const feedPanel = document.getElementById('liveFeed');
+    const feed = feedPanel ? feedPanel.querySelector('.panel-content') : null;
     if (!feed) return;
     if (showOnlyFavorites && !packetInvolvesFavorite(pkt)) return;
 
@@ -2566,6 +2793,13 @@
         requestAnimationFrame(() => requestAnimationFrame(() => entry.element.classList.remove('live-feed-enter')));
         // Re-add to DOM top (works even if it was trimmed out)
         feed.prepend(entry.element);
+        // Update timestamp to latest observation (#701)
+        var _dedupTimeSpan = entry.element.querySelector('.feed-time');
+        if (_dedupTimeSpan) {
+          var _dedupNow = pkt._ts || Date.now();
+          _dedupTimeSpan.setAttribute('data-ts', _dedupNow);
+          _dedupTimeSpan.innerHTML = formatLiveTimestampHtml(_dedupNow);
+        }
         entry.pkt.observation_count = entry.count;
         return;
       }
@@ -2578,6 +2812,9 @@
     const preview = text ? ' ' + (text.length > 35 ? text.slice(0, 35) + '…' : text) : '';
     const hopStr = hops.length ? `<span class="feed-hops">${hops.length}⇢</span>` : '';
     const obsBadge = incomingObs > 1 ? `<span class="badge badge-obs" style="font-size:10px;margin-left:4px">👁 ${incomingObs}</span>` : '';
+    var _ccPayload3 = (pkt.decoded || {}).payload || {};
+    var _ccChan3 = (typeName === 'GRP_TXT' || typeName === 'CHAN') ? (_ccPayload3.channel || null) : null;
+    var dotHtml3 = _ccChan3 ? _feedColorDot(_ccChan3) : '';
 
     const item = document.createElement('div');
     item.className = 'live-feed-item live-feed-enter';
@@ -2591,10 +2828,11 @@
     item.innerHTML = `
       <span class="feed-icon" style="color:${color}">${icon}</span>
       <span class="feed-type" style="color:${color}">${typeName}</span>
-      ${transportBadge(pkt.route_type)}${hopStr}${obsBadge}
+      ${dotHtml3}${transportBadge(pkt.route_type)}${hopStr}${obsBadge}
       <span class="feed-text">${escapeHtml(preview)}</span>
-      <span class="feed-time">${formatLiveTimestampHtml(pkt._ts || Date.now())}</span>
+      <span class="feed-time" data-ts="${pkt._ts || Date.now()}">${formatLiveTimestampHtml(pkt._ts || Date.now())}</span>
     `;
+    if (_ccChan3) item._ccChannel = _ccChan3; // channel color picker (#674)
     item.addEventListener('click', () => showFeedCard(item, pkt, color));
     feed.prepend(item);
     requestAnimationFrame(() => requestAnimationFrame(() => item.classList.remove('live-feed-enter')));
@@ -2669,6 +2907,7 @@
     if (_lcdClockInterval) { clearInterval(_lcdClockInterval); _lcdClockInterval = null; }
     if (_rateCounterInterval) { clearInterval(_rateCounterInterval); _rateCounterInterval = null; }
     if (_pruneInterval) { clearInterval(_pruneInterval); _pruneInterval = null; }
+    if (_feedTimestampInterval) { clearInterval(_feedTimestampInterval); _feedTimestampInterval = null; }
     if (_affinityInterval) { clearInterval(_affinityInterval); _affinityInterval = null; }
     if (ws) { ws.onclose = null; ws.close(); ws = null; }
     if (map) { map.remove(); map = null; }
@@ -2714,7 +2953,10 @@
         if (activeNodeDetailKey) showNodeDetail(activeNodeDetailKey);
       };
       window.addEventListener('theme-refresh', _themeRefreshHandler);
-      return init(app, routeParam);
+      var result = init(app, routeParam);
+      // Install channel color picker (M2, #271)
+      if (window.ChannelColorPicker) window.ChannelColorPicker.installLiveFeed();
+      return result;
     },
     destroy: function() {
       if (_themeRefreshHandler) { window.removeEventListener('theme-refresh', _themeRefreshHandler); _themeRefreshHandler = null; }

public/map.js

@@ -25,7 +25,7 @@
 
   // Roles loaded from shared roles.js (ROLE_STYLE, ROLE_LABELS, ROLE_COLORS globals)
 
-  function makeMarkerIcon(role, isStale) {
+  function makeMarkerIcon(role, isStale, isAlsoObserver) {
     const s = ROLE_STYLE[role] || ROLE_STYLE.companion;
     const size = s.radius * 2 + 4;
     const c = size / 2;
@@ -56,7 +56,22 @@
       default: // circle
         path = `<circle cx="${c}" cy="${c}" r="${c-2}" fill="${s.color}" stroke="#fff" stroke-width="2"/>`;
     }
-    const svg = `<svg width="${size}" height="${size}" viewBox="0 0 ${size} ${size}" xmlns="http://www.w3.org/2000/svg">${path}</svg>`;
+    // If this node is also an observer, add a small star overlay
+    let obsOverlay = '';
+    if (isAlsoObserver) {
+      const starSize = 8;
+      const sx = size - starSize, sy = 0;
+      const scx = starSize / 2, scy = starSize / 2, so = starSize / 2 - 0.5, si = so * 0.4;
+      let starPts = '';
+      for (let i = 0; i < 5; i++) {
+        const aO = (i * 72 - 90) * Math.PI / 180;
+        const aI = ((i * 72) + 36 - 90) * Math.PI / 180;
+        starPts += `${scx + so * Math.cos(aO)},${scy + so * Math.sin(aO)} `;
+        starPts += `${scx + si * Math.cos(aI)},${scy + si * Math.sin(aI)} `;
+      }
+      obsOverlay = `<g transform="translate(${sx},${sy})"><polygon points="${starPts.trim()}" fill="${ROLE_COLORS.observer || '#f1c40f'}" stroke="#fff" stroke-width="0.8"/></g>`;
+    }
+    const svg = `<svg width="${size}" height="${size}" viewBox="0 0 ${size} ${size}" xmlns="http://www.w3.org/2000/svg">${path}${obsOverlay}</svg>`;
     return L.divIcon({
       html: svg,
       className: 'meshcore-marker' + (isStale ? ' marker-stale' : ''),
@@ -66,14 +81,16 @@
     });
   }
 
-  function makeRepeaterLabelIcon(node, isStale) {
+  function makeRepeaterLabelIcon(node, isStale, isAlsoObserver) {
     var s = ROLE_STYLE['repeater'] || ROLE_STYLE.companion;
     var hs = node.hash_size || 1;
     // Show the short mesh hash ID (first N bytes of pubkey, uppercased)
     var shortHash = node.public_key ? node.public_key.slice(0, hs * 2).toUpperCase() : '??';
     var bgColor = s.color;
+    // If this repeater is also an observer, show a star indicator inside the label
+    var obsIndicator = isAlsoObserver ? ' <span style="color:' + (ROLE_COLORS.observer || '#f1c40f') + ';font-size:13px;line-height:1;" title="Also an observer">★</span>' : '';
     var html = '<div style="background:' + bgColor + ';color:#fff;font-weight:bold;font-size:11px;padding:2px 5px;border-radius:3px;border:2px solid #fff;box-shadow:0 1px 3px rgba(0,0,0,0.4);text-align:center;line-height:1.2;white-space:nowrap;">' +
-      shortHash + '</div>';
+      shortHash + obsIndicator + '</div>';
     return L.divIcon({
       html: html,
       className: 'meshcore-marker meshcore-label-marker' + (isStale ? ' marker-stale' : ''),
@@ -547,7 +564,8 @@
     const el = document.getElementById('mcRoleChecks');
     if (!el) return;
     el.innerHTML = '';
-    const obsCount = observers.filter(o => o.lat && o.lon).length;
+    const nodePubkeys = new Set(nodes.map(n => (n.public_key || '').toLowerCase()));
+    const obsCount = observers.filter(o => o.lat && o.lon && !(o.id && nodePubkeys.has(o.id.toLowerCase()))).length;
     const roles = ['repeater', 'companion', 'room', 'sensor', 'observer'];
     const shapeMap = { repeater: '◆', companion: '●', room: '■', sensor: '▲', observer: '★' };
 
@@ -638,6 +656,7 @@
   var _renderingMarkers = false;
   var _lastDeconflictZoom = null;
   var _currentMarkerData = []; // stored marker data for zoom-only repositioning
+  var _observerByPubkey = new Map(); // observer id (pubkey) → observer object, rebuilt on each render
   var _zoomResizeTimer = null;
 
   function deconflictLabels(markers, mapRef) {
@@ -780,19 +799,31 @@
 
     const allMarkers = [];
 
+    // Build a set of observer public keys for quick lookup
+    _observerByPubkey = new Map();
+    for (const obs of observers) {
+      if (obs.id) _observerByPubkey.set(obs.id.toLowerCase(), obs);
+    }
+
     for (const node of filtered) {
       const lastSeenTime = node.last_heard || node.last_seen;
       const isStale = getNodeStatus(node.role || 'companion', lastSeenTime ? new Date(lastSeenTime).getTime() : 0) === 'stale';
+      const pk = (node.public_key || '').toLowerCase();
+      const isAlsoObserver = _observerByPubkey.has(pk);
       const useLabel = node.role === 'repeater' && filters.hashLabels;
-      const icon = useLabel ? makeRepeaterLabelIcon(node, isStale) : makeMarkerIcon(node.role || 'companion', isStale);
+      const icon = useLabel ? makeRepeaterLabelIcon(node, isStale, isAlsoObserver) : makeMarkerIcon(node.role || 'companion', isStale, isAlsoObserver);
       const latLng = L.latLng(node.lat, node.lon);
-      allMarkers.push({ latLng, node, icon, isLabel: useLabel, popupFn: function() { return buildPopup(node); }, alt: (node.name || 'Unknown') + ' (' + (node.role || 'node') + ')' });
+      allMarkers.push({ latLng, node, icon, isLabel: useLabel, popupFn: function() { return buildPopup(node); }, alt: (node.name || 'Unknown') + ' (' + (node.role || 'node') + (isAlsoObserver ? ' + observer' : '') + ')' });
     }
 
-    // Add observer markers
+    // Add observer markers (skip observers already represented as a node marker)
+    // Build set of node pubkeys that are displayed on the map
+    const displayedNodePubkeys = new Set(filtered.map(n => (n.public_key || '').toLowerCase()));
     if (filters.observer) {
       for (const obs of observers) {
         if (!obs.lat || !obs.lon) continue;
+        // Skip observers whose pubkey matches a displayed node — they're shown as combined markers
+        if (obs.id && displayedNodePubkeys.has(obs.id.toLowerCase())) continue;
         const icon = makeMarkerIcon('observer');
         const latLng = L.latLng(obs.lat, obs.lon);
         allMarkers.push({ latLng, node: obs, icon, isLabel: false, popupFn: function() { return buildObserverPopup(obs); }, alt: (obs.name || obs.id || 'Unknown') + ' (observer)' });
@@ -909,6 +940,9 @@
     const loc = (node.lat && node.lon) ? `${node.lat.toFixed(5)}, ${node.lon.toFixed(5)}` : '—';
     const lastAdvert = node.last_seen ? timeAgo(node.last_seen) : '—';
     const roleBadge = `<span style="display:inline-block;padding:2px 8px;border-radius:12px;font-size:11px;font-weight:600;background:${ROLE_COLORS[node.role] || '#4b5563'};color:#fff;">${(node.role || 'unknown').toUpperCase()}</span>`;
+    // Check if this node is also an observer (combined repeater+observer)
+    const matchingObs = node.public_key ? _observerByPubkey.get(node.public_key.toLowerCase()) : null;
+    const obsBadge = matchingObs ? ` <span style="display:inline-block;padding:2px 8px;border-radius:12px;font-size:11px;font-weight:600;background:${ROLE_COLORS.observer || '#f1c40f'};color:#fff;">OBSERVER</span>` : '';
     const hs = node.hash_size || 1;
     const hashPrefix = node.public_key ? node.public_key.slice(0, hs * 2).toUpperCase() : '—';
     const hashPrefixRow = `<dt style="color:var(--text-muted);float:left;clear:left;width:80px;padding:2px 0;">Hash Prefix</dt>
@@ -917,7 +951,7 @@
     return `
       <div class="map-popup" style="font-family:var(--font);min-width:180px;">
         <h3 style="font-weight:700;font-size:14px;margin:0 0 4px;">${safeEsc(node.name || 'Unknown')}</h3>
-        ${roleBadge}
+        ${roleBadge}${obsBadge}
         <dl style="margin-top:8px;font-size:12px;">
           ${hashPrefixRow}
           <dt style="color:var(--text-muted);float:left;clear:left;width:80px;padding:2px 0;">Key</dt>

public/nodes.js

@@ -20,26 +20,24 @@
   let activeTab = 'all';
   let search = '';
   // Sort state: column + direction, persisted to localStorage
-  let sortState = (function () {
-    try {
-      const saved = JSON.parse(localStorage.getItem('meshcore-nodes-sort'));
-      if (saved && saved.column && saved.direction) return saved;
-    } catch {}
-    return { column: 'last_seen', direction: 'desc' };
-  })();
+  // Managed by TableSort utility (public/table-sort.js) when DOM is available,
+  // falls back to simple object for unit testing
+  var _nodesTableSortCtrl = null;
+  // TODO(M5): remove fallback when tests use DOM sandbox
+  var _fallbackSortState = null; // used when TableSort controller not initialized (tests)
 
