fix: add missing geoFilter arg to handleMessage test calls

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.badges/backend-coverage.json

@@ -1 +0,0 @@
-{"schemaVersion":1,"label":"backend coverage","message":"87.79%","color":"brightgreen"}

.badges/backend-tests.json

@@ -1 +0,0 @@
-{"schemaVersion":1,"label":"backend tests","message":"998 passed","color":"brightgreen"}

.badges/coverage.json

@@ -1 +0,0 @@
-{"schemaVersion":1,"label":"coverage","message":"76%","color":"yellow"}

.badges/e2e-tests.json

@@ -0,0 +1 @@
+{"schemaVersion":1,"label":"e2e tests","message":"45 passed","color":"brightgreen"}

.badges/frontend-coverage.json

@@ -1 +1 @@
-{"schemaVersion":1,"label":"frontend coverage","message":"31.35%","color":"red"}
+{"schemaVersion":1,"label":"frontend coverage","message":"39.68%","color":"red"}

.badges/go-ingestor-coverage.json

@@ -0,0 +1 @@
+{"schemaVersion":1,"label":"go ingestor coverage","message":"70.2%","color":"yellow"}

.badges/go-server-coverage.json

@@ -0,0 +1 @@
+{"schemaVersion":1,"label":"go server coverage","message":"85.4%","color":"green"}

.badges/tests.json

@@ -1 +0,0 @@
-{"schemaVersion":1,"label":"tests","message":"844/844 passed","color":"brightgreen"}

.gitattributes

@@ -0,0 +1,5 @@
+# Squad: union merge for append-only team state files
+.squad/decisions.md merge=union
+.squad/agents/*/history.md merge=union
+.squad/log/** merge=union
+.squad/orchestration-log/** merge=union

.github/workflows/deploy.yml

@@ -1,320 +1,378 @@
-name: CI/CD Pipeline
-
-on:
-  push:
-    branches: [master]
-  pull_request:
-    branches: [master]
-
-concurrency:
-  group: ci-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-# Pipeline (sequential, fail-fast):
-#   go-test → e2e-test → build → deploy → publish
-#   PRs stop after build. Master continues to deploy + publish.
-
-jobs:
-  # ───────────────────────────────────────────────────────────────
-  # 1. Go Build & Test
-  # ───────────────────────────────────────────────────────────────
-  go-test:
-    name: "✅ Go Build & Test"
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-
-      - name: Set up Go 1.22
-        uses: actions/setup-go@v6
-        with:
-          go-version: '1.22'
-          cache-dependency-path: |
-            cmd/server/go.sum
-            cmd/ingestor/go.sum
-
-      - name: Build and test Go server (with coverage)
-        run: |
-          set -e -o pipefail
-          cd cmd/server
-          go build .
-          go test -coverprofile=server-coverage.out ./... 2>&1 | tee server-test.log
-          echo "--- Go Server Coverage ---"
-          go tool cover -func=server-coverage.out | tail -1
-
-      - name: Build and test Go ingestor (with coverage)
-        run: |
-          set -e -o pipefail
-          cd cmd/ingestor
-          go build .
-          go test -coverprofile=ingestor-coverage.out ./... 2>&1 | tee ingestor-test.log
-          echo "--- Go Ingestor Coverage ---"
-          go tool cover -func=ingestor-coverage.out | tail -1
-
-      - name: Verify proto syntax
-        run: |
-          set -e
-          sudo apt-get update -qq
-          sudo apt-get install -y protobuf-compiler
-          for proto in proto/*.proto; do
-            echo "  ✓ $(basename "$proto")"
-            protoc --proto_path=proto --descriptor_set_out=/dev/null "$proto"
-          done
-          echo "✅ All .proto files are syntactically valid"
-
-      - name: Generate Go coverage badges
-        if: success()
-        run: |
-          mkdir -p .badges
-
-          SERVER_COV="0"
-          if [ -f cmd/server/server-coverage.out ]; then
-            SERVER_COV=$(cd cmd/server && go tool cover -func=server-coverage.out | tail -1 | grep -oP '[\d.]+(?=%)')
-          fi
-          SERVER_COLOR="red"
-          if [ "$(echo "$SERVER_COV >= 80" | bc -l 2>/dev/null)" = "1" ]; then SERVER_COLOR="green"
-          elif [ "$(echo "$SERVER_COV >= 60" | bc -l 2>/dev/null)" = "1" ]; then SERVER_COLOR="yellow"; fi
-          echo "{\"schemaVersion\":1,\"label\":\"go server coverage\",\"message\":\"${SERVER_COV}%\",\"color\":\"${SERVER_COLOR}\"}" > .badges/go-server-coverage.json
-
-          INGESTOR_COV="0"
-          if [ -f cmd/ingestor/ingestor-coverage.out ]; then
-            INGESTOR_COV=$(cd cmd/ingestor && go tool cover -func=ingestor-coverage.out | tail -1 | grep -oP '[\d.]+(?=%)')
-          fi
-          INGESTOR_COLOR="red"
-          if [ "$(echo "$INGESTOR_COV >= 80" | bc -l 2>/dev/null)" = "1" ]; then INGESTOR_COLOR="green"
-          elif [ "$(echo "$INGESTOR_COV >= 60" | bc -l 2>/dev/null)" = "1" ]; then INGESTOR_COLOR="yellow"; fi
-          echo "{\"schemaVersion\":1,\"label\":\"go ingestor coverage\",\"message\":\"${INGESTOR_COV}%\",\"color\":\"${INGESTOR_COLOR}\"}" > .badges/go-ingestor-coverage.json
-
-          echo "## Go Coverage" >> $GITHUB_STEP_SUMMARY
-          echo "| Module | Coverage |" >> $GITHUB_STEP_SUMMARY
-          echo "|--------|----------|" >> $GITHUB_STEP_SUMMARY
-          echo "| Server | ${SERVER_COV}% |" >> $GITHUB_STEP_SUMMARY
-          echo "| Ingestor | ${INGESTOR_COV}% |" >> $GITHUB_STEP_SUMMARY
-
-      - name: Upload Go coverage badges
-        if: success()
-        uses: actions/upload-artifact@v6
-        with:
-          name: go-badges
-          path: .badges/go-*.json
-          retention-days: 1
-          if-no-files-found: ignore
-
-  # ───────────────────────────────────────────────────────────────
-  # 2. Playwright E2E Tests (against Go server with fixture DB)
-  # ───────────────────────────────────────────────────────────────
-  e2e-test:
-    name: "🎭 Playwright E2E Tests"
-    needs: [go-test]
-    runs-on: [self-hosted, Linux]
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-
-      - name: Set up Node.js 22
-        uses: actions/setup-node@v5
-        with:
-          node-version: '22'
-
-      - name: Set up Go 1.22
-        uses: actions/setup-go@v6
-        with:
-          go-version: '1.22'
-          cache-dependency-path: cmd/server/go.sum
-
-      - name: Build Go server
-        run: |
-          cd cmd/server
-          go build -o ../../corescope-server .
-          echo "Go server built successfully"
-
-      - name: Install npm dependencies
-        run: npm ci --production=false
-
-      - name: Install Playwright browser
-        run: |
-          npx playwright install chromium 2>/dev/null || true
-          npx playwright install-deps chromium 2>/dev/null || true
-
-      - name: Instrument frontend JS for coverage
-        run: sh scripts/instrument-frontend.sh
-
-      - name: Start Go server with fixture DB
-        run: |
-          fuser -k 13581/tcp 2>/dev/null || true
-          sleep 1
-          ./corescope-server -port 13581 -db test-fixtures/e2e-fixture.db -public public-instrumented &
-          echo $! > .server.pid
-          for i in $(seq 1 30); do
-            if curl -sf http://localhost:13581/api/stats > /dev/null 2>&1; then
-              echo "Server ready after ${i}s"
-              break
-            fi
-            if [ "$i" -eq 30 ]; then
-              echo "Server failed to start within 30s"
-              exit 1
-            fi
-            sleep 1
-          done
-
-      - name: Run Playwright E2E tests (fail-fast)
-        run: |
-          BASE_URL=http://localhost:13581 node test-e2e-playwright.js 2>&1 | tee e2e-output.txt
-
-      - name: Collect frontend coverage
-        if: success()
-        run: |
-          BASE_URL=http://localhost:13581 node scripts/collect-frontend-coverage.js 2>&1 | tee fe-coverage-output.txt || true
-
-      - name: Generate frontend coverage badges
-        if: success()
-        run: |
-          E2E_PASS=$(grep -oP '[0-9]+(?=/)' e2e-output.txt | tail -1 || echo "0")
-
-          mkdir -p .badges
-          if [ -f .nyc_output/frontend-coverage.json ] || [ -f .nyc_output/e2e-coverage.json ]; then
-            npx nyc report --reporter=text-summary --reporter=text 2>&1 | tee fe-report.txt
-            FE_COVERAGE=$(grep 'Statements' fe-report.txt | head -1 | grep -oP '[\d.]+(?=%)' || echo "0")
-            FE_COVERAGE=${FE_COVERAGE:-0}
-            FE_COLOR="red"
-            [ "$(echo "$FE_COVERAGE > 50" | bc -l 2>/dev/null)" = "1" ] && FE_COLOR="yellow"
-            [ "$(echo "$FE_COVERAGE > 80" | bc -l 2>/dev/null)" = "1" ] && FE_COLOR="brightgreen"
-            echo "{\"schemaVersion\":1,\"label\":\"frontend coverage\",\"message\":\"${FE_COVERAGE}%\",\"color\":\"${FE_COLOR}\"}" > .badges/frontend-coverage.json
-            echo "## Frontend: ${FE_COVERAGE}% coverage" >> $GITHUB_STEP_SUMMARY
-          fi
-          echo "{\"schemaVersion\":1,\"label\":\"e2e tests\",\"message\":\"${E2E_PASS:-0} passed\",\"color\":\"brightgreen\"}" > .badges/e2e-tests.json
-
-      - name: Stop test server
-        if: success()
-        run: |
-          if [ -f .server.pid ]; then
-            kill $(cat .server.pid) 2>/dev/null || true
-            rm -f .server.pid
-          fi
-
-      - name: Upload E2E badges
-        if: success()
-        uses: actions/upload-artifact@v6
-        with:
-          name: e2e-badges
-          path: .badges/
-          retention-days: 1
-          if-no-files-found: ignore
-
-  # ───────────────────────────────────────────────────────────────
-  # 3. Build Docker Image
-  # ───────────────────────────────────────────────────────────────
-  build:
-    name: "🏗️ Build Docker Image"
-    needs: [e2e-test]
-    runs-on: [self-hosted, Linux]
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v5
-
-      - name: Set up Node.js 22
-        uses: actions/setup-node@v5
-        with:
-          node-version: '22'
-
-      - name: Build Go Docker image
-        run: |
-          echo "${GITHUB_SHA::7}" > .git-commit
-          APP_VERSION=$(node -p "require('./package.json').version") \
-          GIT_COMMIT="${GITHUB_SHA::7}" \
-          docker compose --profile staging-go build staging-go
-          echo "Built Go staging image ✅"
-
-  # ───────────────────────────────────────────────────────────────
-  # 4. Deploy Staging (master only)
-  # ───────────────────────────────────────────────────────────────
-  deploy:
-    name: "🚀 Deploy Staging"
-    if: github.event_name == 'push'
-    needs: [build]
-    runs-on: [self-hosted, Linux]
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v5
-
-      - name: Start staging on port 82
-        run: |
-          docker rm -f corescope-staging-go 2>/dev/null || true
-          fuser -k 82/tcp 2>/dev/null || true
-          docker compose --profile staging-go up -d staging-go
-
-      - name: Healthcheck staging container
-        run: |
-          for i in $(seq 1 120); do
-            HEALTH=$(docker inspect corescope-staging-go --format '{{.State.Health.Status}}' 2>/dev/null || echo "starting")
-            if [ "$HEALTH" = "healthy" ]; then
-              echo "Staging healthy after ${i}s"
-              break
-            fi
-            if [ "$i" -eq 120 ]; then
-              echo "Staging failed health check after 120s"
-              docker logs corescope-staging-go --tail 50
-              exit 1
-            fi
-            sleep 1
-          done
-
-      - name: Smoke test staging API
-        run: |
-          if curl -sf http://localhost:82/api/stats | grep -q engine; then
-            echo "Staging verified — engine field present ✅"
-          else
-            echo "Staging /api/stats did not return engine field"
-            exit 1
-          fi
-
-  # ───────────────────────────────────────────────────────────────
-  # 5. Publish Badges & Summary (master only)
-  # ───────────────────────────────────────────────────────────────
-  publish:
-    name: "📝 Publish Badges & Summary"
-    if: github.event_name == 'push'
-    needs: [deploy]
-    runs-on: [self-hosted, Linux]
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v5
-
-      - name: Download Go coverage badges
-        continue-on-error: true
-        uses: actions/download-artifact@v6
-        with:
-          name: go-badges
-          path: .badges/
-
-      - name: Download E2E badges
-        continue-on-error: true
-        uses: actions/download-artifact@v6
-        with:
-          name: e2e-badges
-          path: .badges/
-
-      - name: Publish coverage badges to repo
-        continue-on-error: true
-        run: |
-          git config user.name "github-actions"
-          git config user.email "actions@github.com"
-          git remote set-url origin https://x-access-token:${{ github.token }}@github.com/${{ github.repository }}.git
-          git add .badges/ -f
-          git diff --cached --quiet || (git commit -m "ci: update test badges [skip ci]" && git push) || echo "Badge push failed"
-
-      - name: Post deployment summary
-        run: |
-          echo "## Staging Deployed ✓" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Commit:** \`$(git rev-parse --short HEAD)\` — $(git log -1 --format=%s)" >> $GITHUB_STEP_SUMMARY
+name: CI/CD Pipeline
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  STAGING_COMPOSE_FILE: docker-compose.staging.yml
+  STAGING_SERVICE: staging-go
+  STAGING_CONTAINER: corescope-staging-go
+
+# Pipeline (sequential, fail-fast):
+#   go-test → e2e-test → build → deploy → publish
+#   PRs stop after build. Master continues to deploy + publish.
+
+jobs:
+  # ───────────────────────────────────────────────────────────────
+  # 1. Go Build & Test
+  # ───────────────────────────────────────────────────────────────
+  go-test:
+    name: "✅ Go Build & Test"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Clean Go module cache
+        run: rm -rf ~/go/pkg/mod 2>/dev/null || true
+
+      - name: Set up Go 1.22
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.22'
+          cache-dependency-path: |
+            cmd/server/go.sum
+            cmd/ingestor/go.sum
+
+      - name: Build and test Go server (with coverage)
+        run: |
+          set -e -o pipefail
+          cd cmd/server
+          go build .
+          go test -coverprofile=server-coverage.out ./... 2>&1 | tee server-test.log
+          echo "--- Go Server Coverage ---"
+          go tool cover -func=server-coverage.out | tail -1
+
+      - name: Build and test Go ingestor (with coverage)
+        run: |
+          set -e -o pipefail
+          cd cmd/ingestor
+          go build .
+          go test -coverprofile=ingestor-coverage.out ./... 2>&1 | tee ingestor-test.log
+          echo "--- Go Ingestor Coverage ---"
+          go tool cover -func=ingestor-coverage.out | tail -1
+
+      - name: Verify proto syntax
+        run: |
+          set -e
+          sudo apt-get update -qq
+          sudo apt-get install -y protobuf-compiler
+          for proto in proto/*.proto; do
+            echo "  ✓ $(basename "$proto")"
+            protoc --proto_path=proto --descriptor_set_out=/dev/null "$proto"
+          done
+          echo "✅ All .proto files are syntactically valid"
+
+      - name: Generate Go coverage badges
+        if: success()
+        run: |
+          mkdir -p .badges
+
+          SERVER_COV="0"
+          if [ -f cmd/server/server-coverage.out ]; then
+            SERVER_COV=$(cd cmd/server && go tool cover -func=server-coverage.out | tail -1 | grep -oP '[\d.]+(?=%)')
+          fi
+          SERVER_COLOR="red"
+          if [ "$(echo "$SERVER_COV >= 80" | bc -l 2>/dev/null)" = "1" ]; then SERVER_COLOR="green"
+          elif [ "$(echo "$SERVER_COV >= 60" | bc -l 2>/dev/null)" = "1" ]; then SERVER_COLOR="yellow"; fi
+          echo "{\"schemaVersion\":1,\"label\":\"go server coverage\",\"message\":\"${SERVER_COV}%\",\"color\":\"${SERVER_COLOR}\"}" > .badges/go-server-coverage.json
+
+          INGESTOR_COV="0"
+          if [ -f cmd/ingestor/ingestor-coverage.out ]; then
+            INGESTOR_COV=$(cd cmd/ingestor && go tool cover -func=ingestor-coverage.out | tail -1 | grep -oP '[\d.]+(?=%)')
+          fi
+          INGESTOR_COLOR="red"
+          if [ "$(echo "$INGESTOR_COV >= 80" | bc -l 2>/dev/null)" = "1" ]; then INGESTOR_COLOR="green"
+          elif [ "$(echo "$INGESTOR_COV >= 60" | bc -l 2>/dev/null)" = "1" ]; then INGESTOR_COLOR="yellow"; fi
+          echo "{\"schemaVersion\":1,\"label\":\"go ingestor coverage\",\"message\":\"${INGESTOR_COV}%\",\"color\":\"${INGESTOR_COLOR}\"}" > .badges/go-ingestor-coverage.json
+
+          echo "## Go Coverage" >> $GITHUB_STEP_SUMMARY
+          echo "| Module | Coverage |" >> $GITHUB_STEP_SUMMARY
+          echo "|--------|----------|" >> $GITHUB_STEP_SUMMARY
+          echo "| Server | ${SERVER_COV}% |" >> $GITHUB_STEP_SUMMARY
+          echo "| Ingestor | ${INGESTOR_COV}% |" >> $GITHUB_STEP_SUMMARY
+
+      - name: Upload Go coverage badges
+        if: success()
+        uses: actions/upload-artifact@v6
+        with:
+          name: go-badges
+          path: .badges/go-*.json
+          retention-days: 1
+          if-no-files-found: ignore
+          include-hidden-files: true
+
+  # ───────────────────────────────────────────────────────────────
+  # 2. Playwright E2E Tests (against Go server with fixture DB)
+  # ───────────────────────────────────────────────────────────────
+  e2e-test:
+    name: "🎭 Playwright E2E Tests"
+    needs: [go-test]
+    runs-on: [self-hosted, Linux]
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Set up Node.js 22
+        uses: actions/setup-node@v5
+        with:
+          node-version: '22'
+
+      - name: Clean Go module cache
+        run: rm -rf ~/go/pkg/mod 2>/dev/null || true
+
+      - name: Set up Go 1.22
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.22'
+          cache-dependency-path: cmd/server/go.sum
+
+      - name: Build Go server
+        run: |
+          cd cmd/server
+          go build -o ../../corescope-server .
+          echo "Go server built successfully"
+
+      - name: Install npm dependencies
+        run: npm ci --production=false
+
+      - name: Install Playwright browser
+        run: |
+          npx playwright install chromium 2>/dev/null || true
+          npx playwright install-deps chromium 2>/dev/null || true
+
+      - name: Instrument frontend JS for coverage
+        run: sh scripts/instrument-frontend.sh
+
+      - name: Start Go server with fixture DB
+        run: |
+          fuser -k 13581/tcp 2>/dev/null || true
+          sleep 1
+          ./corescope-server -port 13581 -db test-fixtures/e2e-fixture.db -public public-instrumented &
+          echo $! > .server.pid
+          for i in $(seq 1 30); do
+            if curl -sf http://localhost:13581/api/stats > /dev/null 2>&1; then
+              echo "Server ready after ${i}s"
+              break
+            fi
+            if [ "$i" -eq 30 ]; then
+              echo "Server failed to start within 30s"
+              exit 1
+            fi
+            sleep 1
+          done
+
+      - name: Run Playwright E2E tests (fail-fast)
+        run: |
+          BASE_URL=http://localhost:13581 node test-e2e-playwright.js 2>&1 | tee e2e-output.txt
+
+      - name: Collect frontend coverage (parallel)
+        if: success() && github.event_name == 'push'
+        run: |
+          BASE_URL=http://localhost:13581 node scripts/collect-frontend-coverage.js 2>&1 | tee fe-coverage-output.txt || true
+
+      - name: Generate frontend coverage badges
+        if: success()
+        run: |
+          E2E_PASS=$(grep -oP '[0-9]+(?=/)' e2e-output.txt | tail -1 || echo "0")
+
+          mkdir -p .badges
+          if [ -f .nyc_output/frontend-coverage.json ] || [ -f .nyc_output/e2e-coverage.json ]; then
+            npx nyc report --reporter=text-summary --reporter=text 2>&1 | tee fe-report.txt
+            FE_COVERAGE=$(grep 'Statements' fe-report.txt | head -1 | grep -oP '[\d.]+(?=%)' || echo "0")
+            FE_COVERAGE=${FE_COVERAGE:-0}
+            FE_COLOR="red"
+            [ "$(echo "$FE_COVERAGE > 50" | bc -l 2>/dev/null)" = "1" ] && FE_COLOR="yellow"
+            [ "$(echo "$FE_COVERAGE > 80" | bc -l 2>/dev/null)" = "1" ] && FE_COLOR="brightgreen"
+            echo "{\"schemaVersion\":1,\"label\":\"frontend coverage\",\"message\":\"${FE_COVERAGE}%\",\"color\":\"${FE_COLOR}\"}" > .badges/frontend-coverage.json
+            echo "## Frontend: ${FE_COVERAGE}% coverage" >> $GITHUB_STEP_SUMMARY
+          fi
+          echo "{\"schemaVersion\":1,\"label\":\"e2e tests\",\"message\":\"${E2E_PASS:-0} passed\",\"color\":\"brightgreen\"}" > .badges/e2e-tests.json
+
+      - name: Stop test server
+        if: always()
+        run: |
+          if [ -f .server.pid ]; then
+            kill $(cat .server.pid) 2>/dev/null || true
+            rm -f .server.pid
+          fi
+
+      - name: Upload E2E badges
+        if: success()
+        uses: actions/upload-artifact@v6
+        with:
+          name: e2e-badges
+          path: .badges/
+          retention-days: 1
+          if-no-files-found: ignore
+          include-hidden-files: true
+
+  # ───────────────────────────────────────────────────────────────
+  # 3. Build Docker Image
+  # ───────────────────────────────────────────────────────────────
+  build:
+    name: "🏗️ Build Docker Image"
+    needs: [e2e-test]
+    runs-on: [self-hosted, Linux]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Set up Node.js 22
+        uses: actions/setup-node@v5
+        with:
+          node-version: '22'
+
+      - name: Build Go Docker image
+        run: |
+          echo "${GITHUB_SHA::7}" > .git-commit
+          APP_VERSION=$(node -p "require('./package.json').version") \
+          GIT_COMMIT="${GITHUB_SHA::7}" \
+          APP_VERSION=$(grep -oP 'APP_VERSION:-\K[^}]+' docker-compose.yml | head -1 || echo "3.0.0")
+          GIT_COMMIT=$(git rev-parse --short HEAD)
+          BUILD_TIME=$(date -u '+%Y-%m-%dT%H:%M:%SZ')
+          export APP_VERSION GIT_COMMIT BUILD_TIME
+          docker compose -f "$STAGING_COMPOSE_FILE" -p corescope-staging build "$STAGING_SERVICE"
+          echo "Built Go staging image ✅"
+
+  # ───────────────────────────────────────────────────────────────
+  # 4. Deploy Staging (master only)
+  # ───────────────────────────────────────────────────────────────
+  deploy:
+    name: "🚀 Deploy Staging"
+    if: github.event_name == 'push'
+    needs: [build]
+    runs-on: [self-hosted, Linux]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Deploy staging
+        run: |
+          # Use docker compose down (not just stop/rm) to properly clean up
+          # the old container, network, and release memory before starting new one
+          docker compose -f "$STAGING_COMPOSE_FILE" -p corescope-staging down --timeout 30 2>/dev/null || true
+
+          # Wait for container to be fully gone and OS to reclaim memory (3GB limit)
+          for i in $(seq 1 15); do
+            if ! docker ps -a --format '{{.Names}}' | grep -q 'corescope-staging-go'; then
+              break
+            fi
+            sleep 1
+          done
+          sleep 5  # extra pause for OS memory reclaim
+
+          # Ensure staging config exists (docker creates a directory if bind mount source missing)
+          STAGING_DATA="${STAGING_DATA_DIR:-$HOME/meshcore-staging-data}"
+          mkdir -p "$STAGING_DATA"
+          # Remove directory-masquerading-as-file left by failed docker mount
+          [ -d "$STAGING_DATA/config.json" ] && rm -rf "$STAGING_DATA/config.json"
+          if [ ! -f "$STAGING_DATA/config.json" ]; then
+            echo "Staging config missing — copying from repo config.json"
+            cp config.json "$STAGING_DATA/config.json" 2>/dev/null || cp config.example.json "$STAGING_DATA/config.json"
+          fi
+
+          docker compose -f "$STAGING_COMPOSE_FILE" -p corescope-staging up -d staging-go
+
+      - name: Healthcheck staging container
+        run: |
+          for i in $(seq 1 120); do
+            HEALTH=$(docker inspect corescope-staging-go --format '{{.State.Health.Status}}' 2>/dev/null || echo "starting")
+            if [ "$HEALTH" = "healthy" ]; then
+              echo "Staging healthy after ${i}s"
+              break
+            fi
+            if [ "$i" -eq 120 ]; then
+              echo "Staging failed health check after 120s"
+              docker logs corescope-staging-go --tail 50
+              exit 1
+            fi
+            sleep 1
+          done
+
+      - name: Smoke test staging API
+        run: |
+          if curl -sf http://localhost:82/api/stats | grep -q engine; then
+            echo "Staging verified — engine field present ✅"
+          else
+            echo "Staging /api/stats did not return engine field"
+            exit 1
+          fi
+
+  # ───────────────────────────────────────────────────────────────
+  # 5. Publish Badges & Summary (master only)
+  # ───────────────────────────────────────────────────────────────
+  publish:
+    name: "📝 Publish Badges & Summary"
+    if: github.event_name == 'push'
+    needs: [deploy]
+    runs-on: [self-hosted, Linux]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Download Go coverage badges
+        continue-on-error: true
+        uses: actions/download-artifact@v6
+        with:
+          name: go-badges
+          path: .badges/
+
+      - name: Download E2E badges
+        continue-on-error: true
+        uses: actions/download-artifact@v6
+        with:
+          name: e2e-badges
+          path: .badges/
+
+      - name: Publish coverage badges to repo
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ secrets.BADGE_PUSH_TOKEN }}
+        run: |
+          # GITHUB_TOKEN cannot push to protected branches (required status checks).
+          # Use admin PAT (BADGE_PUSH_TOKEN) via GitHub Contents API instead.
+          for badge in .badges/*.json; do
+            FILENAME=$(basename "$badge")
+            FILEPATH=".badges/$FILENAME"
+            CONTENT=$(base64 -w0 "$badge")
+            CURRENT_SHA=$(gh api "repos/${{ github.repository }}/contents/$FILEPATH" --jq '.sha' 2>/dev/null || echo "")
+            if [ -n "$CURRENT_SHA" ]; then
+              gh api "repos/${{ github.repository }}/contents/$FILEPATH" \
+                -X PUT \
+                -f message="ci: update $FILENAME [skip ci]" \
+                -f content="$CONTENT" \
+                -f sha="$CURRENT_SHA" \
+                -f branch="master" \
+                --silent 2>&1 || echo "Failed to update $FILENAME"
+            else
+              gh api "repos/${{ github.repository }}/contents/$FILEPATH" \
+                -X PUT \
+                -f message="ci: update $FILENAME [skip ci]" \
+                -f content="$CONTENT" \
+                -f branch="master" \
+                --silent 2>&1 || echo "Failed to create $FILENAME"
+            fi
+          done
+          echo "Badge publish complete"
+
+      - name: Post deployment summary
+        run: |
+          echo "## Staging Deployed ✓" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Commit:** \`$(git rev-parse --short HEAD)\` — $(git log -1 --format=%s)" >> $GITHUB_STEP_SUMMARY

.github/workflows/squad-heartbeat.yml

@@ -0,0 +1,171 @@
+name: Squad Heartbeat (Ralph)
+# ⚠️ SYNC: This workflow is maintained in 4 locations. Changes must be applied to all:
+#   - templates/workflows/squad-heartbeat.yml (source template)
+#   - packages/squad-cli/templates/workflows/squad-heartbeat.yml (CLI package)
+#   - .squad/templates/workflows/squad-heartbeat.yml (installed template)
+#   - .github/workflows/squad-heartbeat.yml (active workflow)
+# Run 'squad upgrade' to sync installed copies from source templates.
+
+on:
+  schedule:
+    # Every 30 minutes — adjust via cron expression as needed
+    - cron: '*/30 * * * *'
+
+  # React to completed work or new squad work
+  issues:
+    types: [closed, labeled]
+  pull_request:
+    types: [closed]
+
+  # Manual trigger
+  workflow_dispatch:
+
+permissions:
+  issues: write
+  contents: read
+  pull-requests: read
+
+jobs:
+  heartbeat:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check triage script
+        id: check-script
+        run: |
+          if [ -f ".squad/templates/ralph-triage.js" ]; then
+            echo "has_script=true" >> $GITHUB_OUTPUT
+          else
+            echo "has_script=false" >> $GITHUB_OUTPUT
+            echo "⚠️ ralph-triage.js not found — run 'squad upgrade' to install"
+          fi
+
+      - name: Ralph — Smart triage
+        if: steps.check-script.outputs.has_script == 'true'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          node .squad/templates/ralph-triage.js \
+            --squad-dir .squad \
+            --output triage-results.json
+
+      - name: Ralph — Apply triage decisions
+        if: steps.check-script.outputs.has_script == 'true' && hashFiles('triage-results.json') != ''
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const path = 'triage-results.json';
+            if (!fs.existsSync(path)) {
+              core.info('No triage results — board is clear');
+              return;
+            }
+            
+            const results = JSON.parse(fs.readFileSync(path, 'utf8'));
+            if (results.length === 0) {
+              core.info('📋 Board is clear — Ralph found no untriaged issues');
+              return;
+            }
+            
+            for (const decision of results) {
+              try {
+                await github.rest.issues.addLabels({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: decision.issueNumber,
+                  labels: [decision.label]
+                });
+                
+                await github.rest.issues.createComment({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: decision.issueNumber,
+                  body: [
+                    '### 🔄 Ralph — Auto-Triage',
+                    '',
+                    `**Assigned to:** ${decision.assignTo}`,
+                    `**Reason:** ${decision.reason}`,
+                    `**Source:** ${decision.source}`,
+                    '',
+                    '> Ralph auto-triaged this issue using routing rules.',
+                    '> To reassign, swap the `squad:*` label.'
+                  ].join('\n')
+                });
+                
+                core.info(`Triaged #${decision.issueNumber} → ${decision.assignTo} (${decision.source})`);
+              } catch (e) {
+                core.warning(`Failed to triage #${decision.issueNumber}: ${e.message}`);
+              }
+            }
+            
+            core.info(`🔄 Ralph triaged ${results.length} issue(s)`);
+
+      # Copilot auto-assign step (uses PAT if available)
+      - name: Ralph — Assign @copilot issues
+        if: success()
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.COPILOT_ASSIGN_TOKEN || secrets.GITHUB_TOKEN }}
+          script: |
+            const fs = require('fs');
+
+            let teamFile = '.squad/team.md';
+            if (!fs.existsSync(teamFile)) {
+              teamFile = '.ai-team/team.md';
+            }
+            if (!fs.existsSync(teamFile)) return;
+
+            const content = fs.readFileSync(teamFile, 'utf8');
+
+            // Check if @copilot is on the team with auto-assign
+            const hasCopilot = content.includes('🤖 Coding Agent') || content.includes('@copilot');
+            const autoAssign = content.includes('<!-- copilot-auto-assign: true -->');
+            if (!hasCopilot || !autoAssign) return;
+
+            // Find issues labeled squad:copilot with no assignee
+            try {
+              const { data: copilotIssues } = await github.rest.issues.listForRepo({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                labels: 'squad:copilot',
+                state: 'open',
+                per_page: 5
+              });
+
+              const unassigned = copilotIssues.filter(i =>
+                !i.assignees || i.assignees.length === 0
+              );
+
+              if (unassigned.length === 0) {
+                core.info('No unassigned squad:copilot issues');
+                return;
+              }
+
+              // Get repo default branch
+              const { data: repoData } = await github.rest.repos.get({
+                owner: context.repo.owner,
+                repo: context.repo.repo
+              });
+
+              for (const issue of unassigned) {
+                try {
+                  await github.request('POST /repos/{owner}/{repo}/issues/{issue_number}/assignees', {
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: issue.number,
+                    assignees: ['copilot-swe-agent[bot]'],
+                    agent_assignment: {
+                      target_repo: `${context.repo.owner}/${context.repo.repo}`,
+                      base_branch: repoData.default_branch,
+                      custom_instructions: `Read .squad/team.md (or .ai-team/team.md) for team context and .squad/routing.md (or .ai-team/routing.md) for routing rules.`
+                    }
+                  });
+                  core.info(`Assigned copilot-swe-agent[bot] to #${issue.number}`);
+                } catch (e) {
+                  core.warning(`Failed to assign @copilot to #${issue.number}: ${e.message}`);
+                }
+              }
+            } catch (e) {
+              core.info(`No squad:copilot label found or error: ${e.message}`);
+            }

.github/workflows/squad-issue-assign.yml

@@ -0,0 +1,161 @@
+name: Squad Issue Assign
+
+on:
+  issues:
+    types: [labeled]
+
+permissions:
+  issues: write
+  contents: read
+
+jobs:
+  assign-work:
+    # Only trigger on squad:{member} labels (not the base "squad" label)
+    if: startsWith(github.event.label.name, 'squad:')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Identify assigned member and trigger work
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const issue = context.payload.issue;
+            const label = context.payload.label.name;
+
+            // Extract member name from label (e.g., "squad:ripley" → "ripley")
+            const memberName = label.replace('squad:', '').toLowerCase();
+
+            // Read team roster — check .squad/ first, fall back to .ai-team/
+            let teamFile = '.squad/team.md';
+            if (!fs.existsSync(teamFile)) {
+              teamFile = '.ai-team/team.md';
+            }
+            if (!fs.existsSync(teamFile)) {
+              core.warning('No .squad/team.md or .ai-team/team.md found — cannot assign work');
+              return;
+            }
+
+            const content = fs.readFileSync(teamFile, 'utf8');
+            const lines = content.split('\n');
+
+            // Check if this is a coding agent assignment
+            const isCopilotAssignment = memberName === 'copilot';
+
+            let assignedMember = null;
+            if (isCopilotAssignment) {
+              assignedMember = { name: '@copilot', role: 'Coding Agent' };
+            } else {
+              let inMembersTable = false;
+              for (const line of lines) {
+                if (line.match(/^##\s+(Members|Team Roster)/i)) {
+                  inMembersTable = true;
+                  continue;
+                }
+                if (inMembersTable && line.startsWith('## ')) {
+                  break;
+                }
+                if (inMembersTable && line.startsWith('|') && !line.includes('---') && !line.includes('Name')) {
+                  const cells = line.split('|').map(c => c.trim()).filter(Boolean);
+                  if (cells.length >= 2 && cells[0].toLowerCase() === memberName) {
+                    assignedMember = { name: cells[0], role: cells[1] };
+                    break;
+                  }
+                }
+              }
+            }
+
+            if (!assignedMember) {
+              core.warning(`No member found matching label "${label}"`);
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issue.number,
+                body: `⚠️ No squad member found matching label \`${label}\`. Check \`.squad/team.md\` (or \`.ai-team/team.md\`) for valid member names.`
+              });
+              return;
+            }
+
+            // Post assignment acknowledgment
+            let comment;
+            if (isCopilotAssignment) {
+              comment = [
+                `### 🤖 Routed to @copilot (Coding Agent)`,
+                '',
+                `**Issue:** #${issue.number} — ${issue.title}`,
+                '',
+                `@copilot has been assigned and will pick this up automatically.`,
+                '',
+                `> The coding agent will create a \`copilot/*\` branch and open a draft PR.`,
+                `> Review the PR as you would any team member's work.`,
+              ].join('\n');
+            } else {
+              comment = [
+                `### 📋 Assigned to ${assignedMember.name} (${assignedMember.role})`,
+                '',
+                `**Issue:** #${issue.number} — ${issue.title}`,
+                '',
+                `${assignedMember.name} will pick this up in the next Copilot session.`,
+                '',
+                `> **For Copilot coding agent:** If enabled, this issue will be worked automatically.`,
+                `> Otherwise, start a Copilot session and say:`,
+                `> \`${assignedMember.name}, work on issue #${issue.number}\``,
+              ].join('\n');
+            }
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: issue.number,
+              body: comment
+            });
+
+            core.info(`Issue #${issue.number} assigned to ${assignedMember.name} (${assignedMember.role})`);
+
+      # Separate step: assign @copilot using PAT (required for coding agent)
+      - name: Assign @copilot coding agent
+        if: github.event.label.name == 'squad:copilot'
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.COPILOT_ASSIGN_TOKEN }}
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const issue_number = context.payload.issue.number;
+
+            // Get the default branch name (main, master, etc.)
+            const { data: repoData } = await github.rest.repos.get({ owner, repo });
+            const baseBranch = repoData.default_branch;
+
+            try {
+              await github.request('POST /repos/{owner}/{repo}/issues/{issue_number}/assignees', {
+                owner,
+                repo,
+                issue_number,
+                assignees: ['copilot-swe-agent[bot]'],
+                agent_assignment: {
+                  target_repo: `${owner}/${repo}`,
+                  base_branch: baseBranch,
+                  custom_instructions: '',
+                  custom_agent: '',
+                  model: ''
+                },
+                headers: {
+                  'X-GitHub-Api-Version': '2022-11-28'
+                }
+              });
+              core.info(`Assigned copilot-swe-agent to issue #${issue_number} (base: ${baseBranch})`);
+            } catch (err) {
+              core.warning(`Assignment with agent_assignment failed: ${err.message}`);
+              // Fallback: try without agent_assignment
+              try {
+                await github.rest.issues.addAssignees({
+                  owner, repo, issue_number,
+                  assignees: ['copilot-swe-agent']
+                });
+                core.info(`Fallback assigned copilot-swe-agent to issue #${issue_number}`);
+              } catch (err2) {
+                core.warning(`Fallback also failed: ${err2.message}`);
+              }
+            }

.github/workflows/squad-triage.yml

@@ -0,0 +1,260 @@
+name: Squad Triage
+
+on:
+  issues:
+    types: [labeled]
+
+permissions:
+  issues: write
+  contents: read
+
+jobs:
+  triage:
+    if: github.event.label.name == 'squad'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Triage issue via Lead agent
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const issue = context.payload.issue;
+
+            // Read team roster — check .squad/ first, fall back to .ai-team/
+            let teamFile = '.squad/team.md';
+            if (!fs.existsSync(teamFile)) {
+              teamFile = '.ai-team/team.md';
+            }
+            if (!fs.existsSync(teamFile)) {
+              core.warning('No .squad/team.md or .ai-team/team.md found — cannot triage');
+              return;
+            }
+
+            const content = fs.readFileSync(teamFile, 'utf8');
+            const lines = content.split('\n');
+
+            // Check if @copilot is on the team
+            const hasCopilot = content.includes('🤖 Coding Agent');
+            const copilotAutoAssign = content.includes('<!-- copilot-auto-assign: true -->');
+
+            // Parse @copilot capability profile
+            let goodFitKeywords = [];
+            let needsReviewKeywords = [];
+            let notSuitableKeywords = [];
+
+            if (hasCopilot) {
+              // Extract capability tiers from team.md
+              const goodFitMatch = content.match(/🟢\s*Good fit[^:]*:\s*(.+)/i);
+              const needsReviewMatch = content.match(/🟡\s*Needs review[^:]*:\s*(.+)/i);
+              const notSuitableMatch = content.match(/🔴\s*Not suitable[^:]*:\s*(.+)/i);
+
+              if (goodFitMatch) {
+                goodFitKeywords = goodFitMatch[1].toLowerCase().split(',').map(s => s.trim());
+              } else {
+                goodFitKeywords = ['bug fix', 'test coverage', 'lint', 'format', 'dependency update', 'small feature', 'scaffolding', 'doc fix', 'documentation'];
+              }
+              if (needsReviewMatch) {
+                needsReviewKeywords = needsReviewMatch[1].toLowerCase().split(',').map(s => s.trim());
+              } else {
+                needsReviewKeywords = ['medium feature', 'refactoring', 'api endpoint', 'migration'];
+              }
+              if (notSuitableMatch) {
+                notSuitableKeywords = notSuitableMatch[1].toLowerCase().split(',').map(s => s.trim());
+              } else {
+                notSuitableKeywords = ['architecture', 'system design', 'security', 'auth', 'encryption', 'performance'];
+              }
+            }
+
+            const members = [];
+            let inMembersTable = false;
+            for (const line of lines) {
+              if (line.match(/^##\s+(Members|Team Roster)/i)) {
+                inMembersTable = true;
+                continue;
+              }
+              if (inMembersTable && line.startsWith('## ')) {
+                break;
+              }
+              if (inMembersTable && line.startsWith('|') && !line.includes('---') && !line.includes('Name')) {
+                const cells = line.split('|').map(c => c.trim()).filter(Boolean);
+                if (cells.length >= 2 && cells[0] !== 'Scribe') {
+                  members.push({
+                    name: cells[0],
+                    role: cells[1]
+                  });
+                }
+              }
+            }
+
+            // Read routing rules — check .squad/ first, fall back to .ai-team/
+            let routingFile = '.squad/routing.md';
+            if (!fs.existsSync(routingFile)) {
+              routingFile = '.ai-team/routing.md';
+            }
+            let routingContent = '';
+            if (fs.existsSync(routingFile)) {
+              routingContent = fs.readFileSync(routingFile, 'utf8');
+            }
+
+            // Find the Lead
+            const lead = members.find(m =>
+              m.role.toLowerCase().includes('lead') ||
+              m.role.toLowerCase().includes('architect') ||
+              m.role.toLowerCase().includes('coordinator')
+            );
+
+            if (!lead) {
+              core.warning('No Lead role found in team roster — cannot triage');
+              return;
+            }
+
+            // Build triage context
+            const memberList = members.map(m =>
+              `- **${m.name}** (${m.role}) → label: \`squad:${m.name.toLowerCase()}\``
+            ).join('\n');
+
+            // Determine best assignee based on issue content and routing
+            const issueText = `${issue.title}\n${issue.body || ''}`.toLowerCase();
+
+            let assignedMember = null;
+            let triageReason = '';
+            let copilotTier = null;
+
+            // First, evaluate @copilot fit if enabled
+            if (hasCopilot) {
+              const isNotSuitable = notSuitableKeywords.some(kw => issueText.includes(kw));
+              const isGoodFit = !isNotSuitable && goodFitKeywords.some(kw => issueText.includes(kw));
+              const isNeedsReview = !isNotSuitable && !isGoodFit && needsReviewKeywords.some(kw => issueText.includes(kw));
+
+              if (isGoodFit) {
+                copilotTier = 'good-fit';
+                assignedMember = { name: '@copilot', role: 'Coding Agent' };
+                triageReason = '🟢 Good fit for @copilot — matches capability profile';
+              } else if (isNeedsReview) {
+                copilotTier = 'needs-review';
+                assignedMember = { name: '@copilot', role: 'Coding Agent' };
+                triageReason = '🟡 Routing to @copilot (needs review) — a squad member should review the PR';
+              } else if (isNotSuitable) {
+                copilotTier = 'not-suitable';
+                // Fall through to normal routing
+              }
+            }
+
+            // If not routed to @copilot, use keyword-based routing
+            if (!assignedMember) {
+              for (const member of members) {
+                const role = member.role.toLowerCase();
+                if ((role.includes('frontend') || role.includes('ui')) &&
+                    (issueText.includes('ui') || issueText.includes('frontend') ||
+                     issueText.includes('css') || issueText.includes('component') ||
+                     issueText.includes('button') || issueText.includes('page') ||
+                     issueText.includes('layout') || issueText.includes('design'))) {
+                  assignedMember = member;
+                  triageReason = 'Issue relates to frontend/UI work';
+                  break;
+                }
+                if ((role.includes('backend') || role.includes('api') || role.includes('server')) &&
+                    (issueText.includes('api') || issueText.includes('backend') ||
+                     issueText.includes('database') || issueText.includes('endpoint') ||
+                     issueText.includes('server') || issueText.includes('auth'))) {
+                  assignedMember = member;
+                  triageReason = 'Issue relates to backend/API work';
+                  break;
+                }
+                if ((role.includes('test') || role.includes('qa') || role.includes('quality')) &&
+                    (issueText.includes('test') || issueText.includes('bug') ||
+                     issueText.includes('fix') || issueText.includes('regression') ||
+                     issueText.includes('coverage'))) {
+                  assignedMember = member;
+                  triageReason = 'Issue relates to testing/quality work';
+                  break;
+                }
+                if ((role.includes('devops') || role.includes('infra') || role.includes('ops')) &&
+                    (issueText.includes('deploy') || issueText.includes('ci') ||
+                     issueText.includes('pipeline') || issueText.includes('docker') ||
+                     issueText.includes('infrastructure'))) {
+                  assignedMember = member;
+                  triageReason = 'Issue relates to DevOps/infrastructure work';
+                  break;
+                }
+              }
+            }
+
+            // Default to Lead if no routing match
+            if (!assignedMember) {
+              assignedMember = lead;
+              triageReason = 'No specific domain match — assigned to Lead for further analysis';
+            }
+
+            const isCopilot = assignedMember.name === '@copilot';
+            const assignLabel = isCopilot ? 'squad:copilot' : `squad:${assignedMember.name.toLowerCase()}`;
+
+            // Add the member-specific label
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: issue.number,
+              labels: [assignLabel]
+            });
+
+            // Apply default triage verdict
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: issue.number,
+              labels: ['go:needs-research']
+            });
+
+            // Auto-assign @copilot if enabled
+            if (isCopilot && copilotAutoAssign) {
+              try {
+                await github.rest.issues.addAssignees({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: issue.number,
+                  assignees: ['copilot']
+                });
+              } catch (err) {
+                core.warning(`Could not auto-assign @copilot: ${err.message}`);
+              }
+            }
+
+            // Build copilot evaluation note
+            let copilotNote = '';
+            if (hasCopilot && !isCopilot) {
+              if (copilotTier === 'not-suitable') {
+                copilotNote = `\n\n**@copilot evaluation:** 🔴 Not suitable — issue involves work outside the coding agent's capability profile.`;
+              } else {
+                copilotNote = `\n\n**@copilot evaluation:** No strong capability match — routed to squad member.`;
+              }
+            }
+
+            // Post triage comment
+            const comment = [
+              `### 🏗️ Squad Triage — ${lead.name} (${lead.role})`,
+              '',
+              `**Issue:** #${issue.number} — ${issue.title}`,
+              `**Assigned to:** ${assignedMember.name} (${assignedMember.role})`,
+              `**Reason:** ${triageReason}`,
+              copilotTier === 'needs-review' ? `\n⚠️ **PR review recommended** — a squad member should review @copilot's work on this one.` : '',
+              copilotNote,
+              '',
+              `---`,
+              '',
+              `**Team roster:**`,
+              memberList,
+              hasCopilot ? `- **@copilot** (Coding Agent) → label: \`squad:copilot\`` : '',
+              '',
+              `> To reassign, remove the current \`squad:*\` label and add the correct one.`,
+            ].filter(Boolean).join('\n');
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: issue.number,
+              body: comment
+            });
+
+            core.info(`Triaged issue #${issue.number} → ${assignedMember.name} (${assignLabel})`);

.github/workflows/sync-squad-labels.yml

@@ -0,0 +1,169 @@
+name: Sync Squad Labels
+
+on:
+  push:
+    paths:
+      - '.squad/team.md'
+      - '.ai-team/team.md'
+  workflow_dispatch:
+
+permissions:
+  issues: write
+  contents: read
+
+jobs:
+  sync-labels:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Parse roster and sync labels
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            let teamFile = '.squad/team.md';
+            if (!fs.existsSync(teamFile)) {
+              teamFile = '.ai-team/team.md';
+            }
+
+            if (!fs.existsSync(teamFile)) {
+              core.info('No .squad/team.md or .ai-team/team.md found — skipping label sync');
+              return;
+            }
+
+            const content = fs.readFileSync(teamFile, 'utf8');
+            const lines = content.split('\n');
+
+            // Parse the Members table for agent names
+            const members = [];
+            let inMembersTable = false;
+            for (const line of lines) {
+              if (line.match(/^##\s+(Members|Team Roster)/i)) {
+                inMembersTable = true;
+                continue;
+              }
+              if (inMembersTable && line.startsWith('## ')) {
+                break;
+              }
+              if (inMembersTable && line.startsWith('|') && !line.includes('---') && !line.includes('Name')) {
+                const cells = line.split('|').map(c => c.trim()).filter(Boolean);
+                if (cells.length >= 2 && cells[0] !== 'Scribe') {
+                  members.push({
+                    name: cells[0],
+                    role: cells[1]
+                  });
+                }
+              }
+            }
+
+            core.info(`Found ${members.length} squad members: ${members.map(m => m.name).join(', ')}`);
+
+            // Check if @copilot is on the team
+            const hasCopilot = content.includes('🤖 Coding Agent');
+
+            // Define label color palette for squad labels
+            const SQUAD_COLOR = '9B8FCC';
+            const MEMBER_COLOR = '9B8FCC';
+            const COPILOT_COLOR = '10b981';
+
+            // Define go: and release: labels (static)
+            const GO_LABELS = [
+              { name: 'go:yes', color: '0E8A16', description: 'Ready to implement' },
+              { name: 'go:no', color: 'B60205', description: 'Not pursuing' },
+              { name: 'go:needs-research', color: 'FBCA04', description: 'Needs investigation' }
+            ];
+
+            const RELEASE_LABELS = [
+              { name: 'release:v0.4.0', color: '6B8EB5', description: 'Targeted for v0.4.0' },
+              { name: 'release:v0.5.0', color: '6B8EB5', description: 'Targeted for v0.5.0' },
+              { name: 'release:v0.6.0', color: '8B7DB5', description: 'Targeted for v0.6.0' },
+              { name: 'release:v1.0.0', color: '8B7DB5', description: 'Targeted for v1.0.0' },
+              { name: 'release:backlog', color: 'D4E5F7', description: 'Not yet targeted' }
+            ];
+
+            const TYPE_LABELS = [
+              { name: 'type:feature', color: 'DDD1F2', description: 'New capability' },
+              { name: 'type:bug', color: 'FF0422', description: 'Something broken' },
+              { name: 'type:spike', color: 'F2DDD4', description: 'Research/investigation — produces a plan, not code' },
+              { name: 'type:docs', color: 'D4E5F7', description: 'Documentation work' },
+              { name: 'type:chore', color: 'D4E5F7', description: 'Maintenance, refactoring, cleanup' },
+              { name: 'type:epic', color: 'CC4455', description: 'Parent issue that decomposes into sub-issues' }
+            ];
+
+            // High-signal labels — these MUST visually dominate all others
+            const SIGNAL_LABELS = [
+              { name: 'bug', color: 'FF0422', description: 'Something isn\'t working' },
+              { name: 'feedback', color: '00E5FF', description: 'User feedback — high signal, needs attention' }
+            ];
+
+            const PRIORITY_LABELS = [
+              { name: 'priority:p0', color: 'B60205', description: 'Blocking release' },
+              { name: 'priority:p1', color: 'D93F0B', description: 'This sprint' },
+              { name: 'priority:p2', color: 'FBCA04', description: 'Next sprint' }
+            ];
+
+            // Ensure the base "squad" triage label exists
+            const labels = [
+              { name: 'squad', color: SQUAD_COLOR, description: 'Squad triage inbox — Lead will assign to a member' }
+            ];
+
+            for (const member of members) {
+              labels.push({
+                name: `squad:${member.name.toLowerCase()}`,
+                color: MEMBER_COLOR,
+                description: `Assigned to ${member.name} (${member.role})`
+              });
+            }
+
+            // Add @copilot label if coding agent is on the team
+            if (hasCopilot) {
+              labels.push({
+                name: 'squad:copilot',
+                color: COPILOT_COLOR,
+                description: 'Assigned to @copilot (Coding Agent) for autonomous work'
+              });
+            }
+
+            // Add go:, release:, type:, priority:, and high-signal labels
+            labels.push(...GO_LABELS);
+            labels.push(...RELEASE_LABELS);
+            labels.push(...TYPE_LABELS);
+            labels.push(...PRIORITY_LABELS);
+            labels.push(...SIGNAL_LABELS);
+
+            // Sync labels (create or update)
+            for (const label of labels) {
+              try {
+                await github.rest.issues.getLabel({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  name: label.name
+                });
+                // Label exists — update it
+                await github.rest.issues.updateLabel({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  name: label.name,
+                  color: label.color,
+                  description: label.description
+                });
+                core.info(`Updated label: ${label.name}`);
+              } catch (err) {
+                if (err.status === 404) {
+                  // Label doesn't exist — create it
+                  await github.rest.issues.createLabel({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    name: label.name,
+                    color: label.color,
+                    description: label.description
+                  });
+                  core.info(`Created label: ${label.name}`);
+                } else {
+                  throw err;
+                }
+              }
+            }
+
+            core.info(`Label sync complete: ${labels.length} labels synced`);

.gitignore

@@ -29,3 +29,4 @@ cmd/server/server.exe
 cmd/ingestor/ingestor.exe
 # CI trigger
 !test-fixtures/e2e-fixture.db
+corescope-server

.nycrc.json

@@ -0,0 +1,10 @@
+{
+  "include": [
+    "public/*.js"
+  ],
+  "exclude": [
+    "public/vendor/**",
+    "public/leaflet-*.js",
+    "public/qrcode*.js"
+  ]
+}

AGENTS.md

@@ -4,14 +4,20 @@ Guide for AI agents working on this codebase. Read this before writing any code.
 
 ## Architecture
 
-Single Node.js server + static frontend. No build step. No framework. No bundler.
+Go backend + static frontend. No build step. No framework. No bundler.
+
+**⚠️ The Node.js server (server.js) is DEPRECATED and has been removed. All backend code is in Go.**
+**⚠️ DO NOT create or modify any Node.js server files. All backend changes go in `cmd/server/` or `cmd/ingestor/`.**
 
 ```
-server.js          — Express API + MQTT ingestion + WebSocket broadcast
-decoder.js         — MeshCore packet parser (header, path, payload, adverts)
-packet-store.js    — In-memory packet store + query engine (backed by SQLite)
-db.js              — SQLite schema + prepared statements
-public/            — Frontend (vanilla JS, one file per page)
+cmd/server/        — Go API server (REST + WebSocket broadcast + static file serving)
+  main.go          — Entry point, flags, SPA handler
+  routes.go        — All /api/* endpoints
+  store.go         — In-memory packet store + analytics + SQLite queries
+  config.go        — Configuration loading
+  decoder.go       — MeshCore packet decoder
+cmd/ingestor/      — Go MQTT ingestor (separate binary, writes to shared SQLite DB)
+public/            — Frontend (vanilla JS, one file per page) — ACTIVE, NOT DEPRECATED
   app.js           — SPA router, shared globals, theme loading
   roles.js         — ROLE_COLORS, TYPE_COLORS, health thresholds, shared helpers
   nodes.js         — Nodes list + side pane + full detail page
@@ -28,17 +34,25 @@ public/            — Frontend (vanilla JS, one file per page)
   live.css         — Live page styles
   home.css         — Home page styles
   index.html       — SPA shell, script/style tags with cache busters
+test-fixtures/     — Real data SQLite fixture from staging (used for E2E tests)
+scripts/           — Tooling (coverage collector, fixture capture, frontend instrumentation)
 ```
 
 ### Data Flow
-1. MQTT brokers → server.js ingests packets → decoder.js parses → packet-store.js stores in memory + SQLite
-2. WebSocket broadcasts new packets to connected browsers
-3. Frontend fetches via REST API, filters/sorts client-side
+1. MQTT brokers → Go ingestor (`cmd/ingestor/`) ingests packets → decodes → writes to SQLite
+2. Go server (`cmd/server/`) polls SQLite for new packets, broadcasts via WebSocket
+3. Frontend fetches via REST API (`/api/*`), filters/sorts client-side
+
+### What's Deprecated (DO NOT TOUCH)
+The following were part of the old Node.js backend and have been removed:
+- `server.js`, `db.js`, `decoder.js`, `server-helpers.js`, `packet-store.js`, `iata-coords.js`
+- All `test-server-*.js`, `test-decoder*.js`, `test-db*.js`, `test-regional*.js` files
+- If you see references to these in comments or docs, they're stale — ignore them
 
 ## Rules — Read These First
 
 ### 1. No commit without tests
-Every change that touches logic MUST have unit tests. Run `node test-packet-filter.js && node test-aging.js` before pushing. If you add new logic, add tests to the appropriate test file or create a new one. No exceptions.
+Every change that touches logic MUST have tests. For Go backend: `cd cmd/server && go test ./...` and `cd cmd/ingestor && go test ./...`. For frontend: `node test-packet-filter.js && node test-aging.js && node test-frontend-helpers.js`. If you add new logic, add tests. No exceptions.
 
 ### 2. No commit without browser validation
 After pushing, verify the change works in an actual browser. Use `browser profile=openclaw` against the running instance. Take a screenshot if the change is visual. If you can't validate it, say so — don't claim it works.

Dockerfile

@@ -9,6 +9,7 @@ ARG BUILD_TIME=unknown
 # Build server
 WORKDIR /build/server
 COPY cmd/server/go.mod cmd/server/go.sum ./
+COPY internal/geofilter/ ../../internal/geofilter/
 RUN go mod download
 COPY cmd/server/ ./
 RUN go build -ldflags "-X main.Version=${APP_VERSION} -X main.Commit=${GIT_COMMIT} -X main.BuildTime=${BUILD_TIME}" -o /corescope-server .

README.md

@@ -1,10 +1,10 @@
 # CoreScope
 
-[![Go Server Coverage](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Kpa-clawbot/corescope/master/.badges/go-server-coverage.json)](https://github.com/Kpa-clawbot/corescope/actions/workflows/deploy.yml)
-[![Go Ingestor Coverage](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Kpa-clawbot/corescope/master/.badges/go-ingestor-coverage.json)](https://github.com/Kpa-clawbot/corescope/actions/workflows/deploy.yml)
-[![Frontend Tests](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Kpa-clawbot/corescope/master/.badges/frontend-tests.json)](https://github.com/Kpa-clawbot/corescope/actions/workflows/deploy.yml)
-[![Frontend Coverage](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Kpa-clawbot/corescope/master/.badges/frontend-coverage.json)](https://github.com/Kpa-clawbot/corescope/actions/workflows/deploy.yml)
-[![Deploy](https://github.com/Kpa-clawbot/corescope/actions/workflows/deploy.yml/badge.svg)](https://github.com/Kpa-clawbot/corescope/actions/workflows/deploy.yml)
+[![Go Server Coverage](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Kpa-clawbot/CoreScope/master/.badges/go-server-coverage.json)](https://github.com/Kpa-clawbot/CoreScope/actions/workflows/deploy.yml)
+[![Go Ingestor Coverage](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Kpa-clawbot/CoreScope/master/.badges/go-ingestor-coverage.json)](https://github.com/Kpa-clawbot/CoreScope/actions/workflows/deploy.yml)
+[![E2E Tests](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Kpa-clawbot/CoreScope/master/.badges/e2e-tests.json)](https://github.com/Kpa-clawbot/CoreScope/actions/workflows/deploy.yml)
+[![Frontend Coverage](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Kpa-clawbot/CoreScope/master/.badges/frontend-coverage.json)](https://github.com/Kpa-clawbot/CoreScope/actions/workflows/deploy.yml)
+[![Deploy](https://github.com/Kpa-clawbot/CoreScope/actions/workflows/deploy.yml/badge.svg)](https://github.com/Kpa-clawbot/CoreScope/actions/workflows/deploy.yml)
 
 > High-performance mesh network analyzer powered by Go. Sub-millisecond packet queries, ~300 MB memory for 56K+ packets, real-time WebSocket broadcast, full channel decryption.
 
