merge master + fix flaky E2E packet detail tests

- Merge latest master (concurrent E2E + coverage, Playwright install split) - Fix 'Packets clicking row shows detail pane' and 'Packet detail pane closes on ✕ click' E2E tests: wait for networkidle before interacting with table rows, and use waitForResponse to ensure the /packets/{hash} API call completes before asserting panel state. The row click triggers an async fetch that was silently failing in CI due to race conditions.
perf: speed up frontend coverage tests (~3x faster)
2026-03-30 15:55:49 +00:00 · 2026-03-29 16:17:41 +00:00 · 2026-03-29 09:12:23 -07:00 · 2026-03-29 16:02:25 +00:00 · 2026-03-29 15:38:02 +00:00 · 2026-03-29 08:32:37 -07:00
17 changed files with 443 additions and 236 deletions
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -10,11 +10,6 @@ on:
      - 'docs/**'
  pull_request:
    branches: [master]
-    paths-ignore:
-      - '**.md'
-      - 'LICENSE'
-      - '.gitignore'
-      - 'docs/**'

 concurrency:
  group: deploy-${{ github.event.pull_request.number || github.ref }}
@@ -41,10 +36,25 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Skip if docs-only change
+        id: docs-check
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            CHANGED=$(git diff --name-only origin/${{ github.base_ref }}...HEAD)
+            NON_DOCS=$(echo "$CHANGED" | grep -cvE '\.(md)$|^LICENSE$|^\.gitignore$|^docs/' || true)
+            if [ "$NON_DOCS" -eq 0 ]; then
+              echo "docs_only=true" >> $GITHUB_OUTPUT
+              echo "📄 Docs-only PR — skipping heavy CI"
+            fi
+          fi

      - name: Set up Go 1.22
-        uses: actions/setup-go@v5
+        if: steps.docs-check.outputs.docs_only != 'true'
+        uses: actions/setup-go@v6
        with:
          go-version: '1.22'
          cache-dependency-path: |
@@ -52,6 +62,7 @@ jobs:
            cmd/ingestor/go.sum

      - name: Build and test Go server (with coverage)
+        if: steps.docs-check.outputs.docs_only != 'true'
        run: |
          set -e -o pipefail
          cd cmd/server
@@ -61,6 +72,7 @@ jobs:
          go tool cover -func=server-coverage.out | tail -1

      - name: Build and test Go ingestor (with coverage)
+        if: steps.docs-check.outputs.docs_only != 'true'
        run: |
          set -e -o pipefail
          cd cmd/ingestor
@@ -70,6 +82,7 @@ jobs:
          go tool cover -func=ingestor-coverage.out | tail -1

      - name: Verify proto syntax (all .proto files compile)
+        if: steps.docs-check.outputs.docs_only != 'true'
        run: |
          set -e
          echo "Installing protoc..."
@@ -84,7 +97,7 @@ jobs:
          echo "✅ All .proto files are syntactically valid"

      - name: Generate Go coverage badges
-        if: always()
+        if: always() && steps.docs-check.outputs.docs_only != 'true'
        run: |
          mkdir -p .badges

@@ -122,9 +135,16 @@ jobs:
          echo "| Server | ${SERVER_COV}% |" >> $GITHUB_STEP_SUMMARY
          echo "| Ingestor | ${INGESTOR_COV}% |" >> $GITHUB_STEP_SUMMARY

+      - name: Cancel workflow on failure
+        if: failure()
+        run: |
+          curl -s -X POST \
+            -H "Authorization: Bearer ${{ github.token }}" \
+            "https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/cancel"
+
      - name: Upload Go coverage badges
        if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
        with:
          name: go-badges
          path: .badges/go-*.json
@@ -136,22 +156,40 @@ jobs:
  # ───────────────────────────────────────────────────────────────
  node-test:
    name: "🧪 Node.js Tests"
-    runs-on: self-hosted
+    runs-on: [self-hosted, Linux]
+    defaults:
+      run:
+        shell: bash
    steps:
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
        with:
-          fetch-depth: 2
+          fetch-depth: 0
+
+      - name: Skip if docs-only change
+        id: docs-check
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            CHANGED=$(git diff --name-only origin/${{ github.base_ref }}...HEAD)
+            NON_DOCS=$(echo "$CHANGED" | grep -cvE '\.(md)$|^LICENSE$|^\.gitignore$|^docs/' || true)
+            if [ "$NON_DOCS" -eq 0 ]; then
+              echo "docs_only=true" >> $GITHUB_OUTPUT
+              echo "📄 Docs-only PR — skipping heavy CI"
+            fi
+          fi