-  function toggleSort(column) {
-    if (sortState.column === column) {
-      sortState.direction = sortState.direction === 'asc' ? 'desc' : 'asc';
-    } else {
-      // Default direction per column type
-      const descDefault = ['last_seen', 'advert_count'];
-      sortState = { column, direction: descDefault.includes(column) ? 'desc' : 'asc' };
-    }
-    localStorage.setItem('meshcore-nodes-sort', JSON.stringify(sortState));
+  function _getSortState() {
+    if (_nodesTableSortCtrl) return _nodesTableSortCtrl.getState();
+    if (_fallbackSortState) return _fallbackSortState;
+    try {
+      var saved = JSON.parse(localStorage.getItem('meshcore-nodes-sort'));
+      if (saved && saved.column && saved.direction) return saved;
+    } catch (e) { /* ignore */ }
+    return { column: 'last_seen', direction: 'desc' };
   }
 
   function sortNodes(arr) {
+    var sortState = _getSortState();
     const col = sortState.column;
     const dir = sortState.direction === 'asc' ? 1 : -1;
     return arr.sort(function (a, b) {
@@ -66,11 +64,6 @@
       return 0;
     });
   }
-
-  function sortArrow(col) {
-    if (sortState.column !== col) return '';
-    return '<span class="sort-arrow">' + (sortState.direction === 'asc' ? '▲' : '▼') + '</span>';
-  }
   let lastHeard = localStorage.getItem('meshcore-nodes-last-heard') || '';
   let statusFilter = localStorage.getItem('meshcore-nodes-status-filter') || 'all';
   let wsHandler = null;
@@ -85,6 +78,18 @@
     { key: 'sensor', label: 'Sensors' },
   ];
 
+  function buildNodesQuery(tab, searchStr) {
+    var parts = [];
+    if (tab && tab !== 'all') parts.push('tab=' + encodeURIComponent(tab));
+    if (searchStr) parts.push('search=' + encodeURIComponent(searchStr));
+    return parts.length ? '?' + parts.join('&') : '';
+  }
+  window.buildNodesQuery = buildNodesQuery;
+
+  function updateNodesUrl() {
+    history.replaceState(null, '', '#/nodes' + buildNodesQuery(activeTab, search));
+  }
+
   function renderNodeTimestampHtml(isoString) {
     if (typeof formatTimestampWithTooltip !== 'function' || typeof getTimestampMode !== 'function') {
       return escapeHtml(typeof timeAgo === 'function' ? timeAgo(isoString) : '—');
@@ -189,7 +194,7 @@
 
   function renderNeighborRows(neighbors, limit) {
     var sorted = neighbors.slice().sort(function(a, b) {
-      return (b.score || b.affinity || 0) - (a.score || a.affinity || 0);
+      return (b.count || 0) - (a.count || 0);
     });
     var items = limit ? sorted.slice(0, limit) : sorted;
     return items.map(function(nb) {
@@ -204,15 +209,21 @@
         : '<span class="text-muted">—</span>';
       var scoreTitle = 'Observations: ' + nb.count;
       if (nb.avg_snr != null) scoreTitle += ' · Avg SNR: ' + Number(nb.avg_snr).toFixed(1) + ' dB';
+      var distanceCell = nb.distance_km != null
+        ? formatDistance(Number(nb.distance_km))
+        : '<span class="text-muted">—</span>';
       var showOnMap = nb.pubkey
         ? ' <button class="btn-link neighbor-show-map" data-pubkey="' + escapeHtml(nb.pubkey) + '" style="font-size:11px;padding:1px 6px;white-space:nowrap">📍 Map</button>'
         : '';
+      var lastSeenVal = nb.last_seen ? new Date(nb.last_seen).getTime() : 0;
+      var distanceVal = nb.distance_km != null ? Number(nb.distance_km) : '';
       return '<tr>' +
-        '<td style="font-weight:600">' + nameHtml + '</td>' +
-        '<td>' + roleBadge + '</td>' +
-        '<td title="' + escapeHtml(scoreTitle) + '">' + Number(nb.score).toFixed(2) + '</td>' +
-        '<td>' + nb.count + '</td>' +
-        '<td>' + renderNodeTimestampHtml(nb.last_seen) + '</td>' +
+        '<td data-value="' + escapeHtml(name.toLowerCase()) + '" style="font-weight:600">' + nameHtml + '</td>' +
+        '<td data-value="' + escapeHtml(role.toLowerCase()) + '">' + roleBadge + '</td>' +
+        '<td data-value="' + Number(nb.score || 0) + '" title="' + escapeHtml(scoreTitle) + '">' + Number(nb.score).toFixed(2) + '</td>' +
+        '<td data-value="' + (nb.count || 0) + '">' + nb.count + '</td>' +
+        '<td data-value="' + lastSeenVal + '">' + renderNodeTimestampHtml(nb.last_seen) + '</td>' +
+        '<td data-value="' + distanceVal + '">' + distanceCell + '</td>' +
         '<td><span title="' + conf.label + '">' + conf.icon + '</span></td>' +
         '<td style="text-align:right">' + showOnMap + '</td>' +
         '</tr>';
@@ -220,8 +231,16 @@
   }
 
   function renderNeighborTable(neighbors, limit) {
-    return '<table class="data-table" style="font-size:12px">' +
-      '<thead><tr><th>Neighbor</th><th>Role</th><th>Score</th><th>Obs</th><th>Last Seen</th><th>Conf</th><th></th></tr></thead>' +
+    return '<table class="data-table neighbor-sort-table" style="font-size:12px">' +
+      '<thead><tr>' +
+      '<th scope="col" data-sort-key="name">Neighbor</th>' +
+      '<th scope="col" data-sort-key="role">Role</th>' +
+      '<th scope="col" data-sort-key="score" data-type="numeric" data-sort-default="desc">Score</th>' +
+      '<th scope="col" data-sort-key="count" data-type="numeric" data-sort-default="desc">Obs</th>' +
+      '<th scope="col" data-sort-key="last_seen" data-type="numeric" data-sort-default="desc">Last Seen</th>' +
+      '<th scope="col" data-sort-key="distance" data-type="numeric">Distance</th>' +
+      '<th scope="col">Conf</th><th scope="col"></th>' +
+      '</tr></thead>' +
       '<tbody>' + renderNeighborRows(neighbors, limit) + '</tbody></table>';
   }
 
@@ -272,6 +291,15 @@
     }
     el.innerHTML = html;
 
+    // Initialize TableSort on neighbor table
+    var neighborTable = el.querySelector('.neighbor-sort-table');
+    if (neighborTable && window.TableSort) {
+      TableSort.init(neighborTable, {
+        defaultColumn: 'count',
+        defaultDirection: 'desc'
+      });
+    }
+
     // Wire up "Show on Map" buttons via event delegation
     el.addEventListener('click', function(e) {
       var btn = e.target.closest('.neighbor-show-map');
@@ -287,32 +315,46 @@
 
   let regionChangeHandler = null;
 
+  // Show full-screen node detail view (works on any screen size)
+  function showFullScreenNode(pubkey) {
+    var app = document.getElementById('app');
+    app.innerHTML = '<div class="node-fullscreen">' +
+      '<div class="node-full-header">' +
+        '<button class="detail-back-btn node-back-btn" id="nodeBackBtn" aria-label="Back to nodes">←</button>' +
+        '<span class="node-full-title">Loading…</span>' +
+      '</div>' +
+      '<div class="node-full-body" id="nodeFullBody">' +
+        '<div class="text-center text-muted" style="padding:40px">Loading…</div>' +
+      '</div>' +
+    '</div>';
+    document.getElementById('nodeBackBtn').addEventListener('click', function() { location.hash = '#/nodes'; });
+    loadFullNode(pubkey);
+    document.addEventListener('keydown', function nodesEsc(e) {
+      if (e.key === 'Escape') {
+        document.removeEventListener('keydown', nodesEsc);
+        location.hash = '#/nodes';
+      }
+    });
+  }
+
   function init(app, routeParam) {
     directNode = routeParam || null;
 
-    if (directNode) {
-      // Full-screen single node view
-      app.innerHTML = `<div class="node-fullscreen">
-        <div class="node-full-header">
-          <button class="detail-back-btn node-back-btn" id="nodeBackBtn" aria-label="Back to nodes">←</button>
-          <span class="node-full-title">Loading…</span>
-        </div>
-        <div class="node-full-body" id="nodeFullBody">
-          <div class="text-center text-muted" style="padding:40px">Loading…</div>
-        </div>
-      </div>`;
-      document.getElementById('nodeBackBtn').addEventListener('click', () => { location.hash = '#/nodes'; });
-      loadFullNode(directNode);
-      // Escape to go back to nodes list
-      document.addEventListener('keydown', function nodesEsc(e) {
-        if (e.key === 'Escape') {
-          document.removeEventListener('keydown', nodesEsc);
-          location.hash = '#/nodes';
-        }
-      });
+    if (directNode && window.innerWidth <= 640) {
+      // Full-screen single node view (mobile)
+      showFullScreenNode(directNode);
       return;
     }
 
+    // Reset list-view state to defaults, then override from URL params
+    activeTab = 'all';
+    search = '';
+    const _listUrlParams = getHashParams();
+    const _urlTab = _listUrlParams.get('tab');
+    const _urlSearch = _listUrlParams.get('search');
+    if (_urlTab && TABS.some(function(t) { return t.key === _urlTab; })) activeTab = _urlTab;
+    if (_urlSearch) search = _urlSearch;
+
     app.innerHTML = `<div class="nodes-page">
       <div class="nodes-topbar">
         <input type="text" class="nodes-search" id="nodeSearch" placeholder="Search nodes by name…" aria-label="Search nodes by name">
@@ -320,20 +362,27 @@
       </div>
       <div id="nodesRegionFilter" class="region-filter-container"></div>
       <div class="split-layout">
-        <div class="panel-left" id="nodesLeft"></div>
+        <div class="panel-left" id="nodesLeft" aria-live="polite" aria-relevant="additions removals"></div>
         <div class="panel-right empty" id="nodesRight"><span>Select a node to view details</span></div>
       </div>
     </div>`;
 
     RegionFilter.init(document.getElementById('nodesRegionFilter'));
-    regionChangeHandler = RegionFilter.onChange(function () { _allNodes = null; loadNodes(); });
+    regionChangeHandler = RegionFilter.onChange(function () { _allNodes = null; _fleetSkew = null; loadNodes(); });
+
+    if (search) {
+      var _si = document.getElementById('nodeSearch');
+      if (_si) _si.value = search;
+    }
 
     document.getElementById('nodeSearch').addEventListener('input', debounce(e => {
       search = e.target.value;
+      updateNodesUrl();
       loadNodes();
     }, 250));
 
     loadNodes();
+    if (directNode) selectNode(directNode);
     // Auto-refresh when ADVERT packets arrive via WebSocket (fixes #131)
     wsHandler = debouncedOnWS(function (msgs) {
       const advertMsgs = msgs.filter(isAdvertMessage);
@@ -366,6 +415,7 @@
 
       if (needReload) {
         _allNodes = null;
+        _fleetSkew = null;
         invalidateApiCache('/nodes');
       }
       loadNodes(true);
@@ -450,18 +500,26 @@
           <tr><td>Hash Prefix</td><td>${n.hash_size ? '<code style="font-family:var(--mono);font-weight:700">' + n.public_key.slice(0, n.hash_size * 2).toUpperCase() + '</code> (' + n.hash_size + '-byte)' : 'Unknown'}${n.hash_size_inconsistent ? ' <span style="color:var(--status-yellow);cursor:help" title="Seen: ' + (Array.isArray(n.hash_sizes_seen) ? n.hash_sizes_seen : []).join(', ') + '-byte">⚠️ varies</span>' : ''}</td></tr>
         </table>
 