@@ -79,7 +79,7 @@ Full experience on your phone — proper touch controls, iOS safe area support,
 No Go installation needed — everything builds inside the container.
 
 ```bash
-git clone https://github.com/Kpa-clawbot/corescope.git
+git clone https://github.com/Kpa-clawbot/CoreScope.git
 cd corescope
 ./manage.sh setup
 ```

benchmark-ab.sh

@@ -1,131 +0,0 @@
-#!/bin/bash
-# A/B benchmark: old (pre-perf) vs new (current)
-# Usage: ./benchmark-ab.sh
-set -e
-
-PORT_OLD=13003
-PORT_NEW=13004
-RUNS=3
-DB_PATH="$(pwd)/data/meshcore.db"
-
-OLD_COMMIT="23caae4"
-NEW_COMMIT="$(git rev-parse HEAD)"
-
-echo "═══════════════════════════════════════════════════════"
-echo "  A/B Benchmark: Pre-optimization vs Current"
-echo "═══════════════════════════════════════════════════════"
-echo "OLD: $OLD_COMMIT (v2.0.1 — before any perf work)"
-echo "NEW: $NEW_COMMIT (current)"
-echo "Runs per endpoint: $RUNS"
-echo ""
-
-# Get a real node pubkey for testing
-ORIG_DIR="$(pwd)"
-PUBKEY=$(sqlite3 "$DB_PATH" "SELECT public_key FROM nodes ORDER BY last_seen DESC LIMIT 1")
-echo "Test node: ${PUBKEY:0:16}..."
-echo ""
-
-# Setup old version in temp dir
-OLD_DIR=$(mktemp -d)
-echo "Cloning old version to $OLD_DIR..."
-git worktree add "$OLD_DIR" "$OLD_COMMIT" --quiet 2>/dev/null || {
-  git worktree add "$OLD_DIR" "$OLD_COMMIT" --detach --quiet
-}
-# Copy config + db symlink
-# Copy config + db + share node_modules
-cp config.json "$OLD_DIR/"
-mkdir -p "$OLD_DIR/data"
-cp "$ORIG_DIR/data/meshcore.db" "$OLD_DIR/data/meshcore.db"
-ln -sf "$ORIG_DIR/node_modules" "$OLD_DIR/node_modules"
-
-ENDPOINTS=(
-  "Stats|/api/stats"
-  "Packets(50)|/api/packets?limit=50"
-  "PacketsGrouped|/api/packets?limit=50&groupByHash=true"
-  "NodesList|/api/nodes?limit=50"
-  "NodeDetail|/api/nodes/$PUBKEY"
-  "NodeHealth|/api/nodes/$PUBKEY/health"
-  "NodeAnalytics|/api/nodes/$PUBKEY/analytics?days=7"
-  "BulkHealth|/api/nodes/bulk-health?limit=50"
-  "NetworkStatus|/api/nodes/network-status"
-  "Channels|/api/channels"
-  "Observers|/api/observers"
-  "RF|/api/analytics/rf"
-  "Topology|/api/analytics/topology"
-  "ChannelAnalytics|/api/analytics/channels"
-  "HashSizes|/api/analytics/hash-sizes"
-)
-
-bench_endpoint() {
-  local port=$1 path=$2 runs=$3 nocache=$4
-  local total=0
-  for i in $(seq 1 $runs); do
-    local url="http://127.0.0.1:$port$path"
-    if [ "$nocache" = "1" ]; then
-      if echo "$path" | grep -q '?'; then
-        url="${url}&nocache=1"
-      else
-        url="${url}?nocache=1"
-      fi
-    fi
-    local ms=$(curl -s -o /dev/null -w "%{time_total}" "$url" 2>/dev/null)
-    local ms_int=$(echo "$ms * 1000" | bc | cut -d. -f1)
-    total=$((total + ms_int))
-  done
-  echo $((total / runs))
-}
-
-# Launch old server
-echo "Starting OLD server (port $PORT_OLD)..."
-cd "$OLD_DIR"
-PORT=$PORT_OLD node server.js &>/dev/null &
-OLD_PID=$!
-cd - >/dev/null
-
-# Launch new server
-echo "Starting NEW server (port $PORT_NEW)..."
-PORT=$PORT_NEW node server.js &>/dev/null &
-NEW_PID=$!
-
-# Wait for both
-sleep 12  # old server has no memory store; new needs prewarm
-
-# Verify
-curl -s "http://127.0.0.1:$PORT_OLD/api/stats" >/dev/null 2>&1 || { echo "OLD server failed to start"; kill $OLD_PID $NEW_PID 2>/dev/null; exit 1; }
-curl -s "http://127.0.0.1:$PORT_NEW/api/stats" >/dev/null 2>&1 || { echo "NEW server failed to start"; kill $OLD_PID $NEW_PID 2>/dev/null; exit 1; }
-
-echo ""
-echo "Warming up caches on new server..."
-for ep in "${ENDPOINTS[@]}"; do
-  path="${ep#*|}"
-  curl -s -o /dev/null "http://127.0.0.1:$PORT_NEW$path" 2>/dev/null
-done
-sleep 2
-
-printf "\n%-22s %9s %9s %9s %9s\n" "Endpoint" "Old(ms)" "New-cold" "New-cache" "Speedup"
-printf "%-22s %9s %9s %9s %9s\n" "──────────────────────" "─────────" "─────────" "─────────" "─────────"
-
-for ep in "${ENDPOINTS[@]}"; do
-  name="${ep%%|*}"
-  path="${ep#*|}"
-  
-  old_ms=$(bench_endpoint $PORT_OLD "$path" $RUNS 0)
-  new_cold=$(bench_endpoint $PORT_NEW "$path" $RUNS 1)
-  new_cached=$(bench_endpoint $PORT_NEW "$path" $RUNS 0)
-  
-  if [ "$old_ms" -gt 0 ] && [ "$new_cached" -gt 0 ]; then
-    speedup="${old_ms}/${new_cached}"
-    speedup_x=$(echo "scale=0; $old_ms / $new_cached" | bc 2>/dev/null || echo "?")
-    printf "%-22s %7dms %7dms %7dms %7d×\n" "$name" "$old_ms" "$new_cold" "$new_cached" "$speedup_x"
-  else
-    printf "%-22s %7dms %7dms %7dms %9s\n" "$name" "$old_ms" "$new_cold" "$new_cached" "∞"
-  fi
-done
-
-echo ""
-echo "═══════════════════════════════════════════════════════"
-
-# Cleanup
-kill $OLD_PID $NEW_PID 2>/dev/null
-git worktree remove "$OLD_DIR" --force 2>/dev/null
-echo "Done."

benchmark.js

@@ -1,246 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-
-/**
- * Benchmark suite for meshcore-analyzer.
- * Launches two server instances — one with in-memory store, one with pure SQLite —
- * and compares performance side by side.
- *
- * Usage: node benchmark.js [--runs 5] [--json]
- */
-
-const http = require('http');
-const { spawn } = require('child_process');
-const path = require('path');
-
-const args = process.argv.slice(2);
-const RUNS = Number(args.find((a, i) => args[i - 1] === '--runs') || 5);
-const JSON_OUT = args.includes('--json');
-
-const PORT_MEM = 13001;  // In-memory store
-const PORT_SQL = 13002;  // SQLite-only
-
-const ENDPOINTS = [
-  { name: 'Stats', path: '/api/stats' },
-  { name: 'Packets (50)', path: '/api/packets?limit=50' },
-  { name: 'Packets (100)', path: '/api/packets?limit=100' },
-  { name: 'Packets grouped', path: '/api/packets?limit=100&groupByHash=true' },
-  { name: 'Packets filtered', path: '/api/packets?limit=50&type=5' },
-  { name: 'Packets timestamps', path: '/api/packets/timestamps?since=2020-01-01' },
-  { name: 'Nodes list', path: '/api/nodes?limit=50' },
-  { name: 'Node detail', path: '/api/nodes/__FIRST_NODE__' },
-  { name: 'Node health', path: '/api/nodes/__FIRST_NODE__/health' },
-  { name: 'Bulk health', path: '/api/nodes/bulk-health?limit=50' },
-  { name: 'Network status', path: '/api/nodes/network-status' },
-  { name: 'Observers', path: '/api/observers' },
-  { name: 'Channels', path: '/api/channels' },
-  { name: 'RF Analytics', path: '/api/analytics/rf' },
-  { name: 'Topology', path: '/api/analytics/topology' },
-  { name: 'Channel Analytics', path: '/api/analytics/channels' },
-  { name: 'Hash Sizes', path: '/api/analytics/hash-sizes' },
-  { name: 'Subpaths 2-hop', path: '/api/analytics/subpaths?minLen=2&maxLen=2&limit=50' },
-  { name: 'Subpaths 3-hop', path: '/api/analytics/subpaths?minLen=3&maxLen=3&limit=30' },
-  { name: 'Subpaths 4-hop', path: '/api/analytics/subpaths?minLen=4&maxLen=4&limit=20' },
-  { name: 'Subpaths 5-8 hop', path: '/api/analytics/subpaths?minLen=5&maxLen=8&limit=15' },
-];
-
-function fetch(url) {
-  return new Promise((resolve, reject) => {
-    const t0 = process.hrtime.bigint();
-    const req = http.get(url, (res) => {
-      let body = '';
-      res.on('data', c => body += c);
-      res.on('end', () => {
-        const ms = Number(process.hrtime.bigint() - t0) / 1e6;
-        resolve({ ms, bytes: Buffer.byteLength(body), status: res.statusCode, body });
-      });
-    });
-    req.on('error', reject);
-    req.setTimeout(60000, () => { req.destroy(); reject(new Error('timeout')); });
-  });
-}
-
-function median(arr) { const s = [...arr].sort((a,b)=>a-b); return s[Math.floor(s.length/2)]; }
-function p95(arr) { const s = [...arr].sort((a,b)=>a-b); return s[Math.floor(s.length*0.95)]; }
-function avg(arr) { return arr.reduce((a,b)=>a+b,0)/arr.length; }
-function fmt(ms) { return ms >= 1000 ? (ms/1000).toFixed(1)+'s' : ms.toFixed(1)+'ms'; }
-function fmtSize(b) { return b >= 1048576 ? (b/1048576).toFixed(1)+'MB' : b >= 1024 ? (b/1024).toFixed(0)+'KB' : b+'B'; }
-
-function launchServer(port, env = {}) {
-  return new Promise((resolve, reject) => {
-    const child = spawn('node', ['server.js'], {
-      cwd: __dirname,
-      env: { ...process.env, PORT: String(port), ...env },
-      stdio: ['ignore', 'pipe', 'pipe'],
-    });
-    let started = false;
-    const timeout = setTimeout(() => { if (!started) { child.kill(); reject(new Error('Server start timeout')); } }, 30000);
-
-    child.stdout.on('data', (d) => {
-      if (!started && (d.toString().includes('listening') || d.toString().includes('running'))) {
-        started = true; clearTimeout(timeout); resolve(child);
-      }
-    });
-    child.stderr.on('data', (d) => {
-      if (!started && (d.toString().includes('listening') || d.toString().includes('running'))) {
-        started = true; clearTimeout(timeout); resolve(child);
-      }
-    });
-    child.on('exit', (code) => { if (!started) { clearTimeout(timeout); reject(new Error(`Server exited with ${code}`)); } });
-
-    // Fallback: wait longer (SQLite-only mode pre-warms subpaths ~6s)
-    setTimeout(() => {
-      if (!started) {
-        started = true; clearTimeout(timeout);
-        resolve(child);
-      }
-    }, 15000);
-  });
-}
-
-async function waitForServer(port, maxMs = 20000) {
-  const t0 = Date.now();
-  while (Date.now() - t0 < maxMs) {
-    try {
-      const r = await fetch(`http://127.0.0.1:${port}/api/stats`);
-      if (r.status === 200) return true;
-    } catch {}
-    await new Promise(r => setTimeout(r, 500));
-  }
-  throw new Error(`Server on port ${port} didn't start`);
-}
-
-async function benchmarkEndpoints(port, endpoints, nocache = false) {
-  const results = [];
-  for (const ep of endpoints) {
-    const suffix = nocache ? (ep.path.includes('?') ? '&nocache=1' : '?nocache=1') : '';
-    const url = `http://127.0.0.1:${port}${ep.path}${suffix}`;
-
-    // Warm-up
-    try { await fetch(url); } catch {}
-
-    const times = [];
-    let bytes = 0;
-    let failed = false;
-
-    for (let i = 0; i < RUNS; i++) {
-      try {
-        const r = await fetch(url);
-        if (r.status !== 200) { failed = true; break; }
-        times.push(r.ms);
-        bytes = r.bytes;
-      } catch { failed = true; break; }
-    }
-
-    if (failed || !times.length) {
-      results.push({ name: ep.name, failed: true });
-    } else {
-      results.push({
-        name: ep.name,
-        avg: Math.round(avg(times) * 10) / 10,
-        p50: Math.round(median(times) * 10) / 10,
-        p95: Math.round(p95(times) * 10) / 10,
-        bytes
-      });
-    }
-  }
-  return results;
-}
-
-async function run() {
-  console.log(`\nCoreScope Benchmark — ${RUNS} runs per endpoint`);
-  console.log('Launching servers...\n');
-
-  // Launch both servers
-  let memServer, sqlServer;
-  try {
-    console.log('  Starting in-memory server (port ' + PORT_MEM + ')...');
-    memServer = await launchServer(PORT_MEM, {});
-    await waitForServer(PORT_MEM);
-    console.log('  ✅ In-memory server ready');
-
-    console.log('  Starting SQLite-only server (port ' + PORT_SQL + ')...');
-    sqlServer = await launchServer(PORT_SQL, { NO_MEMORY_STORE: '1' });
-    await waitForServer(PORT_SQL);
-    console.log('  ✅ SQLite-only server ready\n');
-  } catch (e) {
-    console.error('Failed to start servers:', e.message);
-    if (memServer) memServer.kill();
-    if (sqlServer) sqlServer.kill();
-    process.exit(1);
-  }
-
-  // Get first node pubkey
-  let firstNode = '';
-  try {
-    const r = await fetch(`http://127.0.0.1:${PORT_MEM}/api/nodes?limit=1`);
-    const data = JSON.parse(r.body);
-    firstNode = data.nodes?.[0]?.public_key || '';
-  } catch {}
-
-  const endpoints = ENDPOINTS.map(e => ({
-    ...e,
-    path: e.path.replace('__FIRST_NODE__', firstNode),
-  }));
-
-  // Get packet count
-  try {
-    const r = await fetch(`http://127.0.0.1:${PORT_MEM}/api/stats`);
-    const stats = JSON.parse(r.body);
-    console.log(`Dataset: ${(stats.totalPackets || '?').toLocaleString()} packets\n`);
-  } catch {}
-
-  // Run benchmarks
-  console.log('Benchmarking in-memory store (nocache for true compute cost)...');
-  const memResults = await benchmarkEndpoints(PORT_MEM, endpoints, true);
-
-  console.log('Benchmarking SQLite-only (nocache)...');
-  const sqlResults = await benchmarkEndpoints(PORT_SQL, endpoints, true);
-
-  // Also test cached in-memory for the full picture
-  console.log('Benchmarking in-memory store (cached)...');
-  const memCachedResults = await benchmarkEndpoints(PORT_MEM, endpoints, false);
-
-  // Kill servers
-  memServer.kill();
-  sqlServer.kill();
-
-  if (JSON_OUT) {
-    console.log(JSON.stringify({ memoryNocache: memResults, sqliteNocache: sqlResults, memoryCached: memCachedResults }, null, 2));
-    return;
-  }
-
-  // Print results
-  const W = 94;
-  console.log(`\n${'═'.repeat(W)}`);
-  console.log('  🏁 BENCHMARK RESULTS: SQLite vs In-Memory Store');
-  console.log(`${'═'.repeat(W)}`);
-  console.log(`${'Endpoint'.padEnd(24)} ${'SQLite'.padStart(9)} ${'Memory'.padStart(9)} ${'Cached'.padStart(9)} ${'Speedup'.padStart(9)} ${'Size (SQL)'.padStart(10)} ${'Size (Mem)'.padStart(10)}`);
-  console.log(`${'─'.repeat(24)} ${'─'.repeat(9)} ${'─'.repeat(9)} ${'─'.repeat(9)} ${'─'.repeat(9)} ${'─'.repeat(10)} ${'─'.repeat(10)}`);
-
-  for (let i = 0; i < endpoints.length; i++) {
-    const sql = sqlResults[i];
-    const mem = memResults[i];
-    const cached = memCachedResults[i];
-    if (!sql || sql.failed || !mem || mem.failed) {
-      console.log(`${endpoints[i].name.padEnd(24)} ${'FAILED'.padStart(9)}`);
-      continue;
-    }
-
-    const speedup = sql.avg > 0 && mem.avg > 0 ? Math.round(sql.avg / mem.avg) + '×' : '—';
-    const cachedStr = cached && !cached.failed ? fmt(cached.avg) : '—';
-
-    console.log(
-      `${sql.name.padEnd(24)} ${fmt(sql.avg).padStart(9)} ${fmt(mem.avg).padStart(9)} ${cachedStr.padStart(9)} ${speedup.padStart(9)} ${fmtSize(sql.bytes).padStart(10)} ${fmtSize(mem.bytes).padStart(10)}`
-    );
-  }
-
-  // Summary
-  const sqlTotal = sqlResults.filter(r => !r.failed).reduce((s, r) => s + r.avg, 0);
-  const memTotal = memResults.filter(r => !r.failed).reduce((s, r) => s + r.avg, 0);
-  console.log(`${'─'.repeat(24)} ${'─'.repeat(9)} ${'─'.repeat(9)} ${'─'.repeat(9)} ${'─'.repeat(9)}`);
-  console.log(`${'TOTAL'.padEnd(24)} ${fmt(sqlTotal).padStart(9)} ${fmt(memTotal).padStart(9)} ${''.padStart(9)} ${(Math.round(sqlTotal/memTotal)+'×').padStart(9)}`);
-  console.log(`\n${'═'.repeat(W)}\n`);
-}
-
-run().catch(e => { console.error(e); process.exit(1); });

cmd/ingestor/config.go

@@ -5,6 +5,8 @@ import (
 	"fmt"
 	"os"
 	"strings"
+
+	"github.com/meshcore-analyzer/geofilter"
 )
 
 // MQTTSource represents a single MQTT broker connection.
@@ -34,8 +36,12 @@ type Config struct {
 	ChannelKeys     map[string]string `json:"channelKeys,omitempty"`
 	HashChannels    []string          `json:"hashChannels,omitempty"`
 	Retention       *RetentionConfig  `json:"retention,omitempty"`
+	GeoFilter       *GeoFilterConfig  `json:"geo_filter,omitempty"`
 }
 
+// GeoFilterConfig is an alias for the shared geofilter.Config type.
+type GeoFilterConfig = geofilter.Config
+
 // RetentionConfig controls how long stale nodes are kept before being moved to inactive_nodes.
 type RetentionConfig struct {
 	NodeDays int `json:"nodeDays"`

cmd/ingestor/decoder.go

@@ -572,6 +572,21 @@ func DecodePacket(hexString string, channelKeys map[string]string) (*DecodedPack
 	payloadBuf := buf[offset:]
 	payload := decodePayload(header.PayloadType, payloadBuf, channelKeys)
 
+	// TRACE packets store hop IDs in the payload (buf[9:]) rather than the header
+	// path field. The header path byte still encodes hashSize in bits 6-7, which
+	// we use to split the payload path data into individual hop prefixes.
+	if header.PayloadType == PayloadTRACE && payload.PathData != "" {
+		pathBytes, err := hex.DecodeString(payload.PathData)
+		if err == nil && path.HashSize > 0 {
+			hops := make([]string, 0, len(pathBytes)/path.HashSize)
+			for i := 0; i+path.HashSize <= len(pathBytes); i += path.HashSize {
+				hops = append(hops, strings.ToUpper(hex.EncodeToString(pathBytes[i:i+path.HashSize])))
+			}
+			path.Hops = hops
+			path.HashCount = len(hops)
+		}
+	}
+
 	return &DecodedPacket{
 		Header:         header,
 		TransportCodes: tc,

cmd/ingestor/decoder_test.go

@@ -564,6 +564,31 @@ func TestDecodeTraceValid(t *testing.T) {
 	}
 }
 
+func TestDecodeTracePathParsing(t *testing.T) {
+	// Packet from issue #276: 260001807dca00000000007d547d
+	// Path byte 0x00 → hashSize=1, hops in payload at buf[9:] = 7d 54 7d
+	// Expected path: ["7D", "54", "7D"]
+	pkt, err := DecodePacket("260001807dca00000000007d547d", nil)
+	if err != nil {
+		t.Fatalf("DecodePacket error: %v", err)
+	}
+	if pkt.Payload.Type != "TRACE" {
+		t.Errorf("payload type=%s, want TRACE", pkt.Payload.Type)
+	}
+	want := []string{"7D", "54", "7D"}
+	if len(pkt.Path.Hops) != len(want) {
+		t.Fatalf("hops=%v, want %v", pkt.Path.Hops, want)
+	}
+	for i, h := range want {
+		if pkt.Path.Hops[i] != h {
+			t.Errorf("hops[%d]=%s, want %s", i, pkt.Path.Hops[i], h)
+		}
+	}
+	if pkt.Path.HashCount != 3 {
+		t.Errorf("hashCount=%d, want 3", pkt.Path.HashCount)
+	}
+}
+
 func TestDecodeAdvertShort(t *testing.T) {
 	p := decodeAdvert(make([]byte, 50))
 	if p.Error != "too short for advert" {

cmd/ingestor/geo_filter.go

@@ -0,0 +1,15 @@
+package main
+
+import "github.com/meshcore-analyzer/geofilter"
+
+// NodePassesGeoFilter returns true if the node should be kept.
+// Nodes with no GPS coordinates are always allowed.
+func NodePassesGeoFilter(lat, lon *float64, gf *GeoFilterConfig) bool {
+	if gf == nil {
+		return true
+	}
+	if lat == nil || lon == nil {
+		return true
+	}
+	return geofilter.PassesFilter(*lat, *lon, gf)
+}

cmd/ingestor/go.mod

@@ -4,9 +4,12 @@ go 1.22
 
 require (
 	github.com/eclipse/paho.mqtt.golang v1.5.0
+	github.com/meshcore-analyzer/geofilter v0.0.0
 	modernc.org/sqlite v1.34.5
 )
 
+replace github.com/meshcore-analyzer/geofilter => ../../internal/geofilter
+
 require (
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/google/uuid v1.6.0 // indirect

cmd/ingestor/main.go

@@ -136,7 +136,7 @@ func main() {
 		// Capture source for closure
 		src := source
 		opts.SetDefaultPublishHandler(func(c mqtt.Client, m mqtt.Message) {
-			handleMessage(store, tag, src, m, channelKeys)
+			handleMessage(store, tag, src, m, channelKeys, cfg.GeoFilter)
 		})
 
 		client := mqtt.NewClient(opts)
@@ -170,7 +170,7 @@ func main() {
 	log.Println("Done.")
 }
 
-func handleMessage(store *Store, tag string, source MQTTSource, m mqtt.Message, channelKeys map[string]string) {
+func handleMessage(store *Store, tag string, source MQTTSource, m mqtt.Message, channelKeys map[string]string, geoFilter *GeoFilterConfig) {
 	defer func() {
 		if r := recover(); r != nil {
 			log.Printf("MQTT [%s] panic in handler: %v", tag, r)
@@ -251,33 +251,43 @@ func handleMessage(store *Store, tag string, source MQTTSource, m mqtt.Message,
 			mqttMsg.Origin = v
 		}
 
-		pktData := BuildPacketData(mqttMsg, decoded, observerID, region)
-		isNew, err := store.InsertTransmission(pktData)
-		if err != nil {
-			log.Printf("MQTT [%s] db insert error: %v", tag, err)
-		}
-
-		// Process ADVERT → upsert node
+		// For ADVERT packets with known coordinates, enforce geo_filter before
+		// storing anything — drop the entire message if outside the area.
 		if decoded.Header.PayloadTypeName == "ADVERT" && decoded.Payload.PubKey != "" {
 			ok, reason := ValidateAdvert(&decoded.Payload)
-			if ok {
-				role := advertRole(decoded.Payload.Flags)
-				if err := store.UpsertNode(decoded.Payload.PubKey, decoded.Payload.Name, role, decoded.Payload.Lat, decoded.Payload.Lon, pktData.Timestamp); err != nil {
-					log.Printf("MQTT [%s] node upsert error: %v", tag, err)
-				}
-				if isNew {
-					if err := store.IncrementAdvertCount(decoded.Payload.PubKey); err != nil {
-						log.Printf("MQTT [%s] advert count error: %v", tag, err)
-					}
-				}
-				// Update telemetry if present in advert
-				if decoded.Payload.BatteryMv != nil || decoded.Payload.TemperatureC != nil {
-					if err := store.UpdateNodeTelemetry(decoded.Payload.PubKey, decoded.Payload.BatteryMv, decoded.Payload.TemperatureC); err != nil {
-						log.Printf("MQTT [%s] node telemetry update error: %v", tag, err)
-					}
-				}
-			} else {
+			if !ok {
 				log.Printf("MQTT [%s] skipping corrupted ADVERT: %s", tag, reason)
+				return
+			}
+			if !NodePassesGeoFilter(decoded.Payload.Lat, decoded.Payload.Lon, geoFilter) {
+				return
+			}
+			pktData := BuildPacketData(mqttMsg, decoded, observerID, region)
+			isNew, err := store.InsertTransmission(pktData)
+			if err != nil {
+				log.Printf("MQTT [%s] db insert error: %v", tag, err)
+			}
+			role := advertRole(decoded.Payload.Flags)
+			if err := store.UpsertNode(decoded.Payload.PubKey, decoded.Payload.Name, role, decoded.Payload.Lat, decoded.Payload.Lon, pktData.Timestamp); err != nil {
+				log.Printf("MQTT [%s] node upsert error: %v", tag, err)
+			}
+			if isNew {
+				if err := store.IncrementAdvertCount(decoded.Payload.PubKey); err != nil {
+					log.Printf("MQTT [%s] advert count error: %v", tag, err)
+				}
+			}
+			// Update telemetry if present in advert
+			if decoded.Payload.BatteryMv != nil || decoded.Payload.TemperatureC != nil {
+				if err := store.UpdateNodeTelemetry(decoded.Payload.PubKey, decoded.Payload.BatteryMv, decoded.Payload.TemperatureC); err != nil {
+					log.Printf("MQTT [%s] node telemetry update error: %v", tag, err)
+				}
+			}
+		} else {
+			// Non-ADVERT packets: store normally (routing/channel messages from
+			// in-area observers are relevant regardless of relay hop origin).
+			pktData := BuildPacketData(mqttMsg, decoded, observerID, region)
+			if _, err := store.InsertTransmission(pktData); err != nil {
+				log.Printf("MQTT [%s] db insert error: %v", tag, err)
 			}
 		}
 

cmd/ingestor/main_test.go

@@ -124,7 +124,7 @@ func TestHandleMessageRawPacket(t *testing.T) {
 	payload := []byte(`{"raw":"` + rawHex + `","SNR":5.5,"RSSI":-100.0,"origin":"myobs"}`)
 	msg := &mockMessage{topic: "meshcore/SJC/obs1/packets", payload: payload}
 
-	handleMessage(store, "test", source, msg, nil)
+	handleMessage(store, "test", source, msg, nil, nil)
 
 	var count int
 	store.db.QueryRow("SELECT COUNT(*) FROM transmissions").Scan(&count)
@@ -141,7 +141,7 @@ func TestHandleMessageRawPacketAdvert(t *testing.T) {
 	payload := []byte(`{"raw":"` + rawHex + `"}`)
 	msg := &mockMessage{topic: "meshcore/SJC/obs1/packets", payload: payload}
 
-	handleMessage(store, "test", source, msg, nil)
+	handleMessage(store, "test", source, msg, nil, nil)
 
 	// Should create a node from the ADVERT
 	var count int
@@ -163,7 +163,7 @@ func TestHandleMessageInvalidJSON(t *testing.T) {
 	msg := &mockMessage{topic: "meshcore/SJC/obs1/packets", payload: []byte(`not json`)}
 
 	// Should not panic
-	handleMessage(store, "test", source, msg, nil)
+	handleMessage(store, "test", source, msg, nil, nil)
 
 	var count int
 	store.db.QueryRow("SELECT COUNT(*) FROM transmissions").Scan(&count)
@@ -180,7 +180,7 @@ func TestHandleMessageStatusTopic(t *testing.T) {
 		payload: []byte(`{"origin":"MyObserver"}`),
 	}
 
-	handleMessage(store, "test", source, msg, nil)
+	handleMessage(store, "test", source, msg, nil, nil)
 
 	var name, iata string
 	err := store.db.QueryRow("SELECT name, iata FROM observers WHERE id = 'obs1'").Scan(&name, &iata)
@@ -201,11 +201,11 @@ func TestHandleMessageSkipStatusTopics(t *testing.T) {
 
 	// meshcore/status should be skipped
 	msg1 := &mockMessage{topic: "meshcore/status", payload: []byte(`{"raw":"0A00"}`)}
-	handleMessage(store, "test", source, msg1, nil)
+	handleMessage(store, "test", source, msg1, nil, nil)
 
 	// meshcore/events/connection should be skipped
 	msg2 := &mockMessage{topic: "meshcore/events/connection", payload: []byte(`{"raw":"0A00"}`)}
-	handleMessage(store, "test", source, msg2, nil)
+	handleMessage(store, "test", source, msg2, nil, nil)
 
 	var count int
 	store.db.QueryRow("SELECT COUNT(*) FROM transmissions").Scan(&count)
@@ -224,7 +224,7 @@ func TestHandleMessageIATAFilter(t *testing.T) {
 		topic:   "meshcore/SJC/obs1/packets",
 		payload: []byte(`{"raw":"` + rawHex + `"}`),
 	}
-	handleMessage(store, "test", source, msg, nil)
+	handleMessage(store, "test", source, msg, nil, nil)
 
 	var count int
 	store.db.QueryRow("SELECT COUNT(*) FROM transmissions").Scan(&count)
@@ -237,7 +237,7 @@ func TestHandleMessageIATAFilter(t *testing.T) {
 		topic:   "meshcore/LAX/obs2/packets",
 		payload: []byte(`{"raw":"` + rawHex + `"}`),
 	}
-	handleMessage(store, "test", source, msg2, nil)
+	handleMessage(store, "test", source, msg2, nil, nil)
 
 	store.db.QueryRow("SELECT COUNT(*) FROM transmissions").Scan(&count)
 	if count != 1 {
@@ -255,7 +255,7 @@ func TestHandleMessageIATAFilterNoRegion(t *testing.T) {
 		topic:   "meshcore",
 		payload: []byte(`{"raw":"` + rawHex + `"}`),
 	}
-	handleMessage(store, "test", source, msg, nil)
+	handleMessage(store, "test", source, msg, nil, nil)
 
 	// No region part → filter doesn't apply, message goes through
 	// Actually the code checks len(parts) > 1 for IATA filter
@@ -271,7 +271,7 @@ func TestHandleMessageNoRawHex(t *testing.T) {
 		topic:   "meshcore/SJC/obs1/packets",
 		payload: []byte(`{"type":"companion","data":"something"}`),
 	}
-	handleMessage(store, "test", source, msg, nil)
+	handleMessage(store, "test", source, msg, nil, nil)
 
 	var count int
 	store.db.QueryRow("SELECT COUNT(*) FROM transmissions").Scan(&count)
@@ -289,7 +289,7 @@ func TestHandleMessageBadRawHex(t *testing.T) {
 		topic:   "meshcore/SJC/obs1/packets",
 		payload: []byte(`{"raw":"ZZZZ"}`),
 	}
-	handleMessage(store, "test", source, msg, nil)
+	handleMessage(store, "test", source, msg, nil, nil)
 
 	var count int
 	store.db.QueryRow("SELECT COUNT(*) FROM transmissions").Scan(&count)
@@ -306,7 +306,7 @@ func TestHandleMessageWithSNRRSSIAsNumbers(t *testing.T) {
 	payload := []byte(`{"raw":"` + rawHex + `","SNR":7.2,"RSSI":-95}`)
 	msg := &mockMessage{topic: "meshcore/SJC/obs1/packets", payload: payload}
 
-	handleMessage(store, "test", source, msg, nil)
+	handleMessage(store, "test", source, msg, nil, nil)
 
 	var snr, rssi *float64
 	store.db.QueryRow("SELECT snr, rssi FROM observations LIMIT 1").Scan(&snr, &rssi)
@@ -325,7 +325,7 @@ func TestHandleMessageMinimalTopic(t *testing.T) {
 		topic:   "meshcore/SJC",
 		payload: []byte(`{"raw":"` + rawHex + `"}`),
 	}
-	handleMessage(store, "test", source, msg, nil)
+	handleMessage(store, "test", source, msg, nil, nil)
 
 	var count int
 	store.db.QueryRow("SELECT COUNT(*) FROM transmissions").Scan(&count)
@@ -346,7 +346,7 @@ func TestHandleMessageCorruptedAdvert(t *testing.T) {
 		topic:   "meshcore/SJC/obs1/packets",
 		payload: []byte(`{"raw":"` + rawHex + `"}`),
 	}
-	handleMessage(store, "test", source, msg, nil)
+	handleMessage(store, "test", source, msg, nil, nil)
 
 	// Transmission should be inserted (even if advert is invalid)
 	var count int
@@ -372,7 +372,7 @@ func TestHandleMessageNoObserverID(t *testing.T) {
 		topic:   "packets",
 		payload: []byte(`{"raw":"` + rawHex + `","origin":"obs1"}`),
 	}
-	handleMessage(store, "test", source, msg, nil)
+	handleMessage(store, "test", source, msg, nil, nil)
 
 	var count int
 	store.db.QueryRow("SELECT COUNT(*) FROM transmissions").Scan(&count)
@@ -394,7 +394,7 @@ func TestHandleMessageSNRNotFloat(t *testing.T) {
 	// SNR as a string value — should not parse as float
 	payload := []byte(`{"raw":"` + rawHex + `","SNR":"bad","RSSI":"bad"}`)
 	msg := &mockMessage{topic: "meshcore/SJC/obs1/packets", payload: payload}
-	handleMessage(store, "test", source, msg, nil)
+	handleMessage(store, "test", source, msg, nil, nil)
 
 	var count int
 	store.db.QueryRow("SELECT COUNT(*) FROM transmissions").Scan(&count)
@@ -410,7 +410,7 @@ func TestHandleMessageOriginExtraction(t *testing.T) {
 	rawHex := "0A00D69FD7A5A7475DB07337749AE61FA53A4788E976"
 	payload := []byte(`{"raw":"` + rawHex + `","origin":"MyOrigin"}`)
 	msg := &mockMessage{topic: "meshcore/SJC/obs1/packets", payload: payload}
-	handleMessage(store, "test", source, msg, nil)
+	handleMessage(store, "test", source, msg, nil, nil)
 
 	// Verify origin was extracted to observer name
 	var name string
@@ -433,7 +433,7 @@ func TestHandleMessagePanicRecovery(t *testing.T) {
 	}
 
 	// Should not panic — the defer/recover should catch it
-	handleMessage(store, "test", source, msg, nil)
+	handleMessage(store, "test", source, msg, nil, nil)
 }
 
 func TestHandleMessageStatusOriginFallback(t *testing.T) {
@@ -445,7 +445,7 @@ func TestHandleMessageStatusOriginFallback(t *testing.T) {
 		topic:   "meshcore/SJC/obs1/status",
 		payload: []byte(`{"type":"status"}`),
 	}
-	handleMessage(store, "test", source, msg, nil)
+	handleMessage(store, "test", source, msg, nil, nil)
 
 	var name string
 	err := store.db.QueryRow("SELECT name FROM observers WHERE id = 'obs1'").Scan(&name)

cmd/server/config.go

@@ -4,6 +4,8 @@ import (
 	"encoding/json"
 	"os"
 	"path/filepath"
+
+	"github.com/meshcore-analyzer/geofilter"
 )
 
 // Config mirrors the Node.js config.json structure (read-only fields).
@@ -45,10 +47,24 @@ type Config struct {
 	CacheTTL map[string]interface{} `json:"cacheTTL"`
 
 	Retention *RetentionConfig `json:"retention,omitempty"`
+
+	PacketStore *PacketStoreConfig `json:"packetStore,omitempty"`
+
+	GeoFilter *GeoFilterConfig `json:"geo_filter,omitempty"`
 }
 
+// PacketStoreConfig controls in-memory packet store limits.
+type PacketStoreConfig struct {
+	RetentionHours float64 `json:"retentionHours"` // max age of packets in hours (0 = unlimited)
+	MaxMemoryMB    int     `json:"maxMemoryMB"`     // hard memory ceiling in MB (0 = unlimited)
+}
+
+// GeoFilterConfig is an alias for the shared geofilter.Config type.
+type GeoFilterConfig = geofilter.Config
+
 type RetentionConfig struct {
-	NodeDays int `json:"nodeDays"`
+	NodeDays   int `json:"nodeDays"`
+	PacketDays int `json:"packetDays"`
 }
 
 // NodeDaysOrDefault returns the configured retention.nodeDays or 7 if not set.

cmd/server/coverage_test.go

@@ -259,7 +259,7 @@ func TestStoreQueryMultiNodePackets(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	t.Run("empty pubkeys", func(t *testing.T) {
@@ -313,7 +313,7 @@ func TestIngestNewFromDB(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	initialMax := store.MaxTransmissionID()
@@ -384,7 +384,7 @@ func TestIngestNewFromDBv2(t *testing.T) {
 	db := setupTestDBv2(t)
 	defer db.Close()
 	seedV2Data(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	initialMax := store.MaxTransmissionID()
@@ -412,7 +412,7 @@ func TestMaxTransmissionID(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	maxID := store.MaxTransmissionID()
@@ -421,7 +421,7 @@ func TestMaxTransmissionID(t *testing.T) {
 	}
 
 	t.Run("empty store", func(t *testing.T) {
-		emptyStore := NewPacketStore(db)
+		emptyStore := NewPacketStore(db, nil)
 		if emptyStore.MaxTransmissionID() != 0 {
 			t.Error("expected 0 for empty store")
 		}
@@ -599,7 +599,7 @@ func TestTransmissionsForObserverIndex(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// Query packets for an observer — hits the byObserver index
@@ -622,7 +622,7 @@ func TestGetChannelMessagesFromStore(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// Test channel should exist from seed data
@@ -675,7 +675,7 @@ func TestGetChannelMessagesDedupe(t *testing.T) {
 	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
 		VALUES (4, 2, 9.0, -93, '[]', ?)`, epoch)
 
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	msgs, total := store.GetChannelMessages("#test", 100, 0)
@@ -692,7 +692,7 @@ func TestGetChannelsFromStore(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	channels := store.GetChannels("")
@@ -872,7 +872,7 @@ func TestPickBestObservation(t *testing.T) {
 func TestIndexByNode(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 
 	t.Run("empty decoded_json", func(t *testing.T) {
 		tx := &StoreTx{Hash: "h1"}
@@ -973,7 +973,7 @@ func TestPollerStartWithStore(t *testing.T) {
 	defer db.Close()
 	seedTestData(t, db)
 	hub := NewHub()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	poller := NewPoller(db, hub, 50*time.Millisecond)
@@ -1000,7 +1000,7 @@ func TestPerfMiddlewareSlowQuery(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	srv.store = store
 
@@ -1339,7 +1339,7 @@ func TestStoreQueryPacketsEdgeCases(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	t.Run("hash filter", func(t *testing.T) {
@@ -1654,7 +1654,7 @@ func TestStorePerfAndCacheStats(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	stats := store.GetPerfStoreStats()
@@ -1674,7 +1674,7 @@ func TestEnrichObs(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// Find an observation from the loaded store
@@ -1928,7 +1928,7 @@ func TestStoreGetTimestamps(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	ts := store.GetTimestamps("2000-01-01")
@@ -1983,7 +1983,7 @@ func setupRichTestDB(t *testing.T) *DB {
 func TestStoreGetBulkHealthWithStore(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	results := store.GetBulkHealth(50, "")
@@ -2009,7 +2009,7 @@ func TestStoreGetBulkHealthWithStore(t *testing.T) {
 func TestStoreGetAnalyticsHashSizes(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	result := store.GetAnalyticsHashSizes("")
@@ -2031,7 +2031,7 @@ func TestStoreGetAnalyticsHashSizes(t *testing.T) {
 func TestStoreGetAnalyticsSubpaths(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	result := store.GetAnalyticsSubpaths("", 2, 8, 100)
@@ -2048,7 +2048,7 @@ func TestStoreGetAnalyticsSubpaths(t *testing.T) {
 func TestSubpathPrecomputedIndex(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// After Load(), the precomputed index must be populated.
@@ -2102,7 +2102,7 @@ func TestSubpathPrecomputedIndex(t *testing.T) {
 func TestStoreGetAnalyticsRFCacheHit(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// First call — cache miss
@@ -2128,7 +2128,7 @@ func TestStoreGetAnalyticsRFCacheHit(t *testing.T) {
 func TestStoreGetAnalyticsTopology(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	result := store.GetAnalyticsTopology("")
@@ -2158,7 +2158,7 @@ func TestStoreGetAnalyticsTopology(t *testing.T) {
 func TestStoreGetAnalyticsChannels(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	result := store.GetAnalyticsChannels("")
@@ -2205,7 +2205,7 @@ func TestStoreGetAnalyticsChannelsNumericHash(t *testing.T) {
 	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
 		VALUES (6, 1, 12.0, -88, '[]', ?)`, recentEpoch)
 
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	result := store.GetAnalyticsChannels("")
 
@@ -2250,7 +2250,7 @@ func TestStoreGetAnalyticsChannelsNumericHash(t *testing.T) {
 func TestStoreGetAnalyticsDistance(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	result := store.GetAnalyticsDistance("")
@@ -2267,7 +2267,7 @@ func TestStoreGetAnalyticsDistance(t *testing.T) {
 func TestStoreGetSubpathDetail(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	result := store.GetSubpathDetail([]string{"aabb", "ccdd"})
@@ -2287,7 +2287,7 @@ func TestHandleAnalyticsRFWithStore(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	srv.store = store
 	router := mux.NewRouter()
@@ -2318,7 +2318,7 @@ func TestHandleBulkHealthWithStore(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	srv.store = store
 	router := mux.NewRouter()
@@ -2338,7 +2338,7 @@ func TestHandleAnalyticsSubpathsWithStore(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	srv.store = store
 	router := mux.NewRouter()
@@ -2358,7 +2358,7 @@ func TestHandleAnalyticsSubpathDetailWithStore(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	srv.store = store
 	router := mux.NewRouter()
@@ -2378,7 +2378,7 @@ func TestHandleAnalyticsDistanceWithStore(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	srv.store = store
 	router := mux.NewRouter()
@@ -2398,7 +2398,7 @@ func TestHandleAnalyticsHashSizesWithStore(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	srv.store = store
 	router := mux.NewRouter()
@@ -2418,7 +2418,7 @@ func TestHandleAnalyticsTopologyWithStore(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	srv.store = store
 	router := mux.NewRouter()
@@ -2438,7 +2438,7 @@ func TestHandleAnalyticsChannelsWithStore(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	srv.store = store
 	router := mux.NewRouter()
@@ -2457,7 +2457,7 @@ func TestHandleAnalyticsChannelsWithStore(t *testing.T) {
 func TestGetChannelMessagesRichData(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	messages, total := store.GetChannelMessages("#test", 100, 0)
@@ -2502,7 +2502,7 @@ func TestHandleChannelMessagesWithStore(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	srv.store = store
 	router := mux.NewRouter()
@@ -2524,7 +2524,7 @@ func TestHandleChannelsWithStore(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	srv.store = store
 	router := mux.NewRouter()
@@ -2556,7 +2556,7 @@ func TestStoreGetStoreStats(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	stats, err := store.GetStoreStats()
@@ -2574,7 +2574,7 @@ func TestStoreQueryGroupedPackets(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	result := store.QueryGroupedPackets(PacketQuery{Limit: 50, Order: "DESC"})
@@ -2589,7 +2589,7 @@ func TestStoreGetPacketByHash(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	pkt := store.GetPacketByHash("abc123def4567890")
@@ -2630,7 +2630,7 @@ func TestResolvePayloadTypeNameUnknown(t *testing.T) {
 func TestCacheHitTopology(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// First call — cache miss
@@ -2655,7 +2655,7 @@ func TestCacheHitTopology(t *testing.T) {
 func TestCacheHitHashSizes(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	r1 := store.GetAnalyticsHashSizes("")
@@ -2678,7 +2678,7 @@ func TestCacheHitHashSizes(t *testing.T) {
 func TestCacheHitChannels(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	r1 := store.GetAnalyticsChannels("")
@@ -2701,7 +2701,7 @@ func TestCacheHitChannels(t *testing.T) {
 func TestGetChannelMessagesEdgeCases(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// Channel not found — empty result
@@ -2735,7 +2735,7 @@ func TestFilterPacketsEmptyRegion(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// Region with no observers → empty result
@@ -2749,7 +2749,7 @@ func TestFilterPacketsSinceUntil(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// Since far future → empty
@@ -2776,7 +2776,7 @@ func TestFilterPacketsHashOnly(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// Single hash fast-path — found
@@ -2796,7 +2796,7 @@ func TestFilterPacketsObserverWithType(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// Observer + type filter (takes non-indexed path)
@@ -2809,7 +2809,7 @@ func TestFilterPacketsNodeFilter(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// Node filter — exercises DecodedJSON containment check
@@ -2892,7 +2892,7 @@ func TestGetNodeHashSizeInfoEdgeCases(t *testing.T) {
 	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
 		VALUES (10, 1, 10.0, -90, '[]', ?)`, recentEpoch)
 
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	info := store.GetNodeHashSizeInfo()
 
@@ -3054,7 +3054,7 @@ func TestGetChannelMessagesDedupeRepeats(t *testing.T) {
 	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
 		VALUES (3, 1, 10.0, -90, '[]', ?)`, recentEpoch)
 
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	msgs, total := store.GetChannelMessages("#general", 10, 0)
@@ -3080,7 +3080,7 @@ func TestTransmissionsForObserverFromSlice(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// Test with from=nil (index path) — for non-existent observer
@@ -3100,7 +3100,7 @@ func TestTransmissionsForObserverFromSlice(t *testing.T) {
 func TestGetPerfStoreStatsPublicKeyField(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	stats := store.GetPerfStoreStats()
@@ -3142,7 +3142,7 @@ func TestStoreGetTransmissionByID(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	pkt := store.GetTransmissionByID(1)
@@ -3162,7 +3162,7 @@ func TestStoreGetPacketByID(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// Get an observation ID from the store
@@ -3194,7 +3194,7 @@ func TestStoreGetObservationsForHash(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	obs := store.GetObservationsForHash("abc123def4567890")
@@ -3366,7 +3366,7 @@ func TestIngestNewFromDBDuplicateObs(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	initialMax := store.MaxTransmissionID()
@@ -3397,7 +3397,7 @@ func TestIngestNewObservations(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// Get initial observation count for transmission 1 (hash abc123def4567890)
@@ -3475,7 +3475,7 @@ func TestIngestNewObservationsV2(t *testing.T) {
 	db := setupTestDBv2(t)
 	defer db.Close()
 	seedV2Data(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	tx := store.byHash["abc123def4567890"]
@@ -3546,7 +3546,7 @@ func TestHandleNodeAnalyticsNameless(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	srv.store = store
 	router := mux.NewRouter()
@@ -3588,7 +3588,7 @@ func TestStoreQueryPacketsRegionFilter(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	result := store.QueryPackets(PacketQuery{Region: "SJC", Limit: 50, Order: "DESC"})
@@ -3676,7 +3676,7 @@ func TestGetChannelMessagesAfterIngest(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	initialMax := store.MaxTransmissionID()

cmd/server/db.go

@@ -1569,3 +1569,39 @@ func nullInt(ni sql.NullInt64) interface{} {
 	}
 	return nil
 }
+
+// PruneOldPackets deletes transmissions and their observations older than the
+// given number of days. Nodes and observers are never touched.
+// Returns the number of transmissions deleted.
+// Opens a separate read-write connection since the main connection is read-only.
+func (db *DB) PruneOldPackets(days int) (int64, error) {
+	dsn := fmt.Sprintf("file:%s?_journal_mode=WAL&_busy_timeout=10000", db.path)
+	rw, err := sql.Open("sqlite", dsn)
+	if err != nil {
+		return 0, err
+	}
+	rw.SetMaxOpenConns(1)
+	defer rw.Close()
+
+	cutoff := time.Now().UTC().AddDate(0, 0, -days).Format(time.RFC3339)
+	tx, err := rw.Begin()
+	if err != nil {
+		return 0, err
+	}
+	defer tx.Rollback()
+
+	// Delete observations linked to old transmissions first (no CASCADE in SQLite)
+	_, err = tx.Exec(`DELETE FROM observations WHERE transmission_id IN (
+		SELECT id FROM transmissions WHERE first_seen < ?
+	)`, cutoff)
+	if err != nil {
+		return 0, err
+	}
+
+	res, err := tx.Exec(`DELETE FROM transmissions WHERE first_seen < ?`, cutoff)
+	if err != nil {
+		return 0, err
+	}
+	n, _ := res.RowsAffected()
+	return n, tx.Commit()
+}

cmd/server/decoder.go

@@ -373,6 +373,21 @@ func DecodePacket(hexString string) (*DecodedPacket, error) {
 	payloadBuf := buf[offset:]
 	payload := decodePayload(header.PayloadType, payloadBuf)
 
+	// TRACE packets store hop IDs in the payload (buf[9:]) rather than the header
+	// path field. The header path byte still encodes hashSize in bits 6-7, which
+	// we use to split the payload path data into individual hop prefixes.
+	if header.PayloadType == PayloadTRACE && payload.PathData != "" {
+		pathBytes, err := hex.DecodeString(payload.PathData)
+		if err == nil && path.HashSize > 0 {
+			hops := make([]string, 0, len(pathBytes)/path.HashSize)
+			for i := 0; i+path.HashSize <= len(pathBytes); i += path.HashSize {
+				hops = append(hops, strings.ToUpper(hex.EncodeToString(pathBytes[i:i+path.HashSize])))
+			}
+			path.Hops = hops
+			path.HashCount = len(hops)
+		}
+	}
+
 	return &DecodedPacket{
 		Header:         header,
 		TransportCodes: tc,

cmd/server/eviction_test.go

@@ -0,0 +1,252 @@
+package main
+
+import (
+	"fmt"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+// makeTestStore creates a PacketStore with fake packets for eviction testing.
+// It does NOT use a DB — indexes are populated manually.
+func makeTestStore(count int, startTime time.Time, intervalMin int) *PacketStore {
+	store := &PacketStore{
+		packets:       make([]*StoreTx, 0, count),
+		byHash:        make(map[string]*StoreTx, count),
+		byTxID:        make(map[int]*StoreTx, count),
+		byObsID:       make(map[int]*StoreObs, count*2),
+		byObserver:    make(map[string][]*StoreObs),
+		byNode:        make(map[string][]*StoreTx),
+		nodeHashes:    make(map[string]map[string]bool),
+		byPayloadType: make(map[int][]*StoreTx),
+		spIndex:       make(map[string]int),
+		distHops:      make([]distHopRecord, 0),
+		distPaths:     make([]distPathRecord, 0),
+		rfCache:       make(map[string]*cachedResult),
+		topoCache:     make(map[string]*cachedResult),
+		hashCache:     make(map[string]*cachedResult),
+		chanCache:     make(map[string]*cachedResult),
+		distCache:     make(map[string]*cachedResult),
+		subpathCache:  make(map[string]*cachedResult),
+		rfCacheTTL:    15 * time.Second,
+	}
+
+	obsID := 1000
+	for i := 0; i < count; i++ {
+		ts := startTime.Add(time.Duration(i*intervalMin) * time.Minute)
+		hash := fmt.Sprintf("hash%04d", i)
+		txID := i + 1
+		pt := 4 // ADVERT
+		decodedJSON := fmt.Sprintf(`{"pubKey":"pk%04d"}`, i)
+
+		tx := &StoreTx{
+			ID:          txID,
+			Hash:        hash,
+			FirstSeen:   ts.UTC().Format(time.RFC3339),
+			PayloadType: &pt,
+			DecodedJSON: decodedJSON,
+			PathJSON:    `["aa","bb","cc"]`,
+		}
+
+		// Add 2 observations per tx
+		for j := 0; j < 2; j++ {
+			obsID++
+			obsIDStr := fmt.Sprintf("obs%d", j)
+			obs := &StoreObs{
+				ID:             obsID,
+				TransmissionID: txID,
+				ObserverID:     obsIDStr,
+				ObserverName:   fmt.Sprintf("Observer%d", j),
+				Timestamp:      ts.UTC().Format(time.RFC3339),
+			}
+			tx.Observations = append(tx.Observations, obs)
+			tx.ObservationCount++
+			store.byObsID[obsID] = obs
+			store.byObserver[obsIDStr] = append(store.byObserver[obsIDStr], obs)
+			store.totalObs++
+		}
+
+		store.packets = append(store.packets, tx)
+		store.byHash[hash] = tx
+		store.byTxID[txID] = tx
+		store.byPayloadType[pt] = append(store.byPayloadType[pt], tx)
+
+		// Index by node
+		pk := fmt.Sprintf("pk%04d", i)
+		if store.nodeHashes[pk] == nil {
+			store.nodeHashes[pk] = make(map[string]bool)
+		}
+		store.nodeHashes[pk][hash] = true
+		store.byNode[pk] = append(store.byNode[pk], tx)
+
+		// Add to distance index
+		store.distHops = append(store.distHops, distHopRecord{tx: tx, Hash: hash})
+		store.distPaths = append(store.distPaths, distPathRecord{tx: tx, Hash: hash})
+
+		// Subpath index
+		addTxToSubpathIndex(store.spIndex, tx)
+	}
+
+	return store
+}
+
+func TestEvictStale_TimeBasedEviction(t *testing.T) {
+	now := time.Now().UTC()
+	// 100 packets: first 50 are 48h old, last 50 are 1h old
+	store := makeTestStore(100, now.Add(-48*time.Hour), 0)
+	// Override: set first 50 to 48h ago, last 50 to 1h ago
+	for i := 0; i < 50; i++ {
+		store.packets[i].FirstSeen = now.Add(-48 * time.Hour).Format(time.RFC3339)
+	}
+	for i := 50; i < 100; i++ {
+		store.packets[i].FirstSeen = now.Add(-1 * time.Hour).Format(time.RFC3339)
+	}
+
+	store.retentionHours = 24
+
+	evicted := store.EvictStale()
+	if evicted != 50 {
+		t.Fatalf("expected 50 evicted, got %d", evicted)
+	}
+	if len(store.packets) != 50 {
+		t.Fatalf("expected 50 remaining, got %d", len(store.packets))
+	}
+	if len(store.byHash) != 50 {
+		t.Fatalf("expected 50 in byHash, got %d", len(store.byHash))
+	}
+	if len(store.byTxID) != 50 {
+		t.Fatalf("expected 50 in byTxID, got %d", len(store.byTxID))
+	}
+	// 50 remaining * 2 obs each = 100 obs
+	if store.totalObs != 100 {
+		t.Fatalf("expected 100 obs remaining, got %d", store.totalObs)
+	}
+	if len(store.byObsID) != 100 {
+		t.Fatalf("expected 100 in byObsID, got %d", len(store.byObsID))
+	}
+	if atomic.LoadInt64(&store.evicted) != 50 {
+		t.Fatalf("expected evicted counter=50, got %d", atomic.LoadInt64(&store.evicted))
+	}
+
+	// Verify evicted hashes are gone
+	if _, ok := store.byHash["hash0000"]; ok {
+		t.Fatal("hash0000 should have been evicted")
+	}
+	// Verify remaining hashes exist
+	if _, ok := store.byHash["hash0050"]; !ok {
+		t.Fatal("hash0050 should still exist")
+	}
+
+	// Verify distance indexes cleaned
+	if len(store.distHops) != 50 {
+		t.Fatalf("expected 50 distHops, got %d", len(store.distHops))
+	}
+	if len(store.distPaths) != 50 {
+		t.Fatalf("expected 50 distPaths, got %d", len(store.distPaths))
+	}
+}
+
+func TestEvictStale_NoEvictionWhenDisabled(t *testing.T) {
+	now := time.Now().UTC()
+	store := makeTestStore(10, now.Add(-48*time.Hour), 60)
+	// No retention set (defaults to 0)
+
+	evicted := store.EvictStale()
+	if evicted != 0 {
+		t.Fatalf("expected 0 evicted, got %d", evicted)
+	}
+	if len(store.packets) != 10 {
+		t.Fatalf("expected 10 remaining, got %d", len(store.packets))
+	}
+}
+
+func TestEvictStale_MemoryBasedEviction(t *testing.T) {
+	now := time.Now().UTC()
+	// Create enough packets to exceed a small memory limit
+	// 1000 packets * 5KB + 2000 obs * 500B ≈ 6MB
+	store := makeTestStore(1000, now.Add(-1*time.Hour), 0)
+	// All packets are recent (1h old) so time-based won't trigger
+	store.retentionHours = 24
+	store.maxMemoryMB = 3 // ~3MB limit, should evict roughly half
+
+	evicted := store.EvictStale()
+	if evicted == 0 {
+		t.Fatal("expected some evictions for memory cap")
+	}
+	// After eviction, estimated memory should be <= 3MB
+	estMB := store.estimatedMemoryMB()
+	if estMB > 3.5 { // small tolerance
+		t.Fatalf("expected <=3.5MB after eviction, got %.1fMB", estMB)
+	}
+}
+
+func TestEvictStale_CleansNodeIndexes(t *testing.T) {
+	now := time.Now().UTC()
+	store := makeTestStore(10, now.Add(-48*time.Hour), 0)
+	store.retentionHours = 24
+
+	// Verify node indexes exist before eviction
+	if len(store.byNode) != 10 {
+		t.Fatalf("expected 10 nodes indexed, got %d", len(store.byNode))
+	}
+	if len(store.nodeHashes) != 10 {
+		t.Fatalf("expected 10 nodeHashes, got %d", len(store.nodeHashes))
+	}
+
+	evicted := store.EvictStale()
+	if evicted != 10 {
+		t.Fatalf("expected 10 evicted, got %d", evicted)
+	}
+
+	// All should be cleaned
+	if len(store.byNode) != 0 {
+		t.Fatalf("expected 0 nodes, got %d", len(store.byNode))
+	}
+	if len(store.nodeHashes) != 0 {
+		t.Fatalf("expected 0 nodeHashes, got %d", len(store.nodeHashes))
+	}
+	if len(store.byPayloadType) != 0 {
+		t.Fatalf("expected 0 payload types, got %d", len(store.byPayloadType))
+	}
+	if len(store.byObserver) != 0 {
+		t.Fatalf("expected 0 observers, got %d", len(store.byObserver))
+	}
+}
+
+func TestEvictStale_RunEvictionThreadSafe(t *testing.T) {
+	now := time.Now().UTC()
+	store := makeTestStore(20, now.Add(-48*time.Hour), 0)
+	store.retentionHours = 24
+
+	evicted := store.RunEviction()
+	if evicted != 20 {
+		t.Fatalf("expected 20 evicted, got %d", evicted)
+	}
+}
+
+func TestStartEvictionTicker_NoopWhenDisabled(t *testing.T) {
+	store := &PacketStore{}
+	stop := store.StartEvictionTicker()
+	stop() // should not panic
+}
+
+func TestNewPacketStoreWithConfig(t *testing.T) {
+	cfg := &PacketStoreConfig{
+		RetentionHours: 48,
+		MaxMemoryMB:    512,
+	}
+	store := NewPacketStore(nil, cfg)
+	if store.retentionHours != 48 {
+		t.Fatalf("expected retentionHours=48, got %f", store.retentionHours)
+	}
+	if store.maxMemoryMB != 512 {
+		t.Fatalf("expected maxMemoryMB=512, got %d", store.maxMemoryMB)
+	}
+}
+
+func TestNewPacketStoreNilConfig(t *testing.T) {
+	store := NewPacketStore(nil, nil)
+	if store.retentionHours != 0 {
+		t.Fatalf("expected retentionHours=0, got %f", store.retentionHours)
+	}
+}

cmd/server/geo_filter.go

@@ -0,0 +1,34 @@
+package main
+
+import "github.com/meshcore-analyzer/geofilter"
+
+// NodePassesGeoFilter returns true if the node should be included in responses.
+// Nodes with no GPS coordinates are always allowed.
+// lat and lon are interface{} because they come from DB row maps.
+func NodePassesGeoFilter(lat, lon interface{}, gf *GeoFilterConfig) bool {
+	if gf == nil {
+		return true
+	}
+	latF, ok1 := toFloat64(lat)
+	lonF, ok2 := toFloat64(lon)
+	if !ok1 || !ok2 {
+		return true
+	}
+	return geofilter.PassesFilter(latF, lonF, gf)
+}
+
+func toFloat64(v interface{}) (float64, bool) {
+	switch x := v.(type) {
+	case float64:
+		return x, true
+	case float32:
+		return float64(x), true
+	case int:
+		return float64(x), true
+	case int64:
+		return float64(x), true
+	case nil:
+		return 0, false
+	}
+	return 0, false
+}

cmd/server/go.mod

@@ -5,9 +5,12 @@ go 1.22
 require (
 	github.com/gorilla/mux v1.8.1
 	github.com/gorilla/websocket v1.5.3
+	github.com/meshcore-analyzer/geofilter v0.0.0
 	modernc.org/sqlite v1.34.5
 )
 
+replace github.com/meshcore-analyzer/geofilter => ../../internal/geofilter
+
 require (
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/google/uuid v1.6.0 // indirect

cmd/server/main.go

@@ -128,7 +128,7 @@ func main() {
 	}
 
 	// In-memory packet store
-	store := NewPacketStore(database)
+	store := NewPacketStore(database, cfg.PacketStore)
 	if err := store.Load(); err != nil {
 		log.Fatalf("[store] failed to load: %v", err)
 	}
@@ -164,6 +164,31 @@ func main() {
 	poller.store = store
 	go poller.Start()
 
+	// Start periodic eviction
+	stopEviction := store.StartEvictionTicker()
+	defer stopEviction()
+
+	// Auto-prune old packets if retention.packetDays is configured
+	if cfg.Retention != nil && cfg.Retention.PacketDays > 0 {
+		days := cfg.Retention.PacketDays
+		go func() {
+			time.Sleep(1 * time.Minute)
+			if n, err := database.PruneOldPackets(days); err != nil {
+				log.Printf("[prune] error: %v", err)
+			} else {
+				log.Printf("[prune] deleted %d transmissions older than %d days", n, days)
+			}
+			for range time.Tick(24 * time.Hour) {
+				if n, err := database.PruneOldPackets(days); err != nil {
+					log.Printf("[prune] error: %v", err)
+				} else {
+					log.Printf("[prune] deleted %d transmissions older than %d days", n, days)
+				}
+			}
+		}()
+		log.Printf("[prune] auto-prune enabled: packets older than %d days will be removed daily", days)
+	}
+
 	// Graceful shutdown
 	httpServer := &http.Server{
 		Addr:         fmt.Sprintf(":%d", cfg.Port),

cmd/server/parity_test.go

@@ -409,7 +409,7 @@ func TestParityWSMultiObserverGolden(t *testing.T) {
 	defer db.Close()
 	seedTestData(t, db)
 	hub := NewHub()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	if err := store.Load(); err != nil {
 		t.Fatalf("store load failed: %v", err)
 	}

cmd/server/routes.go

@@ -102,12 +102,14 @@ func (s *Server) RegisterRoutes(r *mux.Router) {
 	r.HandleFunc("/api/config/regions", s.handleConfigRegions).Methods("GET")
 	r.HandleFunc("/api/config/theme", s.handleConfigTheme).Methods("GET")
 	r.HandleFunc("/api/config/map", s.handleConfigMap).Methods("GET")
+	r.HandleFunc("/api/config/geo-filter", s.handleConfigGeoFilter).Methods("GET")
 