      - name: Set up Node.js 22
-        uses: actions/setup-node@v4
+        if: steps.docs-check.outputs.docs_only != 'true'
+        uses: actions/setup-node@v5
        with:
          node-version: '22'

      - name: Install npm dependencies
+        if: steps.docs-check.outputs.docs_only != 'true'
        run: npm ci --production=false

      - name: Detect changed files
+        if: steps.docs-check.outputs.docs_only != 'true'
        id: changes
        run: |
          BACKEND=$(git diff --name-only HEAD~1 | grep -cE '^(server|db|decoder|packet-store|server-helpers|iata-coords)\.js$' || true)
@@ -167,7 +205,7 @@ jobs:
          echo "Changes: backend=$BACKEND frontend=$FRONTEND tests=$TESTS ci=$CI"

      - name: Run backend tests with coverage
-        if: steps.changes.outputs.backend == 'true'
+        if: steps.docs-check.outputs.docs_only != 'true' && steps.changes.outputs.backend == 'true'
        run: |
          npx c8 --reporter=text-summary --reporter=text sh test-all.sh 2>&1 | tee test-output.txt
          
@@ -185,19 +223,23 @@ jobs:
          echo "## Backend: ${TOTAL_PASS} tests, ${BE_COVERAGE}% coverage" >> $GITHUB_STEP_SUMMARY

      - name: Run backend tests (quick, no coverage)
-        if: steps.changes.outputs.backend == 'false'
+        if: steps.docs-check.outputs.docs_only != 'true' && steps.changes.outputs.backend == 'false'
        run: npm run test:unit

      - name: Install Playwright browser
-        if: steps.changes.outputs.frontend == 'true'
-        run: npx playwright install chromium --with-deps 2>/dev/null || true
+        if: steps.docs-check.outputs.docs_only != 'true' && steps.changes.outputs.frontend == 'true'
+        run: |
+          # Install chromium (skips download if already cached on self-hosted runner)
+          npx playwright install chromium 2>/dev/null || true
+          # Install system deps only if missing (apt-get is slow)
+          npx playwright install-deps chromium 2>/dev/null || true

      - name: Instrument frontend JS for coverage
-        if: steps.changes.outputs.frontend == 'true'
+        if: steps.docs-check.outputs.docs_only != 'true' && steps.changes.outputs.frontend == 'true'
        run: sh scripts/instrument-frontend.sh

      - name: Start instrumented test server on port 13581
-        if: steps.changes.outputs.frontend == 'true'
+        if: steps.docs-check.outputs.docs_only != 'true' && steps.changes.outputs.frontend == 'true'
        run: |
          # Kill any stale server on 13581
          fuser -k 13581/tcp 2>/dev/null || true
@@ -220,19 +262,32 @@ jobs:
            sleep 1
          done