+        <div class="node-full-card skew-detail-section" id="node-clock-skew" style="display:none"></div>
+
         ${observers.length ? `<div class="node-full-card" id="node-observers">
           ${(() => { const regions = [...new Set(observers.map(o => o.iata).filter(Boolean))]; return regions.length ? `<div style="margin-bottom:8px"><strong>Regions:</strong> ${regions.map(r => '<span class="badge" style="margin:0 2px">' + escapeHtml(r) + '</span>').join(' ')}</div>` : ''; })()}
           <h4>Heard By (${observers.length} observer${observers.length > 1 ? 's' : ''})</h4>
-          <table class="data-table" style="font-size:12px">
-            <thead><tr><th scope="col">Observer</th><th scope="col">Region</th><th scope="col">Packets</th><th scope="col">Avg SNR</th><th scope="col">Avg RSSI</th></tr></thead>
+          <table class="data-table observer-sort-table" style="font-size:12px">
+            <thead><tr>
+              <th scope="col" data-sort-key="observer">Observer</th>
+              <th scope="col" data-sort-key="region">Region</th>
+              <th scope="col" data-sort-key="packets" data-type="numeric" data-sort-default="desc">Packets</th>
+              <th scope="col" data-sort-key="snr" data-type="numeric" data-sort-default="desc">Avg SNR</th>
+              <th scope="col" data-sort-key="rssi" data-type="numeric" data-sort-default="desc">Avg RSSI</th>
+            </tr></thead>
             <tbody>
               ${observers.map(o => `<tr>
-                <td style="font-weight:600">${escapeHtml(o.observer_name || o.observer_id)}</td>
-                <td>${o.iata ? escapeHtml(o.iata) : '—'}</td>
-                <td>${o.packetCount}</td>
-                <td>${o.avgSnr != null ? Number(o.avgSnr).toFixed(1) + ' dB' : '—'}</td>
-                <td>${o.avgRssi != null ? Number(o.avgRssi).toFixed(0) + ' dBm' : '—'}</td>
+                <td data-value="${escapeHtml((o.observer_name || o.observer_id || '').toLowerCase())}" style="font-weight:600">${escapeHtml(o.observer_name || o.observer_id)}</td>
+                <td data-value="${escapeHtml((o.iata || '').toLowerCase())}">${o.iata ? escapeHtml(o.iata) : '—'}</td>
+                <td data-value="${o.packetCount || 0}">${o.packetCount}</td>
+                <td data-value="${o.avgSnr != null ? Number(o.avgSnr) : ''}">${o.avgSnr != null ? Number(o.avgSnr).toFixed(1) + ' dB' : '—'}</td>
+                <td data-value="${o.avgRssi != null ? Number(o.avgRssi) : ''}">${o.avgRssi != null ? Number(o.avgRssi).toFixed(0) + ' dBm' : '—'}</td>
               </tr>`).join('')}
             </tbody>
           </table>
@@ -499,10 +557,12 @@
               let hashSizeBadge = '';
               if (n.hash_size_inconsistent && p.payload_type === 4 && p.raw_hex) {
                 const pb = parseInt(p.raw_hex.slice(2, 4), 16);
-                const hs = ((pb >> 6) & 0x3) + 1;
-                const hsColor = hs >= 3 ? '#16a34a' : hs === 2 ? '#86efac' : '#f97316';
-                const hsFg = hs === 2 ? '#064e3b' : '#fff';
-                hashSizeBadge = ` <span class="badge" style="background:${hsColor};color:${hsFg};font-size:9px;font-family:var(--mono)">${hs}B</span>`;
+                if ((pb & 0x3F) !== 0) {
+                  const hs = ((pb >> 6) & 0x3) + 1;
+                  const hsColor = hs >= 3 ? '#16a34a' : hs === 2 ? '#86efac' : '#f97316';
+                  const hsFg = hs === 2 ? '#064e3b' : '#fff';
+                  hashSizeBadge = ` <span class="badge" style="background:${hsColor};color:${hsFg};font-size:9px;font-family:var(--mono)">${hs}B</span>`;
+                }
               }
               return `<div class="node-activity-item">
                 <span class="node-activity-time">${renderNodeTimestampHtml(p.timestamp)}</span>
@@ -559,11 +619,49 @@
         } catch {}
       }
 
+      // Initialize TableSort on observer table (full detail page)
+      var observerTable = document.querySelector('#node-observers .observer-sort-table');
+      if (observerTable && window.TableSort) {
+        TableSort.init(observerTable, {
+          defaultColumn: 'packets',
+          defaultDirection: 'desc'
+        });
+      }
+
       // Fetch neighbors for this node (full-screen view)
       fetchAndRenderNeighbors(n.public_key, 'fullNeighborsContent', {
         headerSelector: '#fullNeighborsHeader'
       });
 
+      // #690 — Clock Skew detail section
+      (async function loadClockSkew() {
+        var container = document.getElementById('node-clock-skew');
+        if (!container) return;
+        try {
+          var cs = await api('/nodes/' + encodeURIComponent(n.public_key) + '/clock-skew', { ttl: 30000 });
+          if (!cs || !cs.severity) return;
+          container.style.display = '';
+          var severityColor = SKEW_SEVERITY_COLORS[cs.severity] || 'var(--text-muted)';
+          var severityLabel = SKEW_SEVERITY_LABELS[cs.severity] || cs.severity;
+          var driftHtml = cs.driftPerDaySec ? '<div style="font-size:12px;color:var(--text-muted);margin-top:2px">Drift: ' + formatDrift(cs.driftPerDaySec) + '</div>' : '';
+          var sparkHtml = renderSkewSparkline(cs.samples, 200, 32);
+          var skewDisplay = cs.severity === 'no_clock'
+            ? '<span style="font-size:18px;font-weight:700;color:var(--text-muted)">No Clock</span>'
+            : '<span style="font-size:18px;font-weight:700;font-family:var(--mono)">' + formatSkew(cs.medianSkewSec) + '</span>';
+          container.innerHTML =
+            '<h4 style="margin:0 0 6px">⏰ Clock Skew</h4>' +
+            '<div style="display:flex;align-items:center;gap:12px;flex-wrap:wrap">' +
+              skewDisplay +
+              renderSkewBadge(cs.severity, cs.medianSkewSec) +
+              (cs.calibrated ? ' <span style="font-size:10px;color:var(--text-muted)" title="Observer-calibrated">✓ calibrated</span>' : '') +
+            '</div>' +
+            driftHtml +
+            (sparkHtml ? '<div class="skew-sparkline-wrap" style="margin-top:8px">' + sparkHtml + '<div style="font-size:10px;color:var(--text-muted)">Skew over time (' + (cs.samples || []).length + ' samples)</div></div>' : '');
+        } catch (e) {
+          // Non-fatal — section stays hidden
+        }
+      })();
+
       // Affinity debug panel — show if debugAffinity is enabled
       (function loadAffinityDebug() {
         var show = (window.CLIENT_CONFIG && window.CLIENT_CONFIG.debugAffinity) || localStorage.getItem('meshcore-affinity-debug') === 'true';
@@ -717,6 +815,22 @@
   let _themeRefreshHandler = null;
 
   let _allNodes = null; // cached full node list
+  let _fleetSkew = null; // cached clock skew map: pubkey → {severity, medianSkewSec, ...}
+
+  /** Fetch fleet clock skew once, return map keyed by pubkey */
+  async function getFleetSkew() {
+    if (_fleetSkew) return _fleetSkew;
+    try {
+      const data = await api('/nodes/clock-skew', { ttl: 30000 });
+      _fleetSkew = {};
+      (Array.isArray(data) ? data : []).forEach(function(cs) {
+        if (cs && cs.pubkey) _fleetSkew[cs.pubkey] = cs;
+      });
+    } catch (e) {
+      _fleetSkew = {};
+    }
+    return _fleetSkew;
+  }
 
   // Build a map of lowercased name → count of distinct pubkeys sharing that name
   function buildDupNameMap(allNodes) {
@@ -746,7 +860,10 @@
         const params = new URLSearchParams({ limit: '5000' });
         const rp = RegionFilter.getRegionParam();
         if (rp) params.set('region', rp);
-        const data = await api('/nodes?' + params, { ttl: CLIENT_TTL.nodeList });
+        const [data] = await Promise.all([
+          api('/nodes?' + params, { ttl: CLIENT_TTL.nodeList }),
+          getFleetSkew() // pre-fetch clock skew in parallel
+        ]);
         _allNodes = data.nodes || [];
         counts = data.counts || {};
       }
@@ -855,11 +972,11 @@
       </div>
       <table class="data-table" id="nodesTable">
         <thead><tr>
-          <th scope="col" class="sortable${sortState.column==='name'?' sort-active':''}" data-sort="name">Name${sortArrow('name')}</th>
-          <th scope="col" class="col-pubkey sortable${sortState.column==='public_key'?' sort-active':''}" data-sort="public_key">Public Key${sortArrow('public_key')}</th>
-          <th scope="col" class="sortable${sortState.column==='role'?' sort-active':''}" data-sort="role">Role${sortArrow('role')}</th>
-          <th scope="col" class="sortable${sortState.column==='last_seen'?' sort-active':''}" data-sort="last_seen">Last Seen${sortArrow('last_seen')}</th>
-          <th scope="col" class="sortable${sortState.column==='advert_count'?' sort-active':''}" data-sort="advert_count">Adverts${sortArrow('advert_count')}</th>
+          <th scope="col" data-sort-key="name">Name</th>
+          <th scope="col" class="col-pubkey" data-sort-key="public_key">Public Key</th>
+          <th scope="col" data-sort-key="role">Role</th>
+          <th scope="col" data-sort-key="last_seen" data-sort-default="desc">Last Seen</th>
+          <th scope="col" data-sort-key="advert_count" data-sort-default="desc">Adverts</th>
         </tr></thead>
         <tbody id="nodesBody"></tbody>
       </table>`;
@@ -868,7 +985,7 @@
     const nodeTabs = document.getElementById('nodeTabs');
     initTabBar(nodeTabs);
     el.querySelectorAll('.node-tab').forEach(btn => {
-      btn.addEventListener('click', () => { activeTab = btn.dataset.tab; loadNodes(); });
+      btn.addEventListener('click', () => { activeTab = btn.dataset.tab; updateNodesUrl(); loadNodes(); });
     });
 
     // Filter changes
@@ -884,10 +1001,18 @@
       });
     });
 
-    // Sortable column headers
-    el.querySelectorAll('th.sortable').forEach(th => {
-      th.addEventListener('click', () => { toggleSort(th.dataset.sort); renderLeft(); });
-    });
+    // Initialize TableSort on nodes table (handles header clicks, indicators, persistence)
+    // We use onSort callback to re-render rows (sorting is done at JS-array level in renderRows
+    // because of claimed/favorites pinning logic that TableSort can't handle)
+    var nodesTableEl = document.getElementById('nodesTable');
+    if (nodesTableEl && window.TableSort) {
+      _nodesTableSortCtrl = TableSort.init(nodesTableEl, {
+        defaultColumn: 'last_seen',
+        defaultDirection: 'desc',
+        storageKey: 'meshcore-nodes-sort',
+        onSort: function () { renderRows(); }
+      });
+    }
 
     // Delegated click/keyboard handler for table rows
     const tbody = document.getElementById('nodesBody');
@@ -911,11 +1036,43 @@
           panel.classList.add('empty');
           panel.innerHTML = '<span>Select a node to view details</span>';
           selectedKey = null;
+          history.replaceState(null, '', '#/nodes');
           renderRows();
         }
       }
     });
 
+    // #630: Close button for node detail panel (important for mobile full-screen overlay)
+    document.getElementById('nodesRight').addEventListener('click', function(e) {
+      // #778: Details/Analytics links don't navigate because replaceState
+      // already set the hash to #/nodes/PUBKEY, so clicking <a href="#/nodes/PUBKEY">
+      // is a same-hash no-op. Force navigation by temporarily clearing the hash.
+      var link = e.target.closest('a.btn-primary[href^="#/nodes/"]');
+      if (link) {
+        e.preventDefault();
+        var href = link.getAttribute('href');
+        var pubkey = decodeURIComponent(href.replace('#/nodes/', '').replace('/analytics', ''));
+        if (href.includes('/analytics')) {
+          // Navigate to analytics page
+          history.replaceState(null, '', '#/');
+          location.hash = '/nodes/' + encodeURIComponent(pubkey) + '/analytics';
+        } else {
+          // Show full-screen node detail view
+          showFullScreenNode(pubkey);
+          history.replaceState(null, '', '#/nodes/' + encodeURIComponent(pubkey));
+        }
+        return;
+      }
+      if (e.target.closest('.panel-close-btn')) {
+        const panel = document.getElementById('nodesRight');
+        panel.classList.add('empty');
+        panel.innerHTML = '<span>Select a node to view details</span>';
+        selectedKey = null;
+        history.replaceState(null, '', '#/nodes');
+        renderRows();
+      }
+    });
+
     renderRows();
   }
 
@@ -950,8 +1107,10 @@
       const lastSeenTime = n.last_heard || n.last_seen;
       const status = getNodeStatus(n.role || 'companion', lastSeenTime ? new Date(lastSeenTime).getTime() : 0);
       const lastSeenClass = status === 'active' ? 'last-seen-active' : 'last-seen-stale';
+      const cs = _fleetSkew && _fleetSkew[n.public_key];
+      const skewBadgeHtml = cs && cs.severity && cs.severity !== 'ok' ? renderSkewBadge(cs.severity, cs.medianSkewSec) : '';
       return `<tr data-key="${n.public_key}" data-action="select" data-value="${n.public_key}" tabindex="0" role="row" class="${selectedKey === n.public_key ? 'selected' : ''}${isClaimed ? ' claimed-row' : ''}">
-        <td>${favStar(n.public_key, 'node-fav')}${isClaimed ? '<span class="claimed-badge" title="My Mesh">★</span> ' : ''}<strong>${n.name || '(unnamed)'}</strong>${dupNameBadge(n.name, n.public_key, dupMap)}</td>
+        <td>${favStar(n.public_key, 'node-fav')}${isClaimed ? '<span class="claimed-badge" title="My Mesh">★</span> ' : ''}<strong>${n.name || '(unnamed)'}</strong>${dupNameBadge(n.name, n.public_key, dupMap)}${skewBadgeHtml}</td>
         <td class="mono col-pubkey">${truncate(n.public_key, 16)}</td>
         <td><span class="badge" style="background:${roleColor}20;color:${roleColor}">${n.role}</span></td>
         <td class="${lastSeenClass}">${renderNodeTimestampHtml(n.last_heard || n.last_seen)}</td>
@@ -969,6 +1128,7 @@
       return;
     }
     selectedKey = pubkey;
+    history.replaceState(null, '', '#/nodes/' + encodeURIComponent(pubkey));
     renderRows();
     const panel = document.getElementById('nodesRight');
     panel.classList.remove('empty');
@@ -1003,6 +1163,7 @@
     const dupBadge = dupNameBadge(n.name, n.public_key, dupMap);
 