 	// System endpoints
 	r.HandleFunc("/api/health", s.handleHealth).Methods("GET")
 	r.HandleFunc("/api/stats", s.handleStats).Methods("GET")
 	r.HandleFunc("/api/perf", s.handlePerf).Methods("GET")
 	r.HandleFunc("/api/perf/reset", s.handlePerfReset).Methods("POST")
+	r.HandleFunc("/api/admin/prune", s.handleAdminPrune).Methods("POST")
 
 	// Packet endpoints
 	r.HandleFunc("/api/packets/timestamps", s.handlePacketTimestamps).Methods("GET")
@@ -296,6 +298,15 @@ func (s *Server) handleConfigMap(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, MapConfigResponse{Center: center, Zoom: zoom})
 }
 
+func (s *Server) handleConfigGeoFilter(w http.ResponseWriter, r *http.Request) {
+	gf := s.cfg.GeoFilter
+	if gf == nil || len(gf.Polygon) == 0 {
+		writeJSON(w, map[string]interface{}{"polygon": nil, "bufferKm": 0})
+		return
+	}
+	writeJSON(w, map[string]interface{}{"polygon": gf.Polygon, "bufferKm": gf.BufferKm})
+}
+
 // --- System Handlers ---
 
 func (s *Server) handleHealth(w http.ResponseWriter, r *http.Request) {
@@ -537,6 +548,31 @@ func (s *Server) handlePerfReset(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, OkResp{Ok: true})
 }
 
+func (s *Server) handleAdminPrune(w http.ResponseWriter, r *http.Request) {
+	if s.cfg.APIKey != "" && r.Header.Get("X-API-Key") != s.cfg.APIKey {
+		writeError(w, 401, "invalid or missing API key")
+		return
+	}
+	days := 0
+	if d := r.URL.Query().Get("days"); d != "" {
+		fmt.Sscanf(d, "%d", &days)
+	}
+	if days <= 0 && s.cfg.Retention != nil {
+		days = s.cfg.Retention.PacketDays
+	}
+	if days <= 0 {
+		writeError(w, 400, "days parameter required (or set retention.packetDays in config)")
+		return
+	}
+	n, err := s.db.PruneOldPackets(days)
+	if err != nil {
+		writeError(w, 500, err.Error())
+		return
+	}
+	log.Printf("[prune] deleted %d transmissions older than %d days", n, days)
+	writeJSON(w, map[string]interface{}{"deleted": n, "days": days})
+}
+
 // --- Packet Handlers ---
 
 func (s *Server) handlePackets(w http.ResponseWriter, r *http.Request) {
@@ -830,6 +866,16 @@ func (s *Server) handleNodes(w http.ResponseWriter, r *http.Request) {
 			}
 		}
 	}
+	if s.cfg.GeoFilter != nil {
+		filtered := nodes[:0]
+		for _, node := range nodes {
+			if NodePassesGeoFilter(node["lat"], node["lon"], s.cfg.GeoFilter) {
+				filtered = append(filtered, node)
+			}
+		}
+		total = len(filtered)
+		nodes = filtered
+	}
 	writeJSON(w, NodeListResponse{Nodes: nodes, Total: total, Counts: counts})
 }
 
@@ -1155,12 +1201,13 @@ func (s *Server) handleAnalyticsHashSizes(w http.ResponseWriter, r *http.Request
 		writeJSON(w, s.store.GetAnalyticsHashSizes(region))
 		return
 	}
-	writeJSON(w, HashSizeAnalyticsResponse{
-		Total:          0,
-		Distribution:   map[string]int{"1": 0, "2": 0, "3": 0},
-		Hourly:         []HashSizeHourly{},
-		TopHops:        []HashSizeHop{},
-		MultiByteNodes: []MultiByteNode{},
+	writeJSON(w, map[string]interface{}{
+		"total":                    0,
+		"distribution":            map[string]int{"1": 0, "2": 0, "3": 0},
+		"distributionByRepeaters": map[string]int{"1": 0, "2": 0, "3": 0},
+		"hourly":                  []HashSizeHourly{},
+		"topHops":                 []HashSizeHop{},
+		"multiByteNodes":          []MultiByteNode{},
 	})
 }
 

cmd/server/routes_test.go

@@ -17,7 +17,7 @@ func setupTestServer(t *testing.T) (*Server, *mux.Router) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	if err := store.Load(); err != nil {
 		t.Fatalf("store.Load failed: %v", err)
 	}
@@ -1259,7 +1259,7 @@ func TestNodeAnalyticsNoNameNode(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	if err := store.Load(); err != nil {
 		t.Fatalf("store.Load failed: %v", err)
 	}
@@ -1295,7 +1295,7 @@ func TestNodeHealthForNoNameNode(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	if err := store.Load(); err != nil {
 		t.Fatalf("store.Load failed: %v", err)
 	}
@@ -1890,7 +1890,7 @@ t.Error("hash_sizes_seen should not be set for single size")
 func TestGetNodeHashSizeInfoFlipFlop(t *testing.T) {
 db := setupTestDB(t)
 seedTestData(t, db)
-store := NewPacketStore(db)
+store := NewPacketStore(db, nil)
 if err := store.Load(); err != nil {
 	t.Fatalf("store.Load failed: %v", err)
 }

cmd/server/store.go

@@ -103,6 +103,11 @@ type PacketStore struct {
 	hashSizeInfoMu    sync.Mutex
 	hashSizeInfoCache map[string]*hashSizeNodeInfo
 	hashSizeInfoAt    time.Time
+
+	// Eviction config and stats
+	retentionHours float64 // 0 = unlimited
+	maxMemoryMB    int     // 0 = unlimited
+	evicted        int64   // total packets evicted
 }
 
 // Precomputed distance records for fast analytics aggregation.
@@ -143,8 +148,8 @@ type cachedResult struct {
 }
 
 // NewPacketStore creates a new empty packet store backed by db.
-func NewPacketStore(db *DB) *PacketStore {
-	return &PacketStore{
+func NewPacketStore(db *DB, cfg *PacketStoreConfig) *PacketStore {
+	ps := &PacketStore{
 		db:            db,
 		packets:       make([]*StoreTx, 0, 65536),
 		byHash:        make(map[string]*StoreTx, 65536),
@@ -163,6 +168,11 @@ func NewPacketStore(db *DB) *PacketStore {
 		rfCacheTTL:    15 * time.Second,
 		spIndex:       make(map[string]int, 4096),
 	}
+	if cfg != nil {
+		ps.retentionHours = cfg.RetentionHours
+		ps.maxMemoryMB = cfg.MaxMemoryMB
+	}
+	return ps
 }
 
 // Load reads all transmissions + observations from SQLite into memory.
@@ -293,7 +303,7 @@ func (s *PacketStore) Load() error {
 
 	s.loaded = true
 	elapsed := time.Since(t0)
-	estMB := (len(s.packets)*450 + s.totalObs*100) / (1024 * 1024)
+	estMB := (len(s.packets)*5120 + s.totalObs*500) / (1024 * 1024)
 	log.Printf("[store] Loaded %d transmissions (%d observations) in %v (~%dMB est)",
 		len(s.packets), s.totalObs, elapsed, estMB)
 	return nil
@@ -542,20 +552,22 @@ func (s *PacketStore) GetPerfStoreStats() map[string]interface{} {
 	}
 	s.mu.RUnlock()
 
-	// Rough estimate: ~430 bytes per packet + ~200 per observation
-	estimatedMB := math.Round(float64(totalLoaded*430+totalObs*200)/1048576*10) / 10
+	// Realistic estimate: ~5KB per packet + ~500 bytes per observation
+	estimatedMB := math.Round(float64(totalLoaded*5120+totalObs*500)/1048576*10) / 10
+
+	evicted := atomic.LoadInt64(&s.evicted)
 
 	return map[string]interface{}{
 		"totalLoaded":       totalLoaded,
 		"totalObservations": totalObs,
-		"evicted":           0,
+		"evicted":           evicted,
 		"inserts":           atomic.LoadInt64(&s.insertCount),
 		"queries":           atomic.LoadInt64(&s.queryCount),
 		"inMemory":          totalLoaded,
 		"sqliteOnly":        false,
-		"maxPackets":        2386092,
+		"retentionHours":    s.retentionHours,
+		"maxMemoryMB":       s.maxMemoryMB,
 		"estimatedMB":       estimatedMB,
-		"maxMB":             1024,
 		"indexes": map[string]interface{}{
 			"byHash":           hashIdx,
 			"byTxID":           txIdx,
@@ -648,12 +660,12 @@ func (s *PacketStore) GetPerfStoreStatsTyped() PerfPacketStoreStats {
 	}
 	s.mu.RUnlock()
 
-	estimatedMB := math.Round(float64(totalLoaded*430+totalObs*200)/1048576*10) / 10
+	estimatedMB := math.Round(float64(totalLoaded*5120+totalObs*500)/1048576*10) / 10
 
 	return PerfPacketStoreStats{
 		TotalLoaded:       totalLoaded,
 		TotalObservations: totalObs,
-		Evicted:           0,
+		Evicted:           int(atomic.LoadInt64(&s.evicted)),
 		Inserts:           atomic.LoadInt64(&s.insertCount),
 		Queries:           atomic.LoadInt64(&s.queryCount),
 		InMemory:          totalLoaded,
@@ -1699,6 +1711,218 @@ func (s *PacketStore) buildDistanceIndex() {
 		len(s.distHops), len(s.distPaths))
 }
 
+// estimatedMemoryMB returns estimated memory usage of the packet store.
+func (s *PacketStore) estimatedMemoryMB() float64 {
+	return float64(len(s.packets)*5120+s.totalObs*500) / 1048576.0
+}
+
+// EvictStale removes packets older than the retention window and/or exceeding
+// the memory cap. Must be called with s.mu held (Lock). Returns the number of
+// packets evicted.
+func (s *PacketStore) EvictStale() int {
+	if s.retentionHours <= 0 && s.maxMemoryMB <= 0 {
+		return 0
+	}
+
+	cutoffIdx := 0
+
+	// Time-based eviction: find how many packets from the head are too old
+	if s.retentionHours > 0 {
+		cutoff := time.Now().UTC().Add(-time.Duration(s.retentionHours*3600) * time.Second).Format(time.RFC3339)
+		for cutoffIdx < len(s.packets) && s.packets[cutoffIdx].FirstSeen < cutoff {
+			cutoffIdx++
+		}
+	}
+
+	// Memory-based eviction: if still over budget, trim more from head
+	if s.maxMemoryMB > 0 {
+		for cutoffIdx < len(s.packets) && s.estimatedMemoryMB() > float64(s.maxMemoryMB) {
+			// Estimate how many more to evict: rough binary approach
+			overMB := s.estimatedMemoryMB() - float64(s.maxMemoryMB)
+			// ~5KB per packet, so overMB * 1024*1024 / 5120 packets
+			extra := int(overMB * 1048576.0 / 5120.0)
+			if extra < 100 {
+				extra = 100
+			}
+			cutoffIdx += extra
+			if cutoffIdx > len(s.packets) {
+				cutoffIdx = len(s.packets)
+			}
+			// Recalculate estimated memory with fewer packets
+			// (we haven't actually removed yet, so simulate)
+			remainingPkts := len(s.packets) - cutoffIdx
+			remainingObs := s.totalObs
+			for _, tx := range s.packets[:cutoffIdx] {
+				remainingObs -= len(tx.Observations)
+			}
+			estMB := float64(remainingPkts*5120+remainingObs*500) / 1048576.0
+			if estMB <= float64(s.maxMemoryMB) {
+				break
+			}
+		}
+	}
+
+	if cutoffIdx == 0 {
+		return 0
+	}
+	if cutoffIdx > len(s.packets) {
+		cutoffIdx = len(s.packets)
+	}
+
+	evicting := s.packets[:cutoffIdx]
+	evictedObs := 0
+
+	// Remove from all indexes
+	for _, tx := range evicting {
+		delete(s.byHash, tx.Hash)
+		delete(s.byTxID, tx.ID)
+
+		// Remove observations from indexes
+		for _, obs := range tx.Observations {
+			delete(s.byObsID, obs.ID)
+			// Remove from byObserver
+			if obs.ObserverID != "" {
+				obsList := s.byObserver[obs.ObserverID]
+				for i, o := range obsList {
+					if o.ID == obs.ID {
+						s.byObserver[obs.ObserverID] = append(obsList[:i], obsList[i+1:]...)
+						break
+					}
+				}
+				if len(s.byObserver[obs.ObserverID]) == 0 {
+					delete(s.byObserver, obs.ObserverID)
+				}
+			}
+			evictedObs++
+		}
+
+		// Remove from byPayloadType
+		if tx.PayloadType != nil {
+			pt := *tx.PayloadType
+			ptList := s.byPayloadType[pt]
+			for i, t := range ptList {
+				if t.ID == tx.ID {
+					s.byPayloadType[pt] = append(ptList[:i], ptList[i+1:]...)
+					break
+				}
+			}
+			if len(s.byPayloadType[pt]) == 0 {
+				delete(s.byPayloadType, pt)
+			}
+		}
+
+		// Remove from byNode and nodeHashes
+		if tx.DecodedJSON != "" {
+			var decoded map[string]interface{}
+			if json.Unmarshal([]byte(tx.DecodedJSON), &decoded) == nil {
+				for _, field := range []string{"pubKey", "destPubKey", "srcPubKey"} {
+					if v, ok := decoded[field].(string); ok && v != "" {
+						if hashes, ok := s.nodeHashes[v]; ok {
+							delete(hashes, tx.Hash)
+							if len(hashes) == 0 {
+								delete(s.nodeHashes, v)
+							}
+						}
+						// Remove tx from byNode
+						nodeList := s.byNode[v]
+						for i, t := range nodeList {
+							if t.ID == tx.ID {
+								s.byNode[v] = append(nodeList[:i], nodeList[i+1:]...)
+								break
+							}
+						}
+						if len(s.byNode[v]) == 0 {
+							delete(s.byNode, v)
+						}
+					}
+				}
+			}
+		}
+
+		// Remove from subpath index
+		removeTxFromSubpathIndex(s.spIndex, tx)
+	}
+
+	// Remove from distance indexes — filter out records referencing evicted txs
+	evictedTxSet := make(map[*StoreTx]bool, cutoffIdx)
+	for _, tx := range evicting {
+		evictedTxSet[tx] = true
+	}
+	newDistHops := s.distHops[:0]
+	for i := range s.distHops {
+		if !evictedTxSet[s.distHops[i].tx] {
+			newDistHops = append(newDistHops, s.distHops[i])
+		}
+	}
+	s.distHops = newDistHops
+
+	newDistPaths := s.distPaths[:0]
+	for i := range s.distPaths {
+		if !evictedTxSet[s.distPaths[i].tx] {
+			newDistPaths = append(newDistPaths, s.distPaths[i])
+		}
+	}
+	s.distPaths = newDistPaths
+
+	// Trim packets slice
+	n := copy(s.packets, s.packets[cutoffIdx:])
+	s.packets = s.packets[:n]
+	s.totalObs -= evictedObs
+
+	evictCount := cutoffIdx
+	atomic.AddInt64(&s.evicted, int64(evictCount))
+	freedMB := float64(evictCount*5120+evictedObs*500) / 1048576.0
+	log.Printf("[store] Evicted %d packets older than %.0fh (freed ~%.1fMB estimated)",
+		evictCount, s.retentionHours, freedMB)
+
+	// Invalidate analytics caches
+	s.cacheMu.Lock()
+	s.rfCache = make(map[string]*cachedResult)
+	s.topoCache = make(map[string]*cachedResult)
+	s.hashCache = make(map[string]*cachedResult)
+	s.chanCache = make(map[string]*cachedResult)
+	s.distCache = make(map[string]*cachedResult)
+	s.subpathCache = make(map[string]*cachedResult)
+	s.cacheMu.Unlock()
+
+	// Invalidate hash size cache
+	s.hashSizeInfoMu.Lock()
+	s.hashSizeInfoCache = nil
+	s.hashSizeInfoMu.Unlock()
+
+	return evictCount
+}
+
+// RunEviction acquires the write lock and runs eviction. Safe to call from
+// a goroutine. Returns evicted count.
+func (s *PacketStore) RunEviction() int {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.EvictStale()
+}
+
+// StartEvictionTicker starts a background goroutine that runs eviction every
+// minute. Returns a stop function.
+func (s *PacketStore) StartEvictionTicker() func() {
+	if s.retentionHours <= 0 && s.maxMemoryMB <= 0 {
+		return func() {} // no-op
+	}
+	ticker := time.NewTicker(1 * time.Minute)
+	done := make(chan struct{})
+	go func() {
+		for {
+			select {
+			case <-ticker.C:
+				s.RunEviction()
+			case <-done:
+				ticker.Stop()
+				return
+			}
+		}
+	}()
+	return func() { close(done) }
+}
+
 // computeDistancesForTx computes distance records for a single transmission.
 func computeDistancesForTx(tx *StoreTx, nodeByPk map[string]*nodeInfo, repeaterSet map[string]bool, resolveHop func(string) *nodeInfo) ([]distHopRecord, *distPathRecord) {
 	pathHops := txGetParsedPath(tx)
@@ -2309,6 +2533,7 @@ func (s *PacketStore) computeAnalyticsRF(region string) map[string]interface{} {
 	seenTypeHashes := make(map[string]bool, len(s.packets))
 	typeBuckets := map[int]int{}
 	hourBuckets := map[string]int{}
+	seenHourHash := make(map[string]bool, len(s.packets)) // dedup packets-per-hour by hash+hour
 	snrByType := map[string]*struct{ vals []float64 }{}
 	sigTime := map[string]*struct {
 		snrs  []float64
@@ -2381,10 +2606,16 @@ func (s *PacketStore) computeAnalyticsRF(region string) map[string]interface{} {
 					rssiVals = append(rssiVals, *obs.RSSI)
 				}
 
-				// Packets per hour
+				// Packets per hour (unique by hash per hour)
 				if len(ts) >= 13 {
 					hr := ts[:13]
-					hourBuckets[hr]++
+					hk := hash + "|" + hr
+					if hash == "" || !seenHourHash[hk] {
+						if hash != "" {
+							seenHourHash[hk] = true
+						}
+						hourBuckets[hr]++
+					}
 				}
 
 				// Packet sizes (unique by hash)
@@ -2472,7 +2703,14 @@ func (s *PacketStore) computeAnalyticsRF(region string) map[string]interface{} {
 					}
 
 					if len(ts) >= 13 {
-						hourBuckets[ts[:13]]++
+						hr := ts[:13]
+						hk := hash + "|" + hr
+						if hash == "" || !seenHourHash[hk] {
+							if hash != "" {
+								seenHourHash[hk] = true
+							}
+							hourBuckets[hr]++
+						}
 					}
 				}
 			} else {
@@ -3745,12 +3983,21 @@ func (s *PacketStore) computeAnalyticsHashSizes(region string) map[string]interf
 		return multiByteNodes[i]["packets"].(int) > multiByteNodes[j]["packets"].(int)
 	})
 
+	// Distribution by repeaters: count unique nodes per hash size
+	distributionByRepeaters := map[string]int{"1": 0, "2": 0, "3": 0}
+	for _, data := range byNode {
+		hs := data["hashSize"].(int)
+		key := strconv.Itoa(hs)
+		distributionByRepeaters[key]++
+	}
+
 	return map[string]interface{}{
-		"total":          total,
-		"distribution":   distribution,
-		"hourly":         hourly,
-		"topHops":        topHops,
-		"multiByteNodes": multiByteNodes,
+		"total":                    total,
+		"distribution":            distribution,
+		"distributionByRepeaters": distributionByRepeaters,
+		"hourly":                  hourly,
+		"topHops":                 topHops,
+		"multiByteNodes":          multiByteNodes,
 	}
 }
 

cmd/server/websocket_test.go

@@ -270,7 +270,7 @@ func TestPollerBroadcastsMultipleObservations(t *testing.T) {
 	}()
 
 	poller := NewPoller(db, hub, 50*time.Millisecond)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	if err := store.Load(); err != nil {
 		t.Fatalf("store load failed: %v", err)
 	}
@@ -359,7 +359,7 @@ func TestIngestNewObservationsBroadcast(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	if err := store.Load(); err != nil {
 		t.Fatalf("store load failed: %v", err)
 	}

config.example.json

@@ -3,7 +3,8 @@
   "apiKey": "your-secret-api-key-here",
   "retention": {
     "nodeDays": 7,
-    "_comment": "Nodes not seen in this many days are moved to inactive_nodes table. Default 7."
+    "packetDays": 30,
+    "_comment": "nodeDays: nodes not seen in N days are moved to inactive_nodes (default 7). packetDays: transmissions+observations older than N days are deleted daily (0 = disabled)."
   },
   "https": {
     "cert": "/path/to/cert.pem",

db.js

@@ -1,935 +0,0 @@
-const Database = require('better-sqlite3');
-const path = require('path');
-const fs = require('fs');
-
-// Ensure data directory exists
-const dbPath = process.env.DB_PATH || path.join(__dirname, 'data', 'meshcore.db');
-const dataDir = path.dirname(dbPath);
-if (!fs.existsSync(dataDir)) fs.mkdirSync(dataDir, { recursive: true });
-
-const db = new Database(dbPath);
-db.pragma('journal_mode = WAL');
-db.pragma('foreign_keys = ON');
-db.pragma('wal_autocheckpoint = 0'); // Disable auto-checkpoint — manual checkpoint on timer to avoid random event loop spikes
-
-// --- Migration: drop legacy tables (replaced by transmissions + observations in v2.3.0) ---
-// Drop paths first (has FK to packets)
-const legacyTables = ['paths', 'packets'];
-for (const t of legacyTables) {
-  const exists = db.prepare(`SELECT name FROM sqlite_master WHERE type='table' AND name=?`).get(t);
-  if (exists) {
-    console.log(`[migration] Dropping legacy table: ${t}`);
-    db.exec(`DROP TABLE IF EXISTS ${t}`);
-  }
-}
-
-// --- Schema ---
-db.exec(`
-  CREATE TABLE IF NOT EXISTS nodes (
-    public_key TEXT PRIMARY KEY,
-    name TEXT,
-    role TEXT,
-    lat REAL,
-    lon REAL,
-    last_seen TEXT,
-    first_seen TEXT,
-    advert_count INTEGER DEFAULT 0,
-    battery_mv INTEGER,
-    temperature_c REAL
-  );
-
-  CREATE TABLE IF NOT EXISTS observers (
-    id TEXT PRIMARY KEY,
-    name TEXT,
-    iata TEXT,
-    last_seen TEXT,
-    first_seen TEXT,
-    packet_count INTEGER DEFAULT 0,
-    model TEXT,
-    firmware TEXT,
-    client_version TEXT,
-    radio TEXT,
-    battery_mv INTEGER,
-    uptime_secs INTEGER,
-    noise_floor INTEGER
-  );
-
-  CREATE TABLE IF NOT EXISTS inactive_nodes (
-    public_key TEXT PRIMARY KEY,
-    name TEXT,
-    role TEXT,
-    lat REAL,
-    lon REAL,
-    last_seen TEXT,
-    first_seen TEXT,
-    advert_count INTEGER DEFAULT 0,
-    battery_mv INTEGER,
-    temperature_c REAL
-  );
-
-  CREATE INDEX IF NOT EXISTS idx_nodes_last_seen ON nodes(last_seen);
-  CREATE INDEX IF NOT EXISTS idx_observers_last_seen ON observers(last_seen);
-  CREATE INDEX IF NOT EXISTS idx_inactive_nodes_last_seen ON inactive_nodes(last_seen);
-
-  CREATE TABLE IF NOT EXISTS transmissions (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    raw_hex TEXT NOT NULL,
-    hash TEXT NOT NULL UNIQUE,
-    first_seen TEXT NOT NULL,
-    route_type INTEGER,
-    payload_type INTEGER,
-    payload_version INTEGER,
-    decoded_json TEXT,
-    created_at TEXT DEFAULT (datetime('now'))
-  );
-
-  CREATE INDEX IF NOT EXISTS idx_transmissions_hash ON transmissions(hash);
-  CREATE INDEX IF NOT EXISTS idx_transmissions_first_seen ON transmissions(first_seen);
-  CREATE INDEX IF NOT EXISTS idx_transmissions_payload_type ON transmissions(payload_type);
-`);
-
-// --- Determine schema version ---
-let schemaVersion = db.pragma('user_version', { simple: true }) || 0;
-
-// Migrate from old schema_version table to pragma user_version
-if (schemaVersion === 0) {
-  try {
-    const row = db.prepare('SELECT version FROM schema_version ORDER BY version DESC LIMIT 1').get();
-    if (row && row.version >= 3) {
-      db.pragma(`user_version = ${row.version}`);
-      schemaVersion = row.version;
-      db.exec('DROP TABLE IF EXISTS schema_version');
-    }
-  } catch {}
-}
-
-// Detect v3 schema by column presence (handles crash between migration and version write)
-if (schemaVersion === 0) {
-  try {
-    const cols = db.pragma('table_info(observations)').map(c => c.name);
-    if (cols.includes('observer_idx') && !cols.includes('observer_id')) {
-      db.pragma('user_version = 3');
-      schemaVersion = 3;
-      console.log('[migration-v3] Detected already-migrated schema, set user_version = 3');
-    }
-  } catch {}
-}
-
-// --- v3 migration: lean observations table ---
-function needsV3Migration() {
-  if (schemaVersion >= 3) return false;
-  // Check if observations table exists with old observer_id TEXT column
-  const obsExists = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='observations'").get();
-  if (!obsExists) return false;
-  const cols = db.pragma('table_info(observations)').map(c => c.name);
-  return cols.includes('observer_id');
-}
-
-function runV3Migration() {
-  const startTime = Date.now();
-  console.log('[migration-v3] Starting observations table optimization...');
-
-  // a. Backup DB
-  const backupPath = dbPath + `.pre-v3-backup-${Date.now()}`;
-  try {
-    console.log(`[migration-v3] Backing up DB to ${backupPath}...`);
-    fs.copyFileSync(dbPath, backupPath);
-    console.log(`[migration-v3] Backup complete (${Date.now() - startTime}ms)`);
-  } catch (e) {
-    console.error(`[migration-v3] Backup failed, aborting migration: ${e.message}`);
-    return false;
-  }
-
-  try {
-    // b. Create lean table
-    let stepStart = Date.now();
-    db.exec(`
-      CREATE TABLE observations_v3 (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        transmission_id INTEGER NOT NULL REFERENCES transmissions(id),
-        observer_idx INTEGER,
-        direction TEXT,
-        snr REAL,
-        rssi REAL,
-        score INTEGER,
-        path_json TEXT,
-        timestamp INTEGER NOT NULL
-      )
-    `);
-    console.log(`[migration-v3] Created observations_v3 table (${Date.now() - stepStart}ms)`);
-
-    // c. Migrate data
-    stepStart = Date.now();
-    const result = db.prepare(`
-      INSERT INTO observations_v3 (id, transmission_id, observer_idx, direction, snr, rssi, score, path_json, timestamp)
-      SELECT o.id, o.transmission_id, obs.rowid, o.direction, o.snr, o.rssi, o.score, o.path_json,
-        CAST(strftime('%s', o.timestamp) AS INTEGER)
-      FROM observations o
-      LEFT JOIN observers obs ON obs.id = o.observer_id
-    `).run();
-    console.log(`[migration-v3] Migrated ${result.changes} rows (${Date.now() - stepStart}ms)`);
-
-    // d. Drop view, old table, rename
-    stepStart = Date.now();
-    db.exec('DROP VIEW IF EXISTS packets_v');
-    db.exec('DROP TABLE observations');
-    db.exec('ALTER TABLE observations_v3 RENAME TO observations');
-    console.log(`[migration-v3] Replaced observations table (${Date.now() - stepStart}ms)`);
-
-    // f. Create indexes
-    stepStart = Date.now();
-    db.exec(`
-      CREATE INDEX idx_observations_transmission_id ON observations(transmission_id);
-      CREATE INDEX idx_observations_observer_idx ON observations(observer_idx);
-      CREATE INDEX idx_observations_timestamp ON observations(timestamp);
-      CREATE UNIQUE INDEX idx_observations_dedup ON observations(transmission_id, observer_idx, COALESCE(path_json, ''));
-    `);
-    console.log(`[migration-v3] Created indexes (${Date.now() - stepStart}ms)`);
-
-    // g. Set schema version
-    
-    db.pragma('user_version = 3');
-    schemaVersion = 3;
-
-    // h. Rebuild view (done below in common code)
-
-    // i. VACUUM + checkpoint
-    stepStart = Date.now();
-    db.exec('VACUUM');
-    db.pragma('wal_checkpoint(TRUNCATE)');
-    console.log(`[migration-v3] VACUUM + checkpoint complete (${Date.now() - stepStart}ms)`);
-
-    console.log(`[migration-v3] Migration complete! Total time: ${Date.now() - startTime}ms`);
-    return true;
-  } catch (e) {
-    console.error(`[migration-v3] Migration failed: ${e.message}`);
-    console.error('[migration-v3] Restore from backup if needed: ' + dbPath + '.pre-v3-backup');
-    // Try to clean up v3 table if it exists
-    try { db.exec('DROP TABLE IF EXISTS observations_v3'); } catch {}
-    return false;
-  }
-}
-
-const isV3 = schemaVersion >= 3;
-
-if (!isV3 && needsV3Migration()) {
-  runV3Migration();
-}
-
-// If user_version < 3 and no migration happened (fresh DB or migration skipped), create old-style table
-if (schemaVersion < 3) {
-  const obsExists = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='observations'").get();
-  if (!obsExists) {
-    // Fresh DB — create v3 schema directly
-    db.exec(`
-      CREATE TABLE observations (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        transmission_id INTEGER NOT NULL REFERENCES transmissions(id),
-        observer_idx INTEGER,
-        direction TEXT,
-        snr REAL,
-        rssi REAL,
-        score INTEGER,
-        path_json TEXT,
-        timestamp INTEGER NOT NULL
-      );
-      CREATE INDEX idx_observations_transmission_id ON observations(transmission_id);
-      CREATE INDEX idx_observations_observer_idx ON observations(observer_idx);
-      CREATE INDEX idx_observations_timestamp ON observations(timestamp);
-      CREATE UNIQUE INDEX idx_observations_dedup ON observations(transmission_id, observer_idx, COALESCE(path_json, ''));
-    `);
-    
-    db.pragma('user_version = 3');
-    schemaVersion = 3;
-  } else {
-    // Old-style observations table exists but migration wasn't run (or failed)
-    // Ensure indexes exist for old schema
-    db.exec(`
-      CREATE INDEX IF NOT EXISTS idx_observations_hash ON observations(hash);
-      CREATE INDEX IF NOT EXISTS idx_observations_transmission_id ON observations(transmission_id);
-      CREATE INDEX IF NOT EXISTS idx_observations_observer_id ON observations(observer_id);
-      CREATE INDEX IF NOT EXISTS idx_observations_timestamp ON observations(timestamp);
-    `);
-    // Dedup cleanup for old schema
-    try {
-      db.exec(`DROP INDEX IF EXISTS idx_observations_dedup`);
-      db.exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_observations_dedup ON observations(hash, observer_id, COALESCE(path_json, ''))`);
-      db.exec(`DELETE FROM observations WHERE id NOT IN (SELECT MIN(id) FROM observations GROUP BY hash, observer_id, COALESCE(path_json, ''))`);
-    } catch {}
-  }
-}
-
-// --- Create/rebuild packets_v view ---
-db.exec('DROP VIEW IF EXISTS packets_v');
-if (schemaVersion >= 3) {
-  db.exec(`
-    CREATE VIEW packets_v AS
-      SELECT o.id, t.raw_hex,
-             datetime(o.timestamp, 'unixepoch') AS timestamp,
-             obs.id AS observer_id, obs.name AS observer_name,
-             o.direction, o.snr, o.rssi, o.score, t.hash, t.route_type,
-             t.payload_type, t.payload_version, o.path_json, t.decoded_json,
-             t.created_at
-      FROM observations o
-      JOIN transmissions t ON t.id = o.transmission_id
-      LEFT JOIN observers obs ON obs.rowid = o.observer_idx
-  `);
-} else {
-  db.exec(`
-    CREATE VIEW packets_v AS
-      SELECT o.id, t.raw_hex, o.timestamp, o.observer_id, o.observer_name,
-             o.direction, o.snr, o.rssi, o.score, t.hash, t.route_type,
-             t.payload_type, t.payload_version, o.path_json, t.decoded_json,
-             t.created_at
-      FROM observations o
-      JOIN transmissions t ON t.id = o.transmission_id
-  `);
-}
-
-// --- Migrations for existing DBs ---
-const observerCols = db.pragma('table_info(observers)').map(c => c.name);
-for (const col of ['model', 'firmware', 'client_version', 'radio', 'battery_mv', 'uptime_secs', 'noise_floor']) {
-  if (!observerCols.includes(col)) {
-    const type = ['battery_mv', 'uptime_secs', 'noise_floor'].includes(col) ? 'INTEGER' : 'TEXT';
-    db.exec(`ALTER TABLE observers ADD COLUMN ${col} ${type}`);
-    console.log(`[migration] Added observers.${col}`);
-  }
-}
-
-// --- Cleanup corrupted nodes on startup ---
-// Remove nodes with obviously invalid data (short pubkeys, control chars in names, etc.)
-{
-  const cleaned = db.prepare(`
-    DELETE FROM nodes WHERE
-      length(public_key) < 16
-      OR public_key GLOB '*[^0-9a-fA-F]*'
-      OR (lat IS NOT NULL AND (lat < -90 OR lat > 90))
-      OR (lon IS NOT NULL AND (lon < -180 OR lon > 180))
-  `).run();
-  if (cleaned.changes > 0) console.log(`[cleanup] Removed ${cleaned.changes} corrupted node(s) from DB`);
-}
-
-// --- One-time migration: recalculate advert_count to count unique transmissions only ---
-{
-  db.exec(`CREATE TABLE IF NOT EXISTS _migrations (name TEXT PRIMARY KEY)`);
-  const done = db.prepare(`SELECT 1 FROM _migrations WHERE name = 'advert_count_unique_v1'`).get();
-  if (!done) {
-    const start = Date.now();
-    console.log('[migration] Recalculating advert_count (unique transmissions only)...');
-    db.prepare(`
-      UPDATE nodes SET advert_count = (
-        SELECT COUNT(*) FROM transmissions t
-        WHERE t.payload_type = 4
-          AND t.decoded_json LIKE '%' || nodes.public_key || '%'
-      )
-    `).run();
-    db.prepare(`INSERT INTO _migrations (name) VALUES ('advert_count_unique_v1')`).run();
-    console.log(`[migration] advert_count recalculated in ${Date.now() - start}ms`);
-  }
-}
-
-// --- One-time migration: add telemetry columns to nodes and inactive_nodes ---
-{
-  const done = db.prepare(`SELECT 1 FROM _migrations WHERE name = 'node_telemetry_v1'`).get();
-  if (!done) {
-    console.log('[migration] Adding telemetry columns to nodes/inactive_nodes...');
-    const nodeCols = db.pragma('table_info(nodes)').map(c => c.name);
-    if (!nodeCols.includes('battery_mv')) db.exec(`ALTER TABLE nodes ADD COLUMN battery_mv INTEGER`);
-    if (!nodeCols.includes('temperature_c')) db.exec(`ALTER TABLE nodes ADD COLUMN temperature_c REAL`);
-    const inactiveCols = db.pragma('table_info(inactive_nodes)').map(c => c.name);
-    if (!inactiveCols.includes('battery_mv')) db.exec(`ALTER TABLE inactive_nodes ADD COLUMN battery_mv INTEGER`);
-    if (!inactiveCols.includes('temperature_c')) db.exec(`ALTER TABLE inactive_nodes ADD COLUMN temperature_c REAL`);
-    db.prepare(`INSERT INTO _migrations (name) VALUES ('node_telemetry_v1')`).run();
-    console.log('[migration] node telemetry columns added');
-  }
-}
-
-// --- Prepared statements ---
-const stmts = {
-  upsertNode: db.prepare(`
-    INSERT INTO nodes (public_key, name, role, lat, lon, last_seen, first_seen)
-    VALUES (@public_key, @name, @role, @lat, @lon, @last_seen, @first_seen)
-    ON CONFLICT(public_key) DO UPDATE SET
-      name = COALESCE(@name, name),
-      role = COALESCE(@role, role),
-      lat = COALESCE(@lat, lat),
-      lon = COALESCE(@lon, lon),
-      last_seen = @last_seen
-  `),
-  incrementAdvertCount: db.prepare(`
-    UPDATE nodes SET advert_count = advert_count + 1 WHERE public_key = @public_key
-  `),
-  updateNodeTelemetry: db.prepare(`
-    UPDATE nodes SET
-      battery_mv = COALESCE(@battery_mv, battery_mv),
-      temperature_c = COALESCE(@temperature_c, temperature_c)
-    WHERE public_key = @public_key
-  `),
-  upsertObserver: db.prepare(`
-    INSERT INTO observers (id, name, iata, last_seen, first_seen, packet_count, model, firmware, client_version, radio, battery_mv, uptime_secs, noise_floor)
-    VALUES (@id, @name, @iata, @last_seen, @first_seen, 1, @model, @firmware, @client_version, @radio, @battery_mv, @uptime_secs, @noise_floor)
-    ON CONFLICT(id) DO UPDATE SET
-      name = COALESCE(@name, name),
-      iata = COALESCE(@iata, iata),
-      last_seen = @last_seen,
-      packet_count = packet_count + 1,
-      model = COALESCE(@model, model),
-      firmware = COALESCE(@firmware, firmware),
-      client_version = COALESCE(@client_version, client_version),
-      radio = COALESCE(@radio, radio),
-      battery_mv = COALESCE(@battery_mv, battery_mv),
-      uptime_secs = COALESCE(@uptime_secs, uptime_secs),
-      noise_floor = COALESCE(@noise_floor, noise_floor)
-  `),
-  updateObserverStatus: db.prepare(`
-    INSERT INTO observers (id, name, iata, last_seen, first_seen, packet_count, model, firmware, client_version, radio, battery_mv, uptime_secs, noise_floor)
-    VALUES (@id, @name, @iata, @last_seen, @first_seen, 0, @model, @firmware, @client_version, @radio, @battery_mv, @uptime_secs, @noise_floor)
-    ON CONFLICT(id) DO UPDATE SET
-      name = COALESCE(@name, name),
-      iata = COALESCE(@iata, iata),
-      last_seen = @last_seen,
-      model = COALESCE(@model, model),
-      firmware = COALESCE(@firmware, firmware),
-      client_version = COALESCE(@client_version, client_version),
-      radio = COALESCE(@radio, radio),
-      battery_mv = COALESCE(@battery_mv, battery_mv),
-      uptime_secs = COALESCE(@uptime_secs, uptime_secs),
-      noise_floor = COALESCE(@noise_floor, noise_floor)
-  `),
-  getPacket: db.prepare(`SELECT * FROM packets_v WHERE id = ?`),
-  getNode: db.prepare(`SELECT * FROM nodes WHERE public_key = ?`),
-  getRecentPacketsForNode: db.prepare(`
-    SELECT * FROM packets_v WHERE decoded_json LIKE ? OR decoded_json LIKE ? OR decoded_json LIKE ? OR decoded_json LIKE ?
-    ORDER BY timestamp DESC LIMIT 20
-  `),
-  getObservers: db.prepare(`SELECT * FROM observers ORDER BY last_seen DESC`),
-  countPackets: db.prepare(`SELECT COUNT(*) as count FROM observations`),
-  countNodes: db.prepare(`SELECT COUNT(*) as count FROM nodes`),
-  countActiveNodes: db.prepare(`SELECT COUNT(*) as count FROM nodes WHERE last_seen > ?`),
-  countActiveNodesByRole: db.prepare(`SELECT COUNT(*) as count FROM nodes WHERE role = ? AND last_seen > ?`),
-  countObservers: db.prepare(`SELECT COUNT(*) as count FROM observers`),
-  countRecentPackets: schemaVersion >= 3
-    ? db.prepare(`SELECT COUNT(*) as count FROM observations WHERE timestamp > CAST(strftime('%s', ?) AS INTEGER)`)
-    : db.prepare(`SELECT COUNT(*) as count FROM observations WHERE timestamp > ?`),
-  getTransmissionByHash: db.prepare(`SELECT id, first_seen FROM transmissions WHERE hash = ?`),
-  insertTransmission: db.prepare(`
-    INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, payload_version, decoded_json)
-    VALUES (@raw_hex, @hash, @first_seen, @route_type, @payload_type, @payload_version, @decoded_json)
-  `),
-  updateTransmissionFirstSeen: db.prepare(`UPDATE transmissions SET first_seen = @first_seen WHERE id = @id`),
-  insertObservation: schemaVersion >= 3
-    ? db.prepare(`
-        INSERT OR IGNORE INTO observations (transmission_id, observer_idx, direction, snr, rssi, score, path_json, timestamp)
-        VALUES (@transmission_id, @observer_idx, @direction, @snr, @rssi, @score, @path_json, @timestamp)
-      `)
-    : db.prepare(`
-        INSERT OR IGNORE INTO observations (transmission_id, hash, observer_id, observer_name, direction, snr, rssi, score, path_json, timestamp)
-        VALUES (@transmission_id, @hash, @observer_id, @observer_name, @direction, @snr, @rssi, @score, @path_json, @timestamp)
-      `),
-  getObserverRowid: db.prepare(`SELECT rowid FROM observers WHERE id = ?`),
-};
-
-// --- In-memory observer map (observer_id text → rowid integer) ---
-const observerIdToRowid = new Map();
-if (schemaVersion >= 3) {
-  const rows = db.prepare('SELECT id, rowid FROM observers').all();
-  for (const r of rows) observerIdToRowid.set(r.id, r.rowid);
-}
-
-// --- In-memory dedup set for v3 ---
-const dedupSet = new Map(); // key → timestamp (for cleanup)
-const DEDUP_TTL_MS = 5 * 60 * 1000; // 5 minutes
-
-function cleanupDedupSet() {
-  const cutoff = Date.now() - DEDUP_TTL_MS;
-  for (const [key, ts] of dedupSet) {
-    if (ts < cutoff) dedupSet.delete(key);
-  }
-}
-
-// Periodic cleanup every 60s
-setInterval(cleanupDedupSet, 60000).unref();
-
-function resolveObserverIdx(observerId) {
-  if (!observerId) return null;
-  let rowid = observerIdToRowid.get(observerId);
-  if (rowid !== undefined) return rowid;
-  // Try DB lookup (observer may have been inserted elsewhere)
-  const row = stmts.getObserverRowid.get(observerId);
-  if (row) {
-    observerIdToRowid.set(observerId, row.rowid);
-    return row.rowid;
-  }
-  return null;
-}
-
-// --- Helper functions ---
-
-function insertTransmission(data) {
-  const hash = data.hash;
-  if (!hash) return null;
-
-  const timestamp = data.timestamp || new Date().toISOString();
-  let transmissionId;
-
-  let isNew = false;
-  const existing = stmts.getTransmissionByHash.get(hash);
-  if (existing) {
-    transmissionId = existing.id;
-    if (timestamp < existing.first_seen) {
-      stmts.updateTransmissionFirstSeen.run({ id: transmissionId, first_seen: timestamp });
-    }
-  } else {
-    isNew = true;
-    const result = stmts.insertTransmission.run({
-      raw_hex: data.raw_hex || '',
-      hash,
-      first_seen: timestamp,
-      route_type: data.route_type ?? null,
-      payload_type: data.payload_type ?? null,
-      payload_version: data.payload_version ?? null,
-      decoded_json: data.decoded_json || null,
-    });
-    transmissionId = result.lastInsertRowid;
-  }
-
-  let obsResult;
-  if (schemaVersion >= 3) {
-    const observerIdx = resolveObserverIdx(data.observer_id);
-    const epochTs = typeof timestamp === 'number' ? timestamp : Math.floor(new Date(timestamp).getTime() / 1000);
-
-    // In-memory dedup check
-    const dedupKey = `${transmissionId}|${observerIdx}|${data.path_json || ''}`;
-    if (dedupSet.has(dedupKey)) {
-      return { transmissionId, observationId: 0, isNew };
-    }
-
-    obsResult = stmts.insertObservation.run({
-      transmission_id: transmissionId,
-      observer_idx: observerIdx,
-      direction: data.direction || null,
-      snr: data.snr ?? null,
-      rssi: data.rssi ?? null,
-      score: data.score ?? null,
-      path_json: data.path_json || null,
-      timestamp: epochTs,
-    });
-    dedupSet.set(dedupKey, Date.now());
-  } else {
-    obsResult = stmts.insertObservation.run({
-      transmission_id: transmissionId,
-      hash,
-      observer_id: data.observer_id || null,
-      observer_name: data.observer_name || null,
-      direction: data.direction || null,
-      snr: data.snr ?? null,
-      rssi: data.rssi ?? null,
-      score: data.score ?? null,
-      path_json: data.path_json || null,
-      timestamp,
-    });
-  }
-
-  return { transmissionId, observationId: obsResult.lastInsertRowid, isNew };
-}
-
-function incrementAdvertCount(publicKey) {
-  stmts.incrementAdvertCount.run({ public_key: publicKey });
-}
-
-function updateNodeTelemetry(data) {
-  stmts.updateNodeTelemetry.run({
-    public_key: data.public_key,
-    battery_mv: data.battery_mv ?? null,
-    temperature_c: data.temperature_c ?? null,
-  });
-}
-
-function upsertNode(data) {
-  const now = new Date().toISOString();
-  stmts.upsertNode.run({
-    public_key: data.public_key,
-    name: data.name || null,
-    role: data.role || null,
-    lat: data.lat ?? null,
-    lon: data.lon ?? null,
-    last_seen: data.last_seen || now,
-    first_seen: data.first_seen || now,
-  });
-}
-
-function upsertObserver(data) {
-  const now = new Date().toISOString();
-  stmts.upsertObserver.run({
-    id: data.id,
-    name: data.name || null,
-    iata: data.iata || null,
-    last_seen: data.last_seen || now,
-    first_seen: data.first_seen || now,
-    model: data.model || null,
-    firmware: data.firmware || null,
-    client_version: data.client_version || null,
-    radio: data.radio || null,
-    battery_mv: data.battery_mv || null,
-    uptime_secs: data.uptime_secs || null,
-    noise_floor: data.noise_floor || null,
-  });
-  // Update in-memory map for v3
-  if (schemaVersion >= 3 && !observerIdToRowid.has(data.id)) {
-    const row = stmts.getObserverRowid.get(data.id);
-    if (row) observerIdToRowid.set(data.id, row.rowid);
-  }
-}
-
-function updateObserverStatus(data) {
-  const now = new Date().toISOString();
-  stmts.updateObserverStatus.run({
-    id: data.id,
-    name: data.name || null,
-    iata: data.iata || null,
-    last_seen: data.last_seen || now,
-    first_seen: data.first_seen || now,
-    model: data.model || null,
-    firmware: data.firmware || null,
-    client_version: data.client_version || null,
-    radio: data.radio || null,
-    battery_mv: data.battery_mv || null,
-    uptime_secs: data.uptime_secs || null,
-    noise_floor: data.noise_floor || null,
-  });
-}
-
-function getPackets({ limit = 50, offset = 0, type, route, hash, since } = {}) {
-  let where = [];
-  let params = {};
-  if (type !== undefined) { where.push('payload_type = @type'); params.type = type; }
-  if (route !== undefined) { where.push('route_type = @route'); params.route = route; }
-  if (hash) { where.push('hash = @hash'); params.hash = hash; }
-  if (since) { where.push('timestamp > @since'); params.since = since; }
-  const clause = where.length ? 'WHERE ' + where.join(' AND ') : '';
-  const rows = db.prepare(`SELECT * FROM packets_v ${clause} ORDER BY timestamp DESC LIMIT @limit OFFSET @offset`).all({ ...params, limit, offset });
-  const total = db.prepare(`SELECT COUNT(*) as count FROM packets_v ${clause}`).get(params).count;
-  return { rows, total };
-}
-
-function getTransmission(id) {
-  try {
-    return db.prepare('SELECT * FROM transmissions WHERE id = ?').get(id) || null;
-  } catch { return null; }
-}
-
-function getPacket(id) {
-  const packet = stmts.getPacket.get(id);
-  if (!packet) return null;
-  return packet;
-}
-
-function getNodes({ limit = 50, offset = 0, sortBy = 'last_seen' } = {}) {
-  const allowed = ['last_seen', 'name', 'advert_count', 'first_seen'];
-  const col = allowed.includes(sortBy) ? sortBy : 'last_seen';
-  const dir = col === 'name' ? 'ASC' : 'DESC';
-  const rows = db.prepare(`SELECT * FROM nodes ORDER BY ${col} ${dir} LIMIT ? OFFSET ?`).all(limit, offset);
-  const total = stmts.countNodes.get().count;
-  return { rows, total };
-}
-
-function getNode(pubkey) {
-  const node = stmts.getNode.get(pubkey);
-  if (!node) return null;
-  // Match by: pubkey anywhere, name in sender/text fields, name as text prefix ("Name: msg")
-  const namePattern = node.name ? `%${node.name}%` : `%${pubkey}%`;
-  const textPrefix = node.name ? `%"text":"${node.name}:%` : `%${pubkey}%`;
-  node.recentPackets = stmts.getRecentPacketsForNode.all(
-    `%${pubkey}%`,
-    namePattern,
-    textPrefix,
-    `%"sender":"${node.name || pubkey}"%`
-  );
-  return node;
-}
-
-function getObservers() {
-  return stmts.getObservers.all();
-}
-
-function getStats() {
-  const oneHourAgo = new Date(Date.now() - 3600000).toISOString();
-  const sevenDaysAgo = new Date(Date.now() - 7 * 24 * 3600000).toISOString();
-  // Try to get transmission count from normalized schema
-  let totalTransmissions = null;
-  try {
-    totalTransmissions = db.prepare('SELECT COUNT(*) as count FROM transmissions').get().count;
-  } catch {}
-  return {
-    totalPackets: totalTransmissions || stmts.countPackets.get().count,
-    totalTransmissions,
-    totalObservations: stmts.countPackets.get().count,
-    totalNodes: stmts.countActiveNodes.get(sevenDaysAgo).count,
-    totalNodesAllTime: stmts.countNodes.get().count,
-    totalObservers: stmts.countObservers.get().count,
-    packetsLastHour: stmts.countRecentPackets.get(oneHourAgo).count,
-    packetsLast24h: stmts.countRecentPackets.get(new Date(Date.now() - 24 * 3600000).toISOString()).count,
-  };
-}
-
-// --- Run directly ---
-if (require.main === module) {
-  console.log('Stats:', getStats());
-}
-
-// Remove phantom nodes created by autoLearnHopNodes before this fix.
-// Real MeshCore pubkeys are 32 bytes (64 hex chars). Phantom nodes have only
-// the hop prefix as their public_key (typically 4-8 hex chars).
-// Threshold: public_key <= 16 hex chars (8 bytes) is too short to be real.
-function removePhantomNodes() {
-  const result = db.prepare(`DELETE FROM nodes WHERE LENGTH(public_key) <= 16`).run();
-  if (result.changes > 0) {
-    console.log(`[cleanup] Removed ${result.changes} phantom node(s) with short public_key prefixes`);
-  }
-  return result.changes;
-}
-
-function searchNodes(query, limit = 10) {
-  return db.prepare(`
-    SELECT * FROM nodes
-    WHERE name LIKE @q OR public_key LIKE @prefix
-    ORDER BY last_seen DESC
-    LIMIT @limit
-  `).all({ q: `%${query}%`, prefix: `${query}%`, limit });
-}
-
-function getNodeHealth(pubkey) {
-  const node = stmts.getNode.get(pubkey);
-  if (!node) return null;
-
-  const todayStart = new Date();
-  todayStart.setUTCHours(0, 0, 0, 0);
-  const todayISO = todayStart.toISOString();
-
-  const keyPattern = `%${pubkey}%`;
-  // Also match by node name in decoded_json (channel messages have sender name, not pubkey)
-  const namePattern = node.name ? `%${node.name.replace(/[%_]/g, '')}%` : null;
-  const whereClause = namePattern
-    ? `(decoded_json LIKE @keyPattern OR decoded_json LIKE @namePattern)`
-    : `decoded_json LIKE @keyPattern`;
-  const params = namePattern ? { keyPattern, namePattern } : { keyPattern };
-
-  // Observers that heard this node
-  const observers = db.prepare(`
-    SELECT observer_id, observer_name,
-      AVG(snr) as avgSnr, AVG(rssi) as avgRssi, COUNT(*) as packetCount
-    FROM packets_v
-    WHERE ${whereClause} AND observer_id IS NOT NULL
-    GROUP BY observer_id
-    ORDER BY packetCount DESC
-  `).all(params);
-
-  // Stats
-  const packetsToday = db.prepare(`
-    SELECT COUNT(*) as count FROM packets_v WHERE ${whereClause} AND timestamp > @since
-  `).get({ ...params, since: todayISO }).count;
-
-  const avgStats = db.prepare(`
-    SELECT AVG(snr) as avgSnr FROM packets_v WHERE ${whereClause}
-  `).get(params);
-
-  const lastHeard = db.prepare(`
-    SELECT MAX(timestamp) as lastHeard FROM packets_v WHERE ${whereClause}
-  `).get(params).lastHeard;
-
-  // Avg hops from path_json
-  const pathRows = db.prepare(`
-    SELECT path_json FROM packets_v WHERE ${whereClause} AND path_json IS NOT NULL
-  `).all(params);
-
-  let totalHops = 0, hopCount = 0;
-  for (const row of pathRows) {
-    try {
-      const hops = JSON.parse(row.path_json);
-      if (Array.isArray(hops)) { totalHops += hops.length; hopCount++; }
-    } catch {}
-  }
-  const avgHops = hopCount > 0 ? Math.round(totalHops / hopCount) : 0;
-
-  const totalPackets = db.prepare(`
-    SELECT COUNT(*) as count FROM packets_v WHERE ${whereClause}
-  `).get(params).count;
-
-  // Recent 10 packets
-  const recentPackets = db.prepare(`
-    SELECT * FROM packets_v WHERE ${whereClause} ORDER BY timestamp DESC LIMIT 10
-  `).all(params);
-
-  return {
-    node,
-    observers,
-    stats: { totalPackets, packetsToday, avgSnr: avgStats.avgSnr, avgHops, lastHeard },
-    recentPackets,
-  };
-}
-
-function getNodeAnalytics(pubkey, days) {
-  const node = stmts.getNode.get(pubkey);
-  if (!node) return null;
-
-  const now = new Date();
-  const from = new Date(now.getTime() - days * 86400000);
-  const fromISO = from.toISOString();
-  const toISO = now.toISOString();
-
-  const keyPattern = `%${pubkey}%`;
-  const namePattern = node.name ? `%${node.name.replace(/[%_]/g, '')}%` : null;
-  const whereClause = namePattern
-    ? `(decoded_json LIKE @keyPattern OR decoded_json LIKE @namePattern)`
-    : `decoded_json LIKE @keyPattern`;
-  const timeWhere = `${whereClause} AND timestamp > @fromISO`;
-  const params = namePattern ? { keyPattern, namePattern, fromISO } : { keyPattern, fromISO };
-
-  // Activity timeline
-  const activityTimeline = db.prepare(`
-    SELECT strftime('%Y-%m-%dT%H:00:00Z', timestamp) as bucket, COUNT(*) as count
-    FROM packets_v WHERE ${timeWhere} GROUP BY bucket ORDER BY bucket
-  `).all(params);
-
-  // SNR trend
-  const snrTrend = db.prepare(`
-    SELECT timestamp, snr, rssi, observer_id, observer_name
-    FROM packets_v WHERE ${timeWhere} AND snr IS NOT NULL ORDER BY timestamp
-  `).all(params);
-
-  // Packet type breakdown
-  const packetTypeBreakdown = db.prepare(`
-    SELECT payload_type, COUNT(*) as count FROM packets_v WHERE ${timeWhere} GROUP BY payload_type
-  `).all(params);
-
-  // Observer coverage
-  const observerCoverage = db.prepare(`
-    SELECT observer_id, observer_name, COUNT(*) as packetCount,
-      AVG(snr) as avgSnr, AVG(rssi) as avgRssi, MIN(timestamp) as firstSeen, MAX(timestamp) as lastSeen
-    FROM packets_v WHERE ${timeWhere} AND observer_id IS NOT NULL
-    GROUP BY observer_id ORDER BY packetCount DESC
-  `).all(params);
-
-  // Hop distribution
-  const pathRows = db.prepare(`
-    SELECT path_json FROM packets_v WHERE ${timeWhere} AND path_json IS NOT NULL
-  `).all(params);
-
-  const hopCounts = {};
-  let totalWithPath = 0, relayedCount = 0;
-  for (const row of pathRows) {
-    try {
-      const hops = JSON.parse(row.path_json);
-      if (Array.isArray(hops)) {
-        const h = hops.length;
-        const key = h >= 4 ? '4+' : String(h);
-        hopCounts[key] = (hopCounts[key] || 0) + 1;
-        totalWithPath++;
-        if (h > 1) relayedCount++;
-      }
-    } catch {}
-  }
-  const hopDistribution = Object.entries(hopCounts).map(([hops, count]) => ({ hops, count }))
-    .sort((a, b) => a.hops.localeCompare(b.hops, undefined, { numeric: true }));
-
-  // Peer interactions from decoded_json
-  const decodedRows = db.prepare(`
-    SELECT decoded_json, timestamp FROM packets_v WHERE ${timeWhere} AND decoded_json IS NOT NULL
-  `).all(params);
-
-  const peerMap = {};
-  for (const row of decodedRows) {
-    try {
-      const d = JSON.parse(row.decoded_json);
-      // Look for sender/recipient pubkeys that aren't this node
-      const candidates = [];
-      if (d.sender_key && d.sender_key !== pubkey) candidates.push({ key: d.sender_key, name: d.sender_name || d.sender_short_name });
-      if (d.recipient_key && d.recipient_key !== pubkey) candidates.push({ key: d.recipient_key, name: d.recipient_name || d.recipient_short_name });
-      if (d.pubkey && d.pubkey !== pubkey) candidates.push({ key: d.pubkey, name: d.name });
-      for (const c of candidates) {
-        if (!c.key) continue;
-        if (!peerMap[c.key]) peerMap[c.key] = { peer_key: c.key, peer_name: c.name || c.key.slice(0, 12), messageCount: 0, lastContact: row.timestamp };
-        peerMap[c.key].messageCount++;
-        if (row.timestamp > peerMap[c.key].lastContact) peerMap[c.key].lastContact = row.timestamp;
-      }
-    } catch {}
-  }
-  const peerInteractions = Object.values(peerMap).sort((a, b) => b.messageCount - a.messageCount).slice(0, 20);
-
-  // Uptime heatmap
-  const uptimeHeatmap = db.prepare(`
-    SELECT CAST(strftime('%w', timestamp) AS INTEGER) as dayOfWeek,
-      CAST(strftime('%H', timestamp) AS INTEGER) as hour, COUNT(*) as count
-    FROM packets_v WHERE ${timeWhere} GROUP BY dayOfWeek, hour
-  `).all(params);
-
-  // Computed stats
-  const totalPackets = db.prepare(`SELECT COUNT(*) as count FROM packets_v WHERE ${timeWhere}`).get(params).count;
-  const uniqueObservers = observerCoverage.length;
-  const uniquePeers = peerInteractions.length;
-  const avgPacketsPerDay = days > 0 ? Math.round(totalPackets / days * 10) / 10 : totalPackets;
-
-  // Availability: distinct hours with packets / total hours
-  const distinctHours = activityTimeline.length;
-  const totalHours = days * 24;
-  const availabilityPct = totalHours > 0 ? Math.round(distinctHours / totalHours * 1000) / 10 : 0;
-
-  // Longest silence
-  const timestamps = db.prepare(`
-    SELECT timestamp FROM packets_v WHERE ${timeWhere} ORDER BY timestamp
-  `).all(params).map(r => new Date(r.timestamp).getTime());
-
-  let longestSilenceMs = 0, longestSilenceStart = null;
-  for (let i = 1; i < timestamps.length; i++) {
-    const gap = timestamps[i] - timestamps[i - 1];
-    if (gap > longestSilenceMs) { longestSilenceMs = gap; longestSilenceStart = new Date(timestamps[i - 1]).toISOString(); }
-  }
-
-  // Signal grade
-  const snrValues = snrTrend.map(r => r.snr);
-  const snrMean = snrValues.length > 0 ? snrValues.reduce((a, b) => a + b, 0) / snrValues.length : 0;
-  const snrStdDev = snrValues.length > 1 ? Math.sqrt(snrValues.reduce((s, v) => s + (v - snrMean) ** 2, 0) / snrValues.length) : 0;
-  let signalGrade = 'D';
-  if (snrMean > 15 && snrStdDev < 2) signalGrade = 'A';
-  else if (snrMean > 15) signalGrade = 'A-';
-  else if (snrMean > 12 && snrStdDev < 3) signalGrade = 'B+';
-  else if (snrMean > 8) signalGrade = 'B';
-  else if (snrMean > 3) signalGrade = 'C';
-
-  const relayPct = totalWithPath > 0 ? Math.round(relayedCount / totalWithPath * 1000) / 10 : 0;
-
-  return {
-    node,
-    timeRange: { from: fromISO, to: toISO, days },
-    activityTimeline,
-    snrTrend,
-    packetTypeBreakdown,
-    observerCoverage,
-    hopDistribution,
-    peerInteractions,
-    uptimeHeatmap,
-    computedStats: {
-      availabilityPct, longestSilenceMs, longestSilenceStart, signalGrade,
-      snrMean: Math.round(snrMean * 10) / 10, snrStdDev: Math.round(snrStdDev * 10) / 10,
-      relayPct, totalPackets, uniqueObservers, uniquePeers, avgPacketsPerDay
-    }
-  };
-}
-
-// Move stale nodes to inactive_nodes table based on retention.nodeDays config.
-function moveStaleNodes(nodeDays) {
-  if (!nodeDays || nodeDays <= 0) return 0;
-  const cutoff = new Date(Date.now() - nodeDays * 24 * 3600000).toISOString();
-  const move = db.transaction(() => {
-    db.prepare(`INSERT OR REPLACE INTO inactive_nodes SELECT * FROM nodes WHERE last_seen < ?`).run(cutoff);
-    const result = db.prepare(`DELETE FROM nodes WHERE last_seen < ?`).run(cutoff);
-    return result.changes;
-  });
-  const moved = move();
-  if (moved > 0) {
-    console.log(`[retention] Moved ${moved} node(s) to inactive_nodes (not seen in ${nodeDays} days)`);
-  }
-  return moved;
-}
-
-module.exports = { db, schemaVersion, observerIdToRowid, resolveObserverIdx, insertTransmission, upsertNode, incrementAdvertCount, updateNodeTelemetry, upsertObserver, updateObserverStatus, getPackets, getPacket, getTransmission, getNodes, getNode, getObservers, getStats, searchNodes, getNodeHealth, getNodeAnalytics, removePhantomNodes, moveStaleNodes };