-      - name: Run Playwright E2E tests
-        if: steps.changes.outputs.frontend == 'true'
-        run: BASE_URL=http://localhost:13581 node test-e2e-playwright.js 2>&1 | tee e2e-output.txt
-
-      - name: Collect frontend coverage report
-        if: always() && steps.changes.outputs.frontend == 'true'
+      - name: Run Playwright E2E + coverage collection concurrently
+        if: steps.docs-check.outputs.docs_only != 'true' && steps.changes.outputs.frontend == 'true'
+        run: |
+          # Run E2E tests and coverage collection in parallel — both use the same server
+          BASE_URL=http://localhost:13581 node test-e2e-playwright.js 2>&1 | tee e2e-output.txt &
+          E2E_PID=$!
+          BASE_URL=http://localhost:13581 node scripts/collect-frontend-coverage.js 2>&1 | tee fe-coverage-output.txt &
+          COV_PID=$!
+
+          # Wait for both — E2E must pass, coverage is best-effort
+          E2E_EXIT=0
+          wait $E2E_PID || E2E_EXIT=$?
+          wait $COV_PID || true
+
+          # Fail if E2E failed
+          [ $E2E_EXIT -ne 0 ] && exit $E2E_EXIT
+          true
+
+      - name: Generate frontend coverage badges
+        if: always() && steps.docs-check.outputs.docs_only != 'true' && steps.changes.outputs.frontend == 'true'
        run: |
-          BASE_URL=http://localhost:13581 node scripts/collect-frontend-coverage.js 2>&1 | tee fe-coverage-output.txt
-          
          E2E_PASS=$(grep -oP '[0-9]+(?=/)' e2e-output.txt | tail -1)
          
          mkdir -p .badges
-          if [ -f .nyc_output/frontend-coverage.json ]; then
+          # Merge E2E + coverage collector data if both exist
+          if [ -f .nyc_output/frontend-coverage.json ] || [ -f .nyc_output/e2e-coverage.json ]; then
            npx nyc report --reporter=text-summary --reporter=text 2>&1 | tee fe-report.txt
            FE_COVERAGE=$(grep 'Statements' fe-report.txt | head -1 | grep -oP '[\d.]+(?=%)' || echo "0")
            FE_COVERAGE=${FE_COVERAGE:-0}
@@ -245,7 +300,7 @@ jobs:
          echo "{\"schemaVersion\":1,\"label\":\"frontend tests\",\"message\":\"${E2E_PASS:-0} E2E passed\",\"color\":\"brightgreen\"}" > .badges/frontend-tests.json

      - name: Stop test server
-        if: always() && steps.changes.outputs.frontend == 'true'
+        if: always() && steps.docs-check.outputs.docs_only != 'true' && steps.changes.outputs.frontend == 'true'
        run: |
          if [ -f .server.pid ]; then
            kill $(cat .server.pid) 2>/dev/null || true
@@ -254,18 +309,29 @@ jobs:
          fi

      - name: Run frontend E2E (quick, no coverage)
-        if: steps.changes.outputs.frontend == 'false'
+        if: steps.docs-check.outputs.docs_only != 'true' && steps.changes.outputs.frontend == 'false'
        run: |
          fuser -k 13581/tcp 2>/dev/null || true
          PORT=13581 node server.js &
          SERVER_PID=$!
-          sleep 5
+          # Wait for server to be ready (up to 15s)
+          for i in $(seq 1 15); do
+            curl -sf http://localhost:13581/api/stats > /dev/null 2>&1 && break
+            sleep 1
+          done
          BASE_URL=http://localhost:13581 node test-e2e-playwright.js || true
          kill $SERVER_PID 2>/dev/null || true

+      - name: Cancel workflow on failure
+        if: failure()
+        run: |
+          curl -s -X POST \
+            -H "Authorization: Bearer ${{ github.token }}" \
+            "https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/cancel"
+
      - name: Upload Node.js test badges
        if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
        with:
          name: node-badges
          path: .badges/
@@ -278,14 +344,14 @@ jobs:
  build:
    name: "🏗️ Build Docker Image"
    if: github.event_name == 'push'
-    needs: [go-test]
-    runs-on: self-hosted
+    needs: [go-test, node-test]
+    runs-on: [self-hosted, Linux]
    steps:
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5

      - name: Set up Node.js 22
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
        with:
          node-version: '22'

@@ -304,10 +370,10 @@ jobs:
    name: "🚀 Deploy Staging"
    if: github.event_name == 'push'
    needs: [build]
-    runs-on: self-hosted
+    runs-on: [self-hosted, Linux]
    steps:
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5