     panel.innerHTML = `
+      <button class="panel-close-btn" title="Close detail pane (Esc)">✕</button>
       <div class="node-detail">
         <div class="node-detail-name">${escapeHtml(n.name || '(unnamed)')}${dupBadge}</div>
         <div class="node-detail-role">${renderNodeBadges(n, roleColor)}
@@ -1196,11 +1357,29 @@
   window._nodesIsAdvertMessage = isAdvertMessage;
   window._nodesGetAllNodes = function() { return _allNodes; };
   window._nodesSetAllNodes = function(n) { _allNodes = n; };
-  window._nodesToggleSort = toggleSort;
+  window._nodesToggleSort = function(col) {
+    if (_nodesTableSortCtrl) { _nodesTableSortCtrl.sort(col); return; }
+    // Fallback for tests without DOM
+    var st = _getSortState();
+    var descDefault = ['last_seen', 'advert_count'];
+    if (st.column === col) {
+      _fallbackSortState = { column: col, direction: st.direction === 'asc' ? 'desc' : 'asc' };
+    } else {
+      _fallbackSortState = { column: col, direction: descDefault.indexOf(col) >= 0 ? 'desc' : 'asc' };
+    }
+    localStorage.setItem('meshcore-nodes-sort', JSON.stringify(_fallbackSortState));
+  };
   window._nodesSortNodes = sortNodes;
-  window._nodesSortArrow = sortArrow;
-  window._nodesGetSortState = function() { return sortState; };
-  window._nodesSetSortState = function(s) { sortState = s; };
+  window._nodesSortArrow = function(col) {
+    var st = _getSortState();
+    if (st.column !== col) return '';
+    return '<span class="sort-arrow">' + (st.direction === 'asc' ? '▲' : '▼') + '</span>';
+  };
+  window._nodesGetSortState = _getSortState;
+  window._nodesSetSortState = function(s) {
+    _fallbackSortState = s;
+    if (_nodesTableSortCtrl) _nodesTableSortCtrl.sort(s.column, s.direction);
+  };
   window._nodesSyncClaimedToFavorites = syncClaimedToFavorites;
   window._nodesRenderNodeTimestampHtml = renderNodeTimestampHtml;
   window._nodesRenderNodeTimestampText = renderNodeTimestampText;

public/packets.js

@@ -33,7 +33,30 @@
   let totalCount = 0;
   let expandedHashes = new Set();
   let hopNameCache = {};
+  let _tableSortInstance = null;
+  let _packetSortColumn = null;
+  let _packetSortDirection = 'desc';
   let showHexHashes = localStorage.getItem('meshcore-hex-hashes') === 'true';
+  var _pendingUrlRegion = null;
+
+  var DEFAULT_TIME_WINDOW = 15;
+
+  function buildPacketsQuery(timeWindowMin, regionParam) {
+    var parts = [];
+    if (timeWindowMin && timeWindowMin !== DEFAULT_TIME_WINDOW) parts.push('timeWindow=' + timeWindowMin);
+    if (regionParam) parts.push('region=' + encodeURIComponent(regionParam));
+    if (filters.hash) parts.push('hash=' + encodeURIComponent(filters.hash));
+    if (filters.node) parts.push('node=' + encodeURIComponent(filters.node));
+    if (filters.observer) parts.push('observer=' + encodeURIComponent(filters.observer));
+    if (filters._filterExpr) parts.push('filter=' + encodeURIComponent(filters._filterExpr));
+    return parts.length ? '?' + parts.join('&') : '';
+  }
+  window.buildPacketsQuery = buildPacketsQuery;
+
+  function updatePacketsUrl() {
+    history.replaceState(null, '', '#/packets' + buildPacketsQuery(savedTimeWindowMin, RegionFilter.getRegionParam()));
+  }
+
   let filtersBuilt = false;
   let _renderTimer = null;
   function scheduleRender() {
@@ -63,7 +86,9 @@
   const getParsedDecoded = window.getParsedDecoded;
 
   // --- Virtual scroll state ---
-  const VSCROLL_ROW_HEIGHT = 36;  // estimated row height in px
+  let VSCROLL_ROW_HEIGHT = 36;    // measured dynamically on first render; fallback 36px
+  let _vscrollRowHeightMeasured = false;
+  let _vscrollTheadHeight = 40;   // measured dynamically on first render; fallback 40px
   const VSCROLL_BUFFER = 30;      // extra rows above/below viewport
   let _displayPackets = [];       // filtered packets for current view
   let _displayGrouped = false;    // whether _displayPackets is in grouped mode
@@ -78,6 +103,37 @@
   let _wsRenderDirty = false;     // dirty flag for rAF render coalescing (#396)
   let _observerFilterSet = null;  // cached Set from filters.observer, hoisted above loops (#427)
 
+  // Pure function: calculate visible entry range from scroll state.
+  // Extracted for testability (#405, #409).
+  function _calcVisibleRange(offsets, entryCount, scrollTop, viewportHeight, rowHeight, theadHeight, buffer) {
+    const adjustedScrollTop = Math.max(0, scrollTop - theadHeight);
+    const firstDomRow = Math.floor(adjustedScrollTop / rowHeight);
+    const visibleDomCount = Math.ceil(viewportHeight / rowHeight);
+
+    // Binary search for first entry whose cumulative offset covers firstDomRow
+    let lo = 0, hi = entryCount;
+    while (lo < hi) {
+      const mid = (lo + hi) >>> 1;
+      if (offsets[mid + 1] <= firstDomRow) lo = mid + 1;
+      else hi = mid;
+    }
+    const firstEntry = lo;
+
+    // Binary search for last visible entry
+    const lastDomRow = firstDomRow + visibleDomCount;
+    lo = firstEntry; hi = entryCount;
+    while (lo < hi) {
+      const mid = (lo + hi) >>> 1;
+      if (offsets[mid + 1] <= lastDomRow) lo = mid + 1;
+      else hi = mid;
+    }
+    const lastEntry = Math.min(lo + 1, entryCount);
+
+    const startIdx = Math.max(0, firstEntry - buffer);
+    const endIdx = Math.min(entryCount, lastEntry + buffer);
+    return { startIdx, endIdx, firstEntry, lastEntry };
+  }
+
   function closeDetailPanel() {
     var panel = document.getElementById('pktRight');
     if (panel) {
@@ -280,8 +336,27 @@
         filters.node = routeParam;
       }
     }
+
+    // Read URL params (router strips query from routeParam; read from location.hash)
+    var _initUrlParams = getHashParams();
+    var _urlTimeWindow = Number(_initUrlParams.get('timeWindow'));
+    if (Number.isFinite(_urlTimeWindow) && _urlTimeWindow > 0) {
+      savedTimeWindowMin = _urlTimeWindow;
+      localStorage.setItem('meshcore-time-window', String(_urlTimeWindow));
+    }
+    var _urlRegion = _initUrlParams.get('region');
+    if (_urlRegion) _pendingUrlRegion = _urlRegion;
+    var _urlHash = _initUrlParams.get('hash');
+    if (_urlHash) filters.hash = _urlHash;
+    var _urlNode = _initUrlParams.get('node');
+    if (_urlNode) { filters.node = _urlNode; filters.nodeName = _urlNode.slice(0, 8); }
+    var _urlObserver = _initUrlParams.get('observer');
+    if (_urlObserver) filters.observer = _urlObserver;
+    var _urlFilterExpr = _initUrlParams.get('filter');
+    if (_urlFilterExpr) filters._filterExpr = _urlFilterExpr;
+
     app.innerHTML = `<div class="split-layout detail-collapsed">
-      <div class="panel-left" id="pktLeft"></div>
+      <div class="panel-left" id="pktLeft" aria-live="polite" aria-relevant="additions removals"></div>
       <div class="panel-right empty" id="pktRight" aria-live="polite">
         <div class="panel-resize-handle" id="pktResizeHandle"></div>
         ${PANEL_CLOSE_HTML}
@@ -466,8 +541,12 @@
               if (h) hashIndex.set(h, newGroup);
             }
           }
-          // Re-sort by latest DESC, then evict oldest beyond the limit
-          packets.sort((a, b) => (b.latest || '').localeCompare(a.latest || ''));
+          // Re-sort by active sort column (or latest DESC as default), then evict oldest beyond the limit
+          if (_packetSortColumn) {
+            sortPacketsArray();
+          } else {
+            packets.sort((a, b) => (b.latest || '').localeCompare(a.latest || ''));
+          }
           if (packets.length > PACKET_LIMIT) {
             const evicted = packets.splice(PACKET_LIMIT);
             for (const p of evicted) { if (p.hash) hashIndex.delete(p.hash); }
@@ -488,6 +567,7 @@
     clearTimeout(_renderTimer);
     if (wsHandler) offWS(wsHandler);
     wsHandler = null;
+    if (_tableSortInstance) { _tableSortInstance.destroy(); _tableSortInstance = null; }
     detachVScrollListener();
     clearTimeout(_wsRenderTimer);
     if (_wsRafId) { cancelAnimationFrame(_wsRafId); _wsRafId = null; }
@@ -616,6 +696,7 @@
         }
       }
 
+      sortPacketsArray();
       renderLeft();
     } catch (e) {
       console.error('Failed to load packets:', e);
@@ -706,9 +787,9 @@
       </div>
       <table class="data-table" id="pktTable">
         <thead><tr>
-          <th scope="col"></th><th scope="col" class="col-region">Region</th><th scope="col" class="col-time">Time</th><th scope="col" class="col-hash">Hash</th><th scope="col" class="col-size">Size</th>
-          <th scope="col" class="col-hashsize">HB</th>
-          <th scope="col" class="col-type">Type</th><th scope="col" class="col-observer">Observer</th><th scope="col" class="col-path">Path</th><th scope="col" class="col-rpt">Rpt</th><th scope="col" class="col-details">Details</th>
+          <th scope="col"></th><th scope="col" class="col-region" data-sort-key="region">Region</th><th scope="col" class="col-time" data-sort-key="time" data-type="date">Time</th><th scope="col" class="col-hash" data-sort-key="hash">Hash</th><th scope="col" class="col-size" data-sort-key="size" data-type="numeric">Size</th>
+          <th scope="col" class="col-hashsize" data-sort-key="hb" data-type="numeric">HB</th>
+          <th scope="col" class="col-type" data-sort-key="type">Type</th><th scope="col" class="col-observer" data-sort-key="observer">Observer</th><th scope="col" class="col-path" data-sort-key="path">Path</th><th scope="col" class="col-rpt" data-sort-key="rpt" data-type="numeric">Rpt</th><th scope="col" class="col-details">Details</th>
         </tr></thead>
         <tbody id="pktBody"></tbody>
       </table>
@@ -716,7 +797,11 @@
 
     // Init shared RegionFilter component
     RegionFilter.init(document.getElementById('packetsRegionFilter'), { dropdown: true });
-    RegionFilter.onChange(function() { loadPackets(); });
+    if (_pendingUrlRegion) {
+      RegionFilter.setSelected(_pendingUrlRegion.split(',').filter(Boolean));
+      _pendingUrlRegion = null;
+    }
+    RegionFilter.onChange(function() { updatePacketsUrl(); loadPackets(); });
 
     // --- Packet Filter Language ---
     (function() {
@@ -724,6 +809,12 @@
       var pfError = document.getElementById('packetFilterError');
       var pfCount = document.getElementById('packetFilterCount');
       if (!pfInput || !window.PacketFilter) return;
+      // Restore Wireshark filter expression from URL
+      if (filters._filterExpr) {
+        pfInput.value = filters._filterExpr;
+        var _restored = PacketFilter.compile(filters._filterExpr);
+        if (!_restored.error) { pfInput.classList.add('filter-active'); filters._packetFilter = _restored.filter; }
+      }
       var pfTimer = null;
       pfInput.addEventListener('input', function() {
         clearTimeout(pfTimer);
@@ -734,6 +825,8 @@
             pfError.style.display = 'none';
             pfCount.style.display = 'none';
             filters._packetFilter = null;
+            filters._filterExpr = undefined;
+            updatePacketsUrl();
             renderTableRows();
             return;
           }
@@ -745,12 +838,16 @@
             pfError.style.display = 'block';
             pfCount.style.display = 'none';
             filters._packetFilter = null;
+            filters._filterExpr = undefined;
+            updatePacketsUrl();
             renderTableRows();
           } else {
             pfInput.classList.remove('filter-error');
             pfInput.classList.add('filter-active');
             pfError.style.display = 'none';
             filters._packetFilter = compiled.filter;
+            filters._filterExpr = expr;
+            updatePacketsUrl();
             renderTableRows();
           }
         }, 300);
@@ -795,6 +892,7 @@
       if (filters.observer) localStorage.setItem('meshcore-observer-filter', filters.observer); else localStorage.removeItem('meshcore-observer-filter');
       buildObserverMenu();
       updateObsTrigger();
+      updatePacketsUrl();
       renderTableRows();
     });
 
@@ -857,7 +955,7 @@
 
     // Filter event listeners
     document.getElementById('fHash').value = filters.hash || '';
-    document.getElementById('fHash').addEventListener('input', debounce((e) => { filters.hash = e.target.value || undefined; loadPackets(); }, 300));
+    document.getElementById('fHash').addEventListener('input', debounce((e) => { filters.hash = e.target.value || undefined; updatePacketsUrl(); loadPackets(); }, 300));
 
     // Time window dropdown — restore from localStorage and bind change
     const fTimeWindow = document.getElementById('fTimeWindow');
@@ -866,6 +964,7 @@
       savedTimeWindowMin = Number(fTimeWindow.value);
       if (!Number.isFinite(savedTimeWindowMin) || savedTimeWindowMin <= 0) savedTimeWindowMin = 15;
       localStorage.setItem('meshcore-time-window', fTimeWindow.value);
+      updatePacketsUrl();
       loadPackets();
     });
 