decoder.js

@@ -1,439 +0,0 @@
-/**
- * MeshCore Packet Decoder
- * Custom implementation — does NOT use meshcore-decoder library (known path_length bug).
- *
- * Packet layout (per firmware docs/packet_format.md):
- *   [header(1)] [transportCodes?(4)] [pathLength(1)] [path hops] [payload...]
- *
- * Header byte (LSB first):
- *   bits 1-0: routeType (0=TRANSPORT_FLOOD, 1=FLOOD, 2=DIRECT, 3=TRANSPORT_DIRECT)
- *   bits 5-2: payloadType
- *   bits 7-6: payloadVersion
- *
- * Path length byte:
- *   bits 5-0: hash_count (number of hops, 0-63)
- *   bits 7-6: (value >> 6) + 1 = hash_size (1-4 bytes per hop hash)
- */
-
-'use strict';
-
-// --- Constants ---
-
-const ROUTE_TYPES = {
-  0: 'TRANSPORT_FLOOD',
-  1: 'FLOOD',
-  2: 'DIRECT',
-  3: 'TRANSPORT_DIRECT',
-};
-
-const PAYLOAD_TYPES = {
-  0x00: 'REQ',
-  0x01: 'RESPONSE',
-  0x02: 'TXT_MSG',
-  0x03: 'ACK',
-  0x04: 'ADVERT',
-  0x05: 'GRP_TXT',
-  0x06: 'GRP_DATA',
-  0x07: 'ANON_REQ',
-  0x08: 'PATH',
-  0x09: 'TRACE',
-  0x0A: 'MULTIPART',
-  0x0B: 'CONTROL',
-  0x0F: 'RAW_CUSTOM',
-};
-
-// Route types that carry transport codes (2x uint16_t, 4 bytes total)
-const TRANSPORT_ROUTES = new Set([0, 3]); // TRANSPORT_FLOOD, TRANSPORT_DIRECT
-
-// --- Header parsing ---
-
-function decodeHeader(byte) {
-  return {
-    routeType: byte & 0x03,
-    routeTypeName: ROUTE_TYPES[byte & 0x03] || 'UNKNOWN',
-    payloadType: (byte >> 2) & 0x0F,
-    payloadTypeName: PAYLOAD_TYPES[(byte >> 2) & 0x0F] || 'UNKNOWN',
-    payloadVersion: (byte >> 6) & 0x03,
-  };
-}
-
-// --- Path parsing ---
-
-function decodePath(pathByte, buf, offset) {
-  const hashSize = (pathByte >> 6) + 1;   // 1-4 bytes per hash
-  const hashCount = pathByte & 0x3F;       // 0-63 hops
-  const available = buf.length - offset;
-  // Cap to what the buffer actually holds — corrupt packets may claim more hops than exist
-  const safeCount = Math.min(hashCount, Math.floor(available / hashSize));
-  const totalBytes = safeCount * hashSize;
-  const hops = [];
-
-  for (let i = 0; i < safeCount; i++) {
-    hops.push(buf.subarray(offset + i * hashSize, offset + i * hashSize + hashSize).toString('hex').toUpperCase());
-  }
-
-  return {
-    hashSize,
-    hashCount: safeCount,
-    hops,
-    bytesConsumed: totalBytes,
-    truncated: safeCount < hashCount,
-  };
-}
-
-// --- Payload decoders ---
-
-/** REQ / RESPONSE / TXT_MSG: dest(1) + src(1) + MAC(2) + encrypted (PAYLOAD_VER_1, per Mesh.cpp) */
-function decodeEncryptedPayload(buf) {
-  if (buf.length < 4) return { error: 'too short', raw: buf.toString('hex') };
-  return {
-    destHash: buf.subarray(0, 1).toString('hex'),
-    srcHash: buf.subarray(1, 2).toString('hex'),
-    mac: buf.subarray(2, 4).toString('hex'),
-    encryptedData: buf.subarray(4).toString('hex'),
-  };
-}
-
-/** ACK: checksum(4) — CRC of message timestamp + text + sender pubkey (per Mesh.cpp createAck) */
-function decodeAck(buf) {
-  if (buf.length < 4) return { error: 'too short', raw: buf.toString('hex') };
-  return {
-    ackChecksum: buf.subarray(0, 4).toString('hex'),
-  };
-}
-
-/** ADVERT: pubkey(32) + timestamp(4 LE) + signature(64) + appdata */
-function decodeAdvert(buf) {
-  if (buf.length < 100) return { error: 'too short for advert', raw: buf.toString('hex') };
-  const pubKey = buf.subarray(0, 32).toString('hex');
-  const timestamp = buf.readUInt32LE(32);
-  const signature = buf.subarray(36, 100).toString('hex');
-  const appdata = buf.subarray(100);
-
-  const result = { pubKey, timestamp, timestampISO: new Date(timestamp * 1000).toISOString(), signature };
-
-  if (appdata.length > 0) {
-    const flags = appdata[0];
-    const advType = flags & 0x0F; // lower nibble is enum type, not individual bits
-    result.flags = {
-      raw: flags,
-      type: advType,
-      chat: advType === 1,
-      repeater: advType === 2,
-      room: advType === 3,
-      sensor: advType === 4,
-      hasLocation: !!(flags & 0x10),
-      hasFeat1: !!(flags & 0x20),
-      hasFeat2: !!(flags & 0x40),
-      hasName: !!(flags & 0x80),
-    };
-
-    let off = 1;
-    if (result.flags.hasLocation && appdata.length >= off + 8) {
-      result.lat = appdata.readInt32LE(off) / 1e6;
-      result.lon = appdata.readInt32LE(off + 4) / 1e6;
-      off += 8;
-    }
-    if (result.flags.hasFeat1 && appdata.length >= off + 2) {
-      result.feat1 = appdata.readUInt16LE(off);
-      off += 2;
-    }
-    if (result.flags.hasFeat2 && appdata.length >= off + 2) {
-      result.feat2 = appdata.readUInt16LE(off);
-      off += 2;
-    }
-    if (result.flags.hasName) {
-      // Find null terminator to separate name from trailing telemetry bytes
-      let nameEnd = appdata.length;
-      for (let i = off; i < appdata.length; i++) {
-        if (appdata[i] === 0x00) { nameEnd = i; break; }
-      }
-      let name = appdata.subarray(off, nameEnd).toString('utf8');
-      name = name.replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '');
-      result.name = name;
-      off = nameEnd;
-      // Skip null terminator(s)
-      while (off < appdata.length && appdata[off] === 0x00) off++;
-    }
-
-    // Telemetry bytes after name: battery_mv(2 LE) + temperature_c(2 LE, signed, /100)
-    // Only sensor nodes (advType=4) carry telemetry bytes.
-    if (result.flags.sensor && off + 4 <= appdata.length) {
-      const batteryMv = appdata.readUInt16LE(off);
-      const tempRaw = appdata.readInt16LE(off + 2);
-      const tempC = tempRaw / 100.0;
-      if (batteryMv > 0 && batteryMv <= 10000) {
-        result.battery_mv = batteryMv;
-      }
-      // Raw int16 / 100 → °C; accept -50°C to 100°C (raw: -5000 to 10000)
-      if (tempRaw >= -5000 && tempRaw <= 10000) {
-        result.temperature_c = tempC;
-      }
-    }
-  }
-
-  return result;
-}
-
-/**
- * Check if text contains non-printable characters (binary garbage).
- * Returns true if more than 2 non-printable chars found (excluding \n, \t).
- */
-function hasNonPrintableChars(text) {
-  if (!text) return false;
-  let count = 0;
-  for (let i = 0; i < text.length; i++) {
-    const code = text.charCodeAt(i);
-    if (code < 0x20 && code !== 0x0A && code !== 0x09) count++;
-    else if (code === 0xFFFD) count++;  // Unicode replacement char (invalid UTF-8)
-    if (count > 2) return true;
-  }
-  return false;
-}
-
-/** GRP_TXT: channel_hash(1) + MAC(2) + encrypted */
-function decodeGrpTxt(buf, channelKeys) {
-  if (buf.length < 3) return { error: 'too short', raw: buf.toString('hex') };
-  const channelHash = buf[0];
-  const channelHashHex = channelHash.toString(16).padStart(2, '0').toUpperCase();
-  const mac = buf.subarray(1, 3).toString('hex');
-  const encryptedData = buf.subarray(3).toString('hex');
-
-  const hasKeys = channelKeys && Object.keys(channelKeys).length > 0;
-
-  // Try decryption with known channel keys
-  if (hasKeys && encryptedData.length >= 10) {
-    try {
-      const { ChannelCrypto } = require('@michaelhart/meshcore-decoder/dist/crypto/channel-crypto');
-      for (const [name, key] of Object.entries(channelKeys)) {
-        const result = ChannelCrypto.decryptGroupTextMessage(encryptedData, mac, key);
-        if (result.success && result.data) {
-          const text = result.data.sender && result.data.message
-            ? `${result.data.sender}: ${result.data.message}`
-            : result.data.message || '';
-          // Validate decrypted text is printable UTF-8 (not binary garbage)
-          if (hasNonPrintableChars(text)) {
-            return {
-              type: 'GRP_TXT', channelHash, channelHashHex, channel: name,
-              decryptionStatus: 'decryption_failed', text: null, mac, encryptedData,
-            };
-          }
-          return {
-            type: 'CHAN',
-            channel: name,
-            channelHash,
-            channelHashHex,
-            decryptionStatus: 'decrypted',
-            sender: result.data.sender || null,
-            text,
-            sender_timestamp: result.data.timestamp,
-            flags: result.data.flags,
-          };
-        }
-      }
-    } catch (e) { /* decryption failed, fall through */ }
-
-    return { type: 'GRP_TXT', channelHash, channelHashHex, decryptionStatus: 'decryption_failed', mac, encryptedData };
-  }
-
-  return { type: 'GRP_TXT', channelHash, channelHashHex, decryptionStatus: 'no_key', mac, encryptedData };
-}
-
-/** ANON_REQ: dest(1) + ephemeral_pubkey(32) + MAC(2) + encrypted */
-function decodeAnonReq(buf) {
-  if (buf.length < 35) return { error: 'too short', raw: buf.toString('hex') };
-  return {
-    destHash: buf.subarray(0, 1).toString('hex'),
-    ephemeralPubKey: buf.subarray(1, 33).toString('hex'),
-    mac: buf.subarray(33, 35).toString('hex'),
-    encryptedData: buf.subarray(35).toString('hex'),
-  };
-}
-
-/** PATH: dest(1) + src(1) + MAC(2) + path_data */
-function decodePath_payload(buf) {
-  if (buf.length < 4) return { error: 'too short', raw: buf.toString('hex') };
-  return {
-    destHash: buf.subarray(0, 1).toString('hex'),
-    srcHash: buf.subarray(1, 2).toString('hex'),
-    mac: buf.subarray(2, 4).toString('hex'),
-    pathData: buf.subarray(4).toString('hex'),
-  };
-}
-
-/** TRACE: tag(4) + authCode(4) + flags(1) + pathData (per Mesh.cpp onRecvPacket TRACE) */
-function decodeTrace(buf) {
-  if (buf.length < 9) return { error: 'too short', raw: buf.toString('hex') };
-  return {
-    tag: buf.readUInt32LE(0),
-    authCode: buf.subarray(4, 8).toString('hex'),
-    flags: buf[8],
-    pathData: buf.subarray(9).toString('hex'),
-  };
-}
-
-// Dispatcher
-function decodePayload(type, buf, channelKeys) {
-  switch (type) {
-    case 0x00: return { type: 'REQ', ...decodeEncryptedPayload(buf) };
-    case 0x01: return { type: 'RESPONSE', ...decodeEncryptedPayload(buf) };
-    case 0x02: return { type: 'TXT_MSG', ...decodeEncryptedPayload(buf) };
-    case 0x03: return { type: 'ACK', ...decodeAck(buf) };
-    case 0x04: return { type: 'ADVERT', ...decodeAdvert(buf) };
-    case 0x05: return { type: 'GRP_TXT', ...decodeGrpTxt(buf, channelKeys) };
-    case 0x07: return { type: 'ANON_REQ', ...decodeAnonReq(buf) };
-    case 0x08: return { type: 'PATH', ...decodePath_payload(buf) };
-    case 0x09: return { type: 'TRACE', ...decodeTrace(buf) };
-    default:   return { type: 'UNKNOWN', raw: buf.toString('hex') };
-  }
-}
-
-// --- Main decoder ---
-
-function decodePacket(hexString, channelKeys) {
-  const hex = hexString.replace(/\s+/g, '');
-  const buf = Buffer.from(hex, 'hex');
-
-  if (buf.length < 2) throw new Error('Packet too short (need at least header + pathLength)');
-
-  const header = decodeHeader(buf[0]);
-  let offset = 1;
-
-  // Transport codes for TRANSPORT_FLOOD / TRANSPORT_DIRECT — BEFORE path_length per spec
-  let transportCodes = null;
-  if (TRANSPORT_ROUTES.has(header.routeType)) {
-    if (buf.length < offset + 4) throw new Error('Packet too short for transport codes');
-    transportCodes = {
-      code1: buf.subarray(offset, offset + 2).toString('hex').toUpperCase(),
-      code2: buf.subarray(offset + 2, offset + 4).toString('hex').toUpperCase(),
-    };
-    offset += 4;
-  }
-
-  // Path length byte — AFTER transport codes per spec
-  const pathByte = buf[offset++];
-
-  // Path
-  const path = decodePath(pathByte, buf, offset);
-  offset += path.bytesConsumed;
-
-  // Payload (rest of buffer)
-  const payloadBuf = buf.subarray(offset);
-  const payload = decodePayload(header.payloadType, payloadBuf, channelKeys);
-
-  return {
-    header: {
-      routeType: header.routeType,
-      routeTypeName: header.routeTypeName,
-      payloadType: header.payloadType,
-      payloadTypeName: header.payloadTypeName,
-      payloadVersion: header.payloadVersion,
-    },
-    transportCodes,
-    path: {
-      hashSize: path.hashSize,
-      hashCount: path.hashCount,
-      hops: path.hops,
-      truncated: path.truncated,
-    },
-    payload,
-    raw: hex.toUpperCase(),
-  };
-}
-
-// --- ADVERT validation ---
-
-const VALID_ROLES = new Set(['repeater', 'companion', 'room', 'sensor']);
-
-/**
- * Validate decoded ADVERT data before upserting into the DB.
- * Returns { valid: true } or { valid: false, reason: string }.
- */
-function validateAdvert(advert) {
-  if (!advert || advert.error) return { valid: false, reason: advert?.error || 'null advert' };
-
-  // pubkey must be at least 16 hex chars (8 bytes) and not all zeros
-  const pk = advert.pubKey || '';
-  if (pk.length < 16) return { valid: false, reason: `pubkey too short (${pk.length} hex chars)` };
-  if (/^0+$/.test(pk)) return { valid: false, reason: 'pubkey is all zeros' };
-
-  // lat/lon must be in valid ranges if present
-  if (advert.lat != null) {
-    if (!Number.isFinite(advert.lat) || advert.lat < -90 || advert.lat > 90) {
-      return { valid: false, reason: `invalid lat: ${advert.lat}` };
-    }
-  }
-  if (advert.lon != null) {
-    if (!Number.isFinite(advert.lon) || advert.lon < -180 || advert.lon > 180) {
-      return { valid: false, reason: `invalid lon: ${advert.lon}` };
-    }
-  }
-
-  // name must not contain control chars (except space) or be garbage
-  if (advert.name != null) {
-    // eslint-disable-next-line no-control-regex
-    if (/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(advert.name)) {
-      return { valid: false, reason: 'name contains control characters' };
-    }
-    // Reject names that are mostly non-printable or suspiciously long
-    if (advert.name.length > 64) {
-      return { valid: false, reason: `name too long (${advert.name.length} chars)` };
-    }
-  }
-
-  // role derivation check — flags byte should produce a known role
-  if (advert.flags) {
-    const role = advert.flags.repeater ? 'repeater' : advert.flags.room ? 'room' : advert.flags.sensor ? 'sensor' : 'companion';
-    if (!VALID_ROLES.has(role)) return { valid: false, reason: `unknown role: ${role}` };
-  }
-
-  // timestamp: decoded but not currently used for node storage — skip validation
-
-  return { valid: true };
-}
-
-module.exports = { decodePacket, validateAdvert, hasNonPrintableChars, ROUTE_TYPES, PAYLOAD_TYPES, VALID_ROLES };
-
-// --- Tests ---
-if (require.main === module) {
-  console.log('=== Test 1: ADVERT, FLOOD, 5 hops (2-byte hashes), "Kpa Roof Solar" ===');
-  const pkt1 = decodePacket(
-    '11451000D818206D3AAC152C8A91F89957E6D30CA51F36E28790228971C473B755F244F718754CF5EE4A2FD58D944466E42CDED140C66D0CC590183E32BAF40F112BE8F3F2BDF6012B4B2793C52F1D36F69EE054D9A05593286F78453E56C0EC4A3EB95DDA2A7543FCCC00B939CACC009278603902FC12BCF84B706120526F6F6620536F6C6172'
-  );
-  console.log(JSON.stringify(pkt1, null, 2));
-  console.log();
-
-  // Assertions
-  const assert = (cond, msg) => { if (!cond) throw new Error('ASSERT FAILED: ' + msg); };
-  assert(pkt1.header.routeTypeName === 'FLOOD', 'route should be FLOOD');
-  assert(pkt1.header.payloadTypeName === 'ADVERT', 'payload should be ADVERT');
-  assert(pkt1.path.hashSize === 2, 'hashSize should be 2');
-  assert(pkt1.path.hashCount === 5, 'hashCount should be 5');
-  assert(pkt1.path.hops[0] === '1000', 'first hop should be 1000');
-  assert(pkt1.path.hops[1] === 'D818', 'second hop should be D818');
-  assert(pkt1.transportCodes === null, 'FLOOD has no transport codes');
-  assert(pkt1.payload.name === 'Kpa Roof Solar', 'name should be "Kpa Roof Solar"');
-  console.log('✅ Test 1 passed\n');
-
-  console.log('=== Test 2: ADVERT, FLOOD, 0 hops (zero-path) ===');
-  // Build a minimal advert: header=0x11 (FLOOD+ADVERT), pathLen=0x00 (1-byte hashes, 0 hops)
-  // Then a minimal advert payload: 32-byte pubkey + 4-byte ts + 64-byte sig + flags(1)
-  const fakePubKey = '00'.repeat(32);
-  const fakeTs = '78563412'; // LE = 0x12345678
-  const fakeSig = 'AA'.repeat(64);
-  const flags = '00'; // no location, no name
-  const pkt2hex = '1100' + fakePubKey + fakeTs + fakeSig + flags;
-  const pkt2 = decodePacket(pkt2hex);
-  console.log(JSON.stringify(pkt2, null, 2));
-  console.log();
-
-  assert(pkt2.header.routeTypeName === 'FLOOD', 'route should be FLOOD');
-  assert(pkt2.header.payloadTypeName === 'ADVERT', 'payload should be ADVERT');
-  assert(pkt2.path.hashSize === 1, 'hashSize should be 1');
-  assert(pkt2.path.hashCount === 0, 'hashCount should be 0');
-  assert(pkt2.path.hops.length === 0, 'no hops');
-  assert(pkt2.payload.timestamp === 0x12345678, 'timestamp');
-  console.log('✅ Test 2 passed\n');
-
-  console.log('All tests passed ✅');
-}

docker-compose.staging.yml

@@ -0,0 +1,43 @@
+# Staging-only compose file. Production is managed by docker-compose.yml.
+# Override defaults via .env or environment variables.
+
+services:
+  staging-go:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      args:
+        APP_VERSION: ${APP_VERSION:-unknown}
+        GIT_COMMIT: ${GIT_COMMIT:-unknown}
+        BUILD_TIME: ${BUILD_TIME:-unknown}
+    image: corescope-go:latest
+    container_name: corescope-staging-go
+    restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          memory: 3g
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    ports:
+      - "${STAGING_GO_HTTP_PORT:-82}:80"
+      - "${STAGING_GO_MQTT_PORT:-1885}:1883"
+      - "6060:6060"   # pprof server
+      - "6061:6061"   # pprof ingestor
+    volumes:
+      - ${STAGING_DATA_DIR:-~/meshcore-staging-data}/config.json:/app/config.json:ro
+      - ${STAGING_DATA_DIR:-~/meshcore-staging-data}:/app/data
+      - caddy-data-staging-go:/data/caddy
+    environment:
+      - NODE_ENV=staging
+      - ENABLE_PPROF=true
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/stats"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+
+volumes:
+  # Named volume for Caddy TLS certificates (not user data — managed by Caddy internally)
+  caddy-data-staging-go:

docker-compose.yml

@@ -1,92 +1,38 @@
-# All container config lives here. manage.sh is just a wrapper around docker compose.
-# Override defaults via .env or environment variables.
-# CRITICAL: All data mounts use bind mounts (~/path), NOT named volumes.
-# This ensures the DB and theme are visible on the host filesystem for backup.
-
-services:
-  prod:
-    build: .
-    image: corescope:latest
-    container_name: corescope-prod
-    restart: unless-stopped
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
-    ports:
-      - "${PROD_HTTP_PORT:-80}:${PROD_HTTP_PORT:-80}"
-      - "${PROD_HTTPS_PORT:-443}:${PROD_HTTPS_PORT:-443}"
-      - "${PROD_MQTT_PORT:-1883}:1883"
-    volumes:
-      - ./config.json:/app/config.json:ro
-      - ./caddy-config/Caddyfile:/etc/caddy/Caddyfile:ro
-      - ${PROD_DATA_DIR:-~/meshcore-data}:/app/data
-      - caddy-data:/data/caddy
-    environment:
-      - NODE_ENV=production
-    healthcheck:
-      test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/stats"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-
-  staging:
-    build: .
-    image: corescope:latest
-    container_name: corescope-staging
-    restart: unless-stopped
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
-    ports:
-      - "${STAGING_HTTP_PORT:-81}:${STAGING_HTTP_PORT:-81}"
-      - "${STAGING_MQTT_PORT:-1884}:1883"
-    volumes:
-      - ${STAGING_DATA_DIR:-~/meshcore-staging-data}/config.json:/app/config.json:ro
-      - ${STAGING_DATA_DIR:-~/meshcore-staging-data}/Caddyfile:/etc/caddy/Caddyfile:ro
-      - ${STAGING_DATA_DIR:-~/meshcore-staging-data}:/app/data
-      - caddy-data-staging:/data/caddy
-    environment:
-      - NODE_ENV=staging
-    healthcheck:
-      test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/stats"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-    profiles:
-      - staging
-
-  staging-go:
-    build:
-      context: .
-      dockerfile: Dockerfile
-      args:
-        APP_VERSION: ${APP_VERSION:-unknown}
-        GIT_COMMIT: ${GIT_COMMIT:-unknown}
-    image: corescope-go:latest
-    container_name: corescope-staging-go
-    restart: unless-stopped
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
-    ports:
-      - "${STAGING_GO_HTTP_PORT:-82}:80"
-      - "${STAGING_GO_MQTT_PORT:-1885}:1883"
-      - "6060:6060"   # pprof server
-      - "6061:6061"   # pprof ingestor
-    volumes:
-      - ${STAGING_DATA_DIR:-~/meshcore-staging-data}/config.json:/app/config.json:ro
-      - ${STAGING_DATA_DIR:-~/meshcore-staging-data}:/app/data
-      - caddy-data-staging-go:/data/caddy
-    environment:
-      - NODE_ENV=staging
-      - ENABLE_PPROF=true
-    healthcheck:
-      test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/stats"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-    profiles:
-      - staging-go
-
-volumes:
-  # Named volumes for Caddy TLS certificates (not user data — managed by Caddy internally)
+# All container config lives here. manage.sh is just a wrapper around docker compose.
+# Override defaults via .env or environment variables.
+# CRITICAL: All data mounts use bind mounts (~/path), NOT named volumes.
+# This ensures the DB and theme are visible on the host filesystem for backup.
+
+services:
+  prod:
+    build:
+      context: .
+      args:
+        APP_VERSION: ${APP_VERSION:-unknown}
+        GIT_COMMIT: ${GIT_COMMIT:-unknown}
+        BUILD_TIME: ${BUILD_TIME:-unknown}
+    image: corescope:latest
+    container_name: corescope-prod
+    restart: unless-stopped
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    ports:
+      - "${PROD_HTTP_PORT:-80}:${PROD_HTTP_PORT:-80}"
+      - "${PROD_HTTPS_PORT:-443}:${PROD_HTTPS_PORT:-443}"
+      - "${PROD_MQTT_PORT:-1883}:1883"
+    volumes:
+      - ./config.json:/app/config.json:ro
+      - ./caddy-config/Caddyfile:/etc/caddy/Caddyfile:ro
+      - ${PROD_DATA_DIR:-~/meshcore-data}:/app/data
+      - caddy-data:/data/caddy
+    environment:
+      - NODE_ENV=production
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/stats"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+
+volumes:
+  # Named volumes for Caddy TLS certificates (not user data — managed by Caddy internally)
   caddy-data:
-  caddy-data-staging:
-  caddy-data-staging-go:

docker/entrypoint-go.sh

@@ -1,5 +1,12 @@
 #!/bin/sh
 
+# Fix: Docker creates a directory when bind-mounting a non-existent file.
+# If config.json is a directory (from a failed mount), remove it and use the example.
+if [ -d /app/config.json ]; then
+  echo "[entrypoint] WARNING: config.json is a directory (broken bind mount) — removing and using example"
+  rm -rf /app/config.json
+fi
+
 # Copy example config if no config.json exists (not bind-mounted)
 if [ ! -f /app/config.json ]; then
   echo "[entrypoint] No config.json found, copying from config.example.json"

docker/supervisord-go.conf

@@ -19,6 +19,8 @@ command=/app/corescope-ingestor -config /app/config.json
 directory=/app
 autostart=true
 autorestart=true
+startretries=10
+startsecs=2
 stdout_logfile=/dev/stdout
 stdout_logfile_maxbytes=0
 stderr_logfile=/dev/stderr
@@ -29,6 +31,8 @@ command=/app/corescope-server -config-dir /app -db /app/data/meshcore.db -public
 directory=/app
 autostart=true
 autorestart=true
+startretries=10
+startsecs=2
 stdout_logfile=/dev/stdout
 stdout_logfile_maxbytes=0
 stderr_logfile=/dev/stderr

docker/supervisord.conf

@@ -15,7 +15,7 @@ stderr_logfile=/dev/stderr
 stderr_logfile_maxbytes=0
 
 [program:corescope]
-command=node /app/server.js
+command=/app/corescope-server
 directory=/app
 autostart=true
 autorestart=true

iata-coords.js

@@ -1,90 +0,0 @@
-// IATA airport coordinates for regional node filtering
-// Used by resolve-hops to determine if a node is geographically near an observer's region
-const IATA_COORDS = {
-  // US West Coast
-  SJC: { lat: 37.3626, lon: -121.9290 },
-  SFO: { lat: 37.6213, lon: -122.3790 },
-  OAK: { lat: 37.7213, lon: -122.2208 },
-  SEA: { lat: 47.4502, lon: -122.3088 },
-  PDX: { lat: 45.5898, lon: -122.5951 },
-  LAX: { lat: 33.9425, lon: -118.4081 },
-  SAN: { lat: 32.7338, lon: -117.1933 },
-  SMF: { lat: 38.6954, lon: -121.5908 },
-  MRY: { lat: 36.5870, lon: -121.8430 },
-  EUG: { lat: 44.1246, lon: -123.2119 },
-  RDD: { lat: 40.5090, lon: -122.2934 },
-  MFR: { lat: 42.3742, lon: -122.8735 },
-  FAT: { lat: 36.7762, lon: -119.7181 },
-  SBA: { lat: 34.4262, lon: -119.8405 },
-  RNO: { lat: 39.4991, lon: -119.7681 },
-  BOI: { lat: 43.5644, lon: -116.2228 },
-  LAS: { lat: 36.0840, lon: -115.1537 },
-  PHX: { lat: 33.4373, lon: -112.0078 },
-  SLC: { lat: 40.7884, lon: -111.9778 },
-  // US Mountain/Central
-  DEN: { lat: 39.8561, lon: -104.6737 },
-  DFW: { lat: 32.8998, lon: -97.0403 },
-  IAH: { lat: 29.9844, lon: -95.3414 },
-  AUS: { lat: 30.1975, lon: -97.6664 },
-  MSP: { lat: 44.8848, lon: -93.2223 },
-  // US East Coast
-  ATL: { lat: 33.6407, lon: -84.4277 },
-  ORD: { lat: 41.9742, lon: -87.9073 },
-  JFK: { lat: 40.6413, lon: -73.7781 },
-  EWR: { lat: 40.6895, lon: -74.1745 },
-  BOS: { lat: 42.3656, lon: -71.0096 },
-  MIA: { lat: 25.7959, lon: -80.2870 },
-  IAD: { lat: 38.9531, lon: -77.4565 },
-  CLT: { lat: 35.2144, lon: -80.9473 },
-  DTW: { lat: 42.2124, lon: -83.3534 },
-  MCO: { lat: 28.4312, lon: -81.3081 },
-  BNA: { lat: 36.1263, lon: -86.6774 },
-  RDU: { lat: 35.8801, lon: -78.7880 },
-  // Canada
-  YVR: { lat: 49.1967, lon: -123.1815 },
-  YYZ: { lat: 43.6777, lon: -79.6248 },
-  YYC: { lat: 51.1215, lon: -114.0076 },
-  YEG: { lat: 53.3097, lon: -113.5800 },
-  YOW: { lat: 45.3225, lon: -75.6692 },
-  // Europe
-  LHR: { lat: 51.4700, lon: -0.4543 },
-  CDG: { lat: 49.0097, lon: 2.5479 },
-  FRA: { lat: 50.0379, lon: 8.5622 },
-  AMS: { lat: 52.3105, lon: 4.7683 },
-  MUC: { lat: 48.3537, lon: 11.7750 },
-  SOF: { lat: 42.6952, lon: 23.4062 },
-  // Asia/Pacific
-  NRT: { lat: 35.7720, lon: 140.3929 },
-  HND: { lat: 35.5494, lon: 139.7798 },
-  ICN: { lat: 37.4602, lon: 126.4407 },
-  SYD: { lat: -33.9461, lon: 151.1772 },
-  MEL: { lat: -37.6690, lon: 144.8410 },
-};
-
-// Haversine distance in km
-function haversineKm(lat1, lon1, lat2, lon2) {
-  const R = 6371;
-  const dLat = (lat2 - lat1) * Math.PI / 180;
-  const dLon = (lon2 - lon1) * Math.PI / 180;
-  const a = Math.sin(dLat / 2) ** 2 +
-    Math.cos(lat1 * Math.PI / 180) * Math.cos(lat2 * Math.PI / 180) *
-    Math.sin(dLon / 2) ** 2;
-  return R * 2 * Math.atan2(Math.sqrt(a), Math.sqrt(1 - a));
-}
-
-// Default radius for "near region" — LoRa max realistic range ~300km
-const DEFAULT_REGION_RADIUS_KM = 300;
-
-/**
- * Check if a node is geographically within radius of an IATA region center.
- * Returns { near: boolean, distKm: number } or null if can't determine.
- */
-function nodeNearRegion(nodeLat, nodeLon, iata, radiusKm = DEFAULT_REGION_RADIUS_KM) {
-  const center = IATA_COORDS[iata];
-  if (!center) return null;
-  if (nodeLat == null || nodeLon == null || (nodeLat === 0 && nodeLon === 0)) return null;
-  const distKm = haversineKm(nodeLat, nodeLon, center.lat, center.lon);
-  return { near: distKm <= radiusKm, distKm: Math.round(distKm) };
-}
-
-module.exports = { IATA_COORDS, haversineKm, nodeNearRegion, DEFAULT_REGION_RADIUS_KM };

internal/geofilter/geofilter.go

@@ -0,0 +1,86 @@
+// Package geofilter provides the shared geographic filter configuration and
+// geometry used by both the server and ingestor packages.
+package geofilter
+
+import "math"
+
+// Config defines the geographic filter polygon or bounding box.
+// Shared between the server and ingestor packages.
+type Config struct {
+	Polygon  [][2]float64 `json:"polygon,omitempty"`
+	BufferKm float64      `json:"bufferKm,omitempty"`
+	LatMin   *float64     `json:"latMin,omitempty"`
+	LatMax   *float64     `json:"latMax,omitempty"`
+	LonMin   *float64     `json:"lonMin,omitempty"`
+	LonMax   *float64     `json:"lonMax,omitempty"`
+}
+
+// PassesFilter returns true if the coordinates fall within the filter area.
+// Nodes with no GPS fix (0,0) are always allowed.
+func PassesFilter(lat, lon float64, gf *Config) bool {
+	if gf == nil {
+		return true
+	}
+	if lat == 0 && lon == 0 {
+		return true
+	}
+	if len(gf.Polygon) >= 3 {
+		if PointInPolygon(lat, lon, gf.Polygon) {
+			return true
+		}
+		if gf.BufferKm > 0 {
+			n := len(gf.Polygon)
+			for i := 0; i < n; i++ {
+				j := (i + 1) % n
+				if DistToSegmentKm(lat, lon, gf.Polygon[i], gf.Polygon[j]) <= gf.BufferKm {
+					return true
+				}
+			}
+		}
+		return false
+	}
+	// Legacy bounding box fallback
+	if gf.LatMin != nil && gf.LatMax != nil && gf.LonMin != nil && gf.LonMax != nil {
+		return lat >= *gf.LatMin && lat <= *gf.LatMax && lon >= *gf.LonMin && lon <= *gf.LonMax
+	}
+	return true
+}
+
+// PointInPolygon uses the ray-casting algorithm.
+func PointInPolygon(lat, lon float64, polygon [][2]float64) bool {
+	inside := false
+	n := len(polygon)
+	j := n - 1
+	for i := 0; i < n; i++ {
+		yi, xi := polygon[i][0], polygon[i][1]
+		yj, xj := polygon[j][0], polygon[j][1]
+		if (yi > lat) != (yj > lat) {
+			if lon < (xj-xi)*(lat-yi)/(yj-yi)+xi {
+				inside = !inside
+			}
+		}
+		j = i
+	}
+	return inside
+}
+
+// DistToSegmentKm returns the approximate distance in km from point (lat,lon)
+// to line segment a→b using a flat-earth projection.
+func DistToSegmentKm(lat, lon float64, a, b [2]float64) float64 {
+	lat1, lon1 := a[0], a[1]
+	lat2, lon2 := b[0], b[1]
+	cosLat := math.Cos((lat1+lat2) / 2.0 * math.Pi / 180.0)
+	ax := (lon1 - lon) * 111.0 * cosLat
+	ay := (lat1 - lat) * 111.0
+	bx := (lon2 - lon) * 111.0 * cosLat
+	by := (lat2 - lat) * 111.0
+	abx, aby := bx-ax, by-ay
+	abSq := abx*abx + aby*aby
+	if abSq == 0 {
+		return math.Sqrt(ax*ax + ay*ay)
+	}
+	t := math.Max(0, math.Min(1, -(ax*abx+ay*aby)/abSq))
+	px := ax + t*abx
+	py := ay + t*aby
+	return math.Sqrt(px*px + py*py)
+}

internal/geofilter/go.mod

@@ -0,0 +1,3 @@
+module github.com/meshcore-analyzer/geofilter
+
+go 1.22

manage.sh

@@ -13,11 +13,32 @@ IMAGE_NAME="corescope"
 STATE_FILE=".setup-state"
 
 # Source .env for port/path overrides (same file docker compose reads)
-[ -f .env ] && set -a && . ./.env && set +a
+# Strip \r (Windows line endings) to avoid "$'\r': command not found"
+if [ -f .env ]; then
+  set -a
+  eval "$(sed 's/\r$//' .env)"
+  set +a
+fi
 
 # Resolved paths for prod/staging data (must match docker-compose.yml)
 PROD_DATA="${PROD_DATA_DIR:-$HOME/meshcore-data}"
 STAGING_DATA="${STAGING_DATA_DIR:-$HOME/meshcore-staging-data}"
+STAGING_COMPOSE_FILE="docker-compose.staging.yml"
+
+# Build metadata — exported so docker compose build picks them up via args
+export APP_VERSION=$(node -p "require('./package.json').version" 2>/dev/null || echo "unknown")
+export GIT_COMMIT=$(git rev-parse --short HEAD 2>/dev/null || echo "unknown")
+export BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+# Docker Compose — detect v2 plugin vs v1 standalone
+if docker compose version &>/dev/null 2>&1; then
+  DC="docker compose"
+elif command -v docker-compose &>/dev/null; then
+  DC="docker-compose"
+else
+  echo "ERROR: Neither '$DC' nor 'docker-compose' found." >&2
+  exit 1
+fi
 
 # Colors
 RED='\033[0;31m'
@@ -151,12 +172,7 @@ cmd_setup() {
   fi
 
   log "Docker $(docker --version | grep -oP 'version \K[^ ,]+')"
-  
-  # Check docker compose (separate check since it's a plugin/separate binary)
-  if ! docker compose version &>/dev/null; then
-    err "docker compose is required. Install Docker Desktop or docker-compose-plugin."
-    exit 1
-  fi
+  log "Compose: $DC"
   
   mark_done "docker"
 
@@ -295,12 +311,12 @@ cmd_setup() {
   if [ -n "$IMAGE_EXISTS" ] && is_done "build"; then
     log "Image already built."
     if confirm "Rebuild? (only needed if you updated the code)"; then
-      docker compose build prod
+      $DC build prod
       log "Image rebuilt."
     fi
   else
     info "This takes 1-2 minutes the first time..."
-    docker compose build prod
+    $DC build prod
     log "Image built."
   fi
   mark_done "build"
@@ -317,7 +333,7 @@ cmd_setup() {
     log "Container already running."
   else
     mkdir -p "$PROD_DATA"
-    docker compose up -d prod
+    $DC up -d prod
     log "Container started."
   fi
   mark_done "container"
@@ -357,7 +373,7 @@ cmd_setup() {
     err "Container failed to start."
     echo ""
     echo "   Check what went wrong:"
-    echo "     docker compose logs prod"
+    echo "     $DC logs prod"
     echo ""
     echo "   Common fixes:"
     echo "     • Invalid config.json — check JSON syntax"
@@ -386,7 +402,7 @@ prepare_staging_db() {
 
 # Copy config.prod.json → config.staging.json with siteName change
 prepare_staging_config() {
-  local prod_config="$PROD_DATA/config.json"
+  local prod_config="./config.json"
   local staging_config="$STAGING_DATA/config.json"
   if [ ! -f "$prod_config" ]; then
     warn "No config.json found at ${prod_config} — staging may not start correctly."
@@ -435,13 +451,14 @@ cmd_start() {
     prepare_staging_config
 
     info "Starting production container (corescope-prod) on ports ${PROD_HTTP_PORT:-80}/${PROD_HTTPS_PORT:-443}..."
-    info "Starting staging container (corescope-staging) on port ${STAGING_HTTP_PORT:-81}..."
-    docker compose --profile staging up -d
+    info "Starting staging container (corescope-staging-go) on port ${STAGING_GO_HTTP_PORT:-82}..."
+    $DC up -d prod
+    $DC -f "$STAGING_COMPOSE_FILE" -p corescope-staging up -d staging-go
     log "Production started on ports ${PROD_HTTP_PORT:-80}/${PROD_HTTPS_PORT:-443}/${PROD_MQTT_PORT:-1883}"
-    log "Staging started on port ${STAGING_HTTP_PORT:-81} (MQTT: ${STAGING_MQTT_PORT:-1884})"
+    log "Staging started on port ${STAGING_GO_HTTP_PORT:-82} (MQTT: ${STAGING_GO_MQTT_PORT:-1885})"
   else
     info "Starting production container (corescope-prod) on ports ${PROD_HTTP_PORT:-80}/${PROD_HTTPS_PORT:-443}..."
-    docker compose up -d prod
+    $DC up -d prod
     log "Production started. Staging NOT running (use --with-staging to start both)."
   fi
 }
@@ -452,17 +469,20 @@ cmd_stop() {
   case "$TARGET" in
     prod)
       info "Stopping production container (corescope-prod)..."
-      docker compose stop prod
+      $DC stop prod
       log "Production stopped."
       ;;
     staging)
-      info "Stopping staging container (corescope-staging)..."
-      docker compose --profile staging stop staging
-      log "Staging stopped."
+      info "Stopping staging container (corescope-staging-go)..."
+      $DC -f "$STAGING_COMPOSE_FILE" -p corescope-staging rm -sf staging-go 2>/dev/null || true
+      docker rm -f corescope-staging-go meshcore-staging-go corescope-staging meshcore-staging 2>/dev/null || true
+      log "Staging stopped and cleaned up."
       ;;
     all)
       info "Stopping all containers..."
-      docker compose --profile staging --profile staging-go down
+      $DC stop prod
+      $DC -f "$STAGING_COMPOSE_FILE" -p corescope-staging rm -sf staging-go 2>/dev/null || true
+      docker rm -f corescope-staging-go meshcore-staging-go corescope-staging meshcore-staging 2>/dev/null || true
       log "All containers stopped."
       ;;
     *)
@@ -477,17 +497,38 @@ cmd_restart() {
   case "$TARGET" in
     prod)
       info "Restarting production container (corescope-prod)..."
-      docker compose up -d --force-recreate prod
+      $DC up -d --force-recreate prod
       log "Production restarted."
       ;;
     staging)
-      info "Restarting staging container (corescope-staging)..."
-      docker compose --profile staging up -d --force-recreate staging
+      info "Restarting staging container (corescope-staging-go)..."
+      # Stop and remove old container
+      $DC -f "$STAGING_COMPOSE_FILE" -p corescope-staging rm -sf staging-go 2>/dev/null || true
+      docker rm -f corescope-staging-go 2>/dev/null || true
+      # Wait for container to be fully gone and memory to be reclaimed
+      # This prevents OOM when old + new containers overlap on small VMs
+      for i in $(seq 1 15); do
+        if ! docker ps -a --format '{{.Names}}' | grep -q 'corescope-staging-go'; then
+          break
+        fi
+        sleep 1
+      done
+      sleep 3  # extra pause for OS to reclaim memory
+      # Verify config exists before starting
+      local staging_config="${STAGING_DATA_DIR:-$HOME/meshcore-staging-data}/config.json"
+      if [ ! -f "$staging_config" ]; then
+        warn "Staging config not found at $staging_config — creating from prod config..."
+        prepare_staging_config
+      fi
+      $DC -f "$STAGING_COMPOSE_FILE" -p corescope-staging up -d staging-go
       log "Staging restarted."
       ;;
     all)
       info "Restarting all containers..."
-      docker compose --profile staging up -d --force-recreate
+      $DC up -d --force-recreate prod
+      $DC -f "$STAGING_COMPOSE_FILE" -p corescope-staging rm -sf staging-go 2>/dev/null || true
+      docker rm -f corescope-staging-go 2>/dev/null || true
+      $DC -f "$STAGING_COMPOSE_FILE" -p corescope-staging up -d staging-go
       log "All containers restarted."
       ;;
     *)
@@ -539,10 +580,10 @@ cmd_status() {
   echo ""
 
   # Staging
-  if container_running "corescope-staging"; then
-    show_container_status "corescope-staging" "Staging"
+  if container_running "corescope-staging-go"; then
+    show_container_status "corescope-staging-go" "Staging"
   else
-    info "Staging (corescope-staging): Not running (use --with-staging to start both)"
+    info "Staging (corescope-staging-go): Not running (use --with-staging to start both)"
   fi
   echo ""
 
@@ -569,12 +610,12 @@ cmd_logs() {
   case "$TARGET" in
     prod)
       info "Tailing production logs..."
-      docker compose logs -f --tail="$LINES" prod
+      $DC logs -f --tail="$LINES" prod
       ;;
     staging)
       if container_running "corescope-staging"; then
         info "Tailing staging logs..."
-        docker compose logs -f --tail="$LINES" staging
+        $DC -f "$STAGING_COMPOSE_FILE" -p corescope-staging logs -f --tail="$LINES" staging-go
       else
         err "Staging container is not running."
         info "Start with: ./manage.sh start --with-staging"
@@ -602,7 +643,7 @@ cmd_promote() {
 
   # Show what's currently running
   local staging_image staging_created prod_image prod_created
-  staging_image=$(docker inspect corescope-staging --format '{{.Config.Image}}' 2>/dev/null || echo "not running")
+  staging_image=$(docker inspect corescope-staging-go --format '{{.Config.Image}}' 2>/dev/null || echo "not running")
   staging_created=$(docker inspect corescope-staging --format '{{.Created}}' 2>/dev/null || echo "N/A")
   prod_image=$(docker inspect corescope-prod --format '{{.Config.Image}}' 2>/dev/null || echo "not running")
   prod_created=$(docker inspect corescope-prod --format '{{.Created}}' 2>/dev/null || echo "N/A")
@@ -631,7 +672,7 @@ cmd_promote() {
 
   # Restart prod with latest image
   info "Restarting production with latest image..."
-  docker compose up -d --force-recreate prod
+  $DC up -d --force-recreate prod
 
   # Wait for health
   info "Waiting for production health check..."
@@ -662,13 +703,13 @@ cmd_promote() {
 
 cmd_update() {
   info "Pulling latest code..."
-  git pull
+  git pull --ff-only
 
   info "Rebuilding image..."
-  docker compose build prod
+  $DC build prod
 
   info "Restarting with new image..."
-  docker compose up -d --force-recreate prod
+  $DC up -d --force-recreate prod
 
   log "Updated and restarted. Data preserved."
 }
@@ -782,7 +823,7 @@ cmd_restore() {
   info "Backing up current state..."
   cmd_backup "./backups/corescope-pre-restore-$(date +%Y%m%d-%H%M%S)"
 
-  docker compose stop prod 2>/dev/null || true
+  $DC stop prod 2>/dev/null || true
 
   # Restore database
   mkdir -p "$PROD_DATA"
@@ -810,7 +851,7 @@ cmd_restore() {
     log "theme.json restored"
   fi
 
-  docker compose up -d prod
+  $DC up -d prod
   log "Restored and restarted."
 }
 
@@ -848,7 +889,8 @@ cmd_reset() {
     exit 0
   fi
 
-  docker compose --profile staging --profile staging-go down --rmi local 2>/dev/null || true
+  $DC down --rmi local 2>/dev/null || true
+  $DC -f "$STAGING_COMPOSE_FILE" -p corescope-staging down --rmi local 2>/dev/null || true
   rm -f "$STATE_FILE"
 
   log "Reset complete. Run './manage.sh setup' to start over."
@@ -869,7 +911,7 @@ cmd_help() {
   echo ""
   printf '%b\n' "  ${BOLD}Run${NC}"
   echo "    start              Start production container"
-  echo "    start --with-staging  Start production + staging (copies prod DB + config)"
+  echo "    start --with-staging  Start production + staging-go (copies prod DB + config)"
   echo "    stop [prod|staging|all]  Stop specific or all containers (default: all)"
   echo "    restart [prod|staging|all]  Restart specific or all containers"
   echo "    status             Show health, stats, and service status"
@@ -882,7 +924,7 @@ cmd_help() {
   echo "    restore <d>        Restore from backup dir or .db file"
   echo "    mqtt-test          Check if MQTT data is flowing"
   echo ""
-  echo "All commands use docker compose with docker-compose.yml."
+  echo "Prod uses docker-compose.yml; staging uses ${STAGING_COMPOSE_FILE}."
   echo ""
 }
 

package.json

@@ -5,7 +5,7 @@
   "main": "index.js",
   "scripts": {
     "test": "npx c8 --reporter=text --reporter=text-summary sh test-all.sh",
-    "test:unit": "node test-packet-filter.js && node test-aging.js && node test-regional-filter.js",
+    "test:unit": "node test-packet-filter.js && node test-aging.js && node test-frontend-helpers.js",
     "test:coverage": "npx c8 --reporter=text --reporter=html sh test-all.sh",
     "test:full-coverage": "sh scripts/combined-coverage.sh"
   },