      - name: Start staging on port 82
        run: |
@@ -349,21 +415,21 @@ jobs:
    name: "📝 Publish Badges & Summary"
    if: github.event_name == 'push'
    needs: [deploy]
-    runs-on: self-hosted
+    runs-on: [self-hosted, Linux]
    steps:
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5

      - name: Download Go coverage badges
        continue-on-error: true
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
        with:
          name: go-badges
          path: .badges/

      - name: Download Node.js test badges
        continue-on-error: true
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
        with:
          name: node-badges
          path: .badges/
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@

 > High-performance mesh network analyzer powered by Go. Sub-millisecond packet queries, ~300 MB memory for 56K+ packets, real-time WebSocket broadcast, full channel decryption.

-Self-hosted, open-source MeshCore packet analyzer — a community alternative to the closed-source `analyzer.letsmesh.net`. Collects MeshCore packets via MQTT, decodes them in real time, and presents a full web UI with live packet feed, interactive maps, channel chat, packet tracing, and per-node analytics.
+Self-hosted, open-source MeshCore packet analyzer. Collects MeshCore packets via MQTT, decodes them in real time, and presents a full web UI with live packet feed, interactive maps, channel chat, packet tracing, and per-node analytics.

 ## ⚡ Performance

--- a/cmd/ingestor/decoder.go
+++ b/cmd/ingestor/decoder.go
@@ -72,8 +72,8 @@ type Header struct {

 // TransportCodes are present on TRANSPORT_FLOOD and TRANSPORT_DIRECT routes.
 type TransportCodes struct {
-	NextHop string `json:"nextHop"`
-	LastHop string `json:"lastHop"`
+	Code1 string `json:"code1"`
+	Code2 string `json:"code2"`
 }

 // Path holds decoded path/hop information.
@@ -92,6 +92,8 @@ type AdvertFlags struct {
 	Room        bool `json:"room"`
 	Sensor      bool `json:"sensor"`
 	HasLocation bool `json:"hasLocation"`
+	HasFeat1    bool `json:"hasFeat1"`
+	HasFeat2    bool `json:"hasFeat2"`
 	HasName     bool `json:"hasName"`
 }

@@ -111,6 +113,8 @@ type Payload struct {
 	Lat           *float64     `json:"lat,omitempty"`
 	Lon           *float64     `json:"lon,omitempty"`
 	Name          string       `json:"name,omitempty"`
+	Feat1         *int         `json:"feat1,omitempty"`
+	Feat2         *int         `json:"feat2,omitempty"`
 	BatteryMv     *int         `json:"battery_mv,omitempty"`
 	TemperatureC  *float64     `json:"temperature_c,omitempty"`
 	ChannelHash   int          `json:"channelHash,omitempty"`
@@ -123,6 +127,8 @@ type Payload struct {
 	EphemeralPubKey string     `json:"ephemeralPubKey,omitempty"`
 	PathData      string       `json:"pathData,omitempty"`
 	Tag           uint32       `json:"tag,omitempty"`
+	AuthCode      uint32       `json:"authCode,omitempty"`
+	TraceFlags    *int         `json:"traceFlags,omitempty"`
 	RawHex        string       `json:"raw,omitempty"`
 	Error         string       `json:"error,omitempty"`
 }
@@ -199,14 +205,13 @@ func decodeEncryptedPayload(typeName string, buf []byte) Payload {
 }

 func decodeAck(buf []byte) Payload {
-	if len(buf) < 6 {
+	if len(buf) < 4 {
 		return Payload{Type: "ACK", Error: "too short", RawHex: hex.EncodeToString(buf)}
 	}
+	checksum := binary.LittleEndian.Uint32(buf[0:4])
 	return Payload{
 		Type:      "ACK",
-		DestHash:  hex.EncodeToString(buf[0:1]),
-		SrcHash:   hex.EncodeToString(buf[1:2]),
-		ExtraHash: hex.EncodeToString(buf[2:6]),
+		ExtraHash: fmt.Sprintf("%08x", checksum),
 	}
 }