@@ -991,7 +1090,7 @@
       if (!q) {
         fNodeDrop.classList.add('hidden');
         fNode.setAttribute('aria-expanded', 'false');
-        if (filters.node) { filters.node = undefined; filters.nodeName = undefined; loadPackets(); }
+        if (filters.node) { filters.node = undefined; filters.nodeName = undefined; updatePacketsUrl(); loadPackets(); }
         return;
       }
       try {
@@ -1020,6 +1119,7 @@
       fNode.setAttribute('aria-expanded', 'false');
       fNode.setAttribute('aria-activedescendant', '');
       nodeActiveIdx = -1;
+      updatePacketsUrl();
       loadPackets();
     }
 
@@ -1101,6 +1201,33 @@
 
     renderTableRows();
     makeColumnsResizable('#pktTable', 'meshcore-pkt-col-widths');
+
+    // Initialize table sorting (virtual scroll — sort data array, not DOM)
+    if (window.TableSort) {
+      var pktTableEl = document.getElementById('pktTable');
+      if (pktTableEl) {
+        if (_tableSortInstance) _tableSortInstance.destroy();
+        _tableSortInstance = TableSort.init(pktTableEl, {
+          defaultColumn: 'time',
+          defaultDirection: 'desc',
+          storageKey: 'meshcore-packets-sort',
+          domReorder: false,
+          onSort: function(column, direction) {
+            _packetSortColumn = column;
+            _packetSortDirection = direction;
+            sortPacketsArray();
+            renderTableRows();
+          }
+        });
+        // Apply initial sort state from TableSort
+        if (_tableSortInstance) {
+          var st = _tableSortInstance.getState();
+          _packetSortColumn = st.column;
+          _packetSortDirection = st.direction;
+          sortPacketsArray();
+        }
+      }
+    }
   }
 
   // Build HTML for a single grouped packet row
@@ -1277,35 +1404,14 @@
     // Calculate visible range based on scroll position
     const scrollTop = scrollContainer.scrollTop;
     const viewportHeight = scrollContainer.clientHeight;
-    // Account for thead height (~40px)
-    const theadHeight = 40;
-    const adjustedScrollTop = Math.max(0, scrollTop - theadHeight);
+    // Account for thead height (measured dynamically)
+    const theadEl = scrollContainer.querySelector('thead');
+    if (theadEl) _vscrollTheadHeight = theadEl.offsetHeight || _vscrollTheadHeight;
 
-    // Find the first entry whose cumulative row offset covers the scroll position
-    const firstDomRow = Math.floor(adjustedScrollTop / VSCROLL_ROW_HEIGHT);
-    const visibleDomCount = Math.ceil(viewportHeight / VSCROLL_ROW_HEIGHT);
-
-    // Binary search for entry index containing firstDomRow
-    let lo = 0, hi = _displayPackets.length;
-    while (lo < hi) {
-      const mid = (lo + hi) >>> 1;
-      if (offsets[mid + 1] <= firstDomRow) lo = mid + 1;
-      else hi = mid;
-    }
-    const firstEntry = lo;
-
-    // Find entry index covering last visible DOM row
-    const lastDomRow = firstDomRow + visibleDomCount;
-    lo = firstEntry; hi = _displayPackets.length;
-    while (lo < hi) {
-      const mid = (lo + hi) >>> 1;
-      if (offsets[mid + 1] <= lastDomRow) lo = mid + 1;
-      else hi = mid;
-    }
-    const lastEntry = Math.min(lo + 1, _displayPackets.length);
-
-    const startIdx = Math.max(0, firstEntry - VSCROLL_BUFFER);
-    const endIdx = Math.min(_displayPackets.length, lastEntry + VSCROLL_BUFFER);
+    const { startIdx, endIdx } = _calcVisibleRange(
+      offsets, _displayPackets.length, scrollTop, viewportHeight,
+      VSCROLL_ROW_HEIGHT, _vscrollTheadHeight, VSCROLL_BUFFER
+    );
 
     // Skip DOM rebuild if visible range hasn't changed
     if (startIdx === _lastVisibleStart && endIdx === _lastVisibleEnd) {
@@ -1336,6 +1442,14 @@
       tbody.appendChild(topSpacer);
       tbody.insertAdjacentHTML('beforeend', visibleHtml);
       tbody.appendChild(bottomSpacer);
+      // Measure actual row height from first rendered data row (#407)
+      if (!_vscrollRowHeightMeasured) {
+        const firstRow = topSpacer.nextElementSibling;
+        if (firstRow && firstRow !== bottomSpacer) {
+          const h = firstRow.offsetHeight;
+          if (h > 0) { VSCROLL_ROW_HEIGHT = h; _vscrollRowHeightMeasured = true; }
+        }
+      }
       if (window.__PERF_LOG_RENDER) console.log('[perf] renderVisibleRows: full rebuild %d entries, %.2fms', endIdx - startIdx, performance.now() - _rvr_t0);
       return;
     }
@@ -1395,6 +1509,55 @@
     _vsScrollHandler = null;
   }
 
+  /** Sort the packets array by the current sort column. Called before renderTableRows. */
+  function sortPacketsArray() {
+    if (!_packetSortColumn || !packets.length) return;
+    var col = _packetSortColumn;
+    var dir = _packetSortDirection === 'asc' ? 1 : -1;
+
+    var accessor;
+    switch (col) {
+      case 'time': accessor = function(p) { return p.latest || p.timestamp || ''; }; break;
+      case 'type': accessor = function(p) { return typeName(p.payload_type); }; break;
+      case 'hash': accessor = function(p) { return p.hash || ''; }; break;
+      case 'observer': accessor = function(p) { return obsName(p.observer_id); }; break;
+      case 'size': accessor = function(p) { return p.packet_size || 0; }; break;
+      case 'hb': accessor = function(p) { return p.hash_byte_count != null ? p.hash_byte_count : (p.hash_size || 0); }; break;
+      case 'rpt': accessor = function(p) {
+        try { var pj = typeof p.path_json === 'string' ? JSON.parse(p.path_json) : p.path_json; return Array.isArray(pj) ? pj.length : 0; } catch(e) { return 0; }
+      }; break;
+      case 'region': accessor = function(p) { return (regionMap && regionMap[p.observer_id]) || ''; }; break;
+      case 'path': accessor = function(p) {
+        try { var pj = typeof p.path_json === 'string' ? JSON.parse(p.path_json) : p.path_json; return Array.isArray(pj) ? pj.join(',') : ''; } catch(e) { return ''; }
+      }; break;
+      default: return; // unsortable column
+    }
+
+    // Choose comparator based on column type
+    var isNumeric = (col === 'size' || col === 'hb' || col === 'rpt');
+    var isDate = (col === 'time');
+
+    packets.sort(function(a, b) {
+      var va = accessor(a), vb = accessor(b);
+      var result;
+      if (isDate) {
+        result = TableSort.comparators.date(va, vb);
+      } else if (isNumeric) {
+        result = TableSort.comparators.numeric(va, vb);
+      } else {
+        result = TableSort.comparators.text(va, vb);
+      }
+      // Stable tiebreaker: sort by timestamp (desc) when primary values are equal
+      if (result === 0 && !isDate) {
+        result = TableSort.comparators.date(
+          a.timestamp || a.first_seen || '',
+          b.timestamp || b.first_seen || ''
+        ) * -1; // desc (newest first)
+      }
+      return dir * result;
+    });
+  }
+
   async function renderTableRows() {
     const tbody = document.getElementById('pktBody');
     if (!tbody) return;
@@ -1625,7 +1788,7 @@
 
     // Parse hash size from path byte
     const rawPathByte = pkt.raw_hex ? parseInt(pkt.raw_hex.slice(2, 4), 16) : NaN;
-    const hashSize = isNaN(rawPathByte) ? null : ((rawPathByte >> 6) + 1);
+    const hashSize = (isNaN(rawPathByte) || (rawPathByte & 0x3F) === 0) ? null : ((rawPathByte >> 6) + 1);
 
     const size = pkt.raw_hex ? Math.floor(pkt.raw_hex.length / 2) : 0;
     const typeName = payloadTypeName(pkt.payload_type);
@@ -1712,7 +1875,12 @@
       }
     }
 
+    const anomalyBanner = decoded.anomaly
+      ? `<div class="anomaly-banner" style="background:var(--warning, #f0ad4e); color:#000; padding:8px 12px; border-radius:4px; margin-bottom:8px; font-weight:600;">⚠️ Anomaly: ${escapeHtml(decoded.anomaly)}</div>`
+      : '';
+
     panel.innerHTML = `
+      ${anomalyBanner}
       <div class="detail-title">${hasRawHex ? `Packet Byte Breakdown (${size} bytes)` : typeName + ' Packet'}</div>
       <div class="detail-hash">${pkt.hash || 'Packet #' + pkt.id}</div>
       ${messageHtml}
@@ -1844,13 +2012,9 @@
     // Header section
     rows += sectionRow('Header', 'section-header');
     rows += fieldRow(0, 'Header Byte', '0x' + (buf.slice(0, 2) || '??'), `Route: ${routeTypeName(pkt.route_type)}, Payload: ${payloadTypeName(pkt.payload_type)}`);
-    const pathByte0 = parseInt(buf.slice(2, 4), 16);
-    const hashSizeVal = isNaN(pathByte0) ? '?' : ((pathByte0 >> 6) + 1);
-    const hashCountVal = isNaN(pathByte0) ? '?' : (pathByte0 & 0x3F);
-    rows += fieldRow(1, 'Path Length', '0x' + (buf.slice(2, 4) || '??'), `hash_size=${hashSizeVal} byte${hashSizeVal !== 1 ? 's' : ''}, hash_count=${hashCountVal}`);
 
-    // Transport codes
-    let off = 2;
+    // Transport codes come BEFORE path length for transport routes (bytes 1-4)
+    let off = 1;
     if (pkt.route_type === 0 || pkt.route_type === 3) {
       rows += sectionRow('Transport Codes', 'section-transport');
       rows += fieldRow(off, 'Next Hop', buf.slice(off * 2, (off + 2) * 2), '');
@@ -1858,11 +2022,18 @@
       off += 4;
     }
 
+    // Path length byte is at current offset (byte 1 for non-transport, byte 5 for transport)
+    const pathLenOffset = off;
+    const pathByte0 = parseInt(buf.slice(off * 2, off * 2 + 2), 16);
+    const hashSizeVal = isNaN(pathByte0) ? '?' : ((pathByte0 >> 6) + 1);
+    const hashCountVal = isNaN(pathByte0) ? '?' : (pathByte0 & 0x3F);
+    rows += fieldRow(off, 'Path Length', '0x' + (buf.slice(off * 2, off * 2 + 2) || '??'), hashCountVal === 0 ? `hash_count=0 (direct advert)` : `hash_size=${hashSizeVal} byte${hashSizeVal !== 1 ? 's' : ''}, hash_count=${hashCountVal}`);
+    off += 1;
+
     // Path
     if (pathHops.length > 0) {
       rows += sectionRow('Path (' + pathHops.length + ' hops)', 'section-path');
-      const pathByte = parseInt(buf.slice(2, 4), 16);
-      const hashSize = (pathByte >> 6) + 1;
+      const hashSize = isNaN(pathByte0) ? 1 : ((pathByte0 >> 6) + 1);
       for (let i = 0; i < pathHops.length; i++) {
         const hopHtml = HopDisplay.renderHop(pathHops[i], hopNameCache[pathHops[i]]);
         const label = `Hop ${i} — ${hopHtml}`;
@@ -1875,7 +2046,7 @@
     rows += sectionRow('Payload — ' + payloadTypeName(pkt.payload_type), 'section-payload');
 
     if (decoded.type === 'ADVERT') {
-      rows += fieldRow(1, 'Advertised Hash Size', hashSizeVal + ' byte' + (hashSizeVal !== 1 ? 's' : ''), 'From path byte 0x' + (buf.slice(2, 4) || '??') + ' — bits 7-6 = ' + (hashSizeVal - 1));
+      if (hashCountVal !== 0) rows += fieldRow(pathLenOffset, 'Advertised Hash Size', hashSizeVal + ' byte' + (hashSizeVal !== 1 ? 's' : ''), 'From path byte 0x' + (buf.slice(pathLenOffset * 2, pathLenOffset * 2 + 2) || '??') + ' — bits 7-6 = ' + (hashSizeVal - 1));
       rows += fieldRow(off, 'Public Key (32B)', truncate(decoded.pubKey || '', 24), '');
       rows += fieldRow(off + 32, 'Timestamp (4B)', decoded.timestampISO || '', 'Unix: ' + (decoded.timestamp || ''));
       rows += fieldRow(off + 36, 'Signature (64B)', truncate(decoded.signature || '', 24), '');
@@ -1916,6 +2087,10 @@
       rows += fieldRow(off, 'Raw', truncate(buf.slice(off * 2), 40), '');
     }
 
+    if (decoded.anomaly) {
+      rows += `<tr class="anomaly-row" style="background:var(--warning, #f0ad4e); color:#000; font-weight:600;"><td colspan="2">⚠️ Anomaly</td><td colspan="2">${escapeHtml(decoded.anomaly)}</td></tr>`;
+    }
+
     return `<table class="field-table">
       <thead><tr><th scope="col">Offset</th><th scope="col">Field</th><th scope="col">Value</th><th scope="col">Description</th></tr></thead>
       <tbody>${rows}</tbody>
@@ -2007,6 +2182,11 @@
 
     let html = '<div class="byop-decoded">';
 
+    // Anomaly banner
+    if (d.anomaly) {
+      html += '<div class="anomaly-banner" style="background:var(--warning, #f0ad4e); color:#000; padding:8px 12px; border-radius:4px; margin-bottom:8px; font-weight:600;">⚠️ Anomaly: ' + escapeHtml(d.anomaly) + '</div>';
+    }
+
     // Header section
     html += '<div class="byop-section">'
       + '<div class="byop-section-title">Header</div>'
@@ -2037,6 +2217,12 @@
         html += kv(k, String(v));
       }
     }
+    // Special handling for advert signature validation
+    if (h.payloadType === 4 && p.signatureValid !== undefined) {
+      const status = p.signatureValid ? 'Valid' : 'Invalid';
+      const badgeClass = p.signatureValid ? 'badge-success' : 'badge-danger';
+      html += kv('Signature', `<span class="badge ${badgeClass}">${status}</span>`);
+    }
     html += '</div></div>';
 