packet-store.js

@@ -1,752 +0,0 @@
-'use strict';
-
-/**
- * In-memory packet store — loads transmissions + observations from SQLite on startup,
- * serves reads from RAM, writes to both RAM + SQLite.
- * M3: Restructured around transmissions (deduped by hash) with observations.
- * Caps memory at configurable limit (default 1GB).
- */
-class PacketStore {
-  constructor(dbModule, config = {}) {
-    this.dbModule = dbModule;  // The full db module (has .db, .insertTransmission, .getPacket)
-    this.db = dbModule.db;     // Raw better-sqlite3 instance for queries
-    this.maxBytes = (config.maxMemoryMB || 1024) * 1024 * 1024;
-    this.estPacketBytes = config.estimatedPacketBytes || 450;
-    this.maxPackets = Math.floor(this.maxBytes / this.estPacketBytes);
-
-    // SQLite-only mode: skip RAM loading, all reads go to DB
-    this.sqliteOnly = process.env.NO_MEMORY_STORE === '1';
-
-    // Primary storage: transmissions sorted by first_seen DESC (newest first)
-    // Each transmission looks like a packet for backward compat
-    this.packets = [];
-
-    // Indexes
-    this.byId = new Map();           // observation_id → observation object (backward compat for packet detail links)
-    this.byTxId = new Map();         // transmission_id → transmission object
-    this.byHash = new Map();         // hash → transmission object (1:1)
-    this.byObserver = new Map();     // observer_id → [observation objects]
-    this.byNode = new Map();         // pubkey → [transmission objects] (deduped)
-
-    // Track which hashes are indexed per node pubkey (avoid dupes in byNode)
-    this._nodeHashIndex = new Map(); // pubkey → Set<hash>
-    this._advertByObserver = new Map(); // pubkey → Set<observer_id> (ADVERT-only, for region filtering)
-
-    this.loaded = false;
-    this.stats = { totalLoaded: 0, totalObservations: 0, evicted: 0, inserts: 0, queries: 0 };
-  }
-
-  /** Load all packets from SQLite into memory */
-  load() {
-    if (this.sqliteOnly) {
-      console.log('[PacketStore] SQLite-only mode (NO_MEMORY_STORE=1) — all reads go to database');
-      this.loaded = true;
-      return this;
-    }
-
-    const t0 = Date.now();
-
-    // Check if normalized schema exists
-    const hasTransmissions = this.db.prepare(
-      "SELECT name FROM sqlite_master WHERE type='table' AND name='transmissions'"
-    ).get();
-
-    if (hasTransmissions) {
-      this._loadNormalized();
-    } else {
-      this._loadLegacy();
-    }
-
-    this.stats.totalLoaded = this.packets.length;
-    this.loaded = true;
-    const elapsed = Date.now() - t0;
-    console.log(`[PacketStore] Loaded ${this.packets.length} transmissions (${this.stats.totalObservations} observations) in ${elapsed}ms (${Math.round(this.packets.length * this.estPacketBytes / 1024 / 1024)}MB est)`);
-    return this;
-  }
-
-  /** Load from normalized transmissions + observations tables */
-  _loadNormalized() {
-    // Detect v3 schema (observer_idx instead of observer_id in observations)
-    const obsCols = this.db.pragma('table_info(observations)').map(c => c.name);
-    const isV3 = obsCols.includes('observer_idx');
-
-    const sql = isV3
-      ? `SELECT t.id AS transmission_id, t.raw_hex, t.hash, t.first_seen, t.route_type,
-               t.payload_type, t.payload_version, t.decoded_json,
-               o.id AS observation_id, obs.id AS observer_id, obs.name AS observer_name, o.direction,
-               o.snr, o.rssi, o.score, o.path_json, datetime(o.timestamp, 'unixepoch') AS obs_timestamp
-          FROM transmissions t
-          LEFT JOIN observations o ON o.transmission_id = t.id
-          LEFT JOIN observers obs ON obs.rowid = o.observer_idx
-          ORDER BY t.first_seen DESC, o.timestamp DESC`
-      : `SELECT t.id AS transmission_id, t.raw_hex, t.hash, t.first_seen, t.route_type,
-               t.payload_type, t.payload_version, t.decoded_json,
-               o.id AS observation_id, o.observer_id, o.observer_name, o.direction,
-               o.snr, o.rssi, o.score, o.path_json, o.timestamp AS obs_timestamp
-          FROM transmissions t
-          LEFT JOIN observations o ON o.transmission_id = t.id
-          ORDER BY t.first_seen DESC, o.timestamp DESC`;
-
-    for (const row of this.db.prepare(sql).iterate()) {
-      if (this.packets.length >= this.maxPackets && !this.byHash.has(row.hash)) break;
-
-      let tx = this.byHash.get(row.hash);
-      if (!tx) {
-        tx = {
-          id: row.transmission_id,
-          raw_hex: row.raw_hex,
-          hash: row.hash,
-          first_seen: row.first_seen,
-          timestamp: row.first_seen,
-          route_type: row.route_type,
-          payload_type: row.payload_type,
-          decoded_json: row.decoded_json,
-          observations: [],
-          observation_count: 0,
-          // Filled from first observation for backward compat
-          observer_id: null,
-          observer_name: null,
-          snr: null,
-          rssi: null,
-          path_json: null,
-          direction: null,
-        };
-        this.byHash.set(row.hash, tx);
-        this.byHash.set(row.hash, tx);
-        this.packets.push(tx);
-        this.byTxId.set(tx.id, tx);
-        this._indexByNode(tx);
-      }
-
-      if (row.observation_id != null) {
-        const obs = {
-          id: row.observation_id,
-          transmission_id: tx.id,
-          hash: tx.hash,
-          observer_id: row.observer_id,
-          observer_name: row.observer_name,
-          direction: row.direction,
-          snr: row.snr,
-          rssi: row.rssi,
-          score: row.score,
-          path_json: row.path_json,
-          timestamp: row.obs_timestamp,
-        };
-
-        // Dedup: skip if same observer + same path already loaded
-        const isDupeLoad = tx.observations.some(o => o.observer_id === obs.observer_id && (o.path_json || '') === (obs.path_json || ''));
-        if (isDupeLoad) continue;
-
-        tx.observations.push(obs);
-        tx.observation_count++;
-
-        // Fill first observation data into transmission for backward compat
-        if (tx.observer_id == null && obs.observer_id) {
-          tx.observer_id = obs.observer_id;
-          tx.observer_name = obs.observer_name;
-          tx.snr = obs.snr;
-          tx.rssi = obs.rssi;
-          tx.path_json = obs.path_json;
-          tx.direction = obs.direction;
-        }
-
-        // byId maps observation IDs for packet detail links
-        this.byId.set(obs.id, obs);
-
-        // byObserver
-        if (obs.observer_id) {
-          if (!this.byObserver.has(obs.observer_id)) this.byObserver.set(obs.observer_id, []);
-          this.byObserver.get(obs.observer_id).push(obs);
-        }
-
-        this.stats.totalObservations++;
-      }
-    }
-
-    // Post-load: set each transmission's display path to the LONGEST observation path
-    // (most representative of mesh topology — short paths are just nearby observers)
-    for (const tx of this.packets) {
-      if (tx.observations.length > 0) {
-        let best = tx.observations[0];
-        let bestLen = 0;
-        try { bestLen = JSON.parse(best.path_json || '[]').length; } catch {}
-        for (let i = 1; i < tx.observations.length; i++) {
-          let len = 0;
-          try { len = JSON.parse(tx.observations[i].path_json || '[]').length; } catch {}
-          if (len > bestLen) { best = tx.observations[i]; bestLen = len; }
-        }
-        tx.observer_id = best.observer_id;
-        tx.observer_name = best.observer_name;
-        tx.snr = best.snr;
-        tx.rssi = best.rssi;
-        tx.path_json = best.path_json;
-        tx.direction = best.direction;
-      }
-    }
-
-    // Post-load: build ADVERT-by-observer index (needs all observations loaded first)
-    for (const tx of this.packets) {
-      if (tx.payload_type === 4 && tx.decoded_json) {
-        try {
-          const d = JSON.parse(tx.decoded_json);
-          if (d.pubKey) this._indexAdvertObservers(d.pubKey, tx);
-        } catch {}
-      }
-    }
-    console.log(`[PacketStore] ADVERT observer index: ${this._advertByObserver.size} nodes tracked`);
-  }
-
-  /** Fallback: load from legacy packets table */
-  _loadLegacy() {
-    for (const row of this.db.prepare(
-      'SELECT * FROM packets_v ORDER BY timestamp DESC'
-    ).iterate()) {
-      if (this.packets.length >= this.maxPackets) break;
-      this._indexLegacy(row);
-    }
-  }
-
-  /** Index a legacy packet row (old flat structure) — builds transmission + observation */
-  _indexLegacy(pkt) {
-    let tx = this.byHash.get(pkt.hash);
-    if (!tx) {
-      tx = {
-        id: pkt.id,
-        raw_hex: pkt.raw_hex,
-        hash: pkt.hash,
-        first_seen: pkt.timestamp,
-        timestamp: pkt.timestamp,
-        route_type: pkt.route_type,
-        payload_type: pkt.payload_type,
-        decoded_json: pkt.decoded_json,
-        observations: [],
-        observation_count: 0,
-        observer_id: pkt.observer_id,
-        observer_name: pkt.observer_name,
-        snr: pkt.snr,
-        rssi: pkt.rssi,
-        path_json: pkt.path_json,
-        direction: pkt.direction,
-      };
-      this.byHash.set(pkt.hash, tx);
-      this.byHash.set(pkt.hash, tx);
-      this.packets.push(tx);
-        this.byTxId.set(tx.id, tx);
-      this._indexByNode(tx);
-    }
-
-    if (pkt.timestamp < tx.first_seen) {
-      tx.first_seen = pkt.timestamp;
-      tx.timestamp = pkt.timestamp;
-    }
-    // Update display path if new observation has longer path
-    let newPathLen = 0, curPathLen = 0;
-    try { newPathLen = JSON.parse(pkt.path_json || '[]').length; } catch {}
-    try { curPathLen = JSON.parse(tx.path_json || '[]').length; } catch {}
-    if (newPathLen > curPathLen) {
-      tx.observer_id = pkt.observer_id;
-      tx.observer_name = pkt.observer_name;
-      tx.path_json = pkt.path_json;
-    }
-
-    const obs = {
-      id: pkt.id,
-      transmission_id: tx.id,
-      observer_id: pkt.observer_id,
-      observer_name: pkt.observer_name,
-      direction: pkt.direction,
-      snr: pkt.snr,
-      rssi: pkt.rssi,
-      score: pkt.score,
-      path_json: pkt.path_json,
-      timestamp: pkt.timestamp,
-    };
-    // Dedup: skip if same observer + same path already recorded for this transmission
-    const isDupe = tx.observations.some(o => o.observer_id === obs.observer_id && (o.path_json || '') === (obs.path_json || ''));
-    if (isDupe) return tx;
-
-    tx.observations.push(obs);
-    tx.observation_count++;
-
-    this.byId.set(pkt.id, obs);
-
-    if (pkt.observer_id) {
-      if (!this.byObserver.has(pkt.observer_id)) this.byObserver.set(pkt.observer_id, []);
-      this.byObserver.get(pkt.observer_id).push(obs);
-    }
-
-    this.stats.totalObservations++;
-  }
-
-  /** Extract node pubkeys from decoded_json and index transmission in byNode */
-  _indexByNode(tx) {
-    if (!tx.decoded_json) return;
-    try {
-      const decoded = JSON.parse(tx.decoded_json);
-      const keys = new Set();
-      if (decoded.pubKey) keys.add(decoded.pubKey);
-      if (decoded.destPubKey) keys.add(decoded.destPubKey);
-      if (decoded.srcPubKey) keys.add(decoded.srcPubKey);
-      for (const k of keys) {
-        if (!this._nodeHashIndex.has(k)) this._nodeHashIndex.set(k, new Set());
-        if (this._nodeHashIndex.get(k).has(tx.hash)) continue;
-        this._nodeHashIndex.get(k).add(tx.hash);
-        if (!this.byNode.has(k)) this.byNode.set(k, []);
-        this.byNode.get(k).push(tx);
-      }
-    } catch {}
-  }
-
-  /** Track which observers saw an ADVERT from a given pubkey */
-  _indexAdvertObservers(pubkey, tx) {
-    if (!this._advertByObserver.has(pubkey)) this._advertByObserver.set(pubkey, new Set());
-    const s = this._advertByObserver.get(pubkey);
-    for (const obs of tx.observations) {
-      if (obs.observer_id) s.add(obs.observer_id);
-    }
-  }
-
-  /** Get node pubkeys whose ADVERTs were seen by any of the given observer IDs */
-  getNodesByAdvertObservers(observerIds) {
-    const result = new Set();
-    for (const [pubkey, observers] of this._advertByObserver) {
-      for (const obsId of observerIds) {
-        if (observers.has(obsId)) { result.add(pubkey); break; }
-      }
-    }
-    return result;
-  }
-
-  /** Remove oldest transmissions when over memory limit */
-  _evict() {
-    while (this.packets.length > this.maxPackets) {
-      const old = this.packets.pop();
-      this.byHash.delete(old.hash);
-      this.byHash.delete(old.hash);
-      this.byTxId.delete(old.id);
-      // Remove observations from byId and byObserver
-      for (const obs of old.observations) {
-        this.byId.delete(obs.id);
-        if (obs.observer_id && this.byObserver.has(obs.observer_id)) {
-          const arr = this.byObserver.get(obs.observer_id).filter(o => o.id !== obs.id);
-          if (arr.length) this.byObserver.set(obs.observer_id, arr); else this.byObserver.delete(obs.observer_id);
-        }
-      }
-      // Skip node index cleanup (expensive, low value)
-      this.stats.evicted++;
-    }
-  }
-
-  /** Insert a new packet (to both memory and SQLite) */
-  insert(packetData) {
-    // Write to normalized tables and get the transmission ID
-    const txResult = this.dbModule.insertTransmission ? this.dbModule.insertTransmission(packetData) : null;
-    const transmissionId = txResult ? txResult.transmissionId : null;
-    const observationId = txResult ? txResult.observationId : null;
-
-    // Build row directly from packetData — avoids view ID mismatch issues
-    const row = {
-      id: observationId,
-      raw_hex: packetData.raw_hex,
-      hash: packetData.hash,
-      timestamp: packetData.timestamp,
-      route_type: packetData.route_type,
-      payload_type: packetData.payload_type,
-      payload_version: packetData.payload_version,
-      decoded_json: packetData.decoded_json,
-      observer_id: packetData.observer_id,
-      observer_name: packetData.observer_name,
-      snr: packetData.snr,
-      rssi: packetData.rssi,
-      path_json: packetData.path_json,
-      direction: packetData.direction,
-    };
-    if (!this.sqliteOnly) {
-      // Update or create transmission in memory
-      let tx = this.byHash.get(row.hash);
-      if (!tx) {
-        tx = {
-          id: transmissionId || row.id,
-          raw_hex: row.raw_hex,
-          hash: row.hash,
-          first_seen: row.timestamp,
-          timestamp: row.timestamp,
-          route_type: row.route_type,
-          payload_type: row.payload_type,
-          decoded_json: row.decoded_json,
-          observations: [],
-          observation_count: 0,
-          observer_id: row.observer_id,
-          observer_name: row.observer_name,
-          snr: row.snr,
-          rssi: row.rssi,
-          path_json: row.path_json,
-          direction: row.direction,
-        };
-        this.byHash.set(row.hash, tx);
-        this.byHash.set(row.hash, tx);
-        this.packets.unshift(tx); // newest first
-        this.byTxId.set(tx.id, tx);
-        this._indexByNode(tx);
-      } else {
-        // Update first_seen if earlier
-        if (row.timestamp < tx.first_seen) {
-          tx.first_seen = row.timestamp;
-          tx.timestamp = row.timestamp;
-        }
-        // Update display path if new observation has longer path
-        let newPathLen = 0, curPathLen = 0;
-        try { newPathLen = JSON.parse(row.path_json || '[]').length; } catch {}
-        try { curPathLen = JSON.parse(tx.path_json || '[]').length; } catch {}
-        if (newPathLen > curPathLen) {
-          tx.observer_id = row.observer_id;
-          tx.observer_name = row.observer_name;
-          tx.path_json = row.path_json;
-        }
-      }
-
-      // Add observation
-      const obs = {
-        id: row.id,
-        transmission_id: tx.id,
-        hash: tx.hash,
-        observer_id: row.observer_id,
-        observer_name: row.observer_name,
-        direction: row.direction,
-        snr: row.snr,
-        rssi: row.rssi,
-        score: row.score,
-        path_json: row.path_json,
-        timestamp: row.timestamp,
-      };
-      // Dedup: skip if same observer + same path already recorded for this transmission
-      const isDupe = tx.observations.some(o => o.observer_id === obs.observer_id && (o.path_json || '') === (obs.path_json || ''));
-      if (!isDupe) {
-        tx.observations.push(obs);
-        tx.observation_count++;
-      }
-
-      // Update transmission's display fields if this is first observation
-      if (tx.observations.length === 1) {
-        tx.observer_id = obs.observer_id;
-        tx.observer_name = obs.observer_name;
-        tx.snr = obs.snr;
-        tx.rssi = obs.rssi;
-        tx.path_json = obs.path_json;
-      }
-
-      this.byId.set(obs.id, obs);
-      if (obs.observer_id) {
-        if (!this.byObserver.has(obs.observer_id)) this.byObserver.set(obs.observer_id, []);
-        this.byObserver.get(obs.observer_id).push(obs);
-      }
-
-      this.stats.totalObservations++;
-
-      // Update ADVERT observer index for live ingestion
-      if (tx.payload_type === 4 && obs.observer_id && tx.decoded_json) {
-        try {
-          const d = JSON.parse(tx.decoded_json);
-          if (d.pubKey) {
-            if (!this._advertByObserver.has(d.pubKey)) this._advertByObserver.set(d.pubKey, new Set());
-            this._advertByObserver.get(d.pubKey).add(obs.observer_id);
-          }
-        } catch {}
-      }
-
-      this._evict();
-      this.stats.inserts++;
-    }
-    return observationId || transmissionId;
-  }
-
-  /**
-   * Find ALL packets referencing a node — by pubkey index + name + pubkey text search.
-   * Returns unique transmissions (deduped).
-   * @param {string} nodeIdOrName - pubkey or friendly name
-   * @param {Array} [fromPackets] - packet array to filter (defaults to this.packets)
-   * @returns {{ packets: Array, pubkey: string, nodeName: string }}
-   */
-  findPacketsForNode(nodeIdOrName, fromPackets) {
-    let pubkey = nodeIdOrName;
-    let nodeName = nodeIdOrName;
-
-    // Always resolve to get both pubkey and name
-    try {
-      const row = this.db.prepare("SELECT public_key, name FROM nodes WHERE public_key = ? OR name = ? LIMIT 1").get(nodeIdOrName, nodeIdOrName);
-      if (row) { pubkey = row.public_key; nodeName = row.name || nodeIdOrName; }
-    } catch {}
-
-    // Combine: index hits + text search
-    const indexed = this.byNode.get(pubkey);
-    const hashSet = indexed ? new Set(indexed.map(t => t.hash)) : new Set();
-    const source = fromPackets || this.packets;
-    const packets = source.filter(t =>
-      hashSet.has(t.hash) ||
-      (t.decoded_json && (t.decoded_json.includes(nodeName) || t.decoded_json.includes(pubkey)))
-    );
-
-    return { packets, pubkey, nodeName };
-  }
-
-  /** Count transmissions and observations for a node */
-  countForNode(pubkey) {
-    const txs = this.byNode.get(pubkey) || [];
-    let observations = 0;
-    for (const tx of txs) observations += tx.observation_count;
-    return { transmissions: txs.length, observations };
-  }
-
-  /** Query packets with filters — all from memory (or SQLite in fallback mode) */
-  query({ limit = 50, offset = 0, type, route, region, observer, hash, since, until, node, order = 'DESC' } = {}) {
-    this.stats.queries++;
-
-    if (this.sqliteOnly) return this._querySQLite({ limit, offset, type, route, region, observer, hash, since, until, node, order });
-
-    let results = this.packets;
-
-    // Use indexes for single-key filters when possible
-    if (hash && !type && !route && !region && !observer && !since && !until && !node) {
-      const tx = this.byHash.get(hash);
-      results = tx ? [tx] : [];
-    } else if (observer && !type && !route && !region && !hash && !since && !until && !node) {
-      // For observer filter, find unique transmissions where any observation matches
-      results = this._transmissionsForObserver(observer);
-    } else if (node && !type && !route && !region && !observer && !hash && !since && !until) {
-      results = this.findPacketsForNode(node).packets;
-    } else {
-      // Apply filters sequentially
-      if (type !== undefined) {
-        const t = Number(type);
-        results = results.filter(p => p.payload_type === t);
-      }
-      if (route !== undefined) {
-        const r = Number(route);
-        results = results.filter(p => p.route_type === r);
-      }
-      if (observer) results = this._transmissionsForObserver(observer, results);
-      if (hash) {
-        const h = hash.toLowerCase();
-        const tx = this.byHash.get(h);
-        results = tx ? results.filter(p => p.hash === h) : [];
-      }
-      if (since) results = results.filter(p => p.timestamp > since);
-      if (until) results = results.filter(p => p.timestamp < until);
-      if (region) {
-        const regionObservers = new Set();
-        try {
-          const obs = this.db.prepare('SELECT id FROM observers WHERE iata = ?').all(region);
-          obs.forEach(o => regionObservers.add(o.id));
-        } catch {}
-        results = results.filter(p =>
-          p.observations.some(o => regionObservers.has(o.observer_id))
-        );
-      }
-      if (node) {
-        results = this.findPacketsForNode(node, results).packets;
-      }
-    }
-
-    const total = results.length;
-
-    // Sort
-    if (order === 'ASC') {
-      results = results.slice().sort((a, b) => {
-        if (a.timestamp < b.timestamp) return -1;
-        if (a.timestamp > b.timestamp) return 1;
-        return 0;
-      });
-    }
-    // Default DESC — packets array is already sorted newest-first
-
-    // Paginate
-    const paginated = results.slice(Number(offset), Number(offset) + Number(limit));
-    return { packets: paginated, total };
-  }
-
-  /** Find unique transmissions that have at least one observation from given observer */
-  _transmissionsForObserver(observerId, fromTransmissions) {
-    if (fromTransmissions) {
-      return fromTransmissions.filter(tx =>
-        tx.observations.some(o => o.observer_id === observerId)
-      );
-    }
-    // Use byObserver index: get observations, then unique transmissions
-    const obs = this.byObserver.get(observerId) || [];
-    const seen = new Set();
-    const result = [];
-    for (const o of obs) {
-      const txId = o.transmission_id;
-      if (!seen.has(txId)) {
-        seen.add(txId);
-        const tx = this.byTxId.get(txId);
-        if (tx) result.push(tx);
-      }
-    }
-    return result;
-  }
-
-  /** Query with groupByHash — now trivial since packets ARE transmissions */
-  queryGrouped({ limit = 50, offset = 0, type, route, region, observer, hash, since, until, node } = {}) {
-    this.stats.queries++;
-
-    if (this.sqliteOnly) return this._queryGroupedSQLite({ limit, offset, type, route, region, observer, hash, since, until, node });
-
-    // Get filtered transmissions
-    const { packets: filtered, total: filteredTotal } = this.query({
-      limit: 999999, offset: 0, type, route, region, observer, hash, since, until, node
-    });
-
-    // Already grouped by hash — just format for backward compat
-    const sorted = filtered.map(tx => ({
-      hash: tx.hash,
-      first_seen: tx.first_seen || tx.timestamp,
-      count: tx.observation_count,
-      observer_count: new Set(tx.observations.map(o => o.observer_id).filter(Boolean)).size,
-      latest: tx.observations.length ? tx.observations.reduce((max, o) => o.timestamp > max ? o.timestamp : max, tx.observations[0].timestamp) : tx.timestamp,
-      observer_id: tx.observer_id,
-      observer_name: tx.observer_name,
-      path_json: tx.path_json,
-      payload_type: tx.payload_type,
-      route_type: tx.route_type,
-      raw_hex: tx.raw_hex,
-      decoded_json: tx.decoded_json,
-      observation_count: tx.observation_count,
-      snr: tx.snr,
-      rssi: tx.rssi,
-    })).sort((a, b) => b.latest.localeCompare(a.latest));
-
-    const total = sorted.length;
-    const paginated = sorted.slice(Number(offset), Number(offset) + Number(limit));
-    return { packets: paginated, total };
-  }
-
-  /** Get timestamps for sparkline */
-  getTimestamps(since) {
-    if (this.sqliteOnly) {
-      return this.db.prepare('SELECT timestamp FROM packets_v WHERE timestamp > ? ORDER BY timestamp ASC').all(since).map(r => r.timestamp);
-    }
-    const results = [];
-    for (const p of this.packets) {
-      if (p.timestamp <= since) break;
-      results.push(p.timestamp);
-    }
-    return results.reverse();
-  }
-
-  /** Get a single packet by ID — checks observation IDs first (backward compat) */
-  getById(id) {
-    if (this.sqliteOnly) return this.db.prepare('SELECT * FROM packets_v WHERE id = ?').get(id) || null;
-    const obs = this.byId.get(id) || null;
-    return this._enrichObs(obs);
-  }
-
-  /** Get a transmission by its transmission table ID */
-  getByTxId(id) {
-    if (this.sqliteOnly) return this.db.prepare('SELECT * FROM transmissions WHERE id = ?').get(id) || null;
-    return this.byTxId.get(id) || null;
-  }
-
-  /** Get all siblings of a packet (same hash) — returns enriched observations array */
-  getSiblings(hash) {
-    const h = hash.toLowerCase();
-    if (this.sqliteOnly) return this.db.prepare('SELECT * FROM packets_v WHERE hash = ? ORDER BY timestamp DESC').all(h);
-    const tx = this.byHash.get(h);
-    return tx ? tx.observations.map(o => this._enrichObs(o)) : [];
-  }
-
-  /** Get all transmissions (backward compat — returns packets array) */
-  all() {
-    if (this.sqliteOnly) return this.db.prepare('SELECT * FROM packets_v ORDER BY timestamp DESC').all();
-    return this.packets;
-  }
-
-  /** Get all transmissions matching a filter function */
-  filter(fn) {
-    if (this.sqliteOnly) return this.db.prepare('SELECT * FROM packets_v ORDER BY timestamp DESC').all().filter(fn);
-    return this.packets.filter(fn);
-  }
-
-  /** Enrich a lean observation with transmission fields (for API responses) */
-  _enrichObs(obs) {
-    if (!obs) return null;
-    const tx = this.byTxId.get(obs.transmission_id);
-    if (!tx) return obs;
-    return {
-      ...obs,
-      hash: tx.hash,
-      raw_hex: tx.raw_hex,
-      payload_type: tx.payload_type,
-      decoded_json: tx.decoded_json,
-      route_type: tx.route_type,
-    };
-  }
-
-  /** Enrich an array of observations with transmission fields */
-  enrichObservations(observations) {
-    if (!observations || !observations.length) return observations;
-    return observations.map(o => this._enrichObs(o));
-  }
-
-  /** Memory stats */
-  getStats() {
-    return {
-      ...this.stats,
-      inMemory: this.sqliteOnly ? 0 : this.packets.length,
-      sqliteOnly: this.sqliteOnly,
-      maxPackets: this.maxPackets,
-      estimatedMB: this.sqliteOnly ? 0 : Math.round(this.packets.length * this.estPacketBytes / 1024 / 1024),
-      maxMB: Math.round(this.maxBytes / 1024 / 1024),
-      indexes: {
-        byHash: this.byHash.size,
-        byObserver: this.byObserver.size,
-        byNode: this.byNode.size,
-        advertByObserver: this._advertByObserver.size,
-      }
-    };
-  }
-
-  /** SQLite fallback: query with filters */
-  _querySQLite({ limit, offset, type, route, region, observer, hash, since, until, node, order }) {
-    const where = []; const params = [];
-    if (type !== undefined) { where.push('payload_type = ?'); params.push(Number(type)); }
-    if (route !== undefined) { where.push('route_type = ?'); params.push(Number(route)); }
-    if (observer) { where.push('observer_id = ?'); params.push(observer); }
-    if (hash) { where.push('hash = ?'); params.push(hash.toLowerCase()); }
-    if (since) { where.push('timestamp > ?'); params.push(since); }
-    if (until) { where.push('timestamp < ?'); params.push(until); }
-    if (region) { where.push('observer_id IN (SELECT id FROM observers WHERE iata = ?)'); params.push(region); }
-    if (node) { try { const nr = this.db.prepare('SELECT public_key FROM nodes WHERE public_key = ? OR name = ? LIMIT 1').get(node, node); const pk = nr ? nr.public_key : node; where.push('decoded_json LIKE ?'); params.push('%' + pk + '%'); } catch(e) { where.push('decoded_json LIKE ?'); params.push('%' + node + '%'); } }
-    const w = where.length ? 'WHERE ' + where.join(' AND ') : '';
-    const total = this.db.prepare(`SELECT COUNT(*) as c FROM packets_v ${w}`).get(...params).c;
-    const packets = this.db.prepare(`SELECT * FROM packets_v ${w} ORDER BY timestamp ${order === 'ASC' ? 'ASC' : 'DESC'} LIMIT ? OFFSET ?`).all(...params, limit, offset);
-    return { packets, total };
-  }
-
-  /** SQLite fallback: grouped query */
-  _queryGroupedSQLite({ limit, offset, type, route, region, observer, hash, since, until, node }) {
-    const where = []; const params = [];
-    if (type !== undefined) { where.push('payload_type = ?'); params.push(Number(type)); }
-    if (route !== undefined) { where.push('route_type = ?'); params.push(Number(route)); }
-    if (observer) { where.push('observer_id = ?'); params.push(observer); }
-    if (hash) { where.push('hash = ?'); params.push(hash.toLowerCase()); }
-    if (since) { where.push('timestamp > ?'); params.push(since); }
-    if (until) { where.push('timestamp < ?'); params.push(until); }
-    if (region) { where.push('observer_id IN (SELECT id FROM observers WHERE iata = ?)'); params.push(region); }
-    if (node) { try { const nr = this.db.prepare('SELECT public_key FROM nodes WHERE public_key = ? OR name = ? LIMIT 1').get(node, node); const pk = nr ? nr.public_key : node; where.push('decoded_json LIKE ?'); params.push('%' + pk + '%'); } catch(e) { where.push('decoded_json LIKE ?'); params.push('%' + node + '%'); } }
-    const w = where.length ? 'WHERE ' + where.join(' AND ') : '';
-
-    const sql = `SELECT hash, COUNT(*) as count, COUNT(DISTINCT observer_id) as observer_count,
-      MAX(timestamp) as latest, MIN(observer_id) as observer_id, MIN(observer_name) as observer_name,
-      MIN(path_json) as path_json, MIN(payload_type) as payload_type, MIN(route_type) as route_type,
-      MIN(raw_hex) as raw_hex, MIN(decoded_json) as decoded_json, MIN(snr) as snr, MIN(rssi) as rssi
-      FROM packets_v ${w} GROUP BY hash ORDER BY latest DESC LIMIT ? OFFSET ?`;
-    const packets = this.db.prepare(sql).all(...params, limit, offset);
-
-    const countSql = `SELECT COUNT(DISTINCT hash) as c FROM packets_v ${w}`;
-    const total = this.db.prepare(countSql).get(...params).c;
-    return { packets, total };
-  }
-}
-
-module.exports = PacketStore;

public/analytics.js

@@ -876,6 +876,26 @@
             </div>`;
             }).join('')}
           </div>
+          ${data.distributionByRepeaters ? (() => {
+            const dr = data.distributionByRepeaters;
+            const totalRepeaters = (dr[1] || 0) + (dr[2] || 0) + (dr[3] || 0);
+            const rpct = (n) => totalRepeaters ? (n / totalRepeaters * 100).toFixed(1) : '0';
+            const maxRepeaters = Math.max(dr[1] || 0, dr[2] || 0, dr[3] || 0, 1);
+            const colors = { 1: '#ef4444', 2: '#22c55e', 3: '#3b82f6' };
+            return `<h4 style="margin:16px 0 4px">By Repeaters</h4>
+              <p class="text-muted">${totalRepeaters.toLocaleString()} unique repeaters</p>
+              <div class="hash-bars">
+                ${[1, 2, 3].map(size => {
+                  const count = dr[size] || 0;
+                  const width = Math.max((count / maxRepeaters) * 100, count ? 2 : 0);
+                  return `<div class="hash-bar-row">
+                  <div class="hash-bar-label"><strong>${size}-byte</strong></div>
+                  <div class="hash-bar-track"><div class="hash-bar-fill" style="width:${width}%;background:${colors[size]};opacity:0.7"></div></div>
+                  <div class="hash-bar-value">${count.toLocaleString()} <span class="text-muted">(${rpct(count)}%)</span></div>
+                </div>`;
+                }).join('')}
+              </div>`;
+          })() : ''}
         </div>
         <div class="analytics-card flex-1">
           <h3>📈 Hash Size Over Time</h3>

public/index.html

@@ -94,7 +94,7 @@
   <script src="channels.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
   <script src="nodes.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
   <script src="traces.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="analytics.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="analytics.js?v=1774786039" onerror="console.error('Failed to load:', this.src)"></script>
   <script src="audio.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
   <script src="audio-v1-constellation.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
   <script src="audio-v2-constellation.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
@@ -103,7 +103,7 @@
   <script src="observers.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
   <script src="observer-detail.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
   <script src="compare.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="node-analytics.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="node-analytics.js?v=1774786039" onerror="console.error('Failed to load:', this.src)"></script>
   <script src="perf.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
 </body>
 </html>

public/live.js

@@ -5,7 +5,7 @@
   function cssVar(name) { return getComputedStyle(document.documentElement).getPropertyValue(name).trim(); }
   function statusGreen() { return cssVar('--status-green') || '#22c55e'; }
 
-  let map, ws, nodesLayer, pathsLayer, animLayer, heatLayer;
+  let map, ws, nodesLayer, pathsLayer, animLayer, heatLayer, geoFilterLayer;
   let nodeMarkers = {};
   let nodeData = {};
   let packetCount = 0;
@@ -658,6 +658,7 @@
             <span id="audioDesc" class="sr-only">Sonify packets — turn raw bytes into generative music</span>
             <label><input type="checkbox" id="liveFavoritesToggle" aria-describedby="favDesc"> ⭐ Favorites</label>
             <span id="favDesc" class="sr-only">Show only favorited and claimed nodes</span>
+            <label id="liveGeoFilterLabel" style="display:none"><input type="checkbox" id="liveGeoFilterToggle"> Mesh live area</label>
           </div>
           <div class="audio-controls hidden" id="audioControls">
             <label class="audio-slider-label">Voice <select id="audioVoiceSelect" class="audio-voice-select"></select></label>
@@ -801,6 +802,50 @@
       applyFavoritesFilter();
     });
 
+    // Geo filter overlay
+    (async function () {
+      try {
+        const gf = await api('/config/geo-filter', { ttl: 3600 });
+        if (!gf || !gf.polygon || gf.polygon.length < 3) return;
+        const geoColor = cssVar('--geo-filter-color') || '#3b82f6';
+        const latlngs = gf.polygon.map(function (p) { return [p[0], p[1]]; });
+        const innerPoly = L.polygon(latlngs, {
+          color: geoColor, weight: 2, opacity: 0.8,
+          fillColor: geoColor, fillOpacity: 0.08
+        });
+        const bufferPoly = gf.bufferKm > 0 ? (function () {
+          let cLat = 0, cLon = 0;
+          gf.polygon.forEach(function (p) { cLat += p[0]; cLon += p[1]; });
+          cLat /= gf.polygon.length; cLon /= gf.polygon.length;
+          const cosLat = Math.cos(cLat * Math.PI / 180);
+          const outer = gf.polygon.map(function (p) {
+            const dLatM = (p[0] - cLat) * 111000;
+            const dLonM = (p[1] - cLon) * 111000 * cosLat;
+            const dist = Math.sqrt(dLatM * dLatM + dLonM * dLonM);
+            if (dist === 0) return [p[0], p[1]];
+            const scale = (gf.bufferKm * 1000) / dist;
+            return [p[0] + dLatM * scale / 111000, p[1] + dLonM * scale / (111000 * cosLat)];
+          });
+          return L.polygon(outer, {
+            color: geoColor, weight: 1.5, opacity: 0.4, dashArray: '6 4',
+            fillColor: geoColor, fillOpacity: 0.04
+          });
+        })() : null;
+        geoFilterLayer = L.layerGroup(bufferPoly ? [bufferPoly, innerPoly] : [innerPoly]);
+        const label = document.getElementById('liveGeoFilterLabel');
+        if (label) label.style.display = '';
+        const el = document.getElementById('liveGeoFilterToggle');
+        if (el) {
+          const saved = localStorage.getItem('meshcore-map-geo-filter');
+          if (saved === 'true') { el.checked = true; geoFilterLayer.addTo(map); }
+          el.addEventListener('change', function (e) {
+            localStorage.setItem('meshcore-map-geo-filter', e.target.checked);
+            if (e.target.checked) { geoFilterLayer.addTo(map); } else { map.removeLayer(geoFilterLayer); }
+          });
+        }
+      } catch (e) { /* no geo filter configured */ }
+    })();
+
     const matrixToggle = document.getElementById('liveMatrixToggle');
     matrixToggle.checked = matrixMode;
     matrixToggle.addEventListener('change', (e) => {
@@ -2431,7 +2476,7 @@
       }
       _navCleanup = null;
     }
-    nodesLayer = pathsLayer = animLayer = heatLayer = null;
+    nodesLayer = pathsLayer = animLayer = heatLayer = geoFilterLayer = null;
     stopMatrixRain();
     nodeMarkers = {}; nodeData = {};
     recentPaths = [];

public/map.js

@@ -12,6 +12,7 @@
   let filters = { repeater: true, companion: true, room: true, sensor: true, observer: true, lastHeard: '30d', neighbors: false, clusters: false, hashLabels: localStorage.getItem('meshcore-map-hash-labels') !== 'false', statusFilter: localStorage.getItem('meshcore-map-status-filter') || 'all' };
   let wsHandler = null;
   let heatLayer = null;
+  let geoFilterLayer = null;
   let userHasMoved = false;
   let controlsCollapsed = false;
 
@@ -94,6 +95,7 @@
             <label for="mcClusters"><input type="checkbox" id="mcClusters"> Show clusters</label>
             <label for="mcHeatmap"><input type="checkbox" id="mcHeatmap"> Heat map</label>
             <label for="mcHashLabels"><input type="checkbox" id="mcHashLabels"> Hash prefix labels</label>
+            <label id="mcGeoFilterLabel" for="mcGeoFilter" style="display:none"><input type="checkbox" id="mcGeoFilter"> Mesh live area</label>
           </fieldset>
           <fieldset class="mc-section">
             <legend class="mc-label">Status</legend>
@@ -225,6 +227,51 @@
       });
     });
 
+    // Geo filter overlay
+    (async function () {
+      try {
+        const gf = await api('/config/geo-filter', { ttl: 3600 });
+        if (!gf || !gf.polygon || gf.polygon.length < 3) return;
+        const geoColor = getComputedStyle(document.documentElement).getPropertyValue('--geo-filter-color').trim() || '#3b82f6';
+        const latlngs = gf.polygon.map(function (p) { return [p[0], p[1]]; });
+        const innerPoly = L.polygon(latlngs, {
+          color: geoColor, weight: 2, opacity: 0.8,
+          fillColor: geoColor, fillOpacity: 0.08
+        });
+        // Approximate buffer zone — expand each vertex outward from centroid by bufferKm
+        const bufferPoly = gf.bufferKm > 0 ? (function () {
+          let cLat = 0, cLon = 0;
+          gf.polygon.forEach(function (p) { cLat += p[0]; cLon += p[1]; });
+          cLat /= gf.polygon.length; cLon /= gf.polygon.length;
+          const cosLat = Math.cos(cLat * Math.PI / 180);
+          const outer = gf.polygon.map(function (p) {
+            const dLatM = (p[0] - cLat) * 111000;
+            const dLonM = (p[1] - cLon) * 111000 * cosLat;
+            const dist = Math.sqrt(dLatM * dLatM + dLonM * dLonM);
+            if (dist === 0) return [p[0], p[1]];
+            const scale = (gf.bufferKm * 1000) / dist;
+            return [p[0] + dLatM * scale / 111000, p[1] + dLonM * scale / (111000 * cosLat)];
+          });
+          return L.polygon(outer, {
+            color: geoColor, weight: 1.5, opacity: 0.4, dashArray: '6 4',
+            fillColor: geoColor, fillOpacity: 0.04
+          });
+        })() : null;
+        geoFilterLayer = L.layerGroup(bufferPoly ? [bufferPoly, innerPoly] : [innerPoly]);
+        const label = document.getElementById('mcGeoFilterLabel');
+        if (label) label.style.display = '';
+        const el = document.getElementById('mcGeoFilter');
+        if (el) {
+          const saved = localStorage.getItem('meshcore-map-geo-filter');
+          if (saved === 'true') { el.checked = true; geoFilterLayer.addTo(map); }
+          el.addEventListener('change', function (e) {
+            localStorage.setItem('meshcore-map-geo-filter', e.target.checked);
+            if (e.target.checked) { geoFilterLayer.addTo(map); } else { map.removeLayer(geoFilterLayer); }
+          });
+        }
+      } catch (e) { /* no geo filter configured */ }
+    })();
+
     // WS for live advert updates
     wsHandler = debouncedOnWS(function (msgs) {
       if (msgs.some(function (m) { return m.type === 'packet' && m.data?.decoded?.header?.payloadTypeName === 'ADVERT'; })) {

public/packets.js

@@ -561,6 +561,7 @@
       <table class="data-table" id="pktTable">
         <thead><tr>
           <th scope="col"></th><th scope="col" class="col-region">Region</th><th scope="col" class="col-time">Time</th><th scope="col" class="col-hash">Hash</th><th scope="col" class="col-size">Size</th>
+          <th scope="col" class="col-hashsize">HB</th>
           <th scope="col" class="col-type">Type</th><th scope="col" class="col-observer">Observer</th><th scope="col" class="col-path">Path</th><th scope="col" class="col-rpt">Rpt</th><th scope="col" class="col-details">Details</th>
         </tr></thead>
         <tbody id="pktBody"></tbody>
@@ -1020,6 +1021,7 @@
         const groupTypeName = payloadTypeName(p.payload_type);
         const groupTypeClass = payloadTypeColor(p.payload_type);
         const groupSize = p.raw_hex ? Math.floor(p.raw_hex.length / 2) : 0;
+        const groupHashBytes = ((parseInt(p.raw_hex?.slice(2, 4), 16) || 0) >> 6) + 1;
         const isSingle = p.count <= 1;
         html += `<tr class="${isSingle ? '' : 'group-header'} ${isExpanded ? 'expanded' : ''}" data-hash="${p.hash}" data-action="${isSingle ? 'select-hash' : 'toggle-select'}" data-value="${p.hash}" tabindex="0" role="row">
           <td style="width:28px;text-align:center;cursor:pointer">${isSingle ? '' : (isExpanded ? '▼' : '▶')}</td>
@@ -1027,6 +1029,7 @@
           <td class="col-time">${timeAgo(p.latest)}</td>
           <td class="mono col-hash">${truncate(p.hash || '—', 8)}</td>
           <td class="col-size">${groupSize ? groupSize + 'B' : '—'}</td>
+          <td class="col-hashsize mono">${groupHashBytes}</td>
           <td class="col-type">${p.payload_type != null ? `<span class="badge badge-${groupTypeClass}">${groupTypeName}</span>` : '—'}</td>
           <td class="col-observer">${isSingle ? truncate(obsName(headerObserverId), 16) : truncate(obsName(headerObserverId), 10) + (p.observer_count > 1 ? ' +' + (p.observer_count - 1) : '')}</td>
           <td class="col-path"><span class="path-hops">${groupPathStr}</span></td>
@@ -1045,6 +1048,7 @@
             const typeName = payloadTypeName(c.payload_type);
             const typeClass = payloadTypeColor(c.payload_type);
             const size = c.raw_hex ? Math.floor(c.raw_hex.length / 2) : 0;
+            const childHashBytes = ((parseInt(c.raw_hex?.slice(2, 4), 16) || 0) >> 6) + 1;
             const childRegion = c.observer_id ? (observers.find(o => o.id === c.observer_id)?.iata || '') : '';
             let childPath = [];
             try { childPath = JSON.parse(c.path_json || '[]'); } catch {}
@@ -1054,6 +1058,7 @@
               <td class="col-time">${timeAgo(c.timestamp)}</td>
               <td class="mono col-hash">${truncate(c.hash || '', 8)}</td>
               <td class="col-size">${size}B</td>
+              <td class="col-hashsize mono">${childHashBytes}</td>
               <td class="col-type"><span class="badge badge-${typeClass}">${typeName}</span></td>
               <td class="col-observer">${truncate(obsName(c.observer_id), 16)}</td>
               <td class="col-path"><span class="path-hops">${childPathStr}</span></td>
@@ -1076,6 +1081,7 @@
       const typeName = payloadTypeName(p.payload_type);
       const typeClass = payloadTypeColor(p.payload_type);
       const size = p.raw_hex ? Math.floor(p.raw_hex.length / 2) : 0;
+      const hashBytes = ((parseInt(p.raw_hex?.slice(2, 4), 16) || 0) >> 6) + 1;
       const pathStr = renderPath(pathHops, p.observer_id);      const detail = getDetailPreview(decoded);
 
       return `<tr data-id="${p.id}" data-hash="${p.hash || ''}" data-action="select-hash" data-value="${p.hash || p.id}" tabindex="0" role="row" class="${selectedId === p.id ? 'selected' : ''}">
@@ -1083,6 +1089,7 @@
         <td class="col-time">${timeAgo(p.timestamp)}</td>
         <td class="mono col-hash">${truncate(p.hash || String(p.id), 8)}</td>
         <td class="col-size">${size}B</td>
+        <td class="col-hashsize mono">${hashBytes}</td>
         <td class="col-type"><span class="badge badge-${typeClass}">${typeName}</span></td>
         <td class="col-observer">${truncate(obsName(p.observer_id), 16)}</td>
         <td class="col-path"><span class="path-hops">${pathStr}</span></td>

public/style.css

@@ -6,6 +6,7 @@
   --nav-text: #ffffff;
   --nav-text-muted: #cbd5e1;
   --accent: #4a9eff;
+  --geo-filter-color: #3b82f6;
   --status-green: #22c55e;
   --status-yellow: #eab308;
   --status-red: #ef4444;
@@ -1205,7 +1206,7 @@ button.ch-item.ch-item-encrypted .ch-badge { filter: grayscale(0.6); }
 
 /* Hide low-value columns on mobile */
 @media (max-width: 640px) {
-  .col-region, .col-rpt, .col-size, .col-pubkey { display: none; }
+  .col-region, .col-rpt, .col-size, .col-hashsize, .col-pubkey { display: none; }
 }
 
 /* Clickable hop links */
@@ -1351,6 +1352,7 @@ tr[data-hops]:hover { background: rgba(59,130,246,0.1); }
 .hide-col-observer .col-observer,
 .hide-col-path .col-path,
 .hide-col-rpt .col-rpt,
+.hide-col-hashsize .col-hashsize,
 .hide-col-details .col-details { display: none; }
 
 /* === Home page fixes === */

scripts/combined-coverage.sh

@@ -1,27 +1,10 @@
 #!/bin/sh
-# Run server-side tests with c8, then frontend coverage with nyc
+# Combined coverage: Go backend + frontend via Playwright
+# TODO: Update to use Go server binary instead of removed Node.js server.
+# The old flow used `node server.js` — now use the Go binary from cmd/server/.
 set -e
 
-# 1. Server-side coverage (existing)
-npx c8 --reporter=json --reports-dir=.nyc_output node tools/e2e-test.js
-
-# 2. Instrument frontend
-sh scripts/instrument-frontend.sh
-
-# 3. Start instrumented server
-COVERAGE=1 PORT=13581 node server.js &
-SERVER_PID=$!
-sleep 5
-
-# 4. Run Playwright tests (exercises frontend code)
-BASE_URL=http://localhost:13581 node test-e2e-playwright.js || true
-BASE_URL=http://localhost:13581 node test-e2e-interactions.js || true
-
-# 5. Collect browser coverage
-BASE_URL=http://localhost:13581 node scripts/collect-frontend-coverage.js
-
-# 6. Kill server
-kill $SERVER_PID 2>/dev/null || true
-
-# 7. Generate combined report
-npx nyc report --reporter=text-summary --reporter=text
+echo "⚠️  combined-coverage.sh needs updating for Go server migration."
+echo "   The Node.js server (server.js) has been removed."
+echo "   Update this script to start the Go binary instead."
+exit 1

scripts/prune-nodes-outside-geo-filter.py

@@ -0,0 +1,168 @@
+#!/usr/bin/env python3
+"""
+Delete nodes from the database that fall outside the configured geo_filter polygon + bufferKm.
+Nodes with no GPS coordinates are always kept.
+
+Usage:
+  python3 prune-nodes-outside-geo-filter.py [db_path] [--config config.json] [--dry-run]
+
+  db_path         Path to meshcore.db   (default: /app/data/meshcore.db)
+  --config PATH   Path to config.json   (default: /app/config.json)
+  --dry-run       Show what would be deleted without making any changes
+"""
+
+import sqlite3
+import math
+import sys
+import json
+import os
+
+
+def point_in_polygon(lat, lon, polygon):
+    """Ray-casting algorithm."""
+    inside = False
+    n = len(polygon)
+    j = n - 1
+    for i in range(n):
+        yi, xi = polygon[i]   # lat, lon
+        yj, xj = polygon[j]
+        if ((yi > lat) != (yj > lat)) and (lon < (xj - xi) * (lat - yi) / (yj - yi) + xi):
+            inside = not inside
+        j = i
+    return inside
+
+
+def dist_to_segment_km(lat, lon, a, b):
+    """Approximate distance (km) from point to line segment, using flat-earth projection."""
+    lat1, lon1 = a
+    lat2, lon2 = b
+    mid_lat = (lat1 + lat2) / 2.0
+    cos_lat = math.cos(math.radians(mid_lat))
+    km_per_deg_lat = 111.0
+    km_per_deg_lon = 111.0 * cos_lat
+
+    # Translate so point is at origin
+    ax = (lon1 - lon) * km_per_deg_lon
+    ay = (lat1 - lat) * km_per_deg_lat
+    bx = (lon2 - lon) * km_per_deg_lon
+    by = (lat2 - lat) * km_per_deg_lat
+
+    abx, aby = bx - ax, by - ay
+    ab_sq = abx * abx + aby * aby
+    if ab_sq == 0:
+        return math.sqrt(ax * ax + ay * ay)
+
+    t = max(0.0, min(1.0, -(ax * abx + ay * aby) / ab_sq))
+    px = ax + t * abx
+    py = ay + t * aby
+    return math.sqrt(px * px + py * py)
+
+
+def node_passes_filter(lat, lon, polygon, buffer_km):
+    """Return True if the node should be kept."""
+    if lat is None or lon is None:
+        return True
+    if lat == 0.0 and lon == 0.0:
+        return True  # no GPS fix
+    if point_in_polygon(lat, lon, polygon):
+        return True
+    if buffer_km > 0:
+        n = len(polygon)
+        for i in range(n):
+            j = (i + 1) % n
+            if dist_to_segment_km(lat, lon, polygon[i], polygon[j]) <= buffer_km:
+                return True
+    return False
+
+
+def load_geo_filter(config_path):
+    """Load polygon and bufferKm from config.json geo_filter section."""
+    if not os.path.exists(config_path):
+        print(f"ERROR: config not found at {config_path}")
+        sys.exit(1)
+    with open(config_path) as f:
+        cfg = json.load(f)
+    gf = cfg.get('geo_filter')
+    if not gf:
+        print("ERROR: no geo_filter section found in config.json")
+        sys.exit(1)
+    polygon = gf.get('polygon', [])
+    if len(polygon) < 3:
+        print("ERROR: geo_filter.polygon must have at least 3 points")
+        sys.exit(1)
+    buffer_km = gf.get('bufferKm', 0.0)
+    print(f"Loaded geo_filter from {config_path}: {len(polygon)} points, bufferKm={buffer_km}")
+    return polygon, buffer_km
+
+
+def main():
+    args = sys.argv[1:]
+    dry_run = '--dry-run' in args
+    args = [a for a in args if a != '--dry-run']
+
+    config_path = '/app/config.json'
+    if '--config' in args:
+        idx = args.index('--config')
+        config_path = args[idx + 1]
+        args = args[:idx] + args[idx + 2:]
+
+    db_path = args[0] if args else '/app/data/meshcore.db'
+
+    polygon, buffer_km = load_geo_filter(config_path)
+
+    if not os.path.exists(db_path):
+        print(f"ERROR: database not found at {db_path}")
+        sys.exit(1)
+
+    conn = sqlite3.connect(db_path)
+    conn.row_factory = sqlite3.Row
+    cur = conn.cursor()
+
+    cur.execute('SELECT public_key, name, lat, lon FROM nodes ORDER BY name')
+    nodes = cur.fetchall()
+
+    keep, remove = [], []
+    for row in nodes:
+        lat = row['lat']
+        lon = row['lon']
+        if node_passes_filter(lat, lon, polygon, buffer_km):
+            keep.append(row)
+        else:
+            remove.append(row)
+
+    print(f"Total nodes in DB : {len(nodes)}")
+    print(f"Nodes to keep     : {len(keep)}")
+    print(f"Nodes to delete   : {len(remove)}")
+
+    if not remove:
+        print("\nNothing to delete.")
+        conn.close()
+        return
+
+    print("\nNodes that will be DELETED:")
+    for row in remove:
+        lat = row['lat'] or 0
+        lon = row['lon'] or 0
+        name = row['name'] or row['public_key'][:12]
+        print(f"  {name:<30}  lat={lat:.4f}  lon={lon:.4f}")
+
+    if dry_run:
+        print("\n[dry-run] No changes made.")
+        conn.close()
+        return
+
+    confirm = input(f"\nDelete {len(remove)} nodes? Type 'yes' to confirm: ").strip()
+    if confirm.lower() != 'yes':
+        print("Aborted.")
+        conn.close()
+        return
+
+    pubkeys = [row['public_key'] for row in remove]
+    cur.executemany('DELETE FROM nodes WHERE public_key = ?', [(pk,) for pk in pubkeys])
+    conn.commit()
+    print(f"\nDeleted {cur.rowcount if cur.rowcount >= 0 else len(pubkeys)} nodes.")
+    conn.close()
+
+
+if __name__ == '__main__':
+    main()

scripts/validate.sh

@@ -3,7 +3,6 @@
 set -e
 
 echo "=== Syntax check ==="
-node -c server.js
 for f in public/*.js; do node -c "$f"; done
 echo "✅ All JS files parse OK"
 

server-helpers.js

@@ -1,323 +0,0 @@
-'use strict';
-
-const path = require('path');
-const fs = require('fs');
-const crypto = require('crypto');
-
-// Config file loading
-const CONFIG_PATHS = [
-  path.join(__dirname, 'config.json'),
-  path.join(__dirname, 'data', 'config.json')
-];
-
-function loadConfigFile(configPaths) {
-  const paths = configPaths || CONFIG_PATHS;
-  for (const p of paths) {
-    try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch {}
-  }
-  return {};
-}
-
-// Theme file loading
-const THEME_PATHS = [
-  path.join(__dirname, 'theme.json'),
-  path.join(__dirname, 'data', 'theme.json')
-];
-
-function loadThemeFile(themePaths) {
-  const paths = themePaths || THEME_PATHS;
-  for (const p of paths) {
-    try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch {}
-  }
-  return {};
-}
-
-// Health thresholds
-function buildHealthConfig(config) {
-  const _ht = (config && config.healthThresholds) || {};
-  return {
-    infraDegraded: _ht.infraDegradedHours || 24,
-    infraSilent:   _ht.infraSilentHours   || 72,
-    nodeDegraded:  _ht.nodeDegradedHours  || 1,
-    nodeSilent:    _ht.nodeSilentHours    || 24
-  };
-}
-
-function getHealthMs(role, HEALTH) {
-  const H = 3600000;
-  const isInfra = role === 'repeater' || role === 'room';
-  return {
-    degradedMs: (isInfra ? HEALTH.infraDegraded : HEALTH.nodeDegraded) * H,
-    silentMs:   (isInfra ? HEALTH.infraSilent   : HEALTH.nodeSilent)   * H
-  };
-}
-
-// Hash size flip-flop detection (pure — operates on provided maps)
-function isHashSizeFlipFlop(seq, allSizes) {
-  if (!seq || seq.length < 3) return false;
-  if (!allSizes || allSizes.size < 2) return false;
-  let transitions = 0;
-  for (let i = 1; i < seq.length; i++) {
-    if (seq[i] !== seq[i - 1]) transitions++;
-  }
-  return transitions >= 2;
-}
-
-// Compute content hash from raw hex
-function computeContentHash(rawHex) {
-  try {
-    const buf = Buffer.from(rawHex, 'hex');
-    if (buf.length < 2) return rawHex.slice(0, 16);
-    const pathByte = buf[1];
-    const hashSize = ((pathByte >> 6) & 0x3) + 1;
-    const hashCount = pathByte & 0x3F;
-    const pathBytes = hashSize * hashCount;
-    const payloadStart = 2 + pathBytes;
-    const payload = buf.subarray(payloadStart);
-    const toHash = Buffer.concat([Buffer.from([buf[0]]), payload]);
-    return crypto.createHash('sha256').update(toHash).digest('hex').slice(0, 16);
-  } catch { return rawHex.slice(0, 16); }
-}
-
-// Distance helper (degrees)
-function geoDist(lat1, lon1, lat2, lon2) {
-  return Math.sqrt((lat1 - lat2) ** 2 + (lon1 - lon2) ** 2);
-}
-
-// Derive hashtag channel key
-function deriveHashtagChannelKey(channelName) {
-  return crypto.createHash('sha256').update(channelName).digest('hex').slice(0, 32);
-}
-
-// Build hex breakdown ranges for packet detail view
-function buildBreakdown(rawHex, decoded, decodePacketFn, channelKeys) {
-  if (!rawHex) return {};
-  const buf = Buffer.from(rawHex, 'hex');
-  const ranges = [];
-
-  ranges.push({ start: 0, end: 0, color: 'red', label: 'Header' });
-  if (buf.length < 2) return { ranges };
-
-  ranges.push({ start: 1, end: 1, color: 'orange', label: 'Path Length' });
-
-  const header = decodePacketFn ? decodePacketFn(rawHex, channelKeys || {}) : null;
-  let offset = 2;
-
-  if (header && header.transportCodes) {
-    ranges.push({ start: 2, end: 5, color: 'blue', label: 'Transport Codes' });
-    offset = 6;
-  }
-
-  const pathByte = buf[1];
-  const hashSize = (pathByte >> 6) + 1;
-  const hashCount = pathByte & 0x3F;
-  const pathBytes = hashSize * hashCount;
-  if (pathBytes > 0) {
-    ranges.push({ start: offset, end: offset + pathBytes - 1, color: 'green', label: 'Path' });
-  }
-  const payloadStart = offset + pathBytes;
-
-  if (payloadStart < buf.length) {
-    ranges.push({ start: payloadStart, end: buf.length - 1, color: 'yellow', label: 'Payload' });
-
-    if (decoded && decoded.type === 'ADVERT') {
-      const ps = payloadStart;
-      const subRanges = [];
-      subRanges.push({ start: ps, end: ps + 31, color: '#FFD700', label: 'PubKey' });
-      subRanges.push({ start: ps + 32, end: ps + 35, color: '#FFA500', label: 'Timestamp' });
-      subRanges.push({ start: ps + 36, end: ps + 99, color: '#FF6347', label: 'Signature' });
-      if (buf.length > ps + 100) {
-        subRanges.push({ start: ps + 100, end: ps + 100, color: '#7FFFD4', label: 'Flags' });
-        let off = ps + 101;
-        const flags = buf[ps + 100];
-        if (flags & 0x10 && buf.length >= off + 8) {
-          subRanges.push({ start: off, end: off + 3, color: '#87CEEB', label: 'Latitude' });
-          subRanges.push({ start: off + 4, end: off + 7, color: '#87CEEB', label: 'Longitude' });
-          off += 8;
-        }
-        if (flags & 0x80 && off < buf.length) {
-          subRanges.push({ start: off, end: buf.length - 1, color: '#DDA0DD', label: 'Name' });
-        }
-      }
-      ranges.push(...subRanges);
-    }
-  }
-
-  return { ranges };
-}
-
-// Disambiguate hop prefixes to full nodes
-function disambiguateHops(hops, allNodes, maxHopDist) {
-  const MAX_HOP_DIST = maxHopDist || 1.8;
-
-  if (!allNodes._prefixIdx) {
-    allNodes._prefixIdx = {};
-    allNodes._prefixIdxName = {};
-    for (const n of allNodes) {
-      const pk = n.public_key.toLowerCase();
-      for (let len = 1; len <= 3; len++) {
-        const p = pk.slice(0, len * 2);
-        if (!allNodes._prefixIdx[p]) allNodes._prefixIdx[p] = [];
-        allNodes._prefixIdx[p].push(n);
-        if (!allNodes._prefixIdxName[p]) allNodes._prefixIdxName[p] = n;
-      }
-    }
-  }
-
-  const resolved = hops.map(hop => {
-    const h = hop.toLowerCase();
-    const withCoords = (allNodes._prefixIdx[h] || []).filter(n => n.lat && n.lon && !(n.lat === 0 && n.lon === 0));
-    if (withCoords.length === 1) {
-      return { hop, name: withCoords[0].name, lat: withCoords[0].lat, lon: withCoords[0].lon, pubkey: withCoords[0].public_key, known: true };
-    } else if (withCoords.length > 1) {
-      return { hop, name: hop, lat: null, lon: null, pubkey: null, known: false, candidates: withCoords };
-    }
-    const nameMatch = allNodes._prefixIdxName[h];
-    return { hop, name: nameMatch?.name || hop, lat: null, lon: null, pubkey: nameMatch?.public_key || null, known: false };
-  });
-
-  let lastPos = null;
-  for (const r of resolved) {
-    if (r.known && r.lat) { lastPos = [r.lat, r.lon]; continue; }
-    if (!r.candidates) continue;
-    if (lastPos) r.candidates.sort((a, b) => geoDist(a.lat, a.lon, lastPos[0], lastPos[1]) - geoDist(b.lat, b.lon, lastPos[0], lastPos[1]));
-    const best = r.candidates[0];
-    r.name = best.name; r.lat = best.lat; r.lon = best.lon; r.pubkey = best.public_key; r.known = true;
-    lastPos = [r.lat, r.lon];
-  }
-
-  let nextPos = null;
-  for (let i = resolved.length - 1; i >= 0; i--) {
-    const r = resolved[i];
-    if (r.known && r.lat) { nextPos = [r.lat, r.lon]; continue; }
-    if (!r.candidates || !nextPos) continue;
-    r.candidates.sort((a, b) => geoDist(a.lat, a.lon, nextPos[0], nextPos[1]) - geoDist(b.lat, b.lon, nextPos[0], nextPos[1]));
-    const best = r.candidates[0];
-    r.name = best.name; r.lat = best.lat; r.lon = best.lon; r.pubkey = best.public_key; r.known = true;
-    nextPos = [r.lat, r.lon];
-  }
-
-  // Distance sanity check
-  for (let i = 0; i < resolved.length; i++) {
-    const r = resolved[i];
-    if (!r.lat) continue;
-    const prev = i > 0 && resolved[i-1].lat ? resolved[i-1] : null;
-    const next = i < resolved.length-1 && resolved[i+1].lat ? resolved[i+1] : null;
-    if (!prev && !next) continue;
-    const dPrev = prev ? geoDist(r.lat, r.lon, prev.lat, prev.lon) : 0;
-    const dNext = next ? geoDist(r.lat, r.lon, next.lat, next.lon) : 0;
-    if ((prev && dPrev > MAX_HOP_DIST) && (next && dNext > MAX_HOP_DIST)) { r.unreliable = true; r.lat = null; r.lon = null; }
-    else if (prev && !next && dPrev > MAX_HOP_DIST) { r.unreliable = true; r.lat = null; r.lon = null; }
-    else if (!prev && next && dNext > MAX_HOP_DIST) { r.unreliable = true; r.lat = null; r.lon = null; }
-  }
-
-  return resolved.map(r => ({ hop: r.hop, name: r.name, lat: r.lat, lon: r.lon, pubkey: r.pubkey, known: !!r.known, ambiguous: !!r.candidates, unreliable: !!r.unreliable }));
-}
-
-// Update hash_size maps for a single packet
-function updateHashSizeForPacket(p, hashSizeMap, hashSizeAllMap, hashSizeSeqMap) {
-  if (p.payload_type === 4 && p.raw_hex) {
-    try {
-      const d = typeof p.decoded_json === 'string' ? JSON.parse(p.decoded_json || '{}') : (p.decoded_json || {});
-      const pk = d.pubKey || d.public_key;
-      if (pk) {
-        const pathByte = parseInt(p.raw_hex.slice(2, 4), 16);
-        const hs = ((pathByte >> 6) & 0x3) + 1;
-        hashSizeMap.set(pk, hs);
-        if (!hashSizeAllMap.has(pk)) hashSizeAllMap.set(pk, new Set());
-        hashSizeAllMap.get(pk).add(hs);
-        if (!hashSizeSeqMap.has(pk)) hashSizeSeqMap.set(pk, []);
-        hashSizeSeqMap.get(pk).push(hs);
-      }
-    } catch {}
-  } else if (p.path_json && p.decoded_json) {
-    try {
-      const d = typeof p.decoded_json === 'string' ? JSON.parse(p.decoded_json) : p.decoded_json;
-      const pk = d.pubKey || d.public_key;
-      if (pk && !hashSizeMap.has(pk)) {
-        const hops = typeof p.path_json === 'string' ? JSON.parse(p.path_json) : p.path_json;
-        if (hops.length > 0) {
-          const pathByte = p.raw_hex ? parseInt(p.raw_hex.slice(2, 4), 16) : -1;
-          const hs = pathByte >= 0 ? ((pathByte >> 6) & 0x3) + 1 : (hops[0].length / 2);
-          if (hs >= 1 && hs <= 4) hashSizeMap.set(pk, hs);
-        }
-      }
-    } catch {}
-  }
-}
-
-// Rebuild all hash size maps from packet store
-function rebuildHashSizeMap(packets, hashSizeMap, hashSizeAllMap, hashSizeSeqMap) {
-  hashSizeMap.clear();
-  hashSizeAllMap.clear();
-  hashSizeSeqMap.clear();
-
-  // Pass 1: ADVERT packets
-  for (const p of packets) {
-    if (p.payload_type === 4 && p.raw_hex) {
-      try {
-        const d = JSON.parse(p.decoded_json || '{}');
-        const pk = d.pubKey || d.public_key;
-        if (pk) {
-          const pathByte = parseInt(p.raw_hex.slice(2, 4), 16);
-          const hs = ((pathByte >> 6) & 0x3) + 1;
-          if (!hashSizeMap.has(pk)) hashSizeMap.set(pk, hs);
-          if (!hashSizeAllMap.has(pk)) hashSizeAllMap.set(pk, new Set());
-          hashSizeAllMap.get(pk).add(hs);
-          if (!hashSizeSeqMap.has(pk)) hashSizeSeqMap.set(pk, []);
-          hashSizeSeqMap.get(pk).push(hs);
-        }
-      } catch {}
-    }
-  }
-  for (const [, seq] of hashSizeSeqMap) seq.reverse();
-
-  // Pass 2: fallback from path hops
-  for (const p of packets) {
-    if (p.path_json) {
-      try {
-        const hops = JSON.parse(p.path_json);
-        if (hops.length > 0) {
-          const hopLen = hops[0].length / 2;
-          if (hopLen >= 1 && hopLen <= 4) {
-            const pathByte = p.raw_hex ? parseInt(p.raw_hex.slice(2, 4), 16) : -1;
-            const hs = pathByte >= 0 ? ((pathByte >> 6) & 0x3) + 1 : hopLen;
-            if (p.decoded_json) {
-              const d = JSON.parse(p.decoded_json);
-              const pk = d.pubKey || d.public_key;
-              if (pk && !hashSizeMap.has(pk)) hashSizeMap.set(pk, hs);
-            }
-          }
-        }
-      } catch {}
-    }
-  }
-}
-
-// API key middleware factory
-function requireApiKey(apiKey) {
-  return function(req, res, next) {
-    if (!apiKey) return next();
-    const provided = req.headers['x-api-key'] || req.query.apiKey;
-    if (provided === apiKey) return next();
-    return res.status(401).json({ error: 'Invalid or missing API key' });
-  };
-}
-
-module.exports = {
-  loadConfigFile,
-  loadThemeFile,
-  buildHealthConfig,
-  getHealthMs,
-  isHashSizeFlipFlop,
-  computeContentHash,
-  geoDist,
-  deriveHashtagChannelKey,
-  buildBreakdown,
-  disambiguateHops,
-  updateHashSizeForPacket,
-  rebuildHashSizeMap,
-  requireApiKey,
-  CONFIG_PATHS,
-  THEME_PATHS
-};

test-all.sh

@@ -9,27 +9,12 @@ echo ""
 