@@ -231,6 +236,8 @@ func decodeAdvert(buf []byte) Payload {
 	if len(appdata) > 0 {
 		flags := appdata[0]
 		advType := int(flags & 0x0F)
+		hasFeat1 := flags&0x20 != 0
+		hasFeat2 := flags&0x40 != 0
 		p.Flags = &AdvertFlags{
 			Raw:         int(flags),
 			Type:        advType,
@@ -239,6 +246,8 @@ func decodeAdvert(buf []byte) Payload {
 			Room:        advType == 3,
 			Sensor:      advType == 4,
 			HasLocation: flags&0x10 != 0,
+			HasFeat1:    hasFeat1,
+			HasFeat2:    hasFeat2,
 			HasName:     flags&0x80 != 0,
 		}

@@ -252,6 +261,16 @@ func decodeAdvert(buf []byte) Payload {
 			p.Lon = &lon
 			off += 8
 		}
+		if hasFeat1 && len(appdata) >= off+2 {
+			feat1 := int(binary.LittleEndian.Uint16(appdata[off : off+2]))
+			p.Feat1 = &feat1
+			off += 2
+		}
+		if hasFeat2 && len(appdata) >= off+2 {
+			feat2 := int(binary.LittleEndian.Uint16(appdata[off : off+2]))
+			p.Feat2 = &feat2
+			off += 2
+		}
 		if p.Flags.HasName {
 			// Find null terminator to separate name from trailing telemetry bytes
 			nameEnd := len(appdata)
@@ -469,15 +488,22 @@ func decodePathPayload(buf []byte) Payload {
 }

 func decodeTrace(buf []byte) Payload {
-	if len(buf) < 12 {
+	if len(buf) < 9 {
 		return Payload{Type: "TRACE", Error: "too short", RawHex: hex.EncodeToString(buf)}
 	}
-	return Payload{
-		Type:     "TRACE",
-		DestHash: hex.EncodeToString(buf[5:11]),
-		SrcHash:  hex.EncodeToString(buf[11:12]),
-		Tag:      binary.LittleEndian.Uint32(buf[1:5]),
+	tag := binary.LittleEndian.Uint32(buf[0:4])
+	authCode := binary.LittleEndian.Uint32(buf[4:8])
+	flags := int(buf[8])
+	p := Payload{
+		Type:       "TRACE",
+		Tag:        tag,
+		AuthCode:   authCode,
+		TraceFlags: &flags,
 	}
+	if len(buf) > 9 {
+		p.PathData = hex.EncodeToString(buf[9:])
+	}
+	return p
 }

 func decodePayload(payloadType int, buf []byte, channelKeys map[string]string) Payload {
@@ -520,8 +546,7 @@ func DecodePacket(hexString string, channelKeys map[string]string) (*DecodedPack
 	}

 	header := decodeHeader(buf[0])
-	pathByte := buf[1]
-	offset := 2
+	offset := 1

 	var tc *TransportCodes
 	if isTransportRoute(header.RouteType) {
@@ -529,12 +554,18 @@ func DecodePacket(hexString string, channelKeys map[string]string) (*DecodedPack
 			return nil, fmt.Errorf("packet too short for transport codes")
 		}
 		tc = &TransportCodes{
-			NextHop: strings.ToUpper(hex.EncodeToString(buf[offset : offset+2])),
-			LastHop: strings.ToUpper(hex.EncodeToString(buf[offset+2 : offset+4])),
+			Code1: strings.ToUpper(hex.EncodeToString(buf[offset : offset+2])),
+			Code2: strings.ToUpper(hex.EncodeToString(buf[offset+2 : offset+4])),
 		}
 		offset += 4
 	}

+	if offset >= len(buf) {
+		return nil, fmt.Errorf("packet too short (no path byte)")
+	}
+	pathByte := buf[offset]
+	offset++
+
 	path, bytesConsumed := decodePath(pathByte, buf, offset)
 	offset += bytesConsumed