     // Raw hex
@@ -2167,7 +2353,10 @@
     init: function(app, routeParam) {
       _themeRefreshHandler = () => { if (typeof renderTableRows === 'function') renderTableRows(); };
       window.addEventListener('theme-refresh', _themeRefreshHandler);
-      return init(app, routeParam);
+      var result = init(app, routeParam);
+      // Install channel color picker on packets table (M2, #271)
+      if (window.ChannelColorPicker) window.ChannelColorPicker.installPacketsTable();
+      return result;
     },
     destroy: function() {
       if (_themeRefreshHandler) { window.removeEventListener('theme-refresh', _themeRefreshHandler); _themeRefreshHandler = null; }
@@ -2178,6 +2367,7 @@
   // Standalone packet detail page: #/packet/123 or #/packet/HASH
   // Expose pure functions for unit testing (vm.createContext pattern)
   if (typeof window !== 'undefined') {
+    document.addEventListener('channel-colors-changed', function() { renderVisibleRows(); });
     window._packetsTestAPI = {
       typeName,
       obsName,
@@ -2197,6 +2387,7 @@
       _refreshRowCountsIfDirty,
       buildGroupRowHtml,
       buildFlatRowHtml,
+      _calcVisibleRange,
     };
   }
 

public/perf.js

@@ -91,8 +91,9 @@
         const ps = server.packetStore;
         html += `<h3>In-Memory Packet Store</h3><div style="display:flex;gap:16px;flex-wrap:wrap;margin:8px 0;">
           <div class="perf-card"><div class="perf-num">${ps.inMemory.toLocaleString()}</div><div class="perf-label">Packets in RAM</div></div>
-          <div class="perf-card"><div class="perf-num">${ps.estimatedMB}MB</div><div class="perf-label">Memory Used</div></div>
+          <div class="perf-card"><div class="perf-num">${ps.trackedMB}MB</div><div class="perf-label">Tracked Memory</div></div>
           <div class="perf-card"><div class="perf-num">${ps.maxMB}MB</div><div class="perf-label">Memory Limit</div></div>
+          <div class="perf-card"><div class="perf-num">${ps.estimatedMB}MB</div><div class="perf-label">Heap (debug)</div></div>
           <div class="perf-card"><div class="perf-num">${ps.queries.toLocaleString()}</div><div class="perf-label">Queries Served</div></div>
           <div class="perf-card"><div class="perf-num">${ps.inserts.toLocaleString()}</div><div class="perf-label">Live Inserts</div></div>
           <div class="perf-card"><div class="perf-num">${ps.evicted.toLocaleString()}</div><div class="perf-label">Evicted</div></div>

public/region-filter.js

@@ -6,6 +6,7 @@
   var _regions = {};       // { code: label }
   var _selected = null;    // Set of selected region codes, null = all
   var _listeners = [];
+  var _container = null;
   var _loaded = false;
 
   function loadFromStorage() {
@@ -199,11 +200,19 @@
   /** Initialize filter in a container, fetch regions, render, return promise.
    *  Options: { dropdown: true } to force dropdown mode regardless of region count */
   async function initFilter(container, opts) {
+    _container = container;
     if (opts && opts.dropdown) container._forceDropdown = true;
     await fetchRegions();
     render(container);
   }
 
+  /** Override selected regions (e.g. from URL param). Persists to localStorage and re-renders. */
+  function setSelected(codesArray) {
+    _selected = (codesArray && codesArray.length > 0) ? new Set(codesArray) : null;
+    saveToStorage();
+    if (_container) render(_container);
+  }
+
   // Expose globally
   window.RegionFilter = {
     init: initFilter,
@@ -213,6 +222,7 @@
     regionQueryString: regionQueryString,
     onChange: onChange,
     offChange: offChange,
-    fetchRegions: fetchRegions
+    fetchRegions: fetchRegions,
+    setSelected: setSelected
   };
 })();

public/roles.js

@@ -394,4 +394,68 @@
     });
     return html;
   };
+
+  // #690 — Clock Skew shared helpers
+  var SKEW_SEVERITY_COLORS = {
+    ok: 'var(--status-green)',
+    warning: 'var(--status-yellow)',
+    critical: 'var(--status-orange)',
+    absurd: 'var(--status-purple)',
+    no_clock: 'var(--text-muted)'
+  };
+  var SKEW_SEVERITY_LABELS = {
+    ok: 'OK', warning: 'Warning', critical: 'Critical', absurd: 'Absurd', no_clock: 'No Clock'
+  };
+  var SKEW_SEVERITY_ORDER = { no_clock: 0, absurd: 1, critical: 2, warning: 3, ok: 4 };
+
+  window.SKEW_SEVERITY_COLORS = SKEW_SEVERITY_COLORS;
+  window.SKEW_SEVERITY_LABELS = SKEW_SEVERITY_LABELS;
+  window.SKEW_SEVERITY_ORDER = SKEW_SEVERITY_ORDER;
+
+  /** Format skew seconds into human-readable string like "+2m 34s" or "-15h 22m" */
+  window.formatSkew = function(sec) {
+    if (sec == null) return '—';
+    var abs = Math.abs(sec);
+    var sign = sec >= 0 ? '+' : '-';
+    if (abs < 60) return sign + Math.round(abs) + 's';
+    if (abs < 3600) return sign + Math.floor(abs / 60) + 'm ' + Math.round(abs % 60) + 's';
+    if (abs < 86400) return sign + Math.floor(abs / 3600) + 'h ' + Math.round((abs % 3600) / 60) + 'm';
+    return sign + Math.floor(abs / 86400) + 'd ' + Math.round((abs % 86400) / 3600) + 'h';
+  };
+
+  /** Format drift rate as "+X.Xs/day" or "—" if falsy */
+  window.formatDrift = function(secPerDay) {
+    if (!secPerDay) return '—';
+    return (secPerDay >= 0 ? '+' : '') + secPerDay.toFixed(1) + ' s/day';
+  };
+
+  /** Render a clock skew badge HTML */
+  window.renderSkewBadge = function(severity, skewSec) {
+    if (!severity) return '';
+    var cls = 'skew-badge skew-badge--' + severity;
+    if (severity === 'no_clock') {
+      return '<span class="' + cls + '" title="Uninitialized RTC — no valid clock">🚫 No Clock</span>';
+    }
+    var label = severity === 'ok' ? '⏰' : '⏰ ' + window.formatSkew(skewSec);
+    return '<span class="' + cls + '" title="Clock skew: ' + window.formatSkew(skewSec) + ' (' + (SKEW_SEVERITY_LABELS[severity] || severity) + ')">' + label + '</span>';
+  };
+
+  /** Render a skew sparkline SVG (inline, word-sized) */
+  window.renderSkewSparkline = function(samples, w, h) {
+    w = w || 120; h = h || 24;
+    if (!samples || samples.length < 2) return '';
+    var values = samples.map(function(s) { return s.skew; });
+    var max = Math.max.apply(null, values.map(function(v) { return Math.abs(v); }).concat([1]));
+    var pts = values.map(function(v, i) {
+      var x = i * (w / Math.max(values.length - 1, 1));
+      var y = h / 2 - (v / max) * (h / 2 - 2);
+      return x.toFixed(1) + ',' + y.toFixed(1);
+    }).join(' ');
+    // Zero line
+    var zeroY = h / 2;
+    return '<svg viewBox="0 0 ' + w + ' ' + h + '" style="width:' + w + 'px;height:' + h + 'px" role="img" aria-label="Clock skew sparkline">' +
+      '<title>Clock skew over time</title>' +
+      '<line x1="0" y1="' + zeroY + '" x2="' + w + '" y2="' + zeroY + '" stroke="var(--border)" stroke-width="0.5" stroke-dasharray="2"/>' +
+      '<polyline points="' + pts + '" fill="none" stroke="var(--accent)" stroke-width="1.5"/></svg>';
+  };
 })();

public/style.css

@@ -11,6 +11,9 @@
   --status-green: #22c55e;
   --status-yellow: #eab308;
   --status-red: #ef4444;
+  --status-orange: #f97316;
+  --status-purple: #a855f7;
+  --role-observer: #8b5cf6;
   --accent-hover: #6db3ff;
   --text: #1a1a2e;
   --text-muted: #5b6370;
@@ -30,6 +33,7 @@
   --content-bg: var(--surface-0);
   --card-bg: var(--surface-1);
   --hover-bg: rgba(0,0,0, 0.04);
+  --trace-ghost-color: #94a3b8;
 }
 
 /* ⚠️ DARK THEME VARIABLES — KEEP BOTH BLOCKS IN SYNC
@@ -40,6 +44,8 @@
     --status-green: #22c55e;
     --status-yellow: #eab308;
     --status-red: #ef4444;
+    --status-orange: #f97316;
+    --status-purple: #a855f7;
     --surface-0: #0f0f23;
     --surface-1: #1a1a2e;
     --surface-2: #232340;
@@ -55,6 +61,7 @@
     --input-bg: #1e1e34;
     --selected-bg: #1e3a5f;
     --hover-bg: rgba(255,255,255, 0.06);
+    --trace-ghost-color: #94a3b8;
     --section-bg: #1e1e34;
   }
 }
@@ -63,6 +70,8 @@
   --status-green: #22c55e;
   --status-yellow: #eab308;
   --status-red: #ef4444;
+  --status-orange: #f97316;
+  --status-purple: #a855f7;
   --surface-0: #0f0f23;
   --surface-1: #1a1a2e;
   --surface-2: #232340;
@@ -78,6 +87,7 @@
   --input-bg: #1e1e34;
   --selected-bg: #1e3a5f;
   --hover-bg: rgba(255,255,255, 0.06);
+  --trace-ghost-color: #94a3b8;
   --section-bg: #1e1e34;
 }
 
@@ -460,6 +470,14 @@ fieldset.mc-section legend.mc-label { padding: 0; }
 .ch-sidebar-title {
   display: flex; align-items: center; gap: 8px; font-size: 16px; font-weight: 700; margin-bottom: 8px;
 }
+.ch-encrypted-toggle {
+  display: flex; align-items: center; gap: 4px; font-size: 11px; color: var(--text-muted);
+  cursor: pointer; user-select: none; margin-bottom: 4px;
+}
+.ch-encrypted-toggle input { margin: 0; cursor: pointer; }
+.ch-toggle-label { white-space: nowrap; }
+.ch-item.ch-encrypted { opacity: 0.55; }
+.ch-item.ch-encrypted .ch-item-name { font-style: italic; }
 .ch-icon { font-size: 20px; }
 .ch-sidebar-controls { display: flex; align-items: center; gap: 6px; }
 .ch-region-select {
@@ -492,6 +510,9 @@ button.ch-item.selected { background: var(--selected-bg); }
 .ch-item-top { display: flex; justify-content: space-between; align-items: baseline; margin-bottom: 2px; }
 .ch-item-name { font-weight: 600; font-size: 14px; }
 .ch-item-time { font-size: 11px; color: var(--text-muted); white-space: nowrap; }
+.ch-remove-btn { background: none; border: none; color: var(--text-muted); cursor: pointer; font-size: 13px; padding: 0 2px; margin-left: 4px; opacity: 0; transition: opacity 0.15s; line-height: 1; }
+button.ch-item:hover .ch-remove-btn { opacity: 0.6; }
+.ch-remove-btn:hover { opacity: 1 !important; color: var(--danger, #dc2626); }
 .ch-item-preview { font-size: 12px; color: var(--text-muted); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
 
 .ch-main { flex: 1; display: flex; flex-direction: column; overflow: hidden; position: relative; }
@@ -1094,6 +1115,49 @@ button.ch-item.ch-item-encrypted:hover { opacity: 0.7; }
 button.ch-item.ch-item-encrypted.selected { opacity: 0.8; }
 button.ch-item.ch-item-encrypted .ch-badge { filter: grayscale(0.6); }
 