 # Unit tests (deterministic, fast)
 echo "── Unit Tests ──"
-node test-decoder.js
-node test-decoder-spec.js
-node test-packet-store.js
 node test-packet-filter.js
 node test-aging.js
 node test-frontend-helpers.js
-node test-regional-filter.js
-node test-server-helpers.js
-node test-server-routes.js
-node test-db.js
-node test-db-migration.js
-
-# Integration tests (spin up temp servers)
-echo ""
-echo "── Integration Tests ──"
-node tools/e2e-test.js
-node tools/frontend-test.js
+node test-perf-go-runtime.js
 
 echo ""
 echo "═══════════════════════════════════════"
 echo "  All tests passed"
 echo "═══════════════════════════════════════"
-node test-server-routes.js
-# test trigger

test-db-migration.js

@@ -1,321 +0,0 @@
-'use strict';
-
-// Test v3 migration: create old-schema DB, run db.js to migrate, verify results
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-const { execSync } = require('child_process');
-const Database = require('better-sqlite3');
-
-let passed = 0, failed = 0;
-function assert(cond, msg) {
-  if (cond) { passed++; console.log(`  ✅ ${msg}`); }
-  else { failed++; console.error(`  ❌ ${msg}`); }
-}
-
-console.log('── db.js v3 migration tests ──\n');
-
-// Helper: create a DB with old (v2) schema and test data
-function createOldSchemaDB(dbPath) {
-  const db = new Database(dbPath);
-  db.pragma('journal_mode = WAL');
-  db.pragma('foreign_keys = ON');
-
-  db.exec(`
-    CREATE TABLE nodes (
-      public_key TEXT PRIMARY KEY,
-      name TEXT,
-      role TEXT,
-      lat REAL,
-      lon REAL,
-      last_seen TEXT,
-      first_seen TEXT,
-      advert_count INTEGER DEFAULT 0
-    );
-
-    CREATE TABLE observers (
-      id TEXT PRIMARY KEY,
-      name TEXT,
-      iata TEXT,
-      last_seen TEXT,
-      first_seen TEXT,
-      packet_count INTEGER DEFAULT 0,
-      model TEXT,
-      firmware TEXT,
-      client_version TEXT,
-      radio TEXT,
-      battery_mv INTEGER,
-      uptime_secs INTEGER,
-      noise_floor INTEGER
-    );
-
-    CREATE TABLE transmissions (
-      id INTEGER PRIMARY KEY AUTOINCREMENT,
-      raw_hex TEXT NOT NULL,
-      hash TEXT NOT NULL UNIQUE,
-      first_seen TEXT NOT NULL,
-      route_type INTEGER,
-      payload_type INTEGER,
-      payload_version INTEGER,
-      decoded_json TEXT,
-      created_at TEXT DEFAULT (datetime('now'))
-    );
-
-    CREATE TABLE observations (
-      id INTEGER PRIMARY KEY AUTOINCREMENT,
-      transmission_id INTEGER NOT NULL REFERENCES transmissions(id),
-      hash TEXT NOT NULL,
-      observer_id TEXT,
-      observer_name TEXT,
-      direction TEXT,
-      snr REAL,
-      rssi REAL,
-      score INTEGER,
-      path_json TEXT,
-      timestamp TEXT NOT NULL,
-      created_at TEXT DEFAULT (datetime('now'))
-    );
-
-    CREATE INDEX idx_transmissions_hash ON transmissions(hash);
-    CREATE INDEX idx_observations_hash ON observations(hash);
-    CREATE INDEX idx_observations_transmission_id ON observations(transmission_id);
-    CREATE INDEX idx_observations_observer_id ON observations(observer_id);
-    CREATE INDEX idx_observations_timestamp ON observations(timestamp);
-    CREATE UNIQUE INDEX idx_observations_dedup ON observations(hash, observer_id, COALESCE(path_json, ''));
-  `);
-
-  // Insert test observers
-  db.prepare(`INSERT INTO observers (id, name, iata, last_seen, first_seen, packet_count) VALUES (?, ?, ?, ?, ?, ?)`).run(
-    'aabbccdd11223344aabbccdd11223344aabbccdd11223344aabbccdd11223344', 'Observer Alpha', 'SFO',
-    '2025-06-01T12:00:00Z', '2025-01-01T00:00:00Z', 100
-  );
-  db.prepare(`INSERT INTO observers (id, name, iata, last_seen, first_seen, packet_count) VALUES (?, ?, ?, ?, ?, ?)`).run(
-    'deadbeef12345678deadbeef12345678deadbeef12345678deadbeef12345678', 'Observer Beta', 'LAX',
-    '2025-06-01T11:00:00Z', '2025-02-01T00:00:00Z', 50
-  );
-
-  // Insert test transmissions
-  db.prepare(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json) VALUES (?, ?, ?, ?, ?, ?)`).run(
-    '0400aabbccdd', 'hash-mig-001', '2025-06-01T10:00:00Z', 1, 4, '{"type":"ADVERT"}'
-  );
-  db.prepare(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json) VALUES (?, ?, ?, ?, ?, ?)`).run(
-    '0400deadbeef', 'hash-mig-002', '2025-06-01T10:30:00Z', 2, 5, '{"type":"GRP_TXT"}'
-  );
-
-  // Insert test observations (old schema: has hash, observer_id, observer_name, text timestamp)
-  db.prepare(`INSERT INTO observations (transmission_id, hash, observer_id, observer_name, direction, snr, rssi, score, path_json, timestamp) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(
-    1, 'hash-mig-001', 'aabbccdd11223344aabbccdd11223344aabbccdd11223344aabbccdd11223344', 'Observer Alpha',
-    'rx', 12.5, -80, 85, '["aabb","ccdd"]', '2025-06-01T10:00:00Z'
-  );
-  db.prepare(`INSERT INTO observations (transmission_id, hash, observer_id, observer_name, direction, snr, rssi, score, path_json, timestamp) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(
-    1, 'hash-mig-001', 'deadbeef12345678deadbeef12345678deadbeef12345678deadbeef12345678', 'Observer Beta',
-    'rx', 8.0, -92, 70, '["aabb"]', '2025-06-01T10:01:00Z'
-  );
-  db.prepare(`INSERT INTO observations (transmission_id, hash, observer_id, observer_name, direction, snr, rssi, score, path_json, timestamp) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(
-    2, 'hash-mig-002', 'aabbccdd11223344aabbccdd11223344aabbccdd11223344aabbccdd11223344', 'Observer Alpha',
-    'rx', 15.0, -75, 90, null, '2025-06-01T10:30:00Z'
-  );
-
-  db.close();
-}
-
-// Helper: require db.js in a child process with a given DB_PATH, return schema info
-function runDbModule(dbPath) {
-  const scriptPath = path.join(os.tmpdir(), 'meshcore-mig-test-script.js');
-  fs.writeFileSync(scriptPath, `
-    process.env.DB_PATH = ${JSON.stringify(dbPath)};
-    const db = require(${JSON.stringify(path.resolve(__dirname, 'db'))});
-    const cols = db.db.pragma('table_info(observations)').map(c => c.name);
-    const sv = db.db.pragma('user_version', { simple: true });
-    const obsCount = db.db.prepare('SELECT COUNT(*) as c FROM observations').get().c;
-    const viewRows = db.db.prepare('SELECT * FROM packets_v ORDER BY id').all();
-    const rawObs = db.db.prepare('SELECT * FROM observations ORDER BY id').all();
-    console.log(JSON.stringify({
-      columns: cols,
-      schemaVersion: sv || 0,
-      obsCount,
-      viewRows,
-      rawObs
-    }));
-    db.db.close();
-  `);
-  const result = execSync(`node ${JSON.stringify(scriptPath)}`, {
-    cwd: __dirname,
-    encoding: 'utf8',
-    timeout: 30000,
-  });
-  fs.unlinkSync(scriptPath);
-  const lines = result.trim().split('\n');
-  for (let i = lines.length - 1; i >= 0; i--) {
-    try { return JSON.parse(lines[i]); } catch {}
-  }
-  throw new Error('No JSON output from child process: ' + result);
-}
-
-// --- Test 1: Migration from old schema ---
-console.log('Migration from old schema:');
-{
-  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'meshcore-mig-test-'));
-  const dbPath = path.join(tmpDir, 'test-mig.db');
-
-  createOldSchemaDB(dbPath);
-
-  // Run db.js which should trigger migration
-  const info = runDbModule(dbPath);
-
-  // Verify schema
-  assert(info.schemaVersion === 3, 'schema version is 3 after migration');
-  assert(info.columns.includes('observer_idx'), 'has observer_idx column');
-  assert(!info.columns.includes('observer_id'), 'no observer_id column');
-  assert(!info.columns.includes('observer_name'), 'no observer_name column');
-  assert(!info.columns.includes('hash'), 'no hash column');
-
-  // Verify row count
-  assert(info.obsCount === 3, `all 3 rows migrated (got ${info.obsCount})`);
-
-  // Verify raw observation data
-  const obs0 = info.rawObs[0];
-  assert(typeof obs0.timestamp === 'number', 'timestamp is integer');
-  assert(obs0.timestamp === Math.floor(new Date('2025-06-01T10:00:00Z').getTime() / 1000), 'timestamp epoch correct');
-  assert(obs0.observer_idx !== null, 'observer_idx populated');
-
-  // Verify view backward compat
-  const vr0 = info.viewRows[0];
-  assert(vr0.observer_id === 'aabbccdd11223344aabbccdd11223344aabbccdd11223344aabbccdd11223344', 'view observer_id correct');
-  assert(vr0.observer_name === 'Observer Alpha', 'view observer_name correct');
-  assert(typeof vr0.timestamp === 'string', 'view timestamp is string');
-  assert(vr0.hash === 'hash-mig-001', 'view hash correct');
-  assert(vr0.snr === 12.5, 'view snr correct');
-  assert(vr0.path_json === '["aabb","ccdd"]', 'view path_json correct');
-
-  // Third row has null path_json
-  const vr2 = info.viewRows[2];
-  assert(vr2.path_json === null, 'null path_json preserved');
-
-  // Verify backup file created
-  const backups1 = fs.readdirSync(tmpDir).filter(f => f.includes('.pre-v3-backup-'));
-  assert(backups1.length === 1, 'backup file exists');
-
-  fs.rmSync(tmpDir, { recursive: true });
-}
-
-// --- Test 2: Migration doesn't re-run ---
-console.log('\nMigration idempotency:');
-{
-  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'meshcore-mig-test2-'));
-  const dbPath = path.join(tmpDir, 'test-mig2.db');
-
-  createOldSchemaDB(dbPath);
-
-  // First run — triggers migration
-  let info = runDbModule(dbPath);
-  assert(info.schemaVersion === 3, 'first run migrates to v3');
-
-  // Second run — should NOT re-run migration (no backup overwrite, same data)
-  const backups2pre = fs.readdirSync(tmpDir).filter(f => f.includes('.pre-v3-backup-'));
-  const backupMtime = fs.statSync(path.join(tmpDir, backups2pre[0])).mtimeMs;
-  info = runDbModule(dbPath);
-  assert(info.schemaVersion === 3, 'second run still v3');
-  assert(info.obsCount === 3, 'rows still intact');
-
-  fs.rmSync(tmpDir, { recursive: true });
-}
-
-// --- Test 3: Each migration creates a unique backup ---
-console.log('\nUnique backup per migration:');
-{
-  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'meshcore-mig-test3-'));
-  const dbPath = path.join(tmpDir, 'test-mig3.db');
-
-  createOldSchemaDB(dbPath);
-
-  const info = runDbModule(dbPath);
-
-  // Migration should have completed
-  assert(info.columns.includes('observer_idx'), 'migration completed');
-  assert(info.schemaVersion === 3, 'schema version is 3');
-
-  // A timestamped backup should exist
-  const backups = fs.readdirSync(tmpDir).filter(f => f.includes('.pre-v3-backup-'));
-  assert(backups.length === 1, 'exactly one backup created');
-  assert(fs.statSync(path.join(tmpDir, backups[0])).size > 0, 'backup is non-empty');
-
-  fs.rmSync(tmpDir, { recursive: true });
-}
-
-// --- Test 4: v3 ingestion via child process ---
-console.log('\nv3 ingestion test:');
-{
-  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'meshcore-mig-test4-'));
-  const dbPath = path.join(tmpDir, 'test-v3-ingest.db');
-
-  const scriptPath = path.join(os.tmpdir(), 'meshcore-ingest-test-script.js');
-  fs.writeFileSync(scriptPath, `
-    process.env.DB_PATH = ${JSON.stringify(dbPath)};
-    const db = require(${JSON.stringify(path.resolve(__dirname, 'db'))});
-
-    db.upsertObserver({ id: 'test-obs', name: 'Test Obs' });
-
-    const r = db.insertTransmission({
-      raw_hex: '0400ff',
-      hash: 'h-001',
-      timestamp: '2025-06-01T12:00:00Z',
-      observer_id: 'test-obs',
-      observer_name: 'Test Obs',
-      direction: 'rx',
-      snr: 10,
-      rssi: -85,
-      path_json: '["aa"]',
-      route_type: 1,
-      payload_type: 4,
-    });
-
-    const r2 = db.insertTransmission({
-      raw_hex: '0400ff',
-      hash: 'h-001',
-      timestamp: '2025-06-01T12:00:00Z',
-      observer_id: 'test-obs',
-      direction: 'rx',
-      snr: 10,
-      rssi: -85,
-      path_json: '["aa"]',
-    });
-
-    const pkt = db.db.prepare('SELECT * FROM packets_v WHERE hash = ?').get('h-001');
-
-    console.log(JSON.stringify({
-      r1_ok: r !== null && r.transmissionId > 0,
-      r2_deduped: r2.observationId === 0,
-      obs_count: db.db.prepare('SELECT COUNT(*) as c FROM observations').get().c,
-      view_observer_id: pkt.observer_id,
-      view_observer_name: pkt.observer_name,
-      view_ts_type: typeof pkt.timestamp,
-    }));
-    db.db.close();
-  `);
-
-  const result = execSync(`node ${JSON.stringify(scriptPath)}`, {
-    cwd: __dirname, encoding: 'utf8', timeout: 30000,
-  });
-  fs.unlinkSync(scriptPath);
-  const lines = result.trim().split('\n');
-  let info;
-  for (let i = lines.length - 1; i >= 0; i--) {
-    try { info = JSON.parse(lines[i]); break; } catch {}
-  }
-
-  assert(info.r1_ok, 'first insertion succeeded');
-  assert(info.r2_deduped, 'duplicate caught by dedup');
-  assert(info.obs_count === 1, 'only one observation row');
-  assert(info.view_observer_id === 'test-obs', 'view resolves observer_id');
-  assert(info.view_observer_name === 'Test Obs', 'view resolves observer_name');
-  assert(info.view_ts_type === 'string', 'view timestamp is string');
-
-  fs.rmSync(tmpDir, { recursive: true });
-}
-
-console.log(`\n═══════════════════════════════════════`);
-console.log(`  PASSED: ${passed}`);
-console.log(`  FAILED: ${failed}`);
-console.log(`═══════════════════════════════════════`);
-if (failed > 0) process.exit(1);

test-db.js

@@ -1,512 +0,0 @@
-'use strict';
-
-// Test db.js functions with a temp database
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'meshcore-db-test-'));
-const dbPath = path.join(tmpDir, 'test.db');
-process.env.DB_PATH = dbPath;
-
-// Now require db.js — it will use our temp DB
-const db = require('./db');
-
-let passed = 0, failed = 0;
-function assert(cond, msg) {
-  if (cond) { passed++; console.log(`  ✅ ${msg}`); }
-  else { failed++; console.error(`  ❌ ${msg}`); }
-}
-
-function cleanup() {
-  try { db.db.close(); } catch {}
-  try { fs.rmSync(tmpDir, { recursive: true }); } catch {}
-}
-
-console.log('── db.js tests ──\n');
-
-// --- Schema ---
-console.log('Schema:');
-{
-  const tables = db.db.prepare("SELECT name FROM sqlite_master WHERE type='table'").all().map(r => r.name);
-  assert(tables.includes('nodes'), 'nodes table exists');
-  assert(tables.includes('observers'), 'observers table exists');
-  assert(tables.includes('transmissions'), 'transmissions table exists');
-  assert(tables.includes('observations'), 'observations table exists');
-}
-
-// --- upsertNode ---
-console.log('\nupsertNode:');
-{
-  db.upsertNode({ public_key: 'aabbccdd11223344aabbccdd11223344', name: 'TestNode', role: 'repeater', lat: 37.0, lon: -122.0 });
-  const node = db.getNode('aabbccdd11223344aabbccdd11223344');
-  assert(node !== null, 'node inserted');
-  assert(node.name === 'TestNode', 'name correct');
-  assert(node.role === 'repeater', 'role correct');
-  assert(node.lat === 37.0, 'lat correct');
-
-  // Update
-  db.upsertNode({ public_key: 'aabbccdd11223344aabbccdd11223344', name: 'UpdatedNode', role: 'room' });
-  const node2 = db.getNode('aabbccdd11223344aabbccdd11223344');
-  assert(node2.name === 'UpdatedNode', 'name updated');
-  assert(node2.name === 'UpdatedNode', 'name updated');
-  assert(node2.advert_count === 0, 'advert_count unchanged by upsertNode');
-
-  // advert_count only increments via incrementAdvertCount
-  db.incrementAdvertCount('aabbccdd11223344aabbccdd11223344');
-  const node3 = db.getNode('aabbccdd11223344aabbccdd11223344');
-  assert(node3.advert_count === 1, 'advert_count incremented via incrementAdvertCount');
-}
-
-// --- upsertObserver ---
-console.log('\nupsertObserver:');
-{
-  db.upsertObserver({ id: 'obs-1', name: 'Observer One', iata: 'SFO' });
-  const observers = db.getObservers();
-  assert(observers.length >= 1, 'observer inserted');
-  assert(observers.some(o => o.id === 'obs-1'), 'observer found by id');
-  assert(observers.find(o => o.id === 'obs-1').name === 'Observer One', 'observer name correct');
-
-  // Upsert again
-  db.upsertObserver({ id: 'obs-1', name: 'Observer Updated' });
-  const obs2 = db.getObservers().find(o => o.id === 'obs-1');
-  assert(obs2.name === 'Observer Updated', 'observer name updated');
-  assert(obs2.packet_count === 2, 'packet_count incremented');
-}
-
-// --- updateObserverStatus ---
-console.log('\nupdateObserverStatus:');
-{
-  db.updateObserverStatus({ id: 'obs-2', name: 'Status Observer', iata: 'LAX', model: 'T-Deck' });
-  const obs = db.getObservers().find(o => o.id === 'obs-2');
-  assert(obs !== null, 'observer created via status update');
-  assert(obs.model === 'T-Deck', 'model set');
-  assert(obs.packet_count === 0, 'packet_count stays 0 for status update');
-}
-
-// --- insertTransmission ---
-console.log('\ninsertTransmission:');
-{
-  const result = db.insertTransmission({
-    raw_hex: '0400aabbccdd',
-    hash: 'hash-001',
-    timestamp: '2025-01-01T00:00:00Z',
-    observer_id: 'obs-1',
-    observer_name: 'Observer One',
-    direction: 'rx',
-    snr: 10.5,
-    rssi: -85,
-    route_type: 1,
-    payload_type: 4,
-    payload_version: 1,
-    path_json: '["aabb","ccdd"]',
-    decoded_json: '{"type":"ADVERT","pubKey":"aabbccdd11223344aabbccdd11223344","name":"TestNode"}',
-  });
-  assert(result !== null, 'transmission inserted');
-  assert(result.transmissionId > 0, 'has transmissionId');
-  assert(result.observationId > 0, 'has observationId');
-
-  // Duplicate hash = same transmission, new observation
-  const result2 = db.insertTransmission({
-    raw_hex: '0400aabbccdd',
-    hash: 'hash-001',
-    timestamp: '2025-01-01T00:01:00Z',
-    observer_id: 'obs-2',
-    observer_name: 'Observer Two',
-    direction: 'rx',
-    snr: 8.0,
-    rssi: -90,
-    route_type: 1,
-    payload_type: 4,
-    path_json: '["aabb"]',
-    decoded_json: '{"type":"ADVERT","pubKey":"aabbccdd11223344aabbccdd11223344","name":"TestNode"}',
-  });
-  assert(result2.transmissionId === result.transmissionId, 'same transmissionId for duplicate hash');
-
-  // No hash = null
-  const result3 = db.insertTransmission({ raw_hex: '0400' });
-  assert(result3 === null, 'no hash returns null');
-}
-
-// --- getPackets ---
-console.log('\ngetPackets:');
-{
-  const { rows, total } = db.getPackets({ limit: 10 });
-  assert(total >= 1, 'has packets');
-  assert(rows.length >= 1, 'returns rows');
-  assert(rows[0].hash === 'hash-001', 'correct hash');
-
-  // Filter by type
-  const { rows: r2 } = db.getPackets({ type: 4 });
-  assert(r2.length >= 1, 'filter by type works');
-
-  const { rows: r3 } = db.getPackets({ type: 99 });
-  assert(r3.length === 0, 'filter by nonexistent type returns empty');
-
-  // Filter by hash
-  const { rows: r4 } = db.getPackets({ hash: 'hash-001' });
-  assert(r4.length >= 1, 'filter by hash works');
-}
-
-// --- getPacket ---
-console.log('\ngetPacket:');
-{
-  const { rows } = db.getPackets({ limit: 1 });
-  const pkt = db.getPacket(rows[0].id);
-  assert(pkt !== null, 'getPacket returns packet');
-  assert(pkt.hash === 'hash-001', 'correct packet');
-
-  const missing = db.getPacket(999999);
-  assert(missing === null, 'missing packet returns null');
-}
-
-// --- getTransmission ---
-console.log('\ngetTransmission:');
-{
-  const tx = db.getTransmission(1);
-  assert(tx !== null, 'getTransmission returns data');
-  assert(tx.hash === 'hash-001', 'correct hash');
-
-  const missing = db.getTransmission(999999);
-  assert(missing === null, 'missing transmission returns null');
-}
-
-// --- getNodes ---
-console.log('\ngetNodes:');
-{
-  const { rows, total } = db.getNodes({ limit: 10 });
-  assert(total >= 1, 'has nodes');
-  assert(rows.length >= 1, 'returns node rows');
-
-  // Sort by name
-  const { rows: r2 } = db.getNodes({ sortBy: 'name' });
-  assert(r2.length >= 1, 'sort by name works');
-
-  // Invalid sort falls back to last_seen
-  const { rows: r3 } = db.getNodes({ sortBy: 'DROP TABLE nodes' });
-  assert(r3.length >= 1, 'invalid sort is safe');
-}
-
-// --- getNode ---
-console.log('\ngetNode:');
-{
-  const node = db.getNode('aabbccdd11223344aabbccdd11223344');
-  assert(node !== null, 'getNode returns node');
-  assert(Array.isArray(node.recentPackets), 'has recentPackets');
-
-  const missing = db.getNode('nonexistent');
-  assert(missing === null, 'missing node returns null');
-}
-
-// --- searchNodes ---
-console.log('\nsearchNodes:');
-{
-  const results = db.searchNodes('Updated');
-  assert(results.length >= 1, 'search by name');
-
-  const r2 = db.searchNodes('aabbcc');
-  assert(r2.length >= 1, 'search by pubkey prefix');
-
-  const r3 = db.searchNodes('nonexistent_xyz');
-  assert(r3.length === 0, 'no results for nonexistent');
-}
-
-// --- getStats ---
-console.log('\ngetStats:');
-{
-  const stats = db.getStats();
-  assert(stats.totalNodes >= 1, 'totalNodes');
-  assert(stats.totalObservers >= 1, 'totalObservers');
-  assert(typeof stats.totalPackets === 'number', 'totalPackets is number');
-  assert(typeof stats.packetsLastHour === 'number', 'packetsLastHour is number');
-  assert(typeof stats.totalNodesAllTime === 'number', 'totalNodesAllTime is number');
-  assert(stats.totalNodesAllTime >= stats.totalNodes, 'totalNodesAllTime >= totalNodes');
-}
-
-// --- getStats active node filtering ---
-console.log('\ngetStats active node filtering:');
-{
-  // Insert a node with last_seen 30 days ago (should be excluded from totalNodes)
-  const thirtyDaysAgo = new Date(Date.now() - 30 * 24 * 3600000).toISOString();
-  db.upsertNode({ public_key: 'deadnode0000000000000000deadnode00', name: 'DeadNode', role: 'repeater', last_seen: thirtyDaysAgo, first_seen: thirtyDaysAgo });
-
-  // Insert a node with last_seen now (should be included)
-  db.upsertNode({ public_key: 'livenode0000000000000000livenode00', name: 'LiveNode', role: 'companion', last_seen: new Date().toISOString() });
-
-  const stats = db.getStats();
-  assert(stats.totalNodesAllTime > stats.totalNodes, 'dead node excluded from totalNodes but included in totalNodesAllTime');
-
-  // Verify the dead node is in totalNodesAllTime
-  const allTime = stats.totalNodesAllTime;
-  assert(allTime >= 3, 'totalNodesAllTime includes dead + live nodes');
-
-  // Verify active count doesn't include the 30-day-old node
-  // The dead node's last_seen is 30 days ago, window is 7 days
-  const nodeInDb = db.getNode('deadnode0000000000000000deadnode00');
-  assert(nodeInDb !== null, 'dead node exists in DB');
-  const liveNode = db.getNode('livenode0000000000000000livenode00');
-  assert(liveNode !== null, 'live node exists in DB');
-}
-
-// --- getNodeHealth ---
-console.log('\ngetNodeHealth:');
-{
-  const health = db.getNodeHealth('aabbccdd11223344aabbccdd11223344');
-  assert(health !== null, 'returns health data');
-  assert(health.node.name === 'UpdatedNode', 'has node info');
-  assert(typeof health.stats.totalPackets === 'number', 'has totalPackets stat');
-  assert(Array.isArray(health.observers), 'has observers array');
-  assert(Array.isArray(health.recentPackets), 'has recentPackets array');
-
-  const missing = db.getNodeHealth('nonexistent');
-  assert(missing === null, 'missing node returns null');
-}
-
-// --- getNodeAnalytics ---
-console.log('\ngetNodeAnalytics:');
-{
-  const analytics = db.getNodeAnalytics('aabbccdd11223344aabbccdd11223344', 7);
-  assert(analytics !== null, 'returns analytics');
-  assert(analytics.node.name === 'UpdatedNode', 'has node info');
-  assert(Array.isArray(analytics.activityTimeline), 'has activityTimeline');
-  assert(Array.isArray(analytics.snrTrend), 'has snrTrend');
-  assert(Array.isArray(analytics.packetTypeBreakdown), 'has packetTypeBreakdown');
-  assert(Array.isArray(analytics.observerCoverage), 'has observerCoverage');
-  assert(Array.isArray(analytics.hopDistribution), 'has hopDistribution');
-  assert(Array.isArray(analytics.peerInteractions), 'has peerInteractions');
-  assert(Array.isArray(analytics.uptimeHeatmap), 'has uptimeHeatmap');
-  assert(typeof analytics.computedStats.availabilityPct === 'number', 'has availabilityPct');
-  assert(typeof analytics.computedStats.signalGrade === 'string', 'has signalGrade');
-
-  const missing = db.getNodeAnalytics('nonexistent', 7);
-  assert(missing === null, 'missing node returns null');
-}
-
-// --- seed ---
-console.log('\nseed:');
-{
-  if (typeof db.seed === 'function') {
-    // Already has data, should return false
-    const result = db.seed();
-    assert(result === false, 'seed returns false when data exists');
-  } else {
-    console.log('  (skipped — seed not exported)');
-  }
-}
-
-// --- v3 schema tests (fresh DB should be v3) ---
-console.log('\nv3 schema:');
-{
-  assert(db.schemaVersion >= 3, 'fresh DB creates v3 schema');
-
-  // observations table should have observer_idx, not observer_id
-  const cols = db.db.pragma('table_info(observations)').map(c => c.name);
-  assert(cols.includes('observer_idx'), 'observations has observer_idx column');
-  assert(!cols.includes('observer_id'), 'observations does NOT have observer_id column');
-  assert(!cols.includes('observer_name'), 'observations does NOT have observer_name column');
-  assert(!cols.includes('hash'), 'observations does NOT have hash column');
-  assert(!cols.includes('created_at'), 'observations does NOT have created_at column');
-
-  // timestamp should be integer
-  const obsRow = db.db.prepare('SELECT typeof(timestamp) as t FROM observations LIMIT 1').get();
-  if (obsRow) {
-    assert(obsRow.t === 'integer', 'timestamp is stored as integer');
-  }
-
-  // packets_v view should still expose observer_id, observer_name, ISO timestamp
-  const viewRow = db.db.prepare('SELECT * FROM packets_v LIMIT 1').get();
-  if (viewRow) {
-    assert('observer_id' in viewRow, 'packets_v exposes observer_id');
-    assert('observer_name' in viewRow, 'packets_v exposes observer_name');
-    assert(typeof viewRow.timestamp === 'string', 'packets_v timestamp is ISO string');
-  }
-
-  // user_version is 3
-  const sv = db.db.pragma('user_version', { simple: true });
-  assert(sv === 3, 'user_version is 3');
-}
-
-// --- v3 ingestion: observer resolved via observer_idx ---
-console.log('\nv3 ingestion with observer resolution:');
-{
-  // Insert a new observer
-  db.upsertObserver({ id: 'obs-v3-test', name: 'V3 Test Observer' });
-
-  // Insert observation referencing that observer
-  const result = db.insertTransmission({
-    raw_hex: '0400deadbeef',
-    hash: 'hash-v3-001',
-    timestamp: '2025-06-01T12:00:00Z',
-    observer_id: 'obs-v3-test',
-    observer_name: 'V3 Test Observer',
-    direction: 'rx',
-    snr: 12.0,
-    rssi: -80,
-    route_type: 1,
-    payload_type: 4,
-    path_json: '["aabb"]',
-  });
-  assert(result !== null, 'v3 insertion succeeded');
-  assert(result.transmissionId > 0, 'v3 has transmissionId');
-
-  // Verify via packets_v view
-  const pkt = db.db.prepare('SELECT * FROM packets_v WHERE hash = ?').get('hash-v3-001');
-  assert(pkt !== null, 'v3 packet found via view');
-  assert(pkt.observer_id === 'obs-v3-test', 'v3 observer_id resolved in view');
-  assert(pkt.observer_name === 'V3 Test Observer', 'v3 observer_name resolved in view');
-  assert(typeof pkt.timestamp === 'string', 'v3 timestamp is ISO string in view');
-  assert(pkt.timestamp.includes('2025-06-01'), 'v3 timestamp date correct');
-
-  // Raw observation should have integer timestamp
-  const obs = db.db.prepare('SELECT * FROM observations ORDER BY id DESC LIMIT 1').get();
-  assert(typeof obs.timestamp === 'number', 'v3 raw observation timestamp is integer');
-  assert(obs.observer_idx !== null, 'v3 observation has observer_idx');
-}
-
-// --- v3 dedup ---
-console.log('\nv3 dedup:');
-{
-  // Insert same observation again — should be deduped
-  const result = db.insertTransmission({
-    raw_hex: '0400deadbeef',
-    hash: 'hash-v3-001',
-    timestamp: '2025-06-01T12:00:00Z',
-    observer_id: 'obs-v3-test',
-    direction: 'rx',
-    snr: 12.0,
-    rssi: -80,
-    path_json: '["aabb"]',
-  });
-  assert(result.observationId === 0, 'duplicate caught by in-memory dedup');
-
-  // Different observer = not a dupe
-  db.upsertObserver({ id: 'obs-v3-test-2', name: 'V3 Test Observer 2' });
-  const result2 = db.insertTransmission({
-    raw_hex: '0400deadbeef',
-    hash: 'hash-v3-001',
-    timestamp: '2025-06-01T12:01:00Z',
-    observer_id: 'obs-v3-test-2',
-    direction: 'rx',
-    snr: 9.0,
-    rssi: -88,
-    path_json: '["ccdd"]',
-  });
-  assert(result2.observationId > 0, 'different observer is not a dupe');
-}
-
-// --- removePhantomNodes ---
-console.log('\nremovePhantomNodes:');
-{
-  // Insert phantom nodes (short public_keys like hop prefixes)
-  db.upsertNode({ public_key: 'aabb', name: null, role: 'repeater' });
-  db.upsertNode({ public_key: 'ccddee', name: null, role: 'repeater' });
-  db.upsertNode({ public_key: 'ff001122', name: null, role: 'repeater' });
-  db.upsertNode({ public_key: '0011223344556677', name: null, role: 'repeater' }); // 16 chars — still phantom
-
-  // Verify they exist
-  assert(db.getNode('aabb') !== null, 'phantom node aabb exists before cleanup');
-  assert(db.getNode('ccddee') !== null, 'phantom node ccddee exists before cleanup');
-  assert(db.getNode('ff001122') !== null, 'phantom node ff001122 exists before cleanup');
-  assert(db.getNode('0011223344556677') !== null, 'phantom 16-char exists before cleanup');
-
-  // Verify real node still exists
-  assert(db.getNode('aabbccdd11223344aabbccdd11223344') !== null, 'real node exists before cleanup');
-
-  // Run cleanup
-  const removed = db.removePhantomNodes();
-  assert(removed === 4, `removed 4 phantom nodes (got ${removed})`);
-
-  // Verify phantoms are gone
-  assert(db.getNode('aabb') === null, 'phantom aabb removed');
-  assert(db.getNode('ccddee') === null, 'phantom ccddee removed');
-  assert(db.getNode('ff001122') === null, 'phantom ff001122 removed');
-  assert(db.getNode('0011223344556677') === null, 'phantom 16-char removed');
-
-  // Verify real node is still there
-  assert(db.getNode('aabbccdd11223344aabbccdd11223344') !== null, 'real node preserved after cleanup');
-
-  // Running again should remove 0
-  const removed2 = db.removePhantomNodes();
-  assert(removed2 === 0, 'second cleanup removes nothing');
-}
-
-// --- stats exclude phantom nodes ---
-console.log('\nstats exclude phantom nodes:');
-{
-  const statsBefore = db.getStats();
-  const countBefore = statsBefore.totalNodesAllTime;
-
-  // Insert a phantom — should be cleanable
-  db.upsertNode({ public_key: 'deadbeef', name: null, role: 'repeater' });
-  const statsWithPhantom = db.getStats();
-  assert(statsWithPhantom.totalNodesAllTime === countBefore + 1, 'phantom inflates totalNodesAllTime');
-
-  // Clean it
-  db.removePhantomNodes();
-  const statsAfter = db.getStats();
-  assert(statsAfter.totalNodesAllTime === countBefore, 'phantom removed from totalNodesAllTime');
-}
-
-// --- moveStaleNodes ---
-console.log('\nmoveStaleNodes:');
-{
-  // Verify inactive_nodes table exists
-  const tables = db.db.prepare("SELECT name FROM sqlite_master WHERE type='table'").all().map(r => r.name);
-  assert(tables.includes('inactive_nodes'), 'inactive_nodes table exists');
-
-  // Verify inactive_nodes has same columns as nodes
-  const nodesCols = db.db.pragma('table_info(nodes)').map(c => c.name).sort();
-  const inactiveCols = db.db.pragma('table_info(inactive_nodes)').map(c => c.name).sort();
-  assert(JSON.stringify(nodesCols) === JSON.stringify(inactiveCols), 'inactive_nodes has same columns as nodes');
-
-  // Insert a stale node (last_seen 30 days ago) and a fresh node
-  const thirtyDaysAgo = new Date(Date.now() - 30 * 24 * 3600000).toISOString();
-  const now = new Date().toISOString();
-  db.upsertNode({ public_key: 'stale00000000000000000000stale000', name: 'StaleNode', role: 'repeater', last_seen: thirtyDaysAgo, first_seen: thirtyDaysAgo });
-  db.upsertNode({ public_key: 'fresh00000000000000000000fresh000', name: 'FreshNode', role: 'companion', last_seen: now, first_seen: now });
-
-  // Verify both exist in nodes
-  assert(db.getNode('stale00000000000000000000stale000') !== null, 'stale node exists before move');
-  assert(db.getNode('fresh00000000000000000000fresh000') !== null, 'fresh node exists before move');
-
-  // Move stale nodes (7 day threshold)
-  const moved = db.moveStaleNodes(7);
-  assert(moved >= 1, `moveStaleNodes moved at least 1 node (got ${moved})`);
-
-  // Stale node should be gone from nodes
-  assert(db.getNode('stale00000000000000000000stale000') === null, 'stale node removed from nodes');
-
-  // Fresh node should still be in nodes
-  assert(db.getNode('fresh00000000000000000000fresh000') !== null, 'fresh node still in nodes');
-
-  // Stale node should be in inactive_nodes
-  const inactive = db.db.prepare('SELECT * FROM inactive_nodes WHERE public_key = ?').get('stale00000000000000000000stale000');
-  assert(inactive !== null, 'stale node exists in inactive_nodes');
-  assert(inactive.name === 'StaleNode', 'stale node name preserved in inactive_nodes');
-  assert(inactive.role === 'repeater', 'stale node role preserved in inactive_nodes');
-
-  // Fresh node should NOT be in inactive_nodes
-  const freshInactive = db.db.prepare('SELECT * FROM inactive_nodes WHERE public_key = ?').get('fresh00000000000000000000fresh000');
-  assert(!freshInactive, 'fresh node not in inactive_nodes');
-
-  // Running again should move 0 (already moved)
-  const moved2 = db.moveStaleNodes(7);
-  assert(moved2 === 0, 'second moveStaleNodes moves nothing');
-
-  // With nodeDays=0 should be a no-op
-  const moved3 = db.moveStaleNodes(0);
-  assert(moved3 === 0, 'moveStaleNodes(0) is a no-op');
-
-  // With null should be a no-op
-  const moved4 = db.moveStaleNodes(null);
-  assert(moved4 === 0, 'moveStaleNodes(null) is a no-op');
-}
-
-cleanup();
-delete process.env.DB_PATH;
-
-console.log(`\n═══════════════════════════════════════`);
-console.log(`  PASSED: ${passed}`);
-console.log(`  FAILED: ${failed}`);
-console.log(`═══════════════════════════════════════`);
-if (failed > 0) process.exit(1);

test-decoder-spec.js

@@ -1,625 +0,0 @@
-/**
- * Spec-driven tests for MeshCore decoder.
- *
- * Section 1: Spec assertions (from firmware/docs/packet_format.md + payloads.md)
- * Section 2: Golden fixtures (from production data at analyzer.00id.net)
- */
-
-'use strict';
-
-const { decodePacket, validateAdvert, ROUTE_TYPES, PAYLOAD_TYPES } = require('./decoder');
-
-let passed = 0;
-let failed = 0;
-let noted = 0;
-
-function assert(condition, msg) {
-  if (condition) { passed++; }
-  else { failed++; console.error(`  FAIL: ${msg}`); }
-}
-
-function assertEq(actual, expected, msg) {
-  if (actual === expected) { passed++; }
-  else { failed++; console.error(`  FAIL: ${msg} — expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`); }
-}
-
-function assertDeepEq(actual, expected, msg) {
-  const a = JSON.stringify(actual);
-  const b = JSON.stringify(expected);
-  if (a === b) { passed++; }
-  else { failed++; console.error(`  FAIL: ${msg}\n    expected: ${b}\n    got:      ${a}`); }
-}
-
-function note(msg) {
-  noted++;
-  console.log(`  NOTE: ${msg}`);
-}
-
-// ═══════════════════════════════════════════════════════════
-// Section 1: Spec-based assertions
-// ═══════════════════════════════════════════════════════════
-
-console.log('── Spec Tests: Header Parsing ──');
-
-// Header byte: bits 1-0 = routeType, bits 5-2 = payloadType, bits 7-6 = payloadVersion
-{
-  // 0x11 = 0b00_0100_01 → routeType=1(FLOOD), payloadType=4(ADVERT), version=0
-  const p = decodePacket('1100' + '00'.repeat(101)); // min advert = 100 bytes payload
-  assertEq(p.header.routeType, 1, 'header: routeType from bits 1-0');
-  assertEq(p.header.payloadType, 4, 'header: payloadType from bits 5-2');
-  assertEq(p.header.payloadVersion, 0, 'header: payloadVersion from bits 7-6');
-  assertEq(p.header.routeTypeName, 'FLOOD', 'header: routeTypeName');
-  assertEq(p.header.payloadTypeName, 'ADVERT', 'header: payloadTypeName');
-}
-
-// All four route types
-{
-  const routeNames = { 0: 'TRANSPORT_FLOOD', 1: 'FLOOD', 2: 'DIRECT', 3: 'TRANSPORT_DIRECT' };
-  for (const [val, name] of Object.entries(routeNames)) {
-    assertEq(ROUTE_TYPES[val], name, `ROUTE_TYPES[${val}] = ${name}`);
-  }
-}
-
-// All payload types from spec
-{
-  const specTypes = {
-    0x00: 'REQ', 0x01: 'RESPONSE', 0x02: 'TXT_MSG', 0x03: 'ACK',
-    0x04: 'ADVERT', 0x05: 'GRP_TXT', 0x07: 'ANON_REQ',
-    0x08: 'PATH', 0x09: 'TRACE',
-  };
-  for (const [val, name] of Object.entries(specTypes)) {
-    assertEq(PAYLOAD_TYPES[val], name, `PAYLOAD_TYPES[${val}] = ${name}`);
-  }
-}
-
-// Spec defines 0x06=GRP_DATA, 0x0A=MULTIPART, 0x0B=CONTROL, 0x0F=RAW_CUSTOM — decoder may not have them
-{
-  if (!PAYLOAD_TYPES[0x06]) note('Decoder missing PAYLOAD_TYPE 0x06 (GRP_DATA) — spec defines it');
-  if (!PAYLOAD_TYPES[0x0A]) note('Decoder missing PAYLOAD_TYPE 0x0A (MULTIPART) — spec defines it');
-  if (!PAYLOAD_TYPES[0x0B]) note('Decoder missing PAYLOAD_TYPE 0x0B (CONTROL) — spec defines it');
-  if (!PAYLOAD_TYPES[0x0F]) note('Decoder missing PAYLOAD_TYPE 0x0F (RAW_CUSTOM) — spec defines it');
-}
-
-console.log('── Spec Tests: Path Byte Parsing ──');
-
-// path_length: bits 5-0 = hop count, bits 7-6 = hash_size - 1
-{
-  // 0x00: 0 hops, 1-byte hashes
-  const p0 = decodePacket('0500' + '00'.repeat(10));
-  assertEq(p0.path.hashCount, 0, 'path 0x00: hashCount=0');
-  assertEq(p0.path.hashSize, 1, 'path 0x00: hashSize=1');
-  assertDeepEq(p0.path.hops, [], 'path 0x00: no hops');
-}
-
-{
-  // 0x05: 5 hops, 1-byte hashes → 5 path bytes
-  const p5 = decodePacket('0505' + 'AABBCCDDEE' + '00'.repeat(10));
-  assertEq(p5.path.hashCount, 5, 'path 0x05: hashCount=5');
-  assertEq(p5.path.hashSize, 1, 'path 0x05: hashSize=1');
-  assertEq(p5.path.hops.length, 5, 'path 0x05: 5 hops');
-  assertEq(p5.path.hops[0], 'AA', 'path 0x05: first hop');
-  assertEq(p5.path.hops[4], 'EE', 'path 0x05: last hop');
-}
-
-{
-  // 0x45: 5 hops, 2-byte hashes (bits 7-6 = 01) → 10 path bytes
-  const p45 = decodePacket('0545' + 'AA11BB22CC33DD44EE55' + '00'.repeat(10));
-  assertEq(p45.path.hashCount, 5, 'path 0x45: hashCount=5');
-  assertEq(p45.path.hashSize, 2, 'path 0x45: hashSize=2');
-  assertEq(p45.path.hops.length, 5, 'path 0x45: 5 hops');
-  assertEq(p45.path.hops[0], 'AA11', 'path 0x45: first hop (2-byte)');
-}
-
-{
-  // 0x8A: 10 hops, 3-byte hashes (bits 7-6 = 10) → 30 path bytes
-  const p8a = decodePacket('058A' + 'AA11FF'.repeat(10) + '00'.repeat(10));
-  assertEq(p8a.path.hashCount, 10, 'path 0x8A: hashCount=10');
-  assertEq(p8a.path.hashSize, 3, 'path 0x8A: hashSize=3');
-  assertEq(p8a.path.hops.length, 10, 'path 0x8A: 10 hops');
-}
-
-console.log('── Spec Tests: Transport Codes ──');
-
-{
-  // Route type 0 (TRANSPORT_FLOOD) and 3 (TRANSPORT_DIRECT) should have 4-byte transport codes
-  // Route type 0: header=0x14 = payloadType 5 (GRP_TXT), routeType 0 (TRANSPORT_FLOOD)
-  // Format: header(1) + transportCodes(4) + pathByte(1) + payload
-  const hex = '14' + 'AABB' + 'CCDD' + '00' + '1A' + '00'.repeat(10); // transport codes + pathByte + GRP_TXT payload
-  const p = decodePacket(hex);
-  assertEq(p.header.routeType, 0, 'transport: routeType=0 (TRANSPORT_FLOOD)');
-  assert(p.transportCodes !== null, 'transport: transportCodes present for TRANSPORT_FLOOD');
-  assertEq(p.transportCodes.code1, 'AABB', 'transport: code1');
-  assertEq(p.transportCodes.code2, 'CCDD', 'transport: code2');
-}
-
-{
-  // Route type 1 (FLOOD) should NOT have transport codes
-  const p = decodePacket('0500' + '00'.repeat(10));
-  assertEq(p.transportCodes, null, 'no transport codes for FLOOD');
-}
-
-console.log('── Spec Tests: Advert Payload ──');
-
-// Advert: pubkey(32) + timestamp(4 LE) + signature(64) + appdata
-{
-  const pubkey = 'AA'.repeat(32);
-  const timestamp = '78563412'; // 0x12345678 LE = 305419896
-  const signature = 'BB'.repeat(64);
-  // flags: 0x92 = repeater(2) | hasLocation(0x10) | hasName(0x80)
-  const flags = '92';
-  // lat: 37000000 = 0x02353A80 LE → 80 3A 35 02
-  const lat = '40933402';
-  // lon: -122100000 = 0xF8B9E260 LE → 60 E2 B9 F8
-  const lon = 'E0E6B8F8';
-  const name = Buffer.from('TestNode').toString('hex');
-
-  const hex = '1200' + pubkey + timestamp + signature + flags + lat + lon + name;
-  const p = decodePacket(hex);
-
-  assertEq(p.payload.type, 'ADVERT', 'advert: payload type');
-  assertEq(p.payload.pubKey, pubkey.toLowerCase(), 'advert: 32-byte pubkey');
-  assertEq(p.payload.timestamp, 0x12345678, 'advert: uint32 LE timestamp');
-  assertEq(p.payload.signature, signature.toLowerCase().repeat(1), 'advert: 64-byte signature');
-
-  // Flags
-  assertEq(p.payload.flags.raw, 0x92, 'advert flags: raw byte');
-  assertEq(p.payload.flags.type, 2, 'advert flags: type enum = 2 (repeater)');
-  assertEq(p.payload.flags.repeater, true, 'advert flags: repeater');
-  assertEq(p.payload.flags.room, false, 'advert flags: not room');
-  assertEq(p.payload.flags.chat, false, 'advert flags: not chat');
-  assertEq(p.payload.flags.sensor, false, 'advert flags: not sensor');
-  assertEq(p.payload.flags.hasLocation, true, 'advert flags: hasLocation (bit 4)');
-  assertEq(p.payload.flags.hasName, true, 'advert flags: hasName (bit 7)');
-
-  // Location: int32 at 1e6 scale
-  assert(Math.abs(p.payload.lat - 37.0) < 0.001, 'advert: lat decoded from int32/1e6');
-  assert(Math.abs(p.payload.lon - (-122.1)) < 0.001, 'advert: lon decoded from int32/1e6');
-
-  // Name
-  assertEq(p.payload.name, 'TestNode', 'advert: name from remaining appdata');
-}
-
-// Advert type enum values per spec
-{
-  // type 0 = none (companion), 1 = chat/companion, 2 = repeater, 3 = room, 4 = sensor
-  const makeAdvert = (flagsByte) => {
-    const hex = '1200' + 'AA'.repeat(32) + '00000000' + 'BB'.repeat(64) + flagsByte.toString(16).padStart(2, '0');
-    return decodePacket(hex).payload;
-  };
-
-  const t1 = makeAdvert(0x01);
-  assertEq(t1.flags.type, 1, 'advert type 1 = chat/companion');
-  assertEq(t1.flags.chat, true, 'type 1: chat=true');
-
-  const t2 = makeAdvert(0x02);
-  assertEq(t2.flags.type, 2, 'advert type 2 = repeater');
-  assertEq(t2.flags.repeater, true, 'type 2: repeater=true');
-
-  const t3 = makeAdvert(0x03);
-  assertEq(t3.flags.type, 3, 'advert type 3 = room');
-  assertEq(t3.flags.room, true, 'type 3: room=true');
-
-  const t4 = makeAdvert(0x04);
-  assertEq(t4.flags.type, 4, 'advert type 4 = sensor');
-  assertEq(t4.flags.sensor, true, 'type 4: sensor=true');
-}
-
-// Advert with no location, no name (flags = 0x02, just repeater)
-{
-  const hex = '1200' + 'CC'.repeat(32) + '00000000' + 'DD'.repeat(64) + '02';
-  const p = decodePacket(hex).payload;
-  assertEq(p.flags.hasLocation, false, 'advert no location: hasLocation=false');
-  assertEq(p.flags.hasName, false, 'advert no name: hasName=false');
-  assertEq(p.lat, undefined, 'advert no location: lat undefined');
-  assertEq(p.name, undefined, 'advert no name: name undefined');
-}
-
-// Telemetry: sensor node with battery + positive temperature
-{
-  const pubkey = 'AA'.repeat(32);
-  const sig = 'BB'.repeat(64);
-  const flags = '84'; // sensor(4) | hasName(0x80)
-  const name = Buffer.from('S1').toString('hex') + '00'; // null-terminated
-  const battBuf = Buffer.alloc(2); battBuf.writeUInt16LE(3700);
-  const tempBuf = Buffer.alloc(2); tempBuf.writeInt16LE(2850); // 28.50°C
-  const hex = '1200' + pubkey + '00000000' + sig + flags + name +
-    battBuf.toString('hex') + tempBuf.toString('hex');
-  const p = decodePacket(hex).payload;
-  assertEq(p.battery_mv, 3700, 'telemetry: battery_mv decoded');
-  assert(Math.abs(p.temperature_c - 28.50) < 0.01, 'telemetry: temperature_c positive');
-}
-
-// Telemetry: sensor node with 0°C must still emit temperature_c
-{
-  const pubkey = 'CC'.repeat(32);
-  const sig = 'DD'.repeat(64);
-  const flags = '84'; // sensor(4) | hasName(0x80)
-  const name = Buffer.from('S2').toString('hex') + '00';
-  const battBuf = Buffer.alloc(2); battBuf.writeUInt16LE(3600);
-  const tempBuf = Buffer.alloc(2); // 0°C
-  const hex = '1200' + pubkey + '00000000' + sig + flags + name +
-    battBuf.toString('hex') + tempBuf.toString('hex');
-  const p = decodePacket(hex).payload;
-  assert(p.temperature_c === 0, 'telemetry: 0°C is valid and emitted');
-}
-
-// Telemetry: non-sensor node with trailing bytes must NOT decode telemetry
-{
-  const pubkey = 'EE'.repeat(32);
-  const sig = 'FF'.repeat(64);
-  const flags = '82'; // repeater(2) | hasName(0x80)
-  const name = Buffer.from('R1').toString('hex') + '00';
-  const extraBytes = 'B40ED403'; // battery-like and temp-like bytes
-  const hex = '1200' + pubkey + '00000000' + sig + flags + name + extraBytes;
-  const p = decodePacket(hex).payload;
-  assertEq(p.battery_mv, undefined, 'telemetry: non-sensor node: battery_mv must be undefined');
-  assertEq(p.temperature_c, undefined, 'telemetry: non-sensor node: temperature_c must be undefined');
-}
-
-console.log('── Spec Tests: Encrypted Payload Format ──');
-
-// Spec says v1 encrypted payloads: dest(1)+src(1)+MAC(2)+cipher — decoder matches this.
-{
-  const hex = '0100' + 'AA' + 'BB' + 'CCDD' + '00'.repeat(10);
-  const p = decodePacket(hex);
-  assertEq(p.payload.destHash, 'aa', 'encrypted payload: dest is 1 byte');
-  assertEq(p.payload.srcHash, 'bb', 'encrypted payload: src is 1 byte');
-  assertEq(p.payload.mac, 'ccdd', 'encrypted payload: MAC is 2 bytes');
-}
-
-console.log('── Spec Tests: validateAdvert ──');
-
-{
-  const good = { pubKey: 'aa'.repeat(32), flags: { repeater: true, room: false, sensor: false } };
-  assertEq(validateAdvert(good).valid, true, 'validateAdvert: good advert');
-
-  assertEq(validateAdvert(null).valid, false, 'validateAdvert: null');
-  assertEq(validateAdvert({ error: 'bad' }).valid, false, 'validateAdvert: error advert');
-  assertEq(validateAdvert({ pubKey: 'aa' }).valid, false, 'validateAdvert: short pubkey');
-  assertEq(validateAdvert({ pubKey: '00'.repeat(32) }).valid, false, 'validateAdvert: all-zero pubkey');
-
-  const badLat = { pubKey: 'aa'.repeat(32), lat: 999 };
-  assertEq(validateAdvert(badLat).valid, false, 'validateAdvert: invalid lat');
-
-  const badLon = { pubKey: 'aa'.repeat(32), lon: -999 };
-  assertEq(validateAdvert(badLon).valid, false, 'validateAdvert: invalid lon');
-
-  const badName = { pubKey: 'aa'.repeat(32), name: 'test\x00name' };
-  assertEq(validateAdvert(badName).valid, false, 'validateAdvert: control chars in name');
-
-  const longName = { pubKey: 'aa'.repeat(32), name: 'x'.repeat(65) };
-  assertEq(validateAdvert(longName).valid, false, 'validateAdvert: name too long');
-}
-
-// ═══════════════════════════════════════════════════════════
-// Section 2: Golden fixtures (from production)
-// ═══════════════════════════════════════════════════════════
-
-console.log('── Golden Tests: Production Packets ──');
-
-const goldenFixtures = [
-  {
-    "raw_hex": "0A00D69FD7A5A7475DB07337749AE61FA53A4788E976",
-    "payload_type": 2,
-    "route_type": 2,
-    "decoded": "{\"type\":\"TXT_MSG\",\"destHash\":\"d6\",\"srcHash\":\"9f\",\"mac\":\"d7a5\",\"encryptedData\":\"a7475db07337749ae61fa53a4788e976\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  },
-  {
-    "raw_hex": "0A009FD605771EE2EB0CDC46D100232B455947E3C2D4B9DD0B8880EACA99A3C5F7EF63183D6D",
-    "payload_type": 2,
-    "route_type": 2,
-    "decoded": "{\"type\":\"TXT_MSG\",\"destHash\":\"9f\",\"srcHash\":\"d6\",\"mac\":\"0577\",\"encryptedData\":\"1ee2eb0cdc46d100232b455947e3c2d4b9dd0b8880eaca99a3c5f7ef63183d6d\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  },
-  {
-    "raw_hex": "120046D62DE27D4C5194D7821FC5A34A45565DCC2537B300B9AB6275255CEFB65D840CE5C169C94C9AED39E8BCB6CB6EB0335497A198B33A1A610CD3B03D8DCFC160900E5244280323EE0B44CACAB8F02B5B38B91CFA18BD067B0B5E63E94CFC85F758A8530B9240933402E0E6B8F84D5252322D52",
-    "payload_type": 4,
-    "route_type": 2,
-    "decoded": "{\"type\":\"ADVERT\",\"pubKey\":\"46d62de27d4c5194d7821fc5a34a45565dcc2537b300b9ab6275255cefb65d84\",\"timestamp\":1774314764,\"timestampISO\":\"2026-03-24T01:12:44.000Z\",\"signature\":\"c94c9aed39e8bcb6cb6eb0335497a198b33a1a610cd3b03d8dcfc160900e5244280323ee0b44cacab8f02b5b38b91cfa18bd067b0b5e63e94cfc85f758a8530b\",\"flags\":{\"raw\":146,\"type\":2,\"chat\":false,\"repeater\":true,\"room\":false,\"sensor\":false,\"hasLocation\":true,\"hasName\":true},\"lat\":37,\"lon\":-122.1,\"name\":\"MRR2-R\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  },
-  {
-    "raw_hex": "120073CFF971E1CB5754A742C152B2D2E0EB108A19B246D663ED8898A72C4A5AD86EA6768E66694B025EDF6939D5C44CFF719C5D5520E5F06B20680A83AD9C2C61C3227BBB977A85EE462F3553445FECF8EDD05C234ECE217272E503F14D6DF2B1B9B133890C923CDF3002F8FDC1F85045414BF09F8CB3",
-    "payload_type": 4,
-    "route_type": 2,
-    "decoded": "{\"type\":\"ADVERT\",\"pubKey\":\"73cff971e1cb5754a742c152b2d2e0eb108a19b246d663ed8898a72c4a5ad86e\",\"timestamp\":1720612518,\"timestampISO\":\"2024-07-10T11:55:18.000Z\",\"signature\":\"694b025edf6939d5c44cff719c5d5520e5f06b20680a83ad9c2c61c3227bbb977a85ee462f3553445fecf8edd05c234ece217272e503f14d6df2b1b9b133890c\",\"flags\":{\"raw\":146,\"type\":2,\"chat\":false,\"repeater\":true,\"room\":false,\"sensor\":false,\"hasLocation\":true,\"hasName\":true},\"lat\":36.757308,\"lon\":-121.504264,\"name\":\"PEAK🌳\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  },
-  {
-    "raw_hex": "06001f33e1bef15f5596b394adf03a77d46b89afa2e3",
-    "payload_type": 1,
-    "route_type": 2,
-    "decoded": "{\"type\":\"RESPONSE\",\"destHash\":\"1f\",\"srcHash\":\"33\",\"mac\":\"e1be\",\"encryptedData\":\"f15f5596b394adf03a77d46b89afa2e3\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  },
-  {
-    "raw_hex": "0200331fe52805e05cf6f4bae6a094ac258d57baf045",
-    "payload_type": 0,
-    "route_type": 2,
-    "decoded": "{\"type\":\"REQ\",\"destHash\":\"33\",\"srcHash\":\"1f\",\"mac\":\"e528\",\"encryptedData\":\"05e05cf6f4bae6a094ac258d57baf045\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  },
-  {
-    "raw_hex": "15001ABC314305D3CCC94EB3F398D3054B4E95899229027B027E450FD68B4FA4E0A0126AC1",
-    "payload_type": 5,
-    "route_type": 1,
-    "decoded": "{\"type\":\"GRP_TXT\",\"channelHash\":26,\"mac\":\"bc31\",\"encryptedData\":\"4305d3ccc94eb3f398d3054b4e95899229027b027e450fd68b4fa4e0a0126ac1\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  },
-  {
-    "raw_hex": "010673a210206cb51e42fee24c4847a99208b9fc1d7ab36c42b10748",
-    "payload_type": 0,
-    "route_type": 1,
-    "decoded": "{\"type\":\"REQ\",\"destHash\":\"1e\",\"srcHash\":\"42\",\"mac\":\"fee2\",\"encryptedData\":\"4c4847a99208b9fc1d7ab36c42b10748\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 6,
-      "hops": [
-        "73",
-        "A2",
-        "10",
-        "20",
-        "6C",
-        "B5"
-      ]
-    }
-  },
-  {
-    "raw_hex": "0101731E42FEE24C4847A99208293810E4A3E335640D8E",
-    "payload_type": 0,
-    "route_type": 1,
-    "decoded": "{\"type\":\"REQ\",\"destHash\":\"1e\",\"srcHash\":\"42\",\"mac\":\"fee2\",\"encryptedData\":\"4c4847a99208293810e4a3e335640d8e\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 1,
-      "hops": [
-        "73"
-      ]
-    }
-  },
-  {
-    "raw_hex": "0106FB10844070101E42BA859D1D939362F79D3F3865333629FF92E9",
-    "payload_type": 0,
-    "route_type": 1,
-    "decoded": "{\"type\":\"REQ\",\"destHash\":\"1e\",\"srcHash\":\"42\",\"mac\":\"ba85\",\"encryptedData\":\"9d1d939362f79d3f3865333629ff92e9\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 6,
-      "hops": [
-        "FB",
-        "10",
-        "84",
-        "40",
-        "70",
-        "10"
-      ]
-    }
-  },
-  {
-    "raw_hex": "0102FB101E42BA859D1D939362F79D3F3865333629FF92D9",
-    "payload_type": 0,
-    "route_type": 1,
-    "decoded": "{\"type\":\"REQ\",\"destHash\":\"1e\",\"srcHash\":\"42\",\"mac\":\"ba85\",\"encryptedData\":\"9d1d939362f79d3f3865333629ff92d9\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 2,
-      "hops": [
-        "FB",
-        "10"
-      ]
-    }
-  },
-  {
-    "raw_hex": "22009FD65B38857C5A7F6F0F28E999CF2632C03ACCCC",
-    "payload_type": 8,
-    "route_type": 2,
-    "decoded": "{\"type\":\"PATH\",\"destHash\":\"9f\",\"srcHash\":\"d6\",\"mac\":\"5b38\",\"pathData\":\"857c5a7f6f0f28e999cf2632c03acccc\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  },
-  {
-    "raw_hex": "0506701085AD8573D69F96FA7DD3B1AC3702794035442D9CDAD436D4",
-    "payload_type": 1,
-    "route_type": 1,
-    "decoded": "{\"type\":\"RESPONSE\",\"destHash\":\"d6\",\"srcHash\":\"9f\",\"mac\":\"96fa\",\"encryptedData\":\"7dd3b1ac3702794035442d9cdad436d4\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 6,
-      "hops": [
-        "70",
-        "10",
-        "85",
-        "AD",
-        "85",
-        "73"
-      ]
-    }
-  },
-  {
-    "raw_hex": "0500D69F96FA7DD3B1AC3702794035442D9CDAD43654",
-    "payload_type": 1,
-    "route_type": 1,
-    "decoded": "{\"type\":\"RESPONSE\",\"destHash\":\"d6\",\"srcHash\":\"9f\",\"mac\":\"96fa\",\"encryptedData\":\"7dd3b1ac3702794035442d9cdad43654\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  },
-  {
-    "raw_hex": "1E009FD6DFC543C53E826A2B789B072FF9CBE922E57EA093E5643A0CA813E79F42EE9108F855B72A3E0B599C9AC80D3A211E7C7BA2",
-    "payload_type": 7,
-    "route_type": 2,
-    "decoded": "{\"type\":\"ANON_REQ\",\"destHash\":\"9f\",\"ephemeralPubKey\":\"d6dfc543c53e826a2b789b072ff9cbe922e57ea093e5643a0ca813e79f42ee91\",\"mac\":\"08f8\",\"encryptedData\":\"55b72a3e0b599c9ac80d3a211e7c7ba2\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  },
-  {
-    "raw_hex": "110146B7F1C45F2ED5888335F79E27085D0DE871A7C8ECB1EF5313435EBD0825BACDC181E3C1695556F51A89C9895E2114D1FECA91B58F82CBBBC1DD2B868ADDC0F7EB8C310D0887C2A2283D6F7D01A5E97B6C2F6A4CC899F27AFA513CC6B295E34ADC84A1F1019240933402E0E6B8F84D6574726F2D52",
-    "payload_type": 4,
-    "route_type": 1,
-    "decoded": "{\"type\":\"ADVERT\",\"pubKey\":\"b7f1c45f2ed5888335f79e27085d0de871a7c8ecb1ef5313435ebd0825bacdc1\",\"timestamp\":1774314369,\"timestampISO\":\"2026-03-24T01:06:09.000Z\",\"signature\":\"5556f51a89c9895e2114d1feca91b58f82cbbbc1dd2b868addc0f7eb8c310d0887c2a2283d6f7d01a5e97b6c2f6a4cc899f27afa513cc6b295e34adc84a1f101\",\"flags\":{\"raw\":146,\"type\":2,\"chat\":false,\"repeater\":true,\"room\":false,\"sensor\":false,\"hasLocation\":true,\"hasName\":true},\"lat\":37,\"lon\":-122.1,\"name\":\"Metro-R\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 1,
-      "hops": [
-        "46"
-      ]
-    }
-  },
-  {
-    "raw_hex": "15001A901C5D927D90572BAF6135D226F91D180AD4F7B90DF20F82EEEA920312D9CCFD9C3F8CA9EFBEB1C37DFA31265F73483BD0640EC94E247902F617B2C320BFA332F50441AD234D8324A48ABAA9A16EB15BD50F2D67029F2424E0836010A635EB45B5DFDB4CDC080C09FC849040AB4B82769E0F",
-    "payload_type": 5,
-    "route_type": 1,
-    "decoded": "{\"type\":\"GRP_TXT\",\"channelHash\":26,\"mac\":\"901c\",\"encryptedData\":\"5d927d90572baf6135d226f91d180ad4f7b90df20f82eeea920312d9ccfd9c3f8ca9efbeb1c37dfa31265f73483bd0640ec94e247902f617b2c320bfa332f50441ad234d8324a48abaa9a16eb15bd50f2d67029f2424e0836010a635eb45b5dfdb4cdc080c09fc849040ab4b82769e0f\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  },
-  {
-    "raw_hex": "0A00D69F0E65C6CCDEBE8391ED093D3C76E2D064F525",
-    "payload_type": 2,
-    "route_type": 2,
-    "decoded": "{\"type\":\"TXT_MSG\",\"destHash\":\"d6\",\"srcHash\":\"9f\",\"mac\":\"0e65\",\"encryptedData\":\"c6ccdebe8391ed093d3c76e2d064f525\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  },
-  {
-    "raw_hex": "0A00D69F940E0BA255095E9540EE6E23895DA80AAC60",
-    "payload_type": 2,
-    "route_type": 2,
-    "decoded": "{\"type\":\"TXT_MSG\",\"destHash\":\"d6\",\"srcHash\":\"9f\",\"mac\":\"940e\",\"encryptedData\":\"0ba255095e9540ee6e23895da80aac60\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  },
-  {
-    "raw_hex": "06001f5d5acf699ea80c7ca1a9349b8af9a1b47d4a1a",
-    "payload_type": 1,
-    "route_type": 2,
-    "decoded": "{\"type\":\"RESPONSE\",\"destHash\":\"1f\",\"srcHash\":\"5d\",\"mac\":\"5acf\",\"encryptedData\":\"699ea80c7ca1a9349b8af9a1b47d4a1a\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  }
-];
-
-// One special case: the advert with 1 hop from prod had raw_hex starting with "110146"
-// but the API reported path ["46"]. Let me re-check — header 0x11 = routeType 1, payloadType 4.
-// pathByte 0x01 = 1 hop, 1-byte hash. Next byte is 0x46 = the hop. Correct.
-// However, the raw_hex I captured from the API was "110146B7F1..." but the actual prod JSON showed path ["46"].
-// I need to use the correct raw_hex. Let me fix fixture 15 (Metro-R advert).
-
-for (let i = 0; i < goldenFixtures.length; i++) {
-  const fix = goldenFixtures[i];
-  const expected = typeof fix.decoded === "string" ? JSON.parse(fix.decoded) : fix.decoded;
-  const label = `golden[${i}] ${expected.type}`;
-
-  try {
-    const result = decodePacket(fix.raw_hex);
-
-    // Verify header matches expected route/payload type
-    assertEq(result.header.routeType, fix.route_type, `${label}: routeType`);
-    assertEq(result.header.payloadType, fix.payload_type, `${label}: payloadType`);
-
-    // Verify path hops
-    assertDeepEq(result.path.hops, (fix.path.hops || fix.path), `${label}: path hops`);
-
-    // Verify payload matches prod decoded output
-    // Compare key fields rather than full deep equality (to handle minor serialization diffs)
-    
-    assertEq(result.payload.type, expected.type, `${label}: payload type`);
-
-    if (expected.type === 'ADVERT') {
-      assertEq(result.payload.pubKey, expected.pubKey, `${label}: pubKey`);
-      assertEq(result.payload.timestamp, expected.timestamp, `${label}: timestamp`);
-      assertEq(result.payload.signature, expected.signature, `${label}: signature`);
-      if (expected.flags) {
-        assertEq(result.payload.flags.raw, expected.flags.raw, `${label}: flags.raw`);
-        assertEq(result.payload.flags.type, expected.flags.type, `${label}: flags.type`);
-        assertEq(result.payload.flags.hasLocation, expected.flags.hasLocation, `${label}: hasLocation`);
-        assertEq(result.payload.flags.hasName, expected.flags.hasName, `${label}: hasName`);
-      }
-      if (expected.lat != null) assert(Math.abs(result.payload.lat - expected.lat) < 0.001, `${label}: lat`);
-      if (expected.lon != null) assert(Math.abs(result.payload.lon - expected.lon) < 0.001, `${label}: lon`);
-      if (expected.name) assertEq(result.payload.name, expected.name, `${label}: name`);
-
-      // Spec checks on advert structure
-      assert(result.payload.pubKey.length === 64, `${label}: pubKey is 32 bytes (64 hex chars)`);
-      assert(result.payload.signature.length === 128, `${label}: signature is 64 bytes (128 hex chars)`);
-    } else if (expected.type === 'GRP_TXT' || expected.type === 'CHAN') {
-      assertEq(result.payload.channelHash, expected.channelHash, `${label}: channelHash`);
-      // If decoded as CHAN (with channel key), check sender/text; otherwise check mac/encrypted
-      if (expected.type === 'GRP_TXT') {
-        assertEq(result.payload.mac, expected.mac, `${label}: mac`);
-        assertEq(result.payload.encryptedData, expected.encryptedData, `${label}: encryptedData`);
-      }
-    } else if (expected.type === 'ANON_REQ') {
-      assertEq(result.payload.destHash, expected.destHash, `${label}: destHash`);
-      assertEq(result.payload.ephemeralPubKey, expected.ephemeralPubKey, `${label}: ephemeralPubKey`);
-      assertEq(result.payload.mac, expected.mac, `${label}: mac`);
-    } else {
-      // Encrypted payload types: REQ, RESPONSE, TXT_MSG, PATH
-      assertEq(result.payload.destHash, expected.destHash, `${label}: destHash`);
-      assertEq(result.payload.srcHash, expected.srcHash, `${label}: srcHash`);
-      assertEq(result.payload.mac, expected.mac, `${label}: mac`);
-      if (expected.encryptedData) assertEq(result.payload.encryptedData, expected.encryptedData, `${label}: encryptedData`);
-      if (expected.pathData) assertEq(result.payload.pathData, expected.pathData, `${label}: pathData`);
-    }
-  } catch (e) {
-    failed++;
-    console.error(`  FAIL: ${label} — threw: ${e.message}`);
-  }
-}
-
-// ═══════════════════════════════════════════════════════════
-// Summary
-// ═══════════════════════════════════════════════════════════
-
-console.log('');
-console.log(`═══ Results: ${passed} passed, ${failed} failed, ${noted} notes ═══`);
-if (failed > 0) process.exit(1);