@@ -562,16 +593,24 @@ func ComputeContentHash(rawHex string) string {
 		return rawHex
 	}

-	pathByte := buf[1]
+	headerByte := buf[0]
+	offset := 1
+	if isTransportRoute(int(headerByte & 0x03)) {
+		offset += 4
+	}
+	if offset >= len(buf) {
+		if len(rawHex) >= 16 {
+			return rawHex[:16]
+		}
+		return rawHex
+	}
+	pathByte := buf[offset]
+	offset++
 	hashSize := int((pathByte>>6)&0x3) + 1
 	hashCount := int(pathByte & 0x3F)
 	pathBytes := hashSize * hashCount

-	headerByte := buf[0]
-	payloadStart := 2 + pathBytes
-	if isTransportRoute(int(headerByte & 0x03)) {
-		payloadStart += 4
-	}
+	payloadStart := offset + pathBytes
 	if payloadStart > len(buf) {
 		if len(rawHex) >= 16 {
 			return rawHex[:16]
--- a/cmd/ingestor/decoder_test.go
+++ b/cmd/ingestor/decoder_test.go
@@ -129,7 +129,8 @@ func TestDecodePath3ByteHashes(t *testing.T) {

 func TestTransportCodes(t *testing.T) {
 	// Route type 0 (TRANSPORT_FLOOD) should have transport codes
-	hex := "1400" + "AABB" + "CCDD" + "1A" + strings.Repeat("00", 10)
+	// Firmware order: header + transport_codes(4) + path_len + path + payload
+	hex := "14" + "AABB" + "CCDD" + "00" + strings.Repeat("00", 10)
 	pkt, err := DecodePacket(hex, nil)
 	if err != nil {
 		t.Fatal(err)
@@ -140,11 +141,11 @@ func TestTransportCodes(t *testing.T) {
 	if pkt.TransportCodes == nil {
 		t.Fatal("transportCodes should not be nil for TRANSPORT_FLOOD")
 	}
-	if pkt.TransportCodes.NextHop != "AABB" {
-		t.Errorf("nextHop=%s, want AABB", pkt.TransportCodes.NextHop)
+	if pkt.TransportCodes.Code1 != "AABB" {
+		t.Errorf("code1=%s, want AABB", pkt.TransportCodes.Code1)
 	}
-	if pkt.TransportCodes.LastHop != "CCDD" {
-		t.Errorf("lastHop=%s, want CCDD", pkt.TransportCodes.LastHop)
+	if pkt.TransportCodes.Code2 != "CCDD" {
+		t.Errorf("code2=%s, want CCDD", pkt.TransportCodes.Code2)
 	}

 	// Route type 1 (FLOOD) should NOT have transport codes
@@ -537,10 +538,11 @@ func TestDecodeTraceShort(t *testing.T) {

 func TestDecodeTraceValid(t *testing.T) {
 	buf := make([]byte, 16)
-	buf[0] = 0x00
-	buf[1] = 0x01 // tag LE uint32 = 1
-	buf[5] = 0xAA // destHash start
-	buf[11] = 0xBB
+	// tag(4) + authCode(4) + flags(1) + pathData
+	binary.LittleEndian.PutUint32(buf[0:4], 1)          // tag = 1
+	binary.LittleEndian.PutUint32(buf[4:8], 0xDEADBEEF) // authCode
+	buf[8] = 0x02                                         // flags
+	buf[9] = 0xAA                                         // path data
 	p := decodeTrace(buf)
 	if p.Error != "" {
 		t.Errorf("unexpected error: %s", p.Error)
@@ -548,9 +550,18 @@ func TestDecodeTraceValid(t *testing.T) {
 	if p.Tag != 1 {
 		t.Errorf("tag=%d, want 1", p.Tag)
 	}
+	if p.AuthCode != 0xDEADBEEF {
+		t.Errorf("authCode=%d, want 0xDEADBEEF", p.AuthCode)
+	}
+	if p.TraceFlags == nil || *p.TraceFlags != 2 {
+		t.Errorf("traceFlags=%v, want 2", p.TraceFlags)
+	}
 	if p.Type != "TRACE" {
 		t.Errorf("type=%s, want TRACE", p.Type)
 	}
+	if p.PathData == "" {
+		t.Error("pathData should not be empty")
+	}
 }