+/* Channel key input (#725 M2) */
+.ch-key-input {
+  flex: 1;
+  min-width: 0;
+  box-sizing: border-box;
+  padding: 6px 8px;
+  border: 1px solid var(--border);
+  border-radius: 6px 0 0 6px;
+  background: var(--card-bg);
+  color: var(--text);
+  font-size: 12px;
+  font-family: inherit;
+}
+.ch-key-input:focus {
+  outline: 2px solid var(--accent, #3b82f6);
+  outline-offset: -1px;
+  border-color: var(--accent, #3b82f6);
+}
+.ch-key-input::placeholder { color: var(--text-muted); }
+.ch-key-input-wrap { margin-bottom: 4px; }
+.ch-wrong-key { color: var(--danger, #ef4444); font-weight: 500; }
+
+/* Add channel form (#759) */
+.ch-add-form { margin: 0; }
+.ch-add-label { display: block; font-weight: 600; font-size: 13px; color: var(--text); margin-bottom: 4px; }
+.ch-key-input, .ch-add-btn { height: 32px; box-sizing: border-box; }
+.ch-add-row { display: flex; align-items: stretch; }
+.ch-add-btn {
+  width: 32px; height: 32px; flex-shrink: 0;
+  border: 1px solid var(--accent, #3b82f6); border-left: none;
+  border-radius: 0 6px 6px 0;
+  background: var(--accent, #3b82f6); color: #fff;
+  font-size: 18px; font-weight: 700; line-height: 1;
+  cursor: pointer; display: flex; align-items: center; justify-content: center;
+}
+.ch-add-btn:hover { opacity: 0.85; }
+.ch-add-hint { font-size: 11px; color: var(--text-muted); margin-top: 4px; line-height: 1.3; }
+.ch-add-status { font-size: 12px; margin-top: 4px; padding: 4px 6px; border-radius: 4px; }
+.ch-add-status--loading { color: var(--text-muted); }
+.ch-add-status--success { color: var(--success, #22c55e); }
+.ch-add-status--warn { color: var(--warning, #eab308); }
+.ch-add-status--error { color: var(--danger, #ef4444); }
+
 /* Touch-friendly tappable elements */
 .ch-tappable {
   cursor: pointer;
@@ -1184,6 +1248,8 @@ button.ch-item.ch-item-encrypted .ch-badge { filter: grayscale(0.6); }
 .hash-bar-value { min-width: 120px; text-align: right; font-size: 13px; font-weight: 600; }
 .badge-hash-1 { background: #ef444420; color: var(--status-red); }
 .badge-hash-2 { background: #22c55e20; color: var(--status-green); }
+.badge-success { background: #22c55e20; color: var(--status-green); }
+.badge-danger { background: #ef444420; color: var(--status-red); }
 .badge-hash-3 { background: #3b82f620; color: var(--accent); }
 .timeline-legend { display: flex; gap: 16px; justify-content: center; margin-top: 8px; font-size: 12px; }
 .legend-dot { display: inline-block; width: 10px; height: 10px; border-radius: 50%; margin-right: 4px; vertical-align: middle; }
@@ -2037,3 +2103,193 @@ tr[data-hops]:hover { background: rgba(59,130,246,0.1); }
   .rf-time-selector { gap: 3px; }
   .rf-custom-inputs { margin-left: 0; margin-top: 4px; flex-wrap: wrap; }
 }
+
+/* Channel Color Picker Popover (M2, #271) */
+/* === Channel Color Picker (#674) === */
+.cc-picker-popover {
+  position: fixed;
+  z-index: 9999;
+  background: var(--bg-secondary, #1e1e1e);
+  border: 1px solid var(--border-color, #333);
+  border-radius: 8px;
+  padding: 8px;
+  box-shadow: 0 4px 12px rgba(0,0,0,0.3);
+}
+.cc-picker-swatches {
+  display: flex;
+  gap: 6px;
+}
+.cc-swatch {
+  width: 24px;
+  height: 24px;
+  border-radius: 50%;
+  border: 2px solid transparent;
+  cursor: pointer;
+  padding: 0;
+  transition: border-color 0.15s;
+}
+.cc-swatch:hover { border-color: rgba(255,255,255,0.6); }
+.cc-swatch:focus-visible { border-color: #fff; outline: 2px solid var(--accent, #3b82f6); outline-offset: 1px; }
+.cc-swatch-active { border-color: #fff; }
+.cc-picker-clear {
+  display: block;
+  width: 100%;
+  margin-top: 6px;
+  padding: 4px 0;
+  font-size: 11px;
+  color: var(--text-muted, #888);
+  background: none;
+  border: none;
+  cursor: pointer;
+  text-align: center;
+}
+.cc-picker-clear:hover { color: var(--text-primary, #e0e0e0); }
+
+/* Color dot affordance (#674) */
+.ch-color-dot {
+  display: inline-block;
+  width: 12px;
+  height: 12px;
+  border-radius: 50%;
+  border: 1.5px solid rgba(255,255,255,0.3);
+  cursor: pointer;
+  vertical-align: middle;
+  margin-left: 6px;
+  flex-shrink: 0;
+}
+.ch-color-dot:not([style*="background"]) {
+  background: transparent;
+  border-style: dashed;
+  border-color: var(--text-muted, #888);
+}
+
+/* Mobile bottom-sheet + larger touch targets (#674) */
+@media (pointer: coarse) {
+  .ch-color-dot {
+    width: 20px;
+    height: 20px;
+    margin-left: 8px;
+  }
+  .cc-swatch {
+    width: 36px;
+    height: 36px;
+  }
+  .cc-picker-swatches {
+    justify-content: center;
+    gap: 10px;
+  }
+  .cc-picker-popover {
+    position: fixed !important;
+    bottom: 0 !important;
+    left: 0 !important;
+    right: 0 !important;
+    top: auto !important;
+    width: 100% !important;
+    max-width: 100% !important;
+    border-radius: 12px 12px 0 0;
+    padding: 16px;
+    padding-bottom: calc(16px + env(safe-area-inset-bottom));
+    box-sizing: border-box;
+  }
+}
+
+/* === #630 — Mobile Accessibility Fixes === */
+
+/* #630-1: Touch targets — minimum 44px on touch devices */
+@media (pointer: coarse) {
+  .filter-bar .btn,
+  .filter-group .btn,
+  .tab-btn,
+  .filter-bar input,
+  .filter-bar select,
+  .nav-btn,
+  .region-pill,
+  .region-dropdown-trigger,
+  .multi-select-trigger,
+  .node-count-pill,
+  .analytics-time-range button,
+  .detail-back-btn,
+  .filter-toggle-btn {
+    min-height: 44px;
+    min-width: 44px;
+  }
+  .filter-bar input,
+  .filter-bar select {
+    height: 44px;
+  }
+  .region-dropdown-trigger,
+  .multi-select-trigger {
+    height: 44px;
+  }
+}
+
+/* #630-3: Status text labels — visually hidden text for screen readers */
+.sr-status-label { font-size: 11px; margin-left: 4px; }
+
+/* #630-4: Detail panel as full-width overlay on mobile */
+@media (max-width: 640px) {
+  .split-layout .panel-right:not(.empty) {
+    display: block;
+    position: fixed;
+    top: 52px;
+    left: 0;
+    right: 0;
+    bottom: 0;
+    width: 100%;
+    min-width: 0;
+    z-index: 150;
+    overflow-y: auto;
+    -webkit-overflow-scrolling: touch;
+  }
+}
+
+/* #630-5: Analytics tabs — horizontal scroll on small screens */
+@media (max-width: 640px) {
+  .analytics-tabs {
+    flex-wrap: nowrap;
+    overflow-x: auto;
+    -webkit-overflow-scrolling: touch;
+    scrollbar-width: thin;
+    padding-bottom: 4px;
+  }
+  .analytics-tabs .tab-btn {
+    flex-shrink: 0;
+    white-space: nowrap;
+  }
+}
+
+/* #630-6: Tables — horizontal scroll wrapper */
+.table-scroll-wrap {
+  overflow-x: auto;
+  -webkit-overflow-scrolling: touch;
+}
+@media (max-width: 640px) {
+  .data-table { min-width: 480px; }
+}
+
+/* Table sorting indicators */
+th[data-sort-key] { cursor: pointer; user-select: none; }
+th[data-sort-key]:hover { background: var(--hover-bg, rgba(255,255,255,0.05)); }
+th.sort-active { color: var(--accent, #60a5fa); }
+.sort-arrow { font-size: 0.75em; opacity: 0.8; }
+
+/* #690 — Clock Skew badges & fleet table */
+.skew-badge { display: inline-block; font-size: 10px; padding: 1px 5px; border-radius: 3px; margin-left: 4px; font-weight: 600; white-space: nowrap; }
+.skew-badge--ok { background: var(--status-green); color: #fff; }
+.skew-badge--warning { background: var(--status-yellow); color: #000; }
+.skew-badge--critical { background: var(--status-orange); color: #fff; }
+.skew-badge--absurd { background: var(--status-purple); color: #fff; }
+.skew-badge--no_clock { background: var(--text-muted); color: #fff; }
+
+.skew-detail-section { padding: 10px 16px; margin-bottom: 8px; }
+.skew-sparkline-wrap { margin-top: 6px; }
+.skew-sparkline-wrap svg { display: block; }
+
+
+.clock-fleet-row--warning { background: color-mix(in srgb, var(--status-yellow) 10%, transparent); }
+.clock-fleet-row--critical { background: color-mix(in srgb, var(--status-orange) 10%, transparent); }
+.clock-fleet-row--absurd { background: color-mix(in srgb, var(--status-purple) 10%, transparent); }
+.clock-fleet-row--no_clock { background: color-mix(in srgb, var(--text-muted) 10%, transparent); }
+
+.clock-filter-btn { font-size: 12px; padding: 3px 8px; border: 1px solid var(--border); border-radius: 4px; background: var(--card-bg, #fff); color: var(--text); cursor: pointer; margin-right: 4px; }
+.clock-filter-btn.active { background: var(--accent); color: #fff; border-color: var(--accent); }

public/table-sort.js

@@ -0,0 +1,224 @@
+/* === CoreScope — table-sort.js === */
+/* Shared table sorting utility. IIFE, no dependencies. */
+'use strict';
+
+window.TableSort = (function() {
+
+  /**
+   * Built-in comparators. Each takes two raw string values (from data-value or textContent)
+   * and returns a number for Array.sort.
+   */
+  var comparators = {
+    text: function(a, b) {
+      if (a == null) a = '';
+      if (b == null) b = '';
+      return String(a).localeCompare(String(b));
+    },
+    numeric: function(a, b) {
+      var na = Number(a), nb = Number(b);
+      var aIsNaN = isNaN(na), bIsNaN = isNaN(nb);
+      if (aIsNaN && bIsNaN) return 0;
+      if (aIsNaN) return 1;   // NaN sorts last
+      if (bIsNaN) return -1;
+      return na - nb;
+    },
+    date: function(a, b) {
+      var ta = a ? new Date(a).getTime() : NaN;
+      var tb = b ? new Date(b).getTime() : NaN;
+      var aIsNaN = isNaN(ta), bIsNaN = isNaN(tb);
+      if (aIsNaN && bIsNaN) return 0;
+      if (aIsNaN) return 1;
+      if (bIsNaN) return -1;
+      return ta - tb;
+    },
+    dbm: function(a, b) {
+      var na = parseFloat(String(a).replace(/\s*dBm\s*/i, ''));
+      var nb = parseFloat(String(b).replace(/\s*dBm\s*/i, ''));
+      var aIsNaN = isNaN(na), bIsNaN = isNaN(nb);
+      if (aIsNaN && bIsNaN) return 0;
+      if (aIsNaN) return 1;
+      if (bIsNaN) return -1;
+      return na - nb;
+    }
+  };
+
+  /**
+   * Resolve the comparator for a <th> element.
+   * Priority: custom comparator from options > data-type attribute > text default.
+   */
+  function resolveComparator(key, thEl, customComparators) {
+    if (customComparators && customComparators[key]) return customComparators[key];
+    var type = thEl.getAttribute('data-type');
+    if (type && comparators[type]) return comparators[type];
+    return comparators.text;
+  }
+
+  /**
+   * Get the sort value for a <td>. Prefers data-value attribute, falls back to textContent.
+   */
+  function getCellValue(td) {
+    if (!td) return '';
+    var dv = td.getAttribute('data-value');
+    return dv != null ? dv : td.textContent.trim();
+  }
+
+  /**
+   * Initialize sorting on a table element.
+   *
+   * @param {HTMLTableElement} tableEl - The table to make sortable
+   * @param {Object} [options]
+   * @param {string} [options.defaultColumn] - data-sort-key of initial sort column
+   * @param {string} [options.defaultDirection='asc'] - 'asc' or 'desc'
+   * @param {string} [options.storageKey] - localStorage key for persistence
+   * @param {Object} [options.comparators] - custom comparator functions keyed by column key
+   * @param {Function} [options.onSort] - callback(column, direction) after sort
+   * @param {boolean} [options.domReorder=true] - if false, skip DOM reorder (for virtual scroll tables)
+   * @returns {Object} instance with sort(), destroy(), getState() methods
+   */
+  function init(tableEl, options) {
+    if (!tableEl) return null;
+    options = options || {};
+    var thead = tableEl.querySelector('thead');
+    if (!thead) return null;
+
+    var state = { column: options.defaultColumn || null, direction: options.defaultDirection || 'asc' };
+    var domReorder = options.domReorder !== false;
+
+    // Restore from localStorage
+    if (options.storageKey) {
+      try {
+        var saved = JSON.parse(localStorage.getItem(options.storageKey));
+        if (saved && saved.column) {
+          state.column = saved.column;
+          state.direction = saved.direction || 'asc';
+        }
+      } catch(e) { /* ignore */ }
+    }
+
+    var ths = thead.querySelectorAll('th[data-sort-key]');
+    var thMap = {}; // key → th element
+    var handlers = []; // for cleanup
+
+    for (var i = 0; i < ths.length; i++) {
+      (function(th) {
+        var key = th.getAttribute('data-sort-key');
+        thMap[key] = th;
+        th.style.cursor = 'pointer';
+        th.setAttribute('tabindex', '0');
+        th.setAttribute('aria-sort', 'none');
+
+        var handler = function(e) {
+          if (e.type === 'keydown' && e.key !== 'Enter' && e.key !== ' ') return;
+          if (e.type === 'keydown') e.preventDefault();
+          if (state.column === key) {
+            state.direction = state.direction === 'asc' ? 'desc' : 'asc';
+          } else {
+            state.column = key;
+            state.direction = options.defaultDirection || 'asc';
+          }
+          doSort();
+        };
+
+        th.addEventListener('click', handler);
+        th.addEventListener('keydown', handler);
+        handlers.push({ el: th, click: handler, keydown: handler });
+      })(ths[i]);
+    }
+
+    // Apply initial sort if defaultColumn is set
+    if (state.column && thMap[state.column]) {
+      updateArrows();
+      if (domReorder) sortDOM();
+    }
+
+    function doSort() {
+      updateArrows();
+      if (options.storageKey) {
+        try { localStorage.setItem(options.storageKey, JSON.stringify(state)); } catch(e) { /* ignore */ }
+      }
+      if (domReorder) sortDOM();
+      if (options.onSort) options.onSort(state.column, state.direction);
+    }
+
+    function updateArrows() {
+      for (var k in thMap) {
+        var th = thMap[k];
+        // Remove existing arrow
+        var arrow = th.querySelector('.sort-arrow');
+        if (arrow) arrow.remove();
+
+        if (k === state.column) {
+          th.classList.add('sort-active');
+          th.setAttribute('aria-sort', state.direction === 'asc' ? 'ascending' : 'descending');
+          var span = document.createElement('span');
+          span.className = 'sort-arrow';
+          span.textContent = state.direction === 'asc' ? ' ▲' : ' ▼';
+          th.appendChild(span);
+        } else {
+          th.classList.remove('sort-active');
+          th.setAttribute('aria-sort', 'none');
+        }
+      }
+    }
+
+    function sortDOM() {
+      var tbody = tableEl.querySelector('tbody');
+      if (!tbody) return;
+      var th = thMap[state.column];
+      if (!th) return;
+
+      var cmp = resolveComparator(state.column, th, options.comparators);
+      var colIndex = -1;
+      var allThs = thead.querySelectorAll('th');
+      for (var j = 0; j < allThs.length; j++) {
+        if (allThs[j] === th) { colIndex = j; break; }
+      }
+      if (colIndex < 0) return;
+
+      var rows = Array.prototype.slice.call(tbody.querySelectorAll('tr'));
+      var dir = state.direction === 'asc' ? 1 : -1;
+
+      rows.sort(function(rowA, rowB) {
+        var a = getCellValue(rowA.cells[colIndex]);
+        var b = getCellValue(rowB.cells[colIndex]);
+        return dir * cmp(a, b);
+      });
+
+      // DOM reorder via appendChild (no innerHTML rebuild)
+      for (var r = 0; r < rows.length; r++) {
+        tbody.appendChild(rows[r]);
+      }
+    }
+
+    function destroy() {
+      for (var h = 0; h < handlers.length; h++) {
+        handlers[h].el.removeEventListener('click', handlers[h].click);
+        handlers[h].el.removeEventListener('keydown', handlers[h].keydown);
+        // Clean up aria/classes
+        handlers[h].el.removeAttribute('aria-sort');
+        handlers[h].el.classList.remove('sort-active');
+        var arrow = handlers[h].el.querySelector('.sort-arrow');
+        if (arrow) arrow.remove();
+      }
+      handlers = [];
+    }
+
+    function sort(column, direction) {
+      if (column) state.column = column;
+      if (direction) state.direction = direction;
+      doSort();
+    }
+
+    function getState() {
+      return { column: state.column, direction: state.direction };
+    }
+
+    return { sort: sort, destroy: destroy, getState: getState };
+  }
+
+  return {
+    init: init,
+    comparators: comparators
+  };
+
+})();