test-decoder.js

@@ -1,630 +0,0 @@
-/* Unit tests for decoder.js */
-'use strict';
-const assert = require('assert');
-const { decodePacket, validateAdvert, ROUTE_TYPES, PAYLOAD_TYPES, VALID_ROLES } = require('./decoder');
-
-let passed = 0, failed = 0;
-function test(name, fn) {
-  try { fn(); passed++; console.log(`  ✅ ${name}`); }
-  catch (e) { failed++; console.log(`  ❌ ${name}: ${e.message}`); }
-}
-
-// === Constants ===
-console.log('\n=== Constants ===');
-test('ROUTE_TYPES has 4 entries', () => assert.strictEqual(Object.keys(ROUTE_TYPES).length, 4));
-test('PAYLOAD_TYPES has 13 entries', () => assert.strictEqual(Object.keys(PAYLOAD_TYPES).length, 13));
-test('VALID_ROLES has repeater, companion, room, sensor', () => {
-  for (const r of ['repeater', 'companion', 'room', 'sensor']) assert(VALID_ROLES.has(r));
-});
-
-// === Header decoding ===
-console.log('\n=== Header decoding ===');
-test('FLOOD + ADVERT = 0x11', () => {
-  const p = decodePacket('1100' + '00'.repeat(101));
-  assert.strictEqual(p.header.routeType, 1);
-  assert.strictEqual(p.header.routeTypeName, 'FLOOD');
-  assert.strictEqual(p.header.payloadType, 4);
-  assert.strictEqual(p.header.payloadTypeName, 'ADVERT');
-});
-
-test('TRANSPORT_FLOOD = routeType 0', () => {
-  // header=0x00 (TRANSPORT_FLOOD + REQ), transportCodes=AABB+CCDD, pathByte=0x00, payload
-  const hex = '00' + 'AABB' + 'CCDD' + '00' + '00'.repeat(16);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.header.routeType, 0);
-  assert.strictEqual(p.header.routeTypeName, 'TRANSPORT_FLOOD');
-  assert.notStrictEqual(p.transportCodes, null);
-  assert.strictEqual(p.transportCodes.code1, 'AABB');
-  assert.strictEqual(p.transportCodes.code2, 'CCDD');
-});
-
-test('TRANSPORT_DIRECT = routeType 3', () => {
-  const hex = '03' + '1122' + '3344' + '00' + '00'.repeat(16);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.header.routeType, 3);
-  assert.strictEqual(p.header.routeTypeName, 'TRANSPORT_DIRECT');
-  assert.strictEqual(p.transportCodes.code1, '1122');
-});
-
-test('DIRECT = routeType 2, no transport codes', () => {
-  const hex = '0200' + '00'.repeat(16);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.header.routeType, 2);
-  assert.strictEqual(p.header.routeTypeName, 'DIRECT');
-  assert.strictEqual(p.transportCodes, null);
-});
-
-test('payload version extracted', () => {
-  // 0xC1 = 11_0000_01 → version=3, payloadType=0, routeType=1
-  const hex = 'C100' + '00'.repeat(16);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.header.payloadVersion, 3);
-});
-
-// === Path decoding ===
-console.log('\n=== Path decoding ===');
-test('hashSize=1, hashCount=3', () => {
-  // pathByte = 0x03 → (0>>6)+1=1, 3&0x3F=3
-  const hex = '1103' + 'AABBCC' + '00'.repeat(101);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.path.hashSize, 1);
-  assert.strictEqual(p.path.hashCount, 3);
-  assert.strictEqual(p.path.hops.length, 3);
-  assert.strictEqual(p.path.hops[0], 'AA');
-  assert.strictEqual(p.path.hops[1], 'BB');
-  assert.strictEqual(p.path.hops[2], 'CC');
-});
-
-test('hashSize=2, hashCount=2', () => {
-  // pathByte = 0x42 → (1>>0=1)+1=2, 2&0x3F=2
-  const hex = '1142' + 'AABB' + 'CCDD' + '00'.repeat(101);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.path.hashSize, 2);
-  assert.strictEqual(p.path.hashCount, 2);
-  assert.strictEqual(p.path.hops[0], 'AABB');
-  assert.strictEqual(p.path.hops[1], 'CCDD');
-});
-
-test('hashSize=4 from pathByte 0xC1', () => {
-  // 0xC1 = 11_000001 → hashSize=(3)+1=4, hashCount=1
-  const hex = '11C1' + 'DEADBEEF' + '00'.repeat(101);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.path.hashSize, 4);
-  assert.strictEqual(p.path.hashCount, 1);
-  assert.strictEqual(p.path.hops[0], 'DEADBEEF');
-});
-
-test('zero hops', () => {
-  const hex = '1100' + '00'.repeat(101);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.path.hashCount, 0);
-  assert.strictEqual(p.path.hops.length, 0);
-});
-
-// === Payload types ===
-console.log('\n=== ADVERT payload ===');
-test('ADVERT with name and location', () => {
-  const pkt = decodePacket(
-    '11451000D818206D3AAC152C8A91F89957E6D30CA51F36E28790228971C473B755F244F718754CF5EE4A2FD58D944466E42CDED140C66D0CC590183E32BAF40F112BE8F3F2BDF6012B4B2793C52F1D36F69EE054D9A05593286F78453E56C0EC4A3EB95DDA2A7543FCCC00B939CACC009278603902FC12BCF84B706120526F6F6620536F6C6172'
-  );
-  assert.strictEqual(pkt.payload.type, 'ADVERT');
-  assert.strictEqual(pkt.payload.name, 'Kpa Roof Solar');
-  assert(pkt.payload.pubKey.length === 64);
-  assert(pkt.payload.timestamp > 0);
-  assert(pkt.payload.timestampISO);
-  assert(pkt.payload.signature.length === 128);
-});
-
-test('ADVERT flags: chat type=1', () => {
-  const pubKey = 'AB'.repeat(32);
-  const ts = '01000000';
-  const sig = 'CC'.repeat(64);
-  const flags = '01'; // type=1 → chat
-  const hex = '1100' + pubKey + ts + sig + flags;
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.flags.type, 1);
-  assert.strictEqual(p.payload.flags.chat, true);
-  assert.strictEqual(p.payload.flags.repeater, false);
-});
-
-test('ADVERT flags: repeater type=2', () => {
-  const pubKey = 'AB'.repeat(32);
-  const ts = '01000000';
-  const sig = 'CC'.repeat(64);
-  const flags = '02';
-  const hex = '1100' + pubKey + ts + sig + flags;
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.flags.type, 2);
-  assert.strictEqual(p.payload.flags.repeater, true);
-});
-
-test('ADVERT flags: room type=3', () => {
-  const pubKey = 'AB'.repeat(32);
-  const ts = '01000000';
-  const sig = 'CC'.repeat(64);
-  const flags = '03';
-  const hex = '1100' + pubKey + ts + sig + flags;
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.flags.type, 3);
-  assert.strictEqual(p.payload.flags.room, true);
-});
-
-test('ADVERT flags: sensor type=4', () => {
-  const pubKey = 'AB'.repeat(32);
-  const ts = '01000000';
-  const sig = 'CC'.repeat(64);
-  const flags = '04';
-  const hex = '1100' + pubKey + ts + sig + flags;
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.flags.type, 4);
-  assert.strictEqual(p.payload.flags.sensor, true);
-});
-
-test('ADVERT flags: hasLocation', () => {
-  const pubKey = 'AB'.repeat(32);
-  const ts = '01000000';
-  const sig = 'CC'.repeat(64);
-  // flags=0x12 → type=2(repeater), hasLocation=true
-  const flags = '12';
-  const lat = '40420f00'; // 1000000 → 1.0 degrees
-  const lon = '80841e00'; // 2000000 → 2.0 degrees
-  const hex = '1100' + pubKey + ts + sig + flags + lat + lon;
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.flags.hasLocation, true);
-  assert.strictEqual(p.payload.lat, 1.0);
-  assert.strictEqual(p.payload.lon, 2.0);
-});
-
-test('ADVERT flags: hasName', () => {
-  const pubKey = 'AB'.repeat(32);
-  const ts = '01000000';
-  const sig = 'CC'.repeat(64);
-  // flags=0x82 → type=2(repeater), hasName=true
-  const flags = '82';
-  const name = Buffer.from('MyNode').toString('hex');
-  const hex = '1100' + pubKey + ts + sig + flags + name;
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.flags.hasName, true);
-  assert.strictEqual(p.payload.name, 'MyNode');
-});
-
-test('ADVERT too short', () => {
-  const hex = '1100' + '00'.repeat(50);
-  const p = decodePacket(hex);
-  assert(p.payload.error);
-});
-
-console.log('\n=== GRP_TXT payload ===');
-test('GRP_TXT basic decode', () => {
-  // payloadType=5 → (5<<2)|1 = 0x15
-  const hex = '1500' + 'FF' + 'AABB' + 'CCDDEE';
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.type, 'GRP_TXT');
-  assert.strictEqual(p.payload.channelHash, 0xFF);
-  assert.strictEqual(p.payload.mac, 'aabb');
-});
-
-test('GRP_TXT too short', () => {
-  const hex = '1500' + 'FF' + 'AA';
-  const p = decodePacket(hex);
-  assert(p.payload.error);
-});
-
-test('GRP_TXT has channelHashHex field', () => {
-  const hex = '1500' + '1A' + 'AABB' + 'CCDDEE';
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.channelHashHex, '1A');
-});
-
-test('GRP_TXT channelHashHex zero-pads single digit', () => {
-  const hex = '1500' + '03' + 'AABB' + 'CCDDEE';
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.channelHashHex, '03');
-});
-
-test('GRP_TXT decryptionStatus is no_key when no keys provided', () => {
-  const hex = '1500' + 'FF' + 'AABB' + 'CCDDEE112233';
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.decryptionStatus, 'no_key');
-});
-
-test('GRP_TXT decryptionStatus is no_key when keys empty', () => {
-  const hex = '1500' + 'FF' + 'AABB' + 'CCDDEE112233';
-  const p = decodePacket(hex, {});
-  assert.strictEqual(p.payload.decryptionStatus, 'no_key');
-});
-
-test('GRP_TXT decryptionStatus is decryption_failed with bad keys', () => {
-  const hex = '1500' + 'FF' + 'AABB' + 'CCDDEE112233';
-  const p = decodePacket(hex, { '#test': 'deadbeefdeadbeefdeadbeefdeadbeef' });
-  assert.strictEqual(p.payload.decryptionStatus, 'decryption_failed');
-});
-
-test('GRP_TXT decryptionStatus is no_key when encrypted data too short', () => {
-  // encryptedData < 10 hex chars (5 bytes) — not enough to attempt decryption
-  const hex = '1500' + 'FF' + 'AABB' + 'CCDD';
-  const p = decodePacket(hex, { '#test': 'deadbeefdeadbeefdeadbeefdeadbeef' });
-  assert.strictEqual(p.payload.decryptionStatus, 'no_key');
-});
-
-test('GRP_TXT decryptionStatus is decrypted when key matches', () => {
-  // Mock the ChannelCrypto module to simulate successful decryption
-  const cryptoPath = require.resolve('@michaelhart/meshcore-decoder/dist/crypto/channel-crypto');
-  const originalModule = require.cache[cryptoPath];
-  require.cache[cryptoPath] = {
-    id: cryptoPath,
-    exports: {
-      ChannelCrypto: {
-        decryptGroupTextMessage: () => ({
-          success: true,
-          data: { sender: 'TestUser', message: 'Hello world', timestamp: 1700000000, flags: 0 },
-        }),
-      },
-    },
-  };
-  try {
-    const hex = '1500' + 'FF' + 'AABB' + 'CCDDEE112233';
-    const p = decodePacket(hex, { '#general': 'aabbccddaabbccddaabbccddaabbccdd' });
-    assert.strictEqual(p.payload.decryptionStatus, 'decrypted');
-    assert.strictEqual(p.payload.type, 'CHAN');
-    assert.strictEqual(p.payload.channelHashHex, 'FF');
-    assert.strictEqual(p.payload.channel, '#general');
-    assert.strictEqual(p.payload.sender, 'TestUser');
-    assert.strictEqual(p.payload.text, 'TestUser: Hello world');
-    assert.strictEqual(p.payload.sender_timestamp, 1700000000);
-    assert.strictEqual(p.payload.flags, 0);
-    assert.strictEqual(p.payload.channelHash, 0xFF);
-  } finally {
-    if (originalModule) require.cache[cryptoPath] = originalModule;
-    else delete require.cache[cryptoPath];
-  }
-});
-
-test('GRP_TXT decrypted without sender formats text correctly', () => {
-  const cryptoPath = require.resolve('@michaelhart/meshcore-decoder/dist/crypto/channel-crypto');
-  const originalModule = require.cache[cryptoPath];
-  require.cache[cryptoPath] = {
-    id: cryptoPath,
-    exports: {
-      ChannelCrypto: {
-        decryptGroupTextMessage: () => ({
-          success: true,
-          data: { sender: null, message: 'Broadcast msg', timestamp: 1700000001, flags: 1 },
-        }),
-      },
-    },
-  };
-  try {
-    const hex = '1500' + '0A' + 'AABB' + 'CCDDEE112233';
-    const p = decodePacket(hex, { '#alerts': 'deadbeefdeadbeefdeadbeefdeadbeef' });
-    assert.strictEqual(p.payload.decryptionStatus, 'decrypted');
-    assert.strictEqual(p.payload.sender, null);
-    assert.strictEqual(p.payload.text, 'Broadcast msg');
-    assert.strictEqual(p.payload.channelHashHex, '0A');
-  } finally {
-    if (originalModule) require.cache[cryptoPath] = originalModule;
-    else delete require.cache[cryptoPath];
-  }
-});
-
-test('GRP_TXT decrypted tries multiple keys, first match wins', () => {
-  const cryptoPath = require.resolve('@michaelhart/meshcore-decoder/dist/crypto/channel-crypto');
-  const originalModule = require.cache[cryptoPath];
-  let callCount = 0;
-  require.cache[cryptoPath] = {
-    id: cryptoPath,
-    exports: {
-      ChannelCrypto: {
-        decryptGroupTextMessage: (ciphertext, mac, key) => {
-          callCount++;
-          if (key === 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb') {
-            return { success: true, data: { sender: 'Bob', message: 'Found it', timestamp: 0, flags: 0 } };
-          }
-          return { success: false };
-        },
-      },
-    },
-  };
-  try {
-    const hex = '1500' + 'FF' + 'AABB' + 'CCDDEE112233';
-    const p = decodePacket(hex, {
-      '#wrong': 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
-      '#right': 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb',
-    });
-    assert.strictEqual(p.payload.decryptionStatus, 'decrypted');
-    assert.strictEqual(p.payload.channel, '#right');
-    assert.strictEqual(p.payload.sender, 'Bob');
-    assert.strictEqual(callCount, 2);
-  } finally {
-    if (originalModule) require.cache[cryptoPath] = originalModule;
-    else delete require.cache[cryptoPath];
-  }
-});
-
-console.log('\n=== TXT_MSG payload ===');
-test('TXT_MSG decode', () => {
-  // payloadType=2 → (2<<2)|1 = 0x09
-  const hex = '0900' + '00'.repeat(20);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.type, 'TXT_MSG');
-  assert(p.payload.destHash);
-  assert(p.payload.srcHash);
-  assert(p.payload.mac);
-});
-
-console.log('\n=== ACK payload ===');
-test('ACK decode', () => {
-  // payloadType=3 → (3<<2)|1 = 0x0D
-  const hex = '0D00' + '00'.repeat(18);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.type, 'ACK');
-  assert(p.payload.ackChecksum);
-});
-
-test('ACK too short', () => {
-  const hex = '0D00' + '00'.repeat(3);
-  const p = decodePacket(hex);
-  assert(p.payload.error);
-});
-
-console.log('\n=== REQ payload ===');
-test('REQ decode', () => {
-  // payloadType=0 → (0<<2)|1 = 0x01
-  const hex = '0100' + '00'.repeat(20);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.type, 'REQ');
-});
-
-console.log('\n=== RESPONSE payload ===');
-test('RESPONSE decode', () => {
-  // payloadType=1 → (1<<2)|1 = 0x05
-  const hex = '0500' + '00'.repeat(20);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.type, 'RESPONSE');
-});
-
-console.log('\n=== ANON_REQ payload ===');
-test('ANON_REQ decode', () => {
-  // payloadType=7 → (7<<2)|1 = 0x1D
-  const hex = '1D00' + '00'.repeat(50);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.type, 'ANON_REQ');
-  assert(p.payload.destHash);
-  assert(p.payload.ephemeralPubKey);
-  assert(p.payload.mac);
-});
-
-test('ANON_REQ too short', () => {
-  const hex = '1D00' + '00'.repeat(20);
-  const p = decodePacket(hex);
-  assert(p.payload.error);
-});
-
-console.log('\n=== PATH payload ===');
-test('PATH decode', () => {
-  // payloadType=8 → (8<<2)|1 = 0x21
-  const hex = '2100' + '00'.repeat(20);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.type, 'PATH');
-  assert(p.payload.destHash);
-  assert(p.payload.srcHash);
-});
-
-test('PATH too short', () => {
-  const hex = '2100' + '00'.repeat(1);
-  const p = decodePacket(hex);
-  assert(p.payload.error);
-});
-
-console.log('\n=== TRACE payload ===');
-test('TRACE decode', () => {
-  // payloadType=9 → (9<<2)|1 = 0x25
-  const hex = '2500' + '00'.repeat(12);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.type, 'TRACE');
-  assert(p.payload.tag !== undefined);
-  assert(p.payload.authCode !== undefined);
-  assert.strictEqual(p.payload.flags, 0);
-});
-
-test('TRACE too short', () => {
-  const hex = '2500' + '00'.repeat(5);
-  const p = decodePacket(hex);
-  assert(p.payload.error);
-});
-
-console.log('\n=== UNKNOWN payload ===');
-test('Unknown payload type', () => {
-  // payloadType=6 → (6<<2)|1 = 0x19
-  const hex = '1900' + 'DEADBEEF';
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.type, 'UNKNOWN');
-  assert(p.payload.raw);
-});
-
-// === Edge cases ===
-console.log('\n=== Edge cases ===');
-test('Packet too short throws', () => {
-  assert.throws(() => decodePacket('FF'), /too short/);
-});
-
-test('Packet with spaces in hex', () => {
-  const hex = '11 00 ' + '00'.repeat(101);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.header.payloadTypeName, 'ADVERT');
-});
-
-test('Transport route too short throws', () => {
-  assert.throws(() => decodePacket('0000'), /too short for transport/);
-});
-
-test('Corrupt packet #183 — TRANSPORT_DIRECT with correct field order', () => {
-  const hex = 'BBAD6797EC8751D500BF95A1A776EF580E665BCBF6A0BBE03B5E730707C53489B8C728FD3FB902397197E1263CEC21E52465362243685DBBAD6797EC8751C90A75D9FD8213155D';
-  const p = decodePacket(hex);
-  assert.strictEqual(p.header.routeType, 3, 'routeType should be TRANSPORT_DIRECT');
-  assert.strictEqual(p.header.payloadTypeName, 'UNKNOWN');
-  // transport codes are bytes 1-4, pathByte=0x87 at byte 5
-  assert.strictEqual(p.transportCodes.code1, 'AD67');
-  assert.strictEqual(p.transportCodes.code2, '97EC');
-  // pathByte 0x87: hashSize=3, hashCount=7
-  assert.strictEqual(p.path.hashSize, 3);
-  assert.strictEqual(p.path.hashCount, 7);
-  assert.strictEqual(p.path.hops.length, 7);
-  // No empty strings in hops
-  assert(p.path.hops.every(h => h.length > 0), 'no empty hops');
-});
-
-test('path.truncated is false for normal packets', () => {
-  const hex = '1100' + '00'.repeat(101);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.path.truncated, false);
-});
-
-test('path overflow with hashSize=2', () => {
-  // FLOOD + REQ, pathByte=0x45 → hashSize=2, hashCount=5, needs 10 bytes of path
-  // Only provide 7 bytes after pathByte → fits 3 full 2-byte hops
-  const hex = '0145' + 'AABBCCDDEEFF77';
-  const p = decodePacket(hex);
-  assert.strictEqual(p.path.hashCount, 3);
-  assert.strictEqual(p.path.truncated, true);
-  assert.strictEqual(p.path.hops.length, 3);
-  assert.strictEqual(p.path.hops[0], 'AABB');
-  assert.strictEqual(p.path.hops[1], 'CCDD');
-  assert.strictEqual(p.path.hops[2], 'EEFF');
-});
-
-// === Real packets from API ===
-console.log('\n=== Real packets ===');
-test('Real GRP_TXT packet', () => {
-  const p = decodePacket('150115D96CFF1FC90E7917B91729B76C1B509AE7789BBBD87D5AC3837E6C1487B47B0958AED8C7A6');
-  assert.strictEqual(p.header.payloadTypeName, 'GRP_TXT');
-  assert.strictEqual(p.header.routeTypeName, 'FLOOD');
-  assert.strictEqual(p.path.hashCount, 1);
-});
-
-test('Real ADVERT packet FLOOD with 3 hops', () => {
-  const p = decodePacket('11036CEF52206D763E1EACFD52FBAD4EF926887D0694C42A618AAF480A67C41120D3785950EFE0C1');
-  assert.strictEqual(p.header.payloadTypeName, 'ADVERT');
-  assert.strictEqual(p.header.routeTypeName, 'FLOOD');
-  assert.strictEqual(p.path.hashCount, 3);
-  assert.strictEqual(p.path.hashSize, 1);
-  // Payload is too short for full ADVERT but decoder handles it
-  assert.strictEqual(p.payload.type, 'ADVERT');
-});
-
-test('Real DIRECT TXT_MSG packet', () => {
-  // 0x0A = DIRECT(2) + TXT_MSG(2)
-  const p = decodePacket('0A403220AD034C0394C2C449810E3D86399C53AEE7FE355BA67002FFC3627B1175A257A181AE');
-  assert.strictEqual(p.header.payloadTypeName, 'TXT_MSG');
-  assert.strictEqual(p.header.routeTypeName, 'DIRECT');
-});
-
-// === validateAdvert ===
-console.log('\n=== validateAdvert ===');
-test('valid advert', () => {
-  const a = { pubKey: 'AB'.repeat(16), flags: { repeater: true, room: false, sensor: false } };
-  assert.deepStrictEqual(validateAdvert(a), { valid: true });
-});
-
-test('null advert', () => {
-  assert.strictEqual(validateAdvert(null).valid, false);
-});
-
-test('advert with error', () => {
-  assert.strictEqual(validateAdvert({ error: 'bad' }).valid, false);
-});
-
-test('pubkey too short', () => {
-  assert.strictEqual(validateAdvert({ pubKey: 'AABB' }).valid, false);
-});
-
-test('pubkey all zeros', () => {
-  assert.strictEqual(validateAdvert({ pubKey: '0'.repeat(64) }).valid, false);
-});
-
-test('invalid lat', () => {
-  assert.strictEqual(validateAdvert({ pubKey: 'AB'.repeat(16), lat: 200 }).valid, false);
-});
-
-test('invalid lon', () => {
-  assert.strictEqual(validateAdvert({ pubKey: 'AB'.repeat(16), lon: -200 }).valid, false);
-});
-
-test('name with control chars', () => {
-  assert.strictEqual(validateAdvert({ pubKey: 'AB'.repeat(16), name: 'test\x00bad' }).valid, false);
-});
-
-test('name too long', () => {
-  assert.strictEqual(validateAdvert({ pubKey: 'AB'.repeat(16), name: 'A'.repeat(65) }).valid, false);
-});
-
-test('valid name', () => {
-  assert.strictEqual(validateAdvert({ pubKey: 'AB'.repeat(16), name: 'My Node' }).valid, true);
-});
-
-test('valid lat/lon', () => {
-  const r = validateAdvert({ pubKey: 'AB'.repeat(16), lat: 37.3, lon: -121.9 });
-  assert.strictEqual(r.valid, true);
-});
-
-test('NaN lat invalid', () => {
-  assert.strictEqual(validateAdvert({ pubKey: 'AB'.repeat(16), lat: NaN }).valid, false);
-});
-
-// --- GRP_TXT garbage detection (fixes #197) ---
-
-test('GRP_TXT decrypted garbage text marked as decryption_failed', () => {
-  const cryptoPath = require.resolve('@michaelhart/meshcore-decoder/dist/crypto/channel-crypto');
-  const originalModule = require.cache[cryptoPath];
-  require.cache[cryptoPath] = {
-    id: cryptoPath,
-    exports: {
-      ChannelCrypto: {
-        decryptGroupTextMessage: () => ({
-          success: true,
-          data: { sender: 'Node', message: '\x01\x02\x03\x80\x81', timestamp: 1700000000, flags: 0 },
-        }),
-      },
-    },
-  };
-  try {
-    const hex = '1500' + 'FF' + 'AABB' + 'CCDDEE112233';
-    const p = decodePacket(hex, { '#general': 'aabbccddaabbccddaabbccddaabbccdd' });
-    assert.strictEqual(p.payload.decryptionStatus, 'decryption_failed');
-    assert.strictEqual(p.payload.text, null);
-    assert.strictEqual(p.payload.channelHashHex, 'FF');
-    assert.strictEqual(p.payload.channel, '#general');
-  } finally {
-    if (originalModule) require.cache[cryptoPath] = originalModule;
-    else delete require.cache[cryptoPath];
-  }
-});
-
-test('GRP_TXT valid text still marked as decrypted', () => {
-  const cryptoPath = require.resolve('@michaelhart/meshcore-decoder/dist/crypto/channel-crypto');
-  const originalModule = require.cache[cryptoPath];
-  require.cache[cryptoPath] = {
-    id: cryptoPath,
-    exports: {
-      ChannelCrypto: {
-        decryptGroupTextMessage: () => ({
-          success: true,
-          data: { sender: 'Alice', message: 'Hello\nworld', timestamp: 1700000000, flags: 0 },
-        }),
-      },
-    },
-  };
-  try {
-    const hex = '1500' + 'FF' + 'AABB' + 'CCDDEE112233';
-    const p = decodePacket(hex, { '#general': 'aabbccddaabbccddaabbccddaabbccdd' });
-    assert.strictEqual(p.payload.decryptionStatus, 'decrypted');
-    assert.strictEqual(p.payload.text, 'Alice: Hello\nworld');
-  } finally {
-    if (originalModule) require.cache[cryptoPath] = originalModule;
-    else delete require.cache[cryptoPath];
-  }
-});
-
-// === Summary ===
-console.log(`\n${passed} passed, ${failed} failed`);
-if (failed > 0) process.exit(1);

test-packet-store.js

@@ -1,552 +0,0 @@
-/* Unit tests for packet-store.js — uses a mock db module */
-'use strict';
-const assert = require('assert');
-const PacketStore = require('./packet-store');
-
-let passed = 0, failed = 0;
-function test(name, fn) {
-  try { fn(); passed++; console.log(`  ✅ ${name}`); }
-  catch (e) { failed++; console.log(`  ❌ ${name}: ${e.message}`); }
-}
-
-// Mock db module — minimal stubs for PacketStore
-function createMockDb() {
-  let txIdCounter = 1;
-  let obsIdCounter = 1000;
-  return {
-    db: {
-      pragma: (query) => {
-        if (query.includes('table_info(observations)')) return [{ name: 'observer_idx' }];
-        return [];
-      },
-      prepare: (sql) => ({
-        get: (...args) => {
-          if (sql.includes('sqlite_master')) return { name: 'transmissions' };
-          if (sql.includes('nodes')) return null;
-          if (sql.includes('observers')) return [];
-          return null;
-        },
-        all: (...args) => [],
-        iterate: (...args) => [][Symbol.iterator](),
-      }),
-    },
-    insertTransmission: (data) => ({
-      transmissionId: txIdCounter++,
-      observationId: obsIdCounter++,
-    }),
-  };
-}
-
-function makePacketData(overrides = {}) {
-  return {
-    raw_hex: 'AABBCCDD',
-    hash: 'abc123',
-    timestamp: new Date().toISOString(),
-    route_type: 1,
-    payload_type: 5,
-    payload_version: 0,
-    decoded_json: JSON.stringify({ pubKey: 'DEADBEEF'.repeat(8) }),
-    observer_id: 'obs1',
-    observer_name: 'Observer1',
-    snr: 8.5,
-    rssi: -45,
-    path_json: '["AA","BB"]',
-    direction: 'rx',
-    ...overrides,
-  };
-}
-
-// === Constructor ===
-console.log('\n=== PacketStore constructor ===');
-test('creates empty store', () => {
-  const store = new PacketStore(createMockDb());
-  assert.strictEqual(store.packets.length, 0);
-  assert.strictEqual(store.loaded, false);
-});
-
-test('respects maxMemoryMB config', () => {
-  const store = new PacketStore(createMockDb(), { maxMemoryMB: 512 });
-  assert.strictEqual(store.maxBytes, 512 * 1024 * 1024);
-});
-
-// === Load ===
-console.log('\n=== Load ===');
-test('load sets loaded flag', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  assert.strictEqual(store.loaded, true);
-});
-
-test('sqliteOnly mode skips RAM', () => {
-  const orig = process.env.NO_MEMORY_STORE;
-  process.env.NO_MEMORY_STORE = '1';
-  const store = new PacketStore(createMockDb());
-  store.load();
-  assert.strictEqual(store.sqliteOnly, true);
-  assert.strictEqual(store.packets.length, 0);
-  process.env.NO_MEMORY_STORE = orig || '';
-  if (!orig) delete process.env.NO_MEMORY_STORE;
-});
-
-// === Insert ===
-console.log('\n=== Insert ===');
-test('insert adds packet to memory', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData());
-  assert.strictEqual(store.packets.length, 1);
-  assert.strictEqual(store.stats.inserts, 1);
-});
-
-test('insert deduplicates by hash', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'dup1' }));
-  store.insert(makePacketData({ hash: 'dup1', observer_id: 'obs2' }));
-  assert.strictEqual(store.packets.length, 1);
-  assert.strictEqual(store.packets[0].observations.length, 2);
-  assert.strictEqual(store.packets[0].observation_count, 2);
-});
-
-test('insert dedup: same observer+path skipped', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'dup2' }));
-  store.insert(makePacketData({ hash: 'dup2' })); // same observer_id + path_json
-  assert.strictEqual(store.packets[0].observations.length, 1);
-});
-
-test('insert indexes by node pubkey', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  const pk = 'DEADBEEF'.repeat(8);
-  store.insert(makePacketData({ hash: 'n1', decoded_json: JSON.stringify({ pubKey: pk }) }));
-  assert(store.byNode.has(pk));
-  assert.strictEqual(store.byNode.get(pk).length, 1);
-});
-
-test('insert indexes byObserver', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ observer_id: 'obs-test' }));
-  assert(store.byObserver.has('obs-test'));
-});
-
-test('insert updates first_seen for earlier timestamp', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'ts1', timestamp: '2025-01-02T00:00:00Z', observer_id: 'o1' }));
-  store.insert(makePacketData({ hash: 'ts1', timestamp: '2025-01-01T00:00:00Z', observer_id: 'o2' }));
-  assert.strictEqual(store.packets[0].first_seen, '2025-01-01T00:00:00Z');
-});
-
-test('insert indexes ADVERT observer', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  const pk = 'AA'.repeat(32);
-  store.insert(makePacketData({ hash: 'adv1', payload_type: 4, decoded_json: JSON.stringify({ pubKey: pk }), observer_id: 'obs-adv' }));
-  assert(store._advertByObserver.has(pk));
-  assert(store._advertByObserver.get(pk).has('obs-adv'));
-});
-
-// === Query ===
-console.log('\n=== Query ===');
-test('query returns all packets', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'q1' }));
-  store.insert(makePacketData({ hash: 'q2' }));
-  const r = store.query();
-  assert.strictEqual(r.total, 2);
-  assert.strictEqual(r.packets.length, 2);
-});
-
-test('query by type filter', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'qt1', payload_type: 4 }));
-  store.insert(makePacketData({ hash: 'qt2', payload_type: 5 }));
-  const r = store.query({ type: 4 });
-  assert.strictEqual(r.total, 1);
-  assert.strictEqual(r.packets[0].payload_type, 4);
-});
-
-test('query by route filter', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'qr1', route_type: 0 }));
-  store.insert(makePacketData({ hash: 'qr2', route_type: 1 }));
-  const r = store.query({ route: 1 });
-  assert.strictEqual(r.total, 1);
-});
-
-test('query by hash (index path)', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'qh1' }));
-  store.insert(makePacketData({ hash: 'qh2' }));
-  const r = store.query({ hash: 'qh1' });
-  assert.strictEqual(r.total, 1);
-  assert.strictEqual(r.packets[0].hash, 'qh1');
-});
-
-test('query by observer (index path)', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'qo1', observer_id: 'obsA' }));
-  store.insert(makePacketData({ hash: 'qo2', observer_id: 'obsB' }));
-  const r = store.query({ observer: 'obsA' });
-  assert.strictEqual(r.total, 1);
-});
-
-test('query with limit and offset', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  for (let i = 0; i < 10; i++) store.insert(makePacketData({ hash: `ql${i}`, observer_id: `o${i}` }));
-  const r = store.query({ limit: 3, offset: 2 });
-  assert.strictEqual(r.packets.length, 3);
-  assert.strictEqual(r.total, 10);
-});
-
-test('query by since filter', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'qs1', timestamp: '2025-01-01T00:00:00Z' }));
-  store.insert(makePacketData({ hash: 'qs2', timestamp: '2025-06-01T00:00:00Z', observer_id: 'o2' }));
-  const r = store.query({ since: '2025-03-01T00:00:00Z' });
-  assert.strictEqual(r.total, 1);
-});
-
-test('query by until filter', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'qu1', timestamp: '2025-01-01T00:00:00Z' }));
-  store.insert(makePacketData({ hash: 'qu2', timestamp: '2025-06-01T00:00:00Z', observer_id: 'o2' }));
-  const r = store.query({ until: '2025-03-01T00:00:00Z' });
-  assert.strictEqual(r.total, 1);
-});
-
-test('query ASC order', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'qa1', timestamp: '2025-06-01T00:00:00Z' }));
-  store.insert(makePacketData({ hash: 'qa2', timestamp: '2025-01-01T00:00:00Z', observer_id: 'o2' }));
-  const r = store.query({ order: 'ASC' });
-  assert(r.packets[0].timestamp < r.packets[1].timestamp);
-});
-
-// === queryGrouped ===
-console.log('\n=== queryGrouped ===');
-test('queryGrouped returns grouped data', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'qg1' }));
-  store.insert(makePacketData({ hash: 'qg1', observer_id: 'obs2' }));
-  store.insert(makePacketData({ hash: 'qg2', observer_id: 'obs3' }));
-  const r = store.queryGrouped();
-  assert.strictEqual(r.total, 2);
-  const g1 = r.packets.find(p => p.hash === 'qg1');
-  assert(g1);
-  assert.strictEqual(g1.observation_count, 2);
-  assert.strictEqual(g1.observer_count, 2);
-});
-
-// === getNodesByAdvertObservers ===
-console.log('\n=== getNodesByAdvertObservers ===');
-test('finds nodes by observer', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  const pk = 'BB'.repeat(32);
-  store.insert(makePacketData({ hash: 'nao1', payload_type: 4, decoded_json: JSON.stringify({ pubKey: pk }), observer_id: 'obs-x' }));
-  const result = store.getNodesByAdvertObservers(['obs-x']);
-  assert(result.has(pk));
-});
-
-test('returns empty for unknown observer', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  const result = store.getNodesByAdvertObservers(['nonexistent']);
-  assert.strictEqual(result.size, 0);
-});
-
-// === Other methods ===
-console.log('\n=== Other methods ===');
-test('getById returns observation', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  const id = store.insert(makePacketData({ hash: 'gbi1' }));
-  const obs = store.getById(id);
-  assert(obs);
-});
-
-test('getSiblings returns observations for hash', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'sib1' }));
-  store.insert(makePacketData({ hash: 'sib1', observer_id: 'obs2' }));
-  const sibs = store.getSiblings('sib1');
-  assert.strictEqual(sibs.length, 2);
-});
-
-test('getSiblings empty for unknown hash', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  assert.deepStrictEqual(store.getSiblings('nope'), []);
-});
-
-test('all() returns packets', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'all1' }));
-  assert.strictEqual(store.all().length, 1);
-});
-
-test('filter() works', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'f1', payload_type: 4 }));
-  store.insert(makePacketData({ hash: 'f2', payload_type: 5, observer_id: 'o2' }));
-  assert.strictEqual(store.filter(p => p.payload_type === 4).length, 1);
-});
-
-test('countForNode returns counts', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  const pk = 'CC'.repeat(32);
-  store.insert(makePacketData({ hash: 'cn1', decoded_json: JSON.stringify({ pubKey: pk }) }));
-  store.insert(makePacketData({ hash: 'cn1', decoded_json: JSON.stringify({ pubKey: pk }), observer_id: 'o2' }));
-  const c = store.countForNode(pk);
-  assert.strictEqual(c.transmissions, 1);
-  assert.strictEqual(c.observations, 2);
-});
-
-test('getStats returns stats object', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  const s = store.getStats();
-  assert.strictEqual(s.inMemory, 0);
-  assert(s.indexes);
-  assert.strictEqual(s.sqliteOnly, false);
-});
-
-test('getTimestamps returns timestamps', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'gt1', timestamp: '2025-06-01T00:00:00Z' }));
-  store.insert(makePacketData({ hash: 'gt2', timestamp: '2025-06-02T00:00:00Z', observer_id: 'o2' }));
-  const ts = store.getTimestamps('2025-05-01T00:00:00Z');
-  assert.strictEqual(ts.length, 2);
-});
-
-// === Eviction ===
-console.log('\n=== Eviction ===');
-test('evicts oldest when over maxPackets', () => {
-  const store = new PacketStore(createMockDb(), { maxMemoryMB: 1, estimatedPacketBytes: 500000 });
-  // maxPackets will be very small
-  store.load();
-  for (let i = 0; i < 10; i++) store.insert(makePacketData({ hash: `ev${i}`, observer_id: `o${i}` }));
-  assert(store.packets.length <= store.maxPackets);
-  assert(store.stats.evicted > 0);
-});
-
-// === findPacketsForNode ===
-console.log('\n=== findPacketsForNode ===');
-test('finds by pubkey', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  const pk = 'DD'.repeat(32);
-  store.insert(makePacketData({ hash: 'fpn1', decoded_json: JSON.stringify({ pubKey: pk }) }));
-  store.insert(makePacketData({ hash: 'fpn2', decoded_json: JSON.stringify({ pubKey: 'other' }), observer_id: 'o2' }));
-  const r = store.findPacketsForNode(pk);
-  assert.strictEqual(r.packets.length, 1);
-  assert.strictEqual(r.pubkey, pk);
-});
-
-test('finds by text search in decoded_json', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'fpn3', decoded_json: JSON.stringify({ name: 'MySpecialNode' }) }));
-  const r = store.findPacketsForNode('MySpecialNode');
-  assert.strictEqual(r.packets.length, 1);
-});
-
-// === Memory optimization: observation deduplication ===
-console.log('\n=== Observation deduplication (transmission_id refs) ===');
-
-test('observations don\'t duplicate transmission fields', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'dedup1', raw_hex: 'FF00FF00', decoded_json: '{"pubKey":"ABCD"}' }));
-  const tx = store.byHash.get('dedup1');
-  assert(tx, 'transmission should exist');
-  assert(tx.observations.length >= 1, 'should have at least 1 observation');
-  const obs = tx.observations[0];
-  // Observation should NOT have its own copies of transmission fields
-  assert(!obs.hasOwnProperty('raw_hex'), 'obs should not have own raw_hex');
-  assert(!obs.hasOwnProperty('decoded_json'), 'obs should not have own decoded_json');
-  // Observation should reference its parent transmission
-  assert(obs.hasOwnProperty('transmission_id'), 'obs should have transmission_id');
-});
-
-test('transmission fields accessible through lookup', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'lookup1', raw_hex: 'DEADBEEF', decoded_json: '{"pubKey":"CAFE"}' }));
-  const tx = store.byHash.get('lookup1');
-  const obs = tx.observations[0];
-  // Look up the transmission via the observation's transmission_id
-  const parentTx = store.byTxId.get(obs.transmission_id);
-  assert(parentTx, 'should find parent transmission via transmission_id');
-  assert.strictEqual(parentTx.raw_hex, 'DEADBEEF');
-  assert.strictEqual(parentTx.decoded_json, '{"pubKey":"CAFE"}');
-  assert.strictEqual(parentTx.hash, 'lookup1');
-});
-
-test('query results still contain transmission fields (backward compat)', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'compat1', raw_hex: 'AABB', decoded_json: '{"test":true}' }));
-  const r = store.query();
-  assert.strictEqual(r.total, 1);
-  const pkt = r.packets[0];
-  // Query results (transmissions) should still have these fields
-  assert.strictEqual(pkt.raw_hex, 'AABB');
-  assert.strictEqual(pkt.decoded_json, '{"test":true}');
-  assert.strictEqual(pkt.hash, 'compat1');
-});
-
-test('all() results contain transmission fields', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'allcompat1', raw_hex: 'CCDD', decoded_json: '{"x":1}' }));
-  const pkts = store.all();
-  assert.strictEqual(pkts.length, 1);
-  assert.strictEqual(pkts[0].raw_hex, 'CCDD');
-  assert.strictEqual(pkts[0].decoded_json, '{"x":1}');
-});
-
-test('multiple observations share one transmission', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'shared1', observer_id: 'obs-A', raw_hex: 'FFFF' }));
-  store.insert(makePacketData({ hash: 'shared1', observer_id: 'obs-B', raw_hex: 'FFFF' }));
-  store.insert(makePacketData({ hash: 'shared1', observer_id: 'obs-C', raw_hex: 'FFFF' }));
-  // Only 1 transmission should exist
-  assert.strictEqual(store.packets.length, 1);
-  const tx = store.byHash.get('shared1');
-  assert.strictEqual(tx.observations.length, 3);
-  // All observations should reference the same transmission_id
-  const txId = tx.observations[0].transmission_id;
-  assert(txId != null, 'transmission_id should be set');
-  assert.strictEqual(tx.observations[1].transmission_id, txId);
-  assert.strictEqual(tx.observations[2].transmission_id, txId);
-  // Only 1 entry in byTxId for this transmission
-  assert(store.byTxId.has(txId), 'byTxId should have the shared transmission');
-});
-
-test('getSiblings still returns observation data after dedup', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'sibdedup1', observer_id: 'obs-X', snr: 5.0 }));
-  store.insert(makePacketData({ hash: 'sibdedup1', observer_id: 'obs-Y', snr: 9.0 }));
-  const sibs = store.getSiblings('sibdedup1');
-  assert.strictEqual(sibs.length, 2);
-  // Each sibling should have observer-specific fields
-  const obsIds = sibs.map(s => s.observer_id).sort();
-  assert.deepStrictEqual(obsIds, ['obs-X', 'obs-Y']);
-});
-
-test('queryGrouped still returns transmission fields after dedup', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'grpdedup1', raw_hex: 'AABB', decoded_json: '{"g":1}', observer_id: 'o1' }));
-  store.insert(makePacketData({ hash: 'grpdedup1', observer_id: 'o2' }));
-  const r = store.queryGrouped();
-  assert.strictEqual(r.total, 1);
-  const g = r.packets[0];
-  assert.strictEqual(g.raw_hex, 'AABB');
-  assert.strictEqual(g.decoded_json, '{"g":1}');
-  assert.strictEqual(g.observation_count, 2);
-});
-
-test('memory estimate reflects deduplication savings', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  // Insert 50 unique transmissions, each with 5 observers
-  const longHex = 'AA'.repeat(200);
-  const longJson = JSON.stringify({ pubKey: 'BB'.repeat(32), name: 'TestNode', data: 'X'.repeat(200) });
-  for (let i = 0; i < 50; i++) {
-    for (let j = 0; j < 5; j++) {
-      store.insert(makePacketData({
-        hash: `mem${i}`,
-        observer_id: `obs-mem-${j}`,
-        raw_hex: longHex,
-        decoded_json: longJson,
-      }));
-    }
-  }
-  assert.strictEqual(store.packets.length, 50);
-  // Verify observations don't bloat memory with duplicate strings
-  let obsWithRawHex = 0;
-  for (const tx of store.packets) {
-    for (const obs of tx.observations) {
-      if (obs.hasOwnProperty('raw_hex')) obsWithRawHex++;
-    }
-  }
-  assert.strictEqual(obsWithRawHex, 0, 'no observation should have own raw_hex property');
-});
-
-// === Regression: packetsLastHour must count live-appended observations (#182) ===
-console.log('\n=== packetsLastHour byObserver regression (#182) ===');
-
-test('byObserver counts recent packets regardless of insertion order', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-
-  const twoHoursAgo = new Date(Date.now() - 7200000).toISOString();
-  const thirtyMinAgo = new Date(Date.now() - 1800000).toISOString();
-  const fiveMinAgo   = new Date(Date.now() - 300000).toISOString();
-
-  // Simulate initial DB load: oldest packets pushed first (as if loaded DESC then reversed)
-  store.insert(makePacketData({ hash: 'old1', timestamp: twoHoursAgo, observer_id: 'obs-hr' }));
-  // Simulate live-ingested packet (appended at end, most recent)
-  store.insert(makePacketData({ hash: 'new1', timestamp: thirtyMinAgo, observer_id: 'obs-hr' }));
-  store.insert(makePacketData({ hash: 'new2', timestamp: fiveMinAgo, observer_id: 'obs-hr' }));
-
-  const obsPackets = store.byObserver.get('obs-hr');
-  assert.strictEqual(obsPackets.length, 3, 'should have 3 observations');
-
-  // Count packets in the last hour — the same way the fixed /api/observers does
-  const oneHourAgo = new Date(Date.now() - 3600000).toISOString();
-  let count = 0;
-  for (const obs of obsPackets) {
-    if (obs.timestamp > oneHourAgo) count++;
-  }
-  assert.strictEqual(count, 2, 'should count 2 recent packets, not 0 (regression #182)');
-});
-
-test('byObserver early-break bug: old item at front must not abort count', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-
-  const twoHoursAgo = new Date(Date.now() - 7200000).toISOString();
-  const tenMinAgo   = new Date(Date.now() - 600000).toISOString();
-
-  // Old observation first, then recent — simulates the mixed-order array
-  store.insert(makePacketData({ hash: 'h1', timestamp: twoHoursAgo, observer_id: 'obs-bug' }));
-  store.insert(makePacketData({ hash: 'h2', timestamp: tenMinAgo,   observer_id: 'obs-bug' }));
-
-  const obsPackets = store.byObserver.get('obs-bug');
-  const oneHourAgo = new Date(Date.now() - 3600000).toISOString();
-
-  // BUGGY code (break on first old item) would return 0 here
-  let count = 0;
-  for (const obs of obsPackets) {
-    if (obs.timestamp > oneHourAgo) count++;
-  }
-  assert.strictEqual(count, 1, 'must not skip recent packet after old one');
-});
-
-// === Summary ===
-console.log(`\n${passed} passed, ${failed} failed`);
-if (failed > 0) process.exit(1);

test-regional-filter.js

@@ -1,135 +0,0 @@
-#!/usr/bin/env node
-// Test: Regional hop resolution filtering
-// Validates that resolve-hops correctly filters candidates by geography and observer region
-
-const { IATA_COORDS, haversineKm, nodeNearRegion } = require('./iata-coords');
-
-let pass = 0, fail = 0;
-
-function assert(condition, msg) {
-  if (condition) { pass++; console.log(`  ✅ ${msg}`); }
-  else { fail++; console.error(`  ❌ FAIL: ${msg}`); }
-}
-
-// === 1. Haversine distance tests ===
-console.log('\n=== Haversine Distance ===');
-
-const sjcToSea = haversineKm(37.3626, -121.9290, 47.4502, -122.3088);
-assert(sjcToSea > 1100 && sjcToSea < 1150, `SJC→SEA = ${Math.round(sjcToSea)}km (expect ~1125km)`);
-
-const sjcToOak = haversineKm(37.3626, -121.9290, 37.7213, -122.2208);
-assert(sjcToOak > 40 && sjcToOak < 55, `SJC→OAK = ${Math.round(sjcToOak)}km (expect ~48km)`);
-
-const sjcToSjc = haversineKm(37.3626, -121.9290, 37.3626, -121.9290);
-assert(sjcToSjc === 0, `SJC→SJC = ${sjcToSjc}km (expect 0)`);
-
-const sjcToEug = haversineKm(37.3626, -121.9290, 44.1246, -123.2119);
-assert(sjcToEug > 750 && sjcToEug < 780, `SJC→EUG = ${Math.round(sjcToEug)}km (expect ~762km)`);
-
-// === 2. nodeNearRegion tests ===
-console.log('\n=== Node Near Region ===');
-
-// Node in San Jose, check against SJC region
-const sjNode = nodeNearRegion(37.35, -121.95, 'SJC');
-assert(sjNode && sjNode.near, `San Jose node near SJC: ${sjNode.distKm}km`);
-
-// Node in Seattle, check against SJC region — should NOT be near
-const seaNode = nodeNearRegion(47.45, -122.30, 'SJC');
-assert(seaNode && !seaNode.near, `Seattle node NOT near SJC: ${seaNode.distKm}km`);
-
-// Node in Seattle, check against SEA region — should be near
-const seaNodeSea = nodeNearRegion(47.45, -122.30, 'SEA');
-assert(seaNodeSea && seaNodeSea.near, `Seattle node near SEA: ${seaNodeSea.distKm}km`);
-
-// Node in Eugene, check against EUG — should be near
-const eugNode = nodeNearRegion(44.05, -123.10, 'EUG');
-assert(eugNode && eugNode.near, `Eugene node near EUG: ${eugNode.distKm}km`);
-
-// Eugene node should NOT be near SJC (~762km)
-const eugNodeSjc = nodeNearRegion(44.05, -123.10, 'SJC');
-assert(eugNodeSjc && !eugNodeSjc.near, `Eugene node NOT near SJC: ${eugNodeSjc.distKm}km`);
-
-// Node with no location — returns null
-const noLoc = nodeNearRegion(null, null, 'SJC');
-assert(noLoc === null, 'Null lat/lon returns null');
-
-// Node at 0,0 — returns null
-const zeroLoc = nodeNearRegion(0, 0, 'SJC');
-assert(zeroLoc === null, 'Zero lat/lon returns null');
-
-// Unknown IATA — returns null
-const unkIata = nodeNearRegion(37.35, -121.95, 'ZZZ');
-assert(unkIata === null, 'Unknown IATA returns null');
-
-// === 3. Edge cases: nodes just inside/outside 300km radius ===
-console.log('\n=== Boundary Tests (300km radius) ===');
-
-// Sacramento is ~145km from SJC — inside
-const smfNode = nodeNearRegion(38.58, -121.49, 'SJC');
-assert(smfNode && smfNode.near, `Sacramento near SJC: ${smfNode.distKm}km (expect ~145)`);
-
-// Fresno is ~235km from SJC — inside
-const fatNode = nodeNearRegion(36.74, -119.79, 'SJC');
-assert(fatNode && fatNode.near, `Fresno near SJC: ${fatNode.distKm}km (expect ~235)`);
-
-// Redding is ~400km from SJC — outside
-const rddNode = nodeNearRegion(40.59, -122.39, 'SJC');
-assert(rddNode && !rddNode.near, `Redding NOT near SJC: ${rddNode.distKm}km (expect ~400)`);
-
-// === 4. Simulate the core issue: 1-byte hop with cross-regional collision ===
-console.log('\n=== Cross-Regional Collision Simulation ===');
-
-// Two nodes with pubkeys starting with "D6": one in SJC area, one in SEA area
-const candidates = [
-  { name: 'Redwood Mt. Tam', pubkey: 'D6...sjc', lat: 37.92, lon: -122.60 },  // Marin County, CA
-  { name: 'VE7RSC North Repeater', pubkey: 'D6...sea', lat: 49.28, lon: -123.12 }, // Vancouver, BC
-  { name: 'KK7RXY Lynden', pubkey: 'D6...bel', lat: 48.94, lon: -122.47 }, // Bellingham, WA
-];
-
-// Packet observed in SJC region
-const packetIata = 'SJC';
-const geoFiltered = candidates.filter(c => {
-  const check = nodeNearRegion(c.lat, c.lon, packetIata);
-  return check && check.near;
-});
-assert(geoFiltered.length === 1, `Geo filter SJC: ${geoFiltered.length} candidates (expect 1)`);
-assert(geoFiltered[0].name === 'Redwood Mt. Tam', `Winner: ${geoFiltered[0].name} (expect Redwood Mt. Tam)`);
-
-// Packet observed in SEA region
-const seaFiltered = candidates.filter(c => {
-  const check = nodeNearRegion(c.lat, c.lon, 'SEA');
-  return check && check.near;
-});
-assert(seaFiltered.length === 2, `Geo filter SEA: ${seaFiltered.length} candidates (expect 2 — Vancouver + Bellingham)`);
-
-// Packet observed in EUG region — Eugene is ~300km from SEA nodes
-const eugFiltered = candidates.filter(c => {
-  const check = nodeNearRegion(c.lat, c.lon, 'EUG');
-  return check && check.near;
-});
-assert(eugFiltered.length === 0, `Geo filter EUG: ${eugFiltered.length} candidates (expect 0 — all too far)`);
-
-// === 5. Layered fallback logic ===
-console.log('\n=== Layered Fallback ===');
-
-const nodeWithGps = { lat: 37.92, lon: -122.60 }; // has GPS
-const nodeNoGps = { lat: null, lon: null }; // no GPS
-const observerSawNode = true; // observer-based filter says yes
-
-// Layer 1: GPS check
-const gpsCheck = nodeNearRegion(nodeWithGps.lat, nodeWithGps.lon, 'SJC');
-assert(gpsCheck && gpsCheck.near, 'Layer 1 (GPS): node with GPS near SJC');
-
-// Layer 2: No GPS, fall back to observer
-const gpsCheckNoLoc = nodeNearRegion(nodeNoGps.lat, nodeNoGps.lon, 'SJC');
-assert(gpsCheckNoLoc === null, 'Layer 2: no GPS returns null → use observer-based fallback');
-
-// Bridged WA node with GPS — should be REJECTED by SJC even though observer saw it
-const bridgedWaNode = { lat: 47.45, lon: -122.30 }; // Seattle
-const bridgedCheck = nodeNearRegion(bridgedWaNode.lat, bridgedWaNode.lon, 'SJC');
-assert(bridgedCheck && !bridgedCheck.near, `Bridge test: WA node rejected by SJC geo filter (${bridgedCheck.distKm}km)`);
-
-// === Summary ===
-console.log(`\n${'='.repeat(40)}`);
-console.log(`Results: ${pass} passed, ${fail} failed`);
-process.exit(fail > 0 ? 1 : 0);