 func TestDecodeAdvertShort(t *testing.T) {
@@ -833,10 +844,9 @@ func TestComputeContentHashShortHex(t *testing.T) {
 }

 func TestComputeContentHashTransportRoute(t *testing.T) {
-	// Route type 0 (TRANSPORT_FLOOD) with no path hops + 4 transport code bytes
-	// header=0x14 (TRANSPORT_FLOOD, ADVERT), path=0x00 (0 hops)
-	// transport codes = 4 bytes, then payload
-	hex := "1400" + "AABBCCDD" + strings.Repeat("EE", 10)
+	// Route type 0 (TRANSPORT_FLOOD) with transport codes then path=0x00 (0 hops)
+	// header=0x14 (TRANSPORT_FLOOD, ADVERT), transport(4), path=0x00
+	hex := "14" + "AABBCCDD" + "00" + strings.Repeat("EE", 10)
 	hash := ComputeContentHash(hex)
 	if len(hash) != 16 {
 		t.Errorf("hash length=%d, want 16", len(hash))
@@ -870,12 +880,10 @@ func TestComputeContentHashPayloadBeyondBufferLongHex(t *testing.T) {

 func TestComputeContentHashTransportBeyondBuffer(t *testing.T) {
 	// Transport route (0x00 = TRANSPORT_FLOOD) with path claiming some bytes
-	// total buffer too short for transport codes + path
-	// header=0x00, pathByte=0x02 (2 hops, 1-byte hash), then only 2 more bytes
-	// payloadStart = 2 + 2 + 4(transport) = 8, but buffer only 6 bytes
-	hex := "0002" + "AABB" + strings.Repeat("CC", 6) // 20 chars = 10 bytes
+	// header=0x00, transport(4), pathByte=0x02 (2 hops, 1-byte hash)
+	// offset=1+4+1+2=8, buffer needs to be >= 8
+	hex := "00" + "AABB" + "CCDD" + "02" + strings.Repeat("CC", 6) // 20 chars = 10 bytes  
 	hash := ComputeContentHash(hex)
-	// payloadStart = 2 + 2 + 4 = 8, buffer is 10 bytes → should work
 	if len(hash) != 16 {
 		t.Errorf("hash length=%d, want 16", len(hash))
 	}
@@ -913,8 +921,8 @@ func TestDecodePacketWithNewlines(t *testing.T) {
 }

 func TestDecodePacketTransportRouteTooShort(t *testing.T) {
-	// TRANSPORT_FLOOD (route=0) but only 3 bytes total → too short for transport codes
-	_, err := DecodePacket("140011", nil)
+	// TRANSPORT_FLOOD (route=0) but only 2 bytes total → too short for transport codes
+	_, err := DecodePacket("1400", nil)
 	if err == nil {
 		t.Error("expected error for transport route with too-short buffer")
 	}
@@ -931,16 +939,19 @@ func TestDecodeAckShort(t *testing.T) {
 }

 func TestDecodeAckValid(t *testing.T) {
-	buf := []byte{0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF}
+	buf := []byte{0xAA, 0xBB, 0xCC, 0xDD}
 	p := decodeAck(buf)
 	if p.Error != "" {
 		t.Errorf("unexpected error: %s", p.Error)
 	}
-	if p.DestHash != "aa" {
-		t.Errorf("destHash=%s, want aa", p.DestHash)
+	if p.ExtraHash != "ddccbbaa" {
+		t.Errorf("extraHash=%s, want ddccbbaa", p.ExtraHash)
 	}
-	if p.ExtraHash != "ccddeeff" {
-		t.Errorf("extraHash=%s, want ccddeeff", p.ExtraHash)
+	if p.DestHash != "" {
+		t.Errorf("destHash should be empty, got %s", p.DestHash)
+	}
+	if p.SrcHash != "" {
+		t.Errorf("srcHash should be empty, got %s", p.SrcHash)
 	}
 }