test-channel-add-ux.js

@@ -0,0 +1,64 @@
+/**
+ * Tests for #759 — Add channel UX: button, hint, status feedback.
+ * Validates the HTML structure rendered by channels.js init.
+ */
+'use strict';
+
+const fs = require('fs');
+
+let passed = 0;
+let failed = 0;
+
+function assert(cond, msg) {
+  if (cond) { passed++; console.log('  ✓ ' + msg); }
+  else { failed++; console.error('  ✗ ' + msg); }
+}
+
+function assertIncludes(html, substr, msg) {
+  assert(html.includes(substr), msg);
+}
+
+// Read the channels.js source to extract the HTML template
+const src = fs.readFileSync(__dirname + '/public/channels.js', 'utf8');
+
+// Extract the sidebar HTML from the template literal
+const htmlMatch = src.match(/app\.innerHTML\s*=\s*`([\s\S]*?)`;/);
+const html = htmlMatch ? htmlMatch[1] : '';
+
+console.log('Test: Add channel UX (#759)');
+
+// 1. Button renders in the form
+assertIncludes(html, 'class="ch-add-btn"', 'Add button has ch-add-btn class');
+assertIncludes(html, 'type="submit"', 'Button is type=submit');
+assertIncludes(html, '>+</button>', 'Button shows + text');
+
+// 2. Form has proper structure
+assertIncludes(html, 'class="ch-add-form"', 'Form has ch-add-form class');
+assertIncludes(html, 'class="ch-add-row"', 'Row wrapper present');
+assert(!html.includes('class="ch-add-label"'), 'Label removed (redundant with hint)');
+
+// 3. Hint text present
+assertIncludes(html, 'class="ch-add-hint"', 'Hint div present');
+assertIncludes(html, 'e.g. #LongFast or 32-char hex key', 'Hint text correct');
+
+// 4. Status div present
+assertIncludes(html, 'id="chAddStatus"', 'Status div has correct id');
+assertIncludes(html, 'class="ch-add-status"', 'Status div has correct class');
+assertIncludes(html, 'style="display:none"', 'Status div hidden by default');
+
+// 5. showAddStatus function exists in source
+assert(src.includes('function showAddStatus('), 'showAddStatus function defined');
+assert(src.includes("'success'"), 'Success status type referenced');
+assert(src.includes("'error'"), 'Error status type referenced');
+
+// 6. CSS classes exist
+const css = fs.readFileSync(__dirname + '/public/style.css', 'utf8');
+assert(css.includes('.ch-add-form'), 'CSS: .ch-add-form defined');
+assert(css.includes('.ch-add-btn'), 'CSS: .ch-add-btn defined');
+assert(css.includes('.ch-add-hint'), 'CSS: .ch-add-hint defined');
+assert(css.includes('.ch-add-status'), 'CSS: .ch-add-status defined');
+assert(css.includes('.ch-add-row'), 'CSS: .ch-add-row defined');
+// .ch-add-label CSS kept for backward compat but label removed from HTML
+
+console.log('\n' + passed + ' passed, ' + failed + ' failed');
+process.exit(failed > 0 ? 1 : 0);

test-channel-color-picker.js

@@ -0,0 +1,177 @@
+/**
+ * Tests for channel color picker fix (#674)
+ *
+ * Verifies:
+ * 1. _ccChannel is set correctly for GRP_TXT packets (flat decoded structure)
+ * 2. _ccChannel is NOT set for non-GRP_TXT packets
+ * 3. Channel color picker palette is 8 colors
+ * 4. getRowStyle uses border-left only (no background tint)
+ */
+
+'use strict';
+const vm = require('vm');
+const fs = require('fs');
+const path = require('path');
+
+let passed = 0;
+let failed = 0;
+
+function assert(condition, msg) {
+  if (condition) {
+    passed++;
+    console.log(`  ✓ ${msg}`);
+  } else {
+    failed++;
+    console.error(`  ✗ ${msg}`);
+  }
+}
+
+// --- Test 1: _ccChannel extraction logic (simulates live.js behavior) ---
+console.log('\n=== _ccChannel assignment from flat decoded structure ===');
+
+// Simulate the fixed logic from live.js — uses payload.channel (name string),
+// NOT payload.channelHash (numeric byte). Channel colors are keyed by channel
+// name (e.g. "public", "#test") matching the channels API hash field.
+function extractCcChannel(typeName, pkt) {
+  var _ccPayload = (pkt.decoded || {}).payload || {};
+  if (typeName === 'GRP_TXT' || typeName === 'CHAN') {
+    return _ccPayload.channel || null;
+  }
+  return undefined; // not set
+}
+
+// CHAN with channel name (normal case — ingestor-decrypted WS broadcast)
+var chanPkt = {
+  decoded: {
+    header: { payloadTypeName: 'CHAN' },
+    payload: { type: 'CHAN', channel: '#test', channelHash: 217, text: 'hello' }
+  }
+};
+assert(extractCcChannel('CHAN', chanPkt) === '#test', 'CHAN with channel="#test" → _ccChannel="#test"');
+
+// CHAN with "public" channel
+var publicPkt = {
+  decoded: {
+    header: { payloadTypeName: 'CHAN' },
+    payload: { type: 'CHAN', channel: 'public', text: 'hi' }
+  }
+};
+assert(extractCcChannel('CHAN', publicPkt) === 'public', 'CHAN with channel="public" → _ccChannel="public"');
+
+// GRP_TXT without channel (encrypted, no decryption)
+var encryptedPkt = {
+  decoded: {
+    header: { payloadTypeName: 'GRP_TXT' },
+    payload: { type: 'GRP_TXT', channelHash: 5, mac: 'ab12', encryptedData: 'ff' }
+  }
+};
+assert(extractCcChannel('GRP_TXT', encryptedPkt) === null, 'GRP_TXT without channel field → null');
+
+// Non-GRP_TXT packet — should not set _ccChannel
+var advertPkt = {
+  decoded: {
+    header: { payloadTypeName: 'ADVERT' },
+    payload: { type: 'ADVERT', name: 'Node1' }
+  }
+};
+assert(extractCcChannel('ADVERT', advertPkt) === undefined, 'ADVERT → _ccChannel not set');
+
+// Empty decoded
+var emptyPkt = { decoded: {} };
+assert(extractCcChannel('GRP_TXT', emptyPkt) === null, 'GRP_TXT with empty payload → null');
+
+// --- Test 2: _getChannelStyle fix (simulates fixed logic) ---
+console.log('\n=== _getChannelStyle with flat structure ===');
+
+function simulateGetChannelStyle(pkt, channelColors) {
+  var d = pkt.decoded || {};
+  var h = d.header || {};
+  var p = d.payload || {};
+  var ch = p.channel || null;
+  var typeName = h.payloadTypeName || '';
+  if (typeName !== 'GRP_TXT' && typeName !== 'CHAN') return '';
+  if (!ch) return '';
+  var color = channelColors[ch] || null;
+  if (!color) return '';
+  return 'border-left:3px solid ' + color + ';';
+}
+
+var colors = { '#test': '#ef4444' };
+assert(
+  simulateGetChannelStyle(chanPkt, colors) === 'border-left:3px solid #ef4444;',
+  'getChannelStyle returns border-left for assigned color'
+);
+assert(
+  simulateGetChannelStyle(chanPkt, {}) === '',
+  'getChannelStyle returns empty for unassigned channel'
+);
+assert(
+  simulateGetChannelStyle(advertPkt, colors) === '',
+  'getChannelStyle returns empty for non-GRP_TXT'
+);
+
+// --- Test 3: channel-colors.js getRowStyle uses border-left only ---
+console.log('\n=== channel-colors.js getRowStyle ===');
+
+const ccSource = fs.readFileSync(path.join(__dirname, 'public', 'channel-colors.js'), 'utf8');
+const ccCtx = {
+  window: {},
+  localStorage: {
+    _data: {},
+    getItem(k) { return this._data[k] || null; },
+    setItem(k, v) { this._data[k] = v; }
+  }
+};
+vm.createContext(ccCtx);
+vm.runInContext(ccSource, ccCtx);
+
+// Set a color
+ccCtx.window.ChannelColors.set('5', '#3b82f6');
+var style = ccCtx.window.ChannelColors.getRowStyle('GRP_TXT', '5');
+assert(style === 'border-left:3px solid #3b82f6;', 'getRowStyle returns border-left:3px (no background tint)');
+assert(!style.includes('background'), 'getRowStyle has no background property');
+
+var noStyle = ccCtx.window.ChannelColors.getRowStyle('GRP_TXT', '99');
+assert(noStyle === '', 'getRowStyle returns empty for unassigned channel');
+
+var advertStyle = ccCtx.window.ChannelColors.getRowStyle('ADVERT', '5');
+assert(advertStyle === '', 'getRowStyle returns empty for non-GRP_TXT type');
+
+// --- Test 4: channel-color-picker.js palette ---
+console.log('\n=== channel-color-picker.js palette ===');
+
+const pickerSource = fs.readFileSync(path.join(__dirname, 'public', 'channel-color-picker.js'), 'utf8');
+const pickerCtx = {
+  window: { ChannelColors: ccCtx.window.ChannelColors, matchMedia: () => ({ matches: false }) },
+  document: {
+    createElement: () => ({
+      className: '', style: {}, innerHTML: '',
+      setAttribute: () => {},
+      querySelector: () => ({ textContent: '', style: {}, addEventListener: () => {} }),
+      querySelectorAll: () => [],
+      appendChild: () => {},
+      addEventListener: () => {}
+    }),
+    body: { appendChild: () => {}, style: {} },
+    addEventListener: () => {},
+    removeEventListener: () => {},
+    activeElement: null
+  },
+  setTimeout: (fn) => fn(),
+  Array: Array
+};
+vm.createContext(pickerCtx);
+vm.runInContext(pickerSource, pickerCtx);
+
+assert(pickerCtx.window.ChannelColorPicker != null, 'ChannelColorPicker exported');
+assert(Array.isArray(pickerCtx.window.ChannelColorPicker.PALETTE), 'PALETTE is exported');
+assert(pickerCtx.window.ChannelColorPicker.PALETTE.length === 8, 'PALETTE has exactly 8 colors');
+
+// Verify no teal/rose in palette
+var palette = pickerCtx.window.ChannelColorPicker.PALETTE;
+assert(!palette.includes('#14b8a6'), 'No teal in palette');
+assert(!palette.includes('#f43f5e'), 'No rose in palette');
+
+// --- Summary ---
+console.log(`\n${passed + failed} tests: ${passed} passed, ${failed} failed`);
+process.exit(failed > 0 ? 1 : 0);