test-regional-integration.js

@@ -1,96 +0,0 @@
-#!/usr/bin/env node
-// Integration test: Verify layered filtering works against live prod API
-// Tests that resolve-hops returns regional metadata and correct filtering
-
-const https = require('https');
-const BASE = 'https://analyzer.00id.net';
-
-function apiGet(path) {
-  return new Promise((resolve, reject) => {
-    https.get(BASE + path, { timeout: 10000 }, (res) => {
-      let data = '';
-      res.on('data', d => data += d);
-      res.on('end', () => { try { resolve(JSON.parse(data)); } catch (e) { reject(e); } });
-    }).on('error', reject);
-  });
-}
-
-let pass = 0, fail = 0;
-function assert(condition, msg) {
-  if (condition) { pass++; console.log(`  ✅ ${msg}`); }
-  else { fail++; console.error(`  ❌ FAIL: ${msg}`); }
-}
-
-async function run() {
-  console.log('\n=== Integration: resolve-hops API with regional filtering ===\n');
-
-  // 1. Get a packet with short hops and a known observer
-  const packets = await apiGet('/api/packets?limit=100&groupByHash=true');
-  const pkt = packets.packets.find(p => {
-    const path = JSON.parse(p.path_json || '[]');
-    return path.length > 0 && path.some(h => h.length <= 2) && p.observer_id;
-  });
-
-  if (!pkt) {
-    console.log('  ⚠ No packets with short hops found — skipping API tests');
-    return;
-  }
-
-  const path = JSON.parse(pkt.path_json);
-  const shortHops = path.filter(h => h.length <= 2);
-  console.log(`  Using packet ${pkt.hash.slice(0,12)} observed by ${pkt.observer_name || pkt.observer_id.slice(0,12)}`);
-  console.log(`  Path: ${path.join(' → ')} (${shortHops.length} short hops)`);
-
-  // 2. Resolve WITH observer (should get regional filtering)
-  const withObs = await apiGet(`/api/resolve-hops?hops=${path.join(',')}&observer=${pkt.observer_id}`);
-
-  assert(withObs.region != null, `Response includes region: ${withObs.region}`);
-
-  // 3. Check that conflicts have filterMethod field
-  let hasFilterMethod = false;
-  let hasDistKm = false;
-  for (const [hop, info] of Object.entries(withObs.resolved)) {
-    if (info.conflicts && info.conflicts.length > 0) {
-      for (const c of info.conflicts) {
-        if (c.filterMethod) hasFilterMethod = true;
-        if (c.distKm != null) hasDistKm = true;
-      }
-    }
-    if (info.filterMethods) {
-      assert(Array.isArray(info.filterMethods), `Hop ${hop}: filterMethods is array: ${JSON.stringify(info.filterMethods)}`);
-    }
-  }
-  assert(hasFilterMethod, 'At least one conflict has filterMethod');
-
-  // 4. Resolve WITHOUT observer (no regional filtering)
-  const withoutObs = await apiGet(`/api/resolve-hops?hops=${path.join(',')}`);
-  assert(withoutObs.region === null, `Without observer: region is null`);
-
-  // 5. Compare: with observer should have same or fewer candidates per ambiguous hop
-  for (const hop of shortHops) {
-    const withInfo = withObs.resolved[hop];
-    const withoutInfo = withoutObs.resolved[hop];
-    if (withInfo && withoutInfo && withInfo.conflicts && withoutInfo.conflicts) {
-      const withCount = withInfo.totalRegional || withInfo.conflicts.length;
-      const withoutCount = withoutInfo.totalGlobal || withoutInfo.conflicts.length;
-      assert(withCount <= withoutCount + 1,
-        `Hop ${hop}: regional(${withCount}) <= global(${withoutCount}) — ${withInfo.name || '?'}`);
-    }
-  }
-
-  // 6. Check that geo-filtered candidates have distKm
-  for (const [hop, info] of Object.entries(withObs.resolved)) {
-    if (info.conflicts) {
-      const geoFiltered = info.conflicts.filter(c => c.filterMethod === 'geo');
-      for (const c of geoFiltered) {
-        assert(c.distKm != null, `Hop ${hop} candidate ${c.name}: has distKm=${c.distKm}km (geo filter)`);
-      }
-    }
-  }
-
-  console.log(`\n${'='.repeat(40)}`);
-  console.log(`Results: ${pass} passed, ${fail} failed`);
-  process.exit(fail > 0 ? 1 : 0);
-}
-
-run().catch(e => { console.error('Test error:', e); process.exit(1); });

test-server-helpers.js

@@ -1,319 +0,0 @@
-'use strict';
-
-const helpers = require('./server-helpers');
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-let passed = 0, failed = 0;
-function assert(cond, msg) {
-  if (cond) { passed++; console.log(`  ✅ ${msg}`); }
-  else { failed++; console.error(`  ❌ ${msg}`); }
-}
-
-console.log('── server-helpers tests ──\n');
-
-// --- loadConfigFile ---
-console.log('loadConfigFile:');
-{
-  // Returns {} when no files exist
-  const result = helpers.loadConfigFile(['/nonexistent/path.json']);
-  assert(typeof result === 'object' && Object.keys(result).length === 0, 'returns {} for missing files');
-
-  // Loads valid JSON
-  const tmp = path.join(os.tmpdir(), `test-config-${Date.now()}.json`);
-  fs.writeFileSync(tmp, JSON.stringify({ hello: 'world' }));
-  const result2 = helpers.loadConfigFile([tmp]);
-  assert(result2.hello === 'world', 'loads valid JSON file');
-  fs.unlinkSync(tmp);
-
-  // Falls back to second path
-  const tmp2 = path.join(os.tmpdir(), `test-config2-${Date.now()}.json`);
-  fs.writeFileSync(tmp2, JSON.stringify({ fallback: true }));
-  const result3 = helpers.loadConfigFile(['/nonexistent.json', tmp2]);
-  assert(result3.fallback === true, 'falls back to second path');
-  fs.unlinkSync(tmp2);
-
-  // Handles malformed JSON
-  const tmp3 = path.join(os.tmpdir(), `test-config3-${Date.now()}.json`);
-  fs.writeFileSync(tmp3, 'not json{{{');
-  const result4 = helpers.loadConfigFile([tmp3]);
-  assert(Object.keys(result4).length === 0, 'returns {} for malformed JSON');
-  fs.unlinkSync(tmp3);
-}
-
-// --- loadThemeFile ---
-console.log('\nloadThemeFile:');
-{
-  const result = helpers.loadThemeFile(['/nonexistent/theme.json']);
-  assert(typeof result === 'object' && Object.keys(result).length === 0, 'returns {} for missing files');
-
-  const tmp = path.join(os.tmpdir(), `test-theme-${Date.now()}.json`);
-  fs.writeFileSync(tmp, JSON.stringify({ theme: { accent: '#ff0000' } }));
-  const result2 = helpers.loadThemeFile([tmp]);
-  assert(result2.theme.accent === '#ff0000', 'loads theme file');
-  fs.unlinkSync(tmp);
-}
-
-// --- buildHealthConfig ---
-console.log('\nbuildHealthConfig:');
-{
-  const h = helpers.buildHealthConfig({});
-  assert(h.infraDegraded === 24, 'default infraDegraded');
-  assert(h.infraSilent === 72, 'default infraSilent');
-  assert(h.nodeDegraded === 1, 'default nodeDegraded');
-  assert(h.nodeSilent === 24, 'default nodeSilent');
-
-  const h2 = helpers.buildHealthConfig({ healthThresholds: { infraDegradedHours: 2 } });
-  assert(h2.infraDegraded === 2, 'custom infraDegraded');
-  assert(h2.nodeDegraded === 1, 'other defaults preserved');
-
-  const h3 = helpers.buildHealthConfig(null);
-  assert(h3.infraDegraded === 24, 'handles null config');
-}
-
-// --- getHealthMs ---
-console.log('\ngetHealthMs:');
-{
-  const HEALTH = helpers.buildHealthConfig({});
-
-  const rep = helpers.getHealthMs('repeater', HEALTH);
-  assert(rep.degradedMs === 24 * 3600000, 'repeater uses infra degraded');
-  assert(rep.silentMs === 72 * 3600000, 'repeater uses infra silent');
-
-  const room = helpers.getHealthMs('room', HEALTH);
-  assert(room.degradedMs === 24 * 3600000, 'room uses infra degraded');
-
-  const comp = helpers.getHealthMs('companion', HEALTH);
-  assert(comp.degradedMs === 1 * 3600000, 'companion uses node degraded');
-  assert(comp.silentMs === 24 * 3600000, 'companion uses node silent');
-
-  const sensor = helpers.getHealthMs('sensor', HEALTH);
-  assert(sensor.degradedMs === 1 * 3600000, 'sensor uses node degraded');
-
-  const undef = helpers.getHealthMs(undefined, HEALTH);
-  assert(undef.degradedMs === 1 * 3600000, 'undefined role uses node degraded');
-}
-
-// --- isHashSizeFlipFlop ---
-console.log('\nisHashSizeFlipFlop:');
-{
-  assert(helpers.isHashSizeFlipFlop(null, null) === false, 'null seq returns false');
-  assert(helpers.isHashSizeFlipFlop([1, 2], new Set([1, 2])) === false, 'too few samples');
-  assert(helpers.isHashSizeFlipFlop([1, 1, 1], new Set([1])) === false, 'single size');
-  assert(helpers.isHashSizeFlipFlop([1, 1, 1, 2, 2, 2], new Set([1, 2])) === false, 'clean upgrade (1 transition)');
-  assert(helpers.isHashSizeFlipFlop([1, 2, 1], new Set([1, 2])) === true, 'flip-flop detected');
-  assert(helpers.isHashSizeFlipFlop([1, 2, 1, 2], new Set([1, 2])) === true, 'repeated flip-flop');
-  assert(helpers.isHashSizeFlipFlop([2, 1, 2], new Set([1, 2])) === true, 'reverse flip-flop');
-  assert(helpers.isHashSizeFlipFlop([1, 2, 3], new Set([1, 2, 3])) === true, 'three sizes, 2 transitions');
-}
-
-// --- computeContentHash ---
-console.log('\ncomputeContentHash:');
-{
-  // Minimal packet: header + path byte + payload
-  // header=0x04, path_byte=0x00 (hash_size=1, 0 hops), payload=0xABCD
-  const hex1 = '0400abcd';
-  const h1 = helpers.computeContentHash(hex1);
-  assert(typeof h1 === 'string' && h1.length === 16, 'returns 16-char hash');
-
-  // Same payload, different path should give same hash
-  // header=0x04, path_byte=0x41 (hash_size=2, 1 hop), path=0x1234, payload=0xABCD
-  const hex2 = '04411234abcd';
-  const h2 = helpers.computeContentHash(hex2);
-  assert(h1 === h2, 'same content different path = same hash');
-
-  // Different payload = different hash
-  const hex3 = '0400ffff';
-  const h3 = helpers.computeContentHash(hex3);
-  assert(h3 !== h1, 'different payload = different hash');
-
-  // Very short hex
-  const h4 = helpers.computeContentHash('04');
-  assert(h4 === '04', 'short hex returns prefix');
-
-  // Invalid hex
-  const h5 = helpers.computeContentHash('xyz');
-  assert(typeof h5 === 'string', 'handles invalid hex gracefully');
-}
-
-// --- geoDist ---
-console.log('\ngeoDist:');
-{
-  assert(helpers.geoDist(0, 0, 0, 0) === 0, 'same point = 0');
-  assert(helpers.geoDist(0, 0, 3, 4) === 5, 'pythagorean triple');
-  assert(helpers.geoDist(37.7749, -122.4194, 37.7749, -122.4194) === 0, 'SF to SF = 0');
-  const d = helpers.geoDist(37.0, -122.0, 38.0, -122.0);
-  assert(Math.abs(d - 1.0) < 0.001, '1 degree latitude diff');
-}
-
-// --- deriveHashtagChannelKey ---
-console.log('\nderiveHashtagChannelKey:');
-{
-  const k1 = helpers.deriveHashtagChannelKey('test');
-  assert(typeof k1 === 'string' && k1.length === 32, 'returns 32-char key');
-  const k2 = helpers.deriveHashtagChannelKey('test');
-  assert(k1 === k2, 'deterministic');
-  const k3 = helpers.deriveHashtagChannelKey('other');
-  assert(k3 !== k1, 'different input = different key');
-}
-
-// --- buildBreakdown ---
-console.log('\nbuildBreakdown:');
-{
-  const r1 = helpers.buildBreakdown(null, null, null, null);
-  assert(JSON.stringify(r1) === '{}', 'null rawHex returns empty');
-
-  const r2 = helpers.buildBreakdown('04', null, null, null);
-  assert(r2.ranges.length === 1, 'single-byte returns header only');
-  assert(r2.ranges[0].label === 'Header', 'header range');
-
-  // 2 bytes: header + path byte, no payload
-  const r3 = helpers.buildBreakdown('0400', null, null, null);
-  assert(r3.ranges.length === 2, 'two bytes: header + path length');
-  assert(r3.ranges[1].label === 'Path Length', 'path length range');
-
-  // With payload: header=04, path_byte=00, payload=abcd
-  const r4 = helpers.buildBreakdown('0400abcd', null, null, null);
-  assert(r4.ranges.some(r => r.label === 'Payload'), 'has payload range');
-
-  // With path hops: header=04, path_byte=0x41 (size=2, count=1), path=1234, payload=ff
-  const r5 = helpers.buildBreakdown('04411234ff', null, null, null);
-  assert(r5.ranges.some(r => r.label === 'Path'), 'has path range');
-
-  // ADVERT with enough payload
-  // flags=0x90 (0x10=GPS + 0x80=Name)
-  const advertHex = '0400' + 'aa'.repeat(32) + 'bb'.repeat(4) + 'cc'.repeat(64) + '90' + 'dddddddddddddddd' + '48656c6c6f';
-  const r6 = helpers.buildBreakdown(advertHex, { type: 'ADVERT' }, null, null);
-  assert(r6.ranges.some(r => r.label === 'PubKey'), 'ADVERT has PubKey sub-range');
-  assert(r6.ranges.some(r => r.label === 'Flags'), 'ADVERT has Flags sub-range');
-  assert(r6.ranges.some(r => r.label === 'Latitude'), 'ADVERT with GPS flag has Latitude');
-  assert(r6.ranges.some(r => r.label === 'Name'), 'ADVERT with name flag has Name');
-}
-
-// --- disambiguateHops ---
-console.log('\ndisambiguateHops:');
-{
-  const nodes = [
-    { public_key: 'aabb11223344', name: 'Node-A', lat: 37.0, lon: -122.0 },
-    { public_key: 'ccdd55667788', name: 'Node-C', lat: 37.1, lon: -122.1 },
-  ];
-  // Single unique match
-  const r1 = helpers.disambiguateHops(['aabb'], nodes);
-  assert(r1.length === 1, 'resolves single hop');
-  assert(r1[0].name === 'Node-A', 'resolves to correct node');
-  assert(r1[0].pubkey === 'aabb11223344', 'includes pubkey');
-
-  // Unknown hop
-  delete nodes._prefixIdx; delete nodes._prefixIdxName;
-  const r2 = helpers.disambiguateHops(['ffff'], nodes);
-  assert(r2[0].name === 'ffff', 'unknown hop uses hex as name');
-
-  // Multiple hops
-  delete nodes._prefixIdx; delete nodes._prefixIdxName;
-  const r3 = helpers.disambiguateHops(['aabb', 'ccdd'], nodes);
-  assert(r3.length === 2, 'resolves multiple hops');
-  assert(r3[0].name === 'Node-A' && r3[1].name === 'Node-C', 'both resolved');
-}
-
-// --- updateHashSizeForPacket ---
-console.log('\nupdateHashSizeForPacket:');
-{
-  const map = new Map(), allMap = new Map(), seqMap = new Map();
-
-  // ADVERT packet (payload_type=4)
-  // path byte 0x40 = hash_size 2 (bits 7-6 = 01)
-  const p1 = {
-    payload_type: 4,
-    raw_hex: '0440' + 'aa'.repeat(100),
-    decoded_json: JSON.stringify({ pubKey: 'abc123' }),
-    path_json: null
-  };
-  helpers.updateHashSizeForPacket(p1, map, allMap, seqMap);
-  assert(map.get('abc123') === 2, 'ADVERT sets hash_size=2');
-  assert(allMap.get('abc123').has(2), 'all map has size 2');
-  assert(seqMap.get('abc123')[0] === 2, 'seq map records size');
-
-  // Non-ADVERT with path_json fallback
-  const map2 = new Map(), allMap2 = new Map(), seqMap2 = new Map();
-  const p2 = {
-    payload_type: 1,
-    raw_hex: '0140ff',  // path byte 0x40 = hash_size 2
-    decoded_json: JSON.stringify({ pubKey: 'def456' }),
-    path_json: JSON.stringify(['aabb'])
-  };
-  helpers.updateHashSizeForPacket(p2, map2, allMap2, seqMap2);
-  assert(map2.get('def456') === 2, 'non-ADVERT falls back to path byte');
-
-  // Already-parsed decoded_json (object, not string)
-  const map3 = new Map(), allMap3 = new Map(), seqMap3 = new Map();
-  const p3 = {
-    payload_type: 4,
-    raw_hex: '04c0' + 'aa'.repeat(100),  // 0xC0 = bits 7-6 = 11 = hash_size 4
-    decoded_json: { pubKey: 'ghi789' },
-    path_json: null
-  };
-  helpers.updateHashSizeForPacket(p3, map3, allMap3, seqMap3);
-  assert(map3.get('ghi789') === 4, 'handles object decoded_json');
-}
-
-// --- rebuildHashSizeMap ---
-console.log('\nrebuildHashSizeMap:');
-{
-  const map = new Map(), allMap = new Map(), seqMap = new Map();
-  const packets = [
-    // Newest first (as packet store provides)
-    { payload_type: 4, raw_hex: '0480' + 'bb'.repeat(50), decoded_json: JSON.stringify({ pubKey: 'node1' }), path_json: null },
-    { payload_type: 4, raw_hex: '0440' + 'aa'.repeat(50), decoded_json: JSON.stringify({ pubKey: 'node1' }), path_json: null },
-  ];
-  helpers.rebuildHashSizeMap(packets, map, allMap, seqMap);
-  assert(map.get('node1') === 3, 'first seen (newest) wins for map');
-  assert(allMap.get('node1').size === 2, 'all map has both sizes');
-  // Seq should be reversed to chronological: [2, 3]
-  const seq = seqMap.get('node1');
-  assert(seq[0] === 2 && seq[1] === 3, 'sequence is chronological (reversed)');
-
-  // Pass 2 fallback: node without advert
-  const map2 = new Map(), allMap2 = new Map(), seqMap2 = new Map();
-  const packets2 = [
-    { payload_type: 1, raw_hex: '0140ff', decoded_json: JSON.stringify({ pubKey: 'node2' }), path_json: JSON.stringify(['aabb']) },
-  ];
-  helpers.rebuildHashSizeMap(packets2, map2, allMap2, seqMap2);
-  assert(map2.get('node2') === 2, 'pass 2 fallback from path');
-}
-
-// --- requireApiKey ---
-console.log('\nrequireApiKey:');
-{
-  // No API key configured
-  const mw1 = helpers.requireApiKey(null);
-  let nextCalled = false;
-  mw1({headers: {}, query: {}}, {}, () => { nextCalled = true; });
-  assert(nextCalled, 'no key configured = passes through');
-
-  // Valid key
-  const mw2 = helpers.requireApiKey('secret123');
-  nextCalled = false;
-  mw2({headers: {'x-api-key': 'secret123'}, query: {}}, {}, () => { nextCalled = true; });
-  assert(nextCalled, 'valid header key passes');
-
-  // Valid key via query
-  nextCalled = false;
-  mw2({headers: {}, query: {apiKey: 'secret123'}}, {}, () => { nextCalled = true; });
-  assert(nextCalled, 'valid query key passes');
-
-  // Invalid key
-  let statusCode = null, jsonBody = null;
-  const mockRes = {
-    status(code) { statusCode = code; return { json(body) { jsonBody = body; } }; }
-  };
-  nextCalled = false;
-  mw2({headers: {'x-api-key': 'wrong'}, query: {}}, mockRes, () => { nextCalled = true; });
-  assert(!nextCalled && statusCode === 401, 'invalid key returns 401');
-}
-
-console.log(`\n═══════════════════════════════════════`);
-console.log(`  PASSED: ${passed}`);
-console.log(`  FAILED: ${failed}`);
-console.log(`═══════════════════════════════════════`);
-if (failed > 0) process.exit(1);

tools/e2e-test.js

@@ -1,476 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-
-/**
- * MeshCore Analyzer — End-to-End Validation Test (M12)
- *
- * Starts the server with a temp DB, injects 100+ synthetic packets,
- * validates every API endpoint, WebSocket broadcasts, and optionally MQTT.
- */
-
-const { spawn, execSync } = require('child_process');
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-const crypto = require('crypto');
-const WebSocket = require('ws');
-
-const PROJECT_DIR = path.join(__dirname, '..');
-const PORT = 13579; // avoid conflict with dev server
-const BASE = `http://localhost:${PORT}`;
-
-// ── Helpers ──────────────────────────────────────────────────────────
-
-let passed = 0, failed = 0;
-const failures = [];
-
-function assert(cond, label) {
-  if (cond) { passed++; }
-  else { failed++; failures.push(label); console.error(`  ❌ FAIL: ${label}`); }
-}
-
-async function get(path) {
-  const r = await fetch(`${BASE}${path}`);
-  return { status: r.status, data: await r.json() };
-}
-
-async function post(path, body) {
-  const r = await fetch(`${BASE}${path}`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify(body),
-  });
-  return { status: r.status, data: await r.json() };
-}
-
-function sleep(ms) { return new Promise(r => setTimeout(r, ms)); }
-
-// ── Packet generation (inline from generate-packets.js logic) ────────
-
-const OBSERVERS = [
-  { id: 'E2E-SJC-1', iata: 'SJC' },
-  { id: 'E2E-SFO-2', iata: 'SFO' },
-  { id: 'E2E-OAK-3', iata: 'OAK' },
-];
-
-const NODE_NAMES = [
-  'TestNode Alpha', 'TestNode Beta', 'TestNode Gamma', 'TestNode Delta',
-  'TestNode Epsilon', 'TestNode Zeta', 'TestNode Eta', 'TestNode Theta',
-];
-
-function rand(a, b) { return Math.random() * (b - a) + a; }
-function randInt(a, b) { return Math.floor(rand(a, b + 1)); }
-function pick(a) { return a[randInt(0, a.length - 1)]; }
-function randomBytes(n) { return crypto.randomBytes(n); }
-
-function pubkeyFor(name) {
-  return crypto.createHash('sha256').update(name).digest();
-}
-
-function encodeHeader(routeType, payloadType, ver = 0) {
-  return (routeType & 0x03) | ((payloadType & 0x0F) << 2) | ((ver & 0x03) << 6);
-}
-
-function buildPath(hopCount, hashSize = 2) {
-  const pathByte = ((hashSize - 1) << 6) | (hopCount & 0x3F);
-  const hops = crypto.randomBytes(hashSize * hopCount);
-  return { pathByte, hops };
-}
-
-function buildAdvert(name, role) {
-  const pubKey = pubkeyFor(name);
-  const ts = Buffer.alloc(4); ts.writeUInt32LE(Math.floor(Date.now() / 1000));
-  const sig = randomBytes(64);
-  let flags = 0x80 | 0x10; // hasName + hasLocation
-  if (role === 'repeater') flags |= 0x02;
-  else if (role === 'room') flags |= 0x04;
-  else if (role === 'sensor') flags |= 0x08;
-  else flags |= 0x01;
-  const nameBuf = Buffer.from(name, 'utf8');
-  const appdata = Buffer.alloc(9 + nameBuf.length);
-  appdata[0] = flags;
-  appdata.writeInt32LE(Math.round(37.34 * 1e6), 1);
-  appdata.writeInt32LE(Math.round(-121.89 * 1e6), 5);
-  nameBuf.copy(appdata, 9);
-  const payload = Buffer.concat([pubKey, ts, sig, appdata]);
-  const header = encodeHeader(1, 0x04, 0); // FLOOD + ADVERT
-  const { pathByte, hops } = buildPath(randInt(0, 3));
-  return Buffer.concat([Buffer.from([header, pathByte]), hops, payload]);
-}
-
-function buildGrpTxt(channelHash = 0) {
-  const mac = randomBytes(2);
-  const enc = randomBytes(randInt(10, 40));
-  const payload = Buffer.concat([Buffer.from([channelHash]), mac, enc]);
-  const header = encodeHeader(1, 0x05, 0); // FLOOD + GRP_TXT
-  const { pathByte, hops } = buildPath(randInt(0, 3));
-  return Buffer.concat([Buffer.from([header, pathByte]), hops, payload]);
-}
-
-function buildAck() {
-  const payload = randomBytes(18);
-  const header = encodeHeader(2, 0x03, 0);
-  const { pathByte, hops } = buildPath(randInt(0, 2));
-  return Buffer.concat([Buffer.from([header, pathByte]), hops, payload]);
-}
-
-function buildTxtMsg() {
-  const payload = Buffer.concat([randomBytes(6), randomBytes(6), randomBytes(4), randomBytes(20)]);
-  const header = encodeHeader(2, 0x02, 0);
-  const { pathByte, hops } = buildPath(randInt(0, 2));
-  return Buffer.concat([Buffer.from([header, pathByte]), hops, payload]);
-}
-
-// ── Main ─────────────────────────────────────────────────────────────
-
-async function main() {
-  // 1. Create temp DB
-  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'meshcore-e2e-'));
-  const dbPath = path.join(tmpDir, 'test.db');
-  console.log(`Temp DB: ${dbPath}`);
-
-  // 2. Start server
-  console.log('Starting server...');
-  const srv = spawn('node', ['server.js'], {
-    cwd: PROJECT_DIR,
-    env: { ...process.env, DB_PATH: dbPath, PORT: String(PORT) },
-    stdio: ['ignore', 'pipe', 'pipe'],
-  });
-
-  let serverOutput = '';
-  srv.stdout.on('data', d => { serverOutput += d; });
-  srv.stderr.on('data', d => { serverOutput += d; });
-
-  // We need the server to respect PORT env — check if config is hard-coded
-  // The server uses config.port from config.json. We need to patch that or
-  // monkey-patch. Let's just use port 3000 if the server doesn't read PORT env.
-  // Actually let me check...
-
-  const cleanup = () => {
-    try { srv.kill('SIGTERM'); } catch {}
-    try { fs.unlinkSync(dbPath); fs.rmdirSync(tmpDir); } catch {}
-  };
-
-  process.on('SIGINT', () => { cleanup(); process.exit(1); });
-  process.on('uncaughtException', (e) => { console.error(e); cleanup(); process.exit(1); });
-
-  // 3. Wait for server ready
-  let ready = false;
-  for (let i = 0; i < 30; i++) {
-    await sleep(500);
-    try {
-      const r = await fetch(`${BASE}/api/stats`);
-      if (r.ok) { ready = true; break; }
-    } catch {}
-  }
-
-  if (!ready) {
-    console.error('Server did not start in time. Output:', serverOutput);
-    cleanup();
-    process.exit(1);
-  }
-  console.log('Server ready.\n');
-
-  // 4. Connect WebSocket
-  const wsMessages = [];
-  const ws = new WebSocket(`ws://localhost:${PORT}`);
-  await new Promise((resolve, reject) => {
-    ws.on('open', resolve);
-    ws.on('error', reject);
-    setTimeout(() => reject(new Error('WS timeout')), 5000);
-  });
-  ws.on('message', (data) => {
-    try { wsMessages.push(JSON.parse(data.toString())); } catch {}
-  });
-  console.log('WebSocket connected.\n');
-
-  // 5. Generate and inject packets
-  const roles = ['repeater', 'room', 'companion', 'sensor'];
-  const injected = [];
-  const advertNodes = {}; // name -> {role, pubkey, count}
-  const grpTxtCount = { total: 0, byChannel: {} };
-  const observerCounts = {}; // id -> count
-  const hashToObservers = {}; // hash -> Set(observer)
-
-  // Generate ADVERT packets — ensure at least one of each role
-  for (let ri = 0; ri < roles.length; ri++) {
-    const name = NODE_NAMES[ri];
-    const role = roles[ri];
-    const buf = buildAdvert(name, role);
-    const hex = buf.toString('hex').toUpperCase();
-    const hash = crypto.createHash('md5').update(hex).digest('hex').slice(0, 16);
-    const obs = OBSERVERS[ri % OBSERVERS.length];
-    injected.push({ hex, observer: obs.id, region: obs.iata, hash, snr: 5.0, rssi: -80 });
-    advertNodes[name] = { role, pubkey: pubkeyFor(name).toString('hex'), count: 1 };
-    observerCounts[obs.id] = (observerCounts[obs.id] || 0) + 1;
-    if (!hashToObservers[hash]) hashToObservers[hash] = new Set();
-    hashToObservers[hash].add(obs.id);
-  }
-
-  // More ADVERTs
-  for (let i = 0; i < 40; i++) {
-    const name = pick(NODE_NAMES);
-    const role = pick(roles);
-    const buf = buildAdvert(name, role);
-    const hex = buf.toString('hex').toUpperCase();
-    const hash = crypto.createHash('md5').update(hex).digest('hex').slice(0, 16);
-    // Multi-observer: 30% chance heard by 2 observers
-    const obsCount = Math.random() < 0.3 ? 2 : 1;
-    const shuffled = [...OBSERVERS].sort(() => Math.random() - 0.5);
-    for (let o = 0; o < obsCount; o++) {
-      const obs = shuffled[o];
-      injected.push({ hex, observer: obs.id, region: obs.iata, hash, snr: rand(-2, 10), rssi: rand(-110, -60) });
-      observerCounts[obs.id] = (observerCounts[obs.id] || 0) + 1;
-      if (!hashToObservers[hash]) hashToObservers[hash] = new Set();
-      hashToObservers[hash].add(obs.id);
-    }
-    if (!advertNodes[name]) advertNodes[name] = { role, pubkey: pubkeyFor(name).toString('hex'), count: 0 };
-    advertNodes[name].count++;
-  }
-
-  // GRP_TXT packets
-  for (let i = 0; i < 30; i++) {
-    const ch = randInt(0, 3);
-    const buf = buildGrpTxt(ch);
-    const hex = buf.toString('hex').toUpperCase();
-    const hash = crypto.createHash('md5').update(hex).digest('hex').slice(0, 16);
-    const obs = pick(OBSERVERS);
-    injected.push({ hex, observer: obs.id, region: obs.iata, hash, snr: 3.0, rssi: -90 });
-    grpTxtCount.total++;
-    grpTxtCount.byChannel[ch] = (grpTxtCount.byChannel[ch] || 0) + 1;
-    observerCounts[obs.id] = (observerCounts[obs.id] || 0) + 1;
-    if (!hashToObservers[hash]) hashToObservers[hash] = new Set();
-    hashToObservers[hash].add(obs.id);
-  }
-
-  // ACK + TXT_MSG
-  for (let i = 0; i < 20; i++) {
-    const buf = i < 10 ? buildAck() : buildTxtMsg();
-    const hex = buf.toString('hex').toUpperCase();
-    const hash = crypto.createHash('md5').update(hex).digest('hex').slice(0, 16);
-    const obs = pick(OBSERVERS);
-    injected.push({ hex, observer: obs.id, region: obs.iata, hash, snr: 1.0, rssi: -95 });
-    observerCounts[obs.id] = (observerCounts[obs.id] || 0) + 1;
-    if (!hashToObservers[hash]) hashToObservers[hash] = new Set();
-    hashToObservers[hash].add(obs.id);
-  }
-
-  // Find a hash with multiple observers for trace testing
-  let traceHash = null;
-  for (const [h, obs] of Object.entries(hashToObservers)) {
-    if (obs.size >= 2) { traceHash = h; break; }
-  }
-  // If none, create one explicitly
-  if (!traceHash) {
-    const buf = buildAck();
-    const hex = buf.toString('hex').toUpperCase();
-    traceHash = crypto.createHash('md5').update(hex).digest('hex').slice(0, 16);
-    injected.push({ hex, observer: OBSERVERS[0].id, region: OBSERVERS[0].iata, hash: traceHash, snr: 5, rssi: -80 });
-    injected.push({ hex, observer: OBSERVERS[1].id, region: OBSERVERS[1].iata, hash: traceHash, snr: 3, rssi: -90 });
-    observerCounts[OBSERVERS[0].id] = (observerCounts[OBSERVERS[0].id] || 0) + 1;
-    observerCounts[OBSERVERS[1].id] = (observerCounts[OBSERVERS[1].id] || 0) + 1;
-  }
-
-  console.log(`Injecting ${injected.length} packets...`);
-  let injectOk = 0, injectFail = 0;
-  for (const pkt of injected) {
-    const r = await post('/api/packets', pkt);
-    if (r.status === 200) injectOk++;
-    else { injectFail++; if (injectFail <= 3) console.error('  Inject fail:', r.data); }
-  }
-  console.log(`Injected: ${injectOk} ok, ${injectFail} fail\n`);
-  assert(injectFail === 0, 'All packets injected successfully');
-  assert(injected.length >= 100, `Injected 100+ packets (got ${injected.length})`);
-
-  // Wait a moment for WS messages to arrive
-  await sleep(500);
-
-  // ── Validate ───────────────────────────────────────────────────────
-
-  // 5a. Stats
-  console.log('── Stats ──');
-  const stats = (await get('/api/stats')).data;
-  // totalPackets includes seed packet, so should be >= injected.length
-  assert(stats.totalPackets > 0, `stats.totalPackets (${stats.totalPackets}) >= ${injected.length}`);
-  assert(stats.totalNodes > 0, `stats.totalNodes > 0 (${stats.totalNodes})`);
-  assert(stats.totalObservers >= OBSERVERS.length, `stats.totalObservers >= ${OBSERVERS.length} (${stats.totalObservers})`);
-  console.log(`  totalPackets=${stats.totalPackets} totalNodes=${stats.totalNodes} totalObservers=${stats.totalObservers}\n`);
-
-  // 5b. Packets API - basic list
-  console.log('── Packets API ──');
-  const pktsAll = (await get('/api/packets?limit=200')).data;
-  assert(pktsAll.total > 0, `packets total (${pktsAll.total}) > 0`);
-  assert(pktsAll.packets.length > 0, 'packets array not empty');
-
-  // Filter by type (ADVERT = 4)
-  const pktsAdvert = (await get('/api/packets?type=4&limit=200')).data;
-  assert(pktsAdvert.total > 0, `filter by type=ADVERT returns results (${pktsAdvert.total})`);
-  assert(pktsAdvert.packets.every(p => p.payload_type === 4), 'all filtered packets are ADVERT');
-
-  // Filter by observer
-  const testObs = OBSERVERS[0].id;
-  const pktsObs = (await get(`/api/packets?observer=${testObs}&limit=200`)).data;
-  assert(pktsObs.total > 0, `filter by observer=${testObs} returns results`);
-  assert(pktsObs.packets.length > 0, 'observer filter returns packets');
-
-  // Filter by region
-  const pktsRegion = (await get('/api/packets?region=SJC&limit=200')).data;
-  assert(pktsRegion.total > 0, 'filter by region=SJC returns results');
-
-  // Pagination
-  const page1 = (await get('/api/packets?limit=5&offset=0')).data;
-  const page2 = (await get('/api/packets?limit=5&offset=5')).data;
-  assert(page1.packets.length === 5, 'pagination: page1 has 5');
-  assert(page2.packets.length === 5, 'pagination: page2 has 5');
-  if (page1.packets.length && page2.packets.length) {
-    assert(page1.packets[0].id !== page2.packets[0].id, 'pagination: pages are different');
-  }
-
-  // groupByHash
-  const grouped = (await get('/api/packets?groupByHash=true&limit=200')).data;
-  assert(grouped.total > 0, `groupByHash returns results (${grouped.total})`);
-  assert(grouped.packets[0].hash !== undefined, 'groupByHash entries have hash');
-  assert(grouped.packets[0].count !== undefined, 'groupByHash entries have count');
-  // Find a multi-observer group
-  const multiObs = grouped.packets.find(p => p.observer_count >= 2);
-  assert(!!multiObs, 'groupByHash has entry with observer_count >= 2');
-  console.log('  ✓ Packets API checks passed\n');
-
-  // 5c. Packet detail
-  console.log('── Packet Detail ──');
-  const firstPkt = pktsAll.packets[0];
-  const detail = (await get(`/api/packets/${firstPkt.id}`)).data;
-  assert(detail.packet !== undefined, 'detail has packet');
-  assert(detail.breakdown !== undefined, 'detail has breakdown');
-  assert(detail.breakdown.ranges !== undefined, 'breakdown has ranges');
-  assert(detail.breakdown.ranges.length > 0, 'breakdown has color ranges');
-  assert(detail.breakdown.ranges[0].color !== undefined, 'ranges have color field');
-  assert(detail.breakdown.ranges[0].start !== undefined, 'ranges have start field');
-  console.log(`  ✓ Detail: ${detail.breakdown.ranges.length} color ranges\n`);
-
-  // 5d. Nodes
-  console.log('── Nodes ──');
-  const nodesResp = (await get('/api/nodes?limit=50')).data;
-  assert(nodesResp.total > 0, `nodes total > 0 (${nodesResp.total})`);
-  assert(nodesResp.nodes.length > 0, 'nodes array not empty');
-  assert(nodesResp.counts !== undefined, 'nodes response has counts');
-
-  // Role filtering
-  const repNodes = (await get('/api/nodes?role=repeater')).data;
-  assert(repNodes.nodes.every(n => n.role === 'repeater'), 'role filter works for repeater');
-
-  // Node detail
-  const someNode = nodesResp.nodes[0];
-  const nodeDetail = (await get(`/api/nodes/${someNode.public_key}`)).data;
-  assert(nodeDetail.node !== undefined, 'node detail has node');
-  assert(nodeDetail.node.public_key === someNode.public_key, 'node detail matches pubkey');
-  assert(nodeDetail.recentAdverts !== undefined, 'node detail has recentAdverts');
-  console.log(`  ✓ Nodes: ${nodesResp.total} total, detail works\n`);
-
-  // 5e. Channels
-  console.log('── Channels ──');
-  const chResp = (await get('/api/channels')).data;
-  const chList = chResp.channels || [];
-  assert(Array.isArray(chList), 'channels response is array');
-  if (chList.length > 0) {
-    const someCh = chList[0];
-    assert(someCh.messageCount > 0, `channel has messages (${someCh.messageCount})`);
-    const msgResp = (await get(`/api/channels/${encodeURIComponent(someCh.hash)}/messages`)).data;
-    assert(msgResp.messages.length > 0, 'channel has message list');
-    assert(msgResp.messages[0].sender !== undefined, 'message has sender');
-    console.log(`  ✓ Channels: ${chList.length} channels\n`);
-  } else {
-    console.log(`  ⚠ Channels: 0 (synthetic packets don't produce decodable channel messages)\n`);
-  }
-
-  // 5f. Observers
-  console.log('── Observers ──');
-  const obsResp = (await get('/api/observers')).data;
-  assert(obsResp.observers.length >= OBSERVERS.length, `observers >= ${OBSERVERS.length} (${obsResp.observers.length})`);
-  for (const expObs of OBSERVERS) {
-    const found = obsResp.observers.find(o => o.id === expObs.id);
-    assert(!!found, `observer ${expObs.id} exists`);
-    if (found) {
-      assert(found.packet_count > 0, `observer ${expObs.id} has packet_count > 0 (${found.packet_count})`);
-    }
-  }
-  console.log(`  ✓ Observers: ${obsResp.observers.length}\n`);
-
-  // 5g. Traces
-  console.log('── Traces ──');
-  if (traceHash) {
-    const traceResp = (await get(`/api/traces/${traceHash}`)).data;
-    assert(Array.isArray(traceResp.traces), 'trace response is array');
-    if (traceResp.traces.length >= 2) {
-      const traceObservers = new Set(traceResp.traces.map(t => t.observer));
-      assert(traceObservers.size >= 2, `trace has >= 2 distinct observers (${traceObservers.size})`);
-    }
-    console.log(`  ✓ Traces: ${traceResp.traces.length} entries for hash\n`);
-  } else {
-    console.log('  ⚠ No multi-observer hash available for trace test\n');
-  }
-
-  // 5h. WebSocket
-  console.log('── WebSocket ──');
-  assert(wsMessages.length > 0, `WebSocket received messages (${wsMessages.length})`);
-  assert(wsMessages.length >= injected.length * 0.5, `WS got >= 50% of injected (${wsMessages.length}/${injected.length})`);
-  const wsPacketMsgs = wsMessages.filter(m => m.type === 'packet');
-  assert(wsPacketMsgs.length > 0, 'WS has packet-type messages');
-  console.log(`  ✓ WebSocket: ${wsMessages.length} messages received\n`);
-
-  // 6. MQTT (optional)
-  console.log('── MQTT ──');
-  let mqttAvailable = false;
-  try {
-    execSync('which mosquitto_pub', { stdio: 'ignore' });
-    mqttAvailable = true;
-  } catch {}
-
-  if (mqttAvailable) {
-    console.log('  mosquitto_pub found, testing MQTT path...');
-    // Would need a running mosquitto broker — skip if not running
-    try {
-      const mqttMod = require('mqtt');
-      const mc = mqttMod.connect('mqtt://localhost:1883', { connectTimeout: 2000 });
-      await new Promise((resolve, reject) => {
-        mc.on('connect', resolve);
-        mc.on('error', reject);
-        setTimeout(() => reject(new Error('timeout')), 2000);
-      });
-      const mqttHex = buildAdvert('MQTTTestNode', 'repeater').toString('hex').toUpperCase();
-      const mqttHash = 'mqtt-test-hash-001';
-      mc.publish('meshcore/SJC/MQTT-OBS-1/packets', JSON.stringify({
-        raw: mqttHex, SNR: 8.0, RSSI: -75, hash: mqttHash,
-      }));
-      await sleep(1000);
-      mc.end();
-      const mqttTrace = (await get(`/api/traces/${mqttHash}`)).data;
-      assert(mqttTrace.traces.length >= 1, 'MQTT packet appeared in traces');
-      console.log('  ✓ MQTT path works\n');
-    } catch (e) {
-      console.log(`  ⚠ MQTT broker not reachable: ${e.message}\n`);
-    }
-  } else {
-    console.log('  ⚠ mosquitto not available, skipping MQTT test\n');
-  }
-
-  // 7. Summary
-  ws.close();
-  cleanup();
-
-  console.log('═══════════════════════════════════════');
-  console.log(`  PASSED: ${passed}`);
-  console.log(`  FAILED: ${failed}`);
-  if (failures.length) {
-    console.log('  Failures:');
-    failures.forEach(f => console.log(`    - ${f}`));
-  }
-  console.log('═══════════════════════════════════════');
-
-  process.exit(failed > 0 ? 1 : 0);
-}
-
-main().catch(e => {
-  console.error('Fatal:', e);
-  process.exit(1);
-});

tools/frontend-test.js

@@ -1,320 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-
-/**
- * MeshCore Analyzer — Frontend Smoke Tests (M13)
- *
- * Starts the server with a temp DB, injects synthetic packets,
- * then validates HTML pages, JS syntax, and API data shapes.
- */
-
-const { spawn } = require('child_process');
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-const crypto = require('crypto');
-
-const PROJECT_DIR = path.join(__dirname, '..');
-const PORT = 13580;
-const BASE = `http://localhost:${PORT}`;
-
-// ── Helpers ──────────────────────────────────────────────────────────
-
-let passed = 0, failed = 0;
-const failures = [];
-
-function assert(cond, label) {
-  if (cond) { passed++; }
-  else { failed++; failures.push(label); console.error(`  ❌ FAIL: ${label}`); }
-}
-
-function sleep(ms) { return new Promise(r => setTimeout(r, ms)); }
-
-async function get(urlPath) {
-  const r = await fetch(`${BASE}${urlPath}`);
-  return { status: r.status, data: await r.json() };
-}
-
-async function getHtml(urlPath) {
-  const r = await fetch(`${BASE}${urlPath}`);
-  return { status: r.status, text: await r.text() };
-}
-
-async function post(urlPath, body) {
-  const r = await fetch(`${BASE}${urlPath}`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify(body),
-  });
-  return { status: r.status, data: await r.json() };
-}
-
-// ── Packet builders (from e2e-test.js) ───────────────────────────────
-
-function rand(a, b) { return Math.random() * (b - a) + a; }
-function randInt(a, b) { return Math.floor(rand(a, b + 1)); }
-function pick(a) { return a[randInt(0, a.length - 1)]; }
-
-function pubkeyFor(name) {
-  return crypto.createHash('sha256').update(name).digest();
-}
-
-function encodeHeader(routeType, payloadType, ver = 0) {
-  return (routeType & 0x03) | ((payloadType & 0x0F) << 2) | ((ver & 0x03) << 6);
-}
-
-function buildPath(hopCount, hashSize = 2) {
-  const pathByte = ((hashSize - 1) << 6) | (hopCount & 0x3F);
-  const hops = crypto.randomBytes(hashSize * hopCount);
-  return { pathByte, hops };
-}
-
-function buildAdvert(name, role) {
-  const pubKey = pubkeyFor(name);
-  const ts = Buffer.alloc(4); ts.writeUInt32LE(Math.floor(Date.now() / 1000));
-  const sig = crypto.randomBytes(64);
-  let flags = 0x80 | 0x10;
-  if (role === 'repeater') flags |= 0x02;
-  else if (role === 'room') flags |= 0x04;
-  else if (role === 'sensor') flags |= 0x08;
-  else flags |= 0x01;
-  const nameBuf = Buffer.from(name, 'utf8');
-  const appdata = Buffer.alloc(9 + nameBuf.length);
-  appdata[0] = flags;
-  appdata.writeInt32LE(Math.round(37.34 * 1e6), 1);
-  appdata.writeInt32LE(Math.round(-121.89 * 1e6), 5);
-  nameBuf.copy(appdata, 9);
-  const payload = Buffer.concat([pubKey, ts, sig, appdata]);
-  const header = encodeHeader(1, 0x04, 0);
-  const { pathByte, hops } = buildPath(randInt(0, 3));
-  return Buffer.concat([Buffer.from([header, pathByte]), hops, payload]);
-}
-
-function buildGrpTxt(channelHash = 0) {
-  const mac = crypto.randomBytes(2);
-  const enc = crypto.randomBytes(randInt(10, 40));
-  const payload = Buffer.concat([Buffer.from([channelHash]), mac, enc]);
-  const header = encodeHeader(1, 0x05, 0);
-  const { pathByte, hops } = buildPath(randInt(0, 3));
-  return Buffer.concat([Buffer.from([header, pathByte]), hops, payload]);
-}
-
-function buildAck() {
-  const payload = crypto.randomBytes(18);
-  const header = encodeHeader(2, 0x03, 0);
-  const { pathByte, hops } = buildPath(randInt(0, 2));
-  return Buffer.concat([Buffer.from([header, pathByte]), hops, payload]);
-}
-
-// ── Main ─────────────────────────────────────────────────────────────
-
-const OBSERVERS = [
-  { id: 'FE-SJC-1', iata: 'SJC' },
-  { id: 'FE-SFO-2', iata: 'SFO' },
-];
-
-const NODE_NAMES = ['FENode Alpha', 'FENode Beta', 'FENode Gamma', 'FENode Delta'];
-
-async function main() {
-  // 1. Temp DB
-  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'meshcore-fe-'));
-  const dbPath = path.join(tmpDir, 'test.db');
-  console.log(`Temp DB: ${dbPath}`);
-
-  // 2. Start server
-  console.log('Starting server...');
-  const srv = spawn('node', ['server.js'], {
-    cwd: PROJECT_DIR,
-    env: { ...process.env, DB_PATH: dbPath, PORT: String(PORT) },
-    stdio: ['ignore', 'pipe', 'pipe'],
-  });
-
-  let serverOutput = '';
-  srv.stdout.on('data', d => { serverOutput += d; });
-  srv.stderr.on('data', d => { serverOutput += d; });
-
-  const cleanup = () => {
-    try { srv.kill('SIGTERM'); } catch {}
-    try { fs.unlinkSync(dbPath); fs.rmdirSync(tmpDir); } catch {}
-  };
-
-  process.on('SIGINT', () => { cleanup(); process.exit(1); });
-
-  // 3. Wait for ready
-  let ready = false;
-  for (let i = 0; i < 30; i++) {
-    await sleep(500);
-    try {
-      const r = await fetch(`${BASE}/api/stats`);
-      if (r.ok) { ready = true; break; }
-    } catch {}
-  }
-  if (!ready) {
-    console.error('Server did not start. Output:', serverOutput);
-    cleanup();
-    process.exit(1);
-  }
-  console.log('Server ready.\n');
-
-  // 4. Inject test data
-  const injected = [];
-  const roles = ['repeater', 'room', 'companion', 'sensor'];
-  for (let i = 0; i < NODE_NAMES.length; i++) {
-    const buf = buildAdvert(NODE_NAMES[i], roles[i]);
-    const hex = buf.toString('hex').toUpperCase();
-    const hash = crypto.createHash('md5').update(hex).digest('hex').slice(0, 16);
-    const obs = OBSERVERS[i % OBSERVERS.length];
-    injected.push({ hex, observer: obs.id, region: obs.iata, hash, snr: 5.0, rssi: -80 });
-  }
-  for (let i = 0; i < 20; i++) {
-    const buf = buildGrpTxt(i % 3);
-    const hex = buf.toString('hex').toUpperCase();
-    const hash = crypto.createHash('md5').update(hex).digest('hex').slice(0, 16);
-    const obs = pick(OBSERVERS);
-    injected.push({ hex, observer: obs.id, region: obs.iata, hash, snr: 3.0, rssi: -90 });
-  }
-  for (let i = 0; i < 10; i++) {
-    const buf = buildAck();
-    const hex = buf.toString('hex').toUpperCase();
-    const hash = crypto.createHash('md5').update(hex).digest('hex').slice(0, 16);
-    const obs = pick(OBSERVERS);
-    injected.push({ hex, observer: obs.id, region: obs.iata, hash, snr: 1.0, rssi: -95 });
-  }
-
-  console.log(`Injecting ${injected.length} packets...`);
-  let injectFail = 0;
-  for (const pkt of injected) {
-    const r = await post('/api/packets', pkt);
-    if (r.status !== 200) injectFail++;
-  }
-  assert(injectFail === 0, `All ${injected.length} packets injected`);
-  console.log(`Injected: ${injected.length - injectFail} ok, ${injectFail} fail\n`);
-
-  // ── HTML & Nav Tests ───────────────────────────────────────────────
-  console.log('── HTML & Navigation ──');
-  const { status: htmlStatus, text: html } = await getHtml('/');
-  assert(htmlStatus === 200, 'index.html returns 200');
-  assert(html.includes('<nav'), 'index.html contains <nav>');
-
-  const expectedLinks = ['#/packets', '#/map', '#/channels', '#/nodes', '#/traces', '#/observers'];
-  for (const link of expectedLinks) {
-    assert(html.includes(`href="${link}"`), `nav contains link to ${link}`);
-  }
-
-  // ── JS File References ─────────────────────────────────────────────
-  console.log('\n── JS File References ──');
-  const jsFiles = ['app.js', 'packets.js', 'map.js', 'channels.js', 'nodes.js', 'traces.js', 'observers.js'];
-  for (const jsFile of jsFiles) {
-    assert(html.includes(`src="${jsFile}`) || html.includes(`src="${jsFile}?`), `index.html references ${jsFile}`);
-  }
-
-  // ── JS Syntax Validation ───────────────────────────────────────────
-  console.log('\n── JS Syntax Validation ──');
-  for (const jsFile of jsFiles) {
-    const jsPath = path.join(PROJECT_DIR, 'public', jsFile);
-    try {
-      const source = fs.readFileSync(jsPath, 'utf8');
-      // Use the vm module's Script to check for syntax errors
-      new (require('vm')).Script(source, { filename: jsFile });
-      assert(true, `${jsFile} has valid syntax`);
-    } catch (e) {
-      assert(false, `${jsFile} syntax error: ${e.message}`);
-    }
-  }
-
-  // ── JS Files Fetchable from Server ─────────────────────────────────
-  console.log('\n── JS Files Served ──');
-  for (const jsFile of jsFiles) {
-    const resp = await getHtml(`/${jsFile}`);
-    assert(resp.status === 200, `${jsFile} served with 200`);
-    assert(resp.text.length > 0, `${jsFile} is non-empty`);
-  }
-
-  // ── API Data Shape Validation ──────────────────────────────────────
-  console.log('\n── API: /api/stats ──');
-  const stats = (await get('/api/stats')).data;
-  assert(typeof stats.totalPackets === 'number', 'stats.totalPackets is number');
-  assert(typeof stats.totalNodes === 'number', 'stats.totalNodes is number');
-  assert(typeof stats.totalObservers === 'number', 'stats.totalObservers is number');
-  assert(stats.totalPackets > 0, `stats.totalPackets > 0 (${stats.totalPackets})`);
-
-  console.log('\n── API: /api/packets (packets page) ──');
-  const pkts = (await get('/api/packets?limit=10')).data;
-  assert(typeof pkts.total === 'number', 'packets response has total');
-  assert(Array.isArray(pkts.packets), 'packets response has packets array');
-  assert(pkts.packets.length > 0, 'packets array non-empty');
-  const pkt0 = pkts.packets[0];
-  assert(pkt0.id !== undefined, 'packet has id');
-  assert(pkt0.raw_hex !== undefined, 'packet has raw_hex');
-  assert(pkt0.payload_type !== undefined, 'packet has payload_type');
-  assert(pkt0.observer_id !== undefined, 'packet has observer_id');
-
-  // Packet detail (byte breakdown)
-  const detail = (await get(`/api/packets/${pkt0.id}`)).data;
-  assert(detail.packet !== undefined, 'packet detail has packet');
-  assert(detail.breakdown !== undefined, 'packet detail has breakdown');
-  assert(Array.isArray(detail.breakdown.ranges), 'breakdown has ranges array');
-
-  console.log('\n── API: /api/packets?groupByHash (map page) ──');
-  const grouped = (await get('/api/packets?groupByHash=true&limit=10')).data;
-  assert(typeof grouped.total === 'number', 'groupByHash has total');
-  assert(Array.isArray(grouped.packets), 'groupByHash has packets array');
-
-  console.log('\n── API: /api/channels (channels page) ──');
-  const ch = (await get('/api/channels')).data;
-  assert(Array.isArray(ch.channels), 'channels response has channels array');
-  if (ch.channels.length > 0) {
-    assert(ch.channels[0].hash !== undefined, 'channel has hash');
-    assert(ch.channels[0].messageCount !== undefined, 'channel has messageCount');
-    const chMsgs = (await get(`/api/channels/${ch.channels[0].hash}/messages`)).data;
-    assert(Array.isArray(chMsgs.messages || []), 'channel messages is array');
-  } else {
-    console.log('  ⚠ No channels (synthetic packets are not decodable channel messages)');
-  }
-
-  console.log('\n── API: /api/nodes (nodes page) ──');
-  const nodes = (await get('/api/nodes?limit=10')).data;
-  assert(typeof nodes.total === 'number', 'nodes has total');
-  assert(Array.isArray(nodes.nodes), 'nodes has nodes array');
-  assert(nodes.nodes.length > 0, 'nodes non-empty');
-  const n0 = nodes.nodes[0];
-  assert(n0.public_key !== undefined, 'node has public_key');
-  assert(n0.name !== undefined, 'node has name');
-
-  // Node detail
-  const nd = (await get(`/api/nodes/${n0.public_key}`)).data;
-  assert(nd.node !== undefined, 'node detail has node');
-  assert(nd.recentAdverts !== undefined, 'node detail has recentAdverts');
-
-  console.log('\n── API: /api/observers (observers page) ──');
-  const obs = (await get('/api/observers')).data;
-  assert(Array.isArray(obs.observers), 'observers is array');
-  assert(obs.observers.length > 0, 'observers non-empty');
-  assert(obs.observers[0].id !== undefined, 'observer has id');
-  assert(obs.observers[0].packet_count !== undefined, 'observer has packet_count');
-
-  console.log('\n── API: /api/traces (traces page) ──');
-  // Use a known hash from injected packets
-  const knownHash = crypto.createHash('md5').update(injected[0].hex).digest('hex').slice(0, 16);
-  const traces = (await get(`/api/traces/${knownHash}`)).data;
-  assert(Array.isArray(traces.traces), 'traces is array');
-
-  // ── Summary ────────────────────────────────────────────────────────
-  cleanup();
-
-  console.log('\n═══════════════════════════════════════');
-  console.log(`  PASSED: ${passed}`);
-  console.log(`  FAILED: ${failed}`);
-  if (failures.length) {
-    console.log('  Failures:');
-    failures.forEach(f => console.log(`    - ${f}`));
-  }
-  console.log('═══════════════════════════════════════');
-
-  process.exit(failed > 0 ? 1 : 0);
-}
-
-main().catch(e => {
-  console.error('Fatal:', e);
-  process.exit(1);
-});

tools/geofilter-builder.html

@@ -0,0 +1,153 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>GeoFilter Builder</title>
+<link rel="stylesheet" href="https://unpkg.com/leaflet@1.9.4/dist/leaflet.css"/>
+<script src="https://unpkg.com/leaflet@1.9.4/dist/leaflet.js"></script>
+<style>
+  * { box-sizing: border-box; margin: 0; padding: 0; }
+  body { font-family: system-ui, sans-serif; background: #1a1a2e; color: #e0e0e0; height: 100vh; display: flex; flex-direction: column; }
+  header { padding: 12px 16px; background: #0f0f23; border-bottom: 1px solid #333; display: flex; align-items: center; gap: 16px; flex-wrap: wrap; }
+  header h1 { font-size: 1rem; font-weight: 600; color: #4a9eff; white-space: nowrap; }
+  .controls { display: flex; gap: 8px; flex-wrap: wrap; }
+  button { padding: 6px 14px; border: none; border-radius: 6px; cursor: pointer; font-size: 0.85rem; font-weight: 500; }
+  #btnUndo  { background: #333; color: #ccc; }
+  #btnClear { background: #5a2020; color: #ffaaaa; }
+  #btnUndo:hover  { background: #444; }
+  #btnClear:hover { background: #7a2020; }
+  .hint { font-size: 0.8rem; color: #888; margin-left: auto; }
+  #map { flex: 1; }
+  #output-panel { background: #0f0f23; border-top: 1px solid #333; padding: 12px 16px; display: flex; gap: 12px; align-items: flex-start; }
+  #output-panel label { font-size: 0.75rem; color: #888; white-space: nowrap; padding-top: 6px; }
+  #output { flex: 1; background: #111; border: 1px solid #333; border-radius: 6px; padding: 10px 12px; font-family: monospace; font-size: 0.78rem; color: #7ec8e3; white-space: pre; overflow-x: auto; min-height: 54px; max-height: 140px; overflow-y: auto; cursor: text; }
+  #output.empty { color: #555; font-style: italic; }
+  #btnCopy { padding: 6px 14px; background: #1a4a7a; color: #7ec8e3; border-radius: 6px; border: none; cursor: pointer; font-size: 0.85rem; white-space: nowrap; align-self: flex-end; }
+  #btnCopy:hover { background: #2a6aaa; }
+  #btnCopy.copied { background: #1a6a3a; color: #7effa0; }
+  #counter { font-size: 0.8rem; color: #888; padding-top: 6px; white-space: nowrap; }
+  .bufferRow { display: flex; align-items: center; gap: 8px; }
+  .bufferRow label { font-size: 0.85rem; color: #aaa; }
+  .bufferRow input { width: 60px; padding: 5px 8px; background: #222; border: 1px solid #444; border-radius: 6px; color: #eee; font-size: 0.85rem; }
+</style>
+</head>
+<body>
+
+<header>
+  <h1>GeoFilter Builder</h1>
+  <div class="controls">
+    <button id="btnUndo">↩ Undo</button>
+    <button id="btnClear">✕ Clear</button>
+  </div>
+  <div class="bufferRow">
+    <label for="bufferKm">Buffer km:</label>
+    <input type="number" id="bufferKm" value="20" min="0" max="500"/>
+  </div>
+  <span class="hint">Click on the map to add polygon points</span>
+</header>
+
+<div id="map"></div>
+
+<div id="output-panel">
+  <label>config.json</label>
+  <div id="output" class="empty">Add at least 3 points to generate config…</div>
+  <div style="display:flex;flex-direction:column;gap:8px;align-items:flex-end">
+    <span id="counter">0 points</span>
+    <button id="btnCopy">Copy</button>
+  </div>
+</div>
+
+<script>
+const map = L.map('map').setView([50.5, 4.4], 8);
+
+L.tileLayer('https://{s}.basemaps.cartocdn.com/dark_all/{z}/{x}/{y}{r}.png', {
+  attribution: '© OpenStreetMap © CartoDB',
+  maxZoom: 19
+}).addTo(map);
+
+let points = [];
+let markers = [];
+let polygon = null;
+let closingLine = null;
+
+function latLonPair(latlng) {
+  return [parseFloat(latlng.lat.toFixed(6)), parseFloat(latlng.lng.toFixed(6))];
+}
+
+function render() {
+  // Remove existing polygon and closing line
+  if (polygon) { map.removeLayer(polygon); polygon = null; }
+  if (closingLine) { map.removeLayer(closingLine); closingLine = null; }
+
+  if (points.length >= 3) {
+    polygon = L.polygon(points, {
+      color: '#4a9eff', weight: 2, fillColor: '#4a9eff', fillOpacity: 0.12
+    }).addTo(map);
+  } else if (points.length === 2) {
+    closingLine = L.polyline(points, { color: '#4a9eff', weight: 2, dashArray: '5,5' }).addTo(map);
+  }
+
+  updateOutput();
+}
+
+function updateOutput() {
+  const el = document.getElementById('output');
+  const counter = document.getElementById('counter');
+  counter.textContent = points.length + ' point' + (points.length !== 1 ? 's' : '');
+
+  if (points.length < 3) {
+    el.textContent = 'Add at least 3 points to generate config…';
+    el.classList.add('empty');
+    return;
+  }
+  el.classList.remove('empty');
+
+  const bufferKm = parseFloat(document.getElementById('bufferKm').value) || 0;
+  const config = { bufferKm, polygon: points };
+  el.textContent = JSON.stringify({ geo_filter: config }, null, 2);
+}
+
+map.on('click', function(e) {
+  const pt = latLonPair(e.latlng);
+  points.push(pt);
+
+  const idx = points.length;
+  const marker = L.circleMarker(e.latlng, {
+    radius: 6, color: '#4a9eff', weight: 2, fillColor: '#4a9eff', fillOpacity: 0.9
+  }).addTo(map).bindTooltip(String(idx), { permanent: true, direction: 'top', offset: [0, -8], className: 'pt-label' });
+  markers.push(marker);
+
+  render();
+});
+
+document.getElementById('btnUndo').addEventListener('click', function() {
+  if (!points.length) return;
+  points.pop();
+  const m = markers.pop();
+  if (m) map.removeLayer(m);
+  render();
+});
+
+document.getElementById('btnClear').addEventListener('click', function() {
+  points = [];
+  markers.forEach(m => map.removeLayer(m));
+  markers = [];
+  render();
+});
+
+document.getElementById('bufferKm').addEventListener('input', updateOutput);
+
+document.getElementById('btnCopy').addEventListener('click', function() {
+  if (points.length < 3) return;
+  const text = document.getElementById('output').textContent;
+  navigator.clipboard.writeText(text).then(() => {
+    const btn = document.getElementById('btnCopy');
+    btn.textContent = 'Copied!';
+    btn.classList.add('copied');
+    setTimeout(() => { btn.textContent = 'Copy'; btn.classList.remove('copied'); }, 2000);
+  });
+});
+</script>
+</body>
+</html>