--- a/cmd/server/decoder.go
+++ b/cmd/server/decoder.go
@@ -54,8 +54,8 @@ type Header struct {

 // TransportCodes are present on TRANSPORT_FLOOD and TRANSPORT_DIRECT routes.
 type TransportCodes struct {
-	NextHop string `json:"nextHop"`
-	LastHop string `json:"lastHop"`
+	Code1 string `json:"code1"`
+	Code2 string `json:"code2"`
 }

 // Path holds decoded path/hop information.
@@ -74,6 +74,8 @@ type AdvertFlags struct {
 	Room        bool `json:"room"`
 	Sensor      bool `json:"sensor"`
 	HasLocation bool `json:"hasLocation"`
+	HasFeat1    bool `json:"hasFeat1"`
+	HasFeat2    bool `json:"hasFeat2"`
 	HasName     bool `json:"hasName"`
 }

@@ -97,6 +99,8 @@ type Payload struct {
 	EphemeralPubKey string       `json:"ephemeralPubKey,omitempty"`
 	PathData        string       `json:"pathData,omitempty"`
 	Tag             uint32       `json:"tag,omitempty"`
+	AuthCode        uint32       `json:"authCode,omitempty"`
+	TraceFlags      *int         `json:"traceFlags,omitempty"`
 	RawHex          string       `json:"raw,omitempty"`
 	Error           string       `json:"error,omitempty"`
 }
@@ -173,14 +177,13 @@ func decodeEncryptedPayload(typeName string, buf []byte) Payload {
 }

 func decodeAck(buf []byte) Payload {
-	if len(buf) < 6 {
+	if len(buf) < 4 {
 		return Payload{Type: "ACK", Error: "too short", RawHex: hex.EncodeToString(buf)}
 	}
+	checksum := binary.LittleEndian.Uint32(buf[0:4])
 	return Payload{
 		Type:      "ACK",
-		DestHash:  hex.EncodeToString(buf[0:1]),
-		SrcHash:   hex.EncodeToString(buf[1:2]),
-		ExtraHash: hex.EncodeToString(buf[2:6]),
+		ExtraHash: fmt.Sprintf("%08x", checksum),
 	}
 }

@@ -205,6 +208,8 @@ func decodeAdvert(buf []byte) Payload {
 	if len(appdata) > 0 {
 		flags := appdata[0]
 		advType := int(flags & 0x0F)
+		hasFeat1 := flags&0x20 != 0
+		hasFeat2 := flags&0x40 != 0
 		p.Flags = &AdvertFlags{
 			Raw:         int(flags),
 			Type:        advType,
@@ -213,6 +218,8 @@ func decodeAdvert(buf []byte) Payload {
 			Room:        advType == 3,
 			Sensor:      advType == 4,
 			HasLocation: flags&0x10 != 0,
+			HasFeat1:    hasFeat1,
+			HasFeat2:    hasFeat2,
 			HasName:     flags&0x80 != 0,
 		}

@@ -226,6 +233,12 @@ func decodeAdvert(buf []byte) Payload {
 			p.Lon = &lon
 			off += 8
 		}
+		if hasFeat1 && len(appdata) >= off+2 {
+			off += 2  // skip feat1 bytes (reserved for future use)
+		}
+		if hasFeat2 && len(appdata) >= off+2 {
+			off += 2  // skip feat2 bytes (reserved for future use)
+		}
 		if p.Flags.HasName {
 			name := string(appdata[off:])
 			name = strings.TrimRight(name, "\x00")
@@ -276,15 +289,22 @@ func decodePathPayload(buf []byte) Payload {
 }

 func decodeTrace(buf []byte) Payload {
-	if len(buf) < 12 {
+	if len(buf) < 9 {
 		return Payload{Type: "TRACE", Error: "too short", RawHex: hex.EncodeToString(buf)}
 	}
-	return Payload{
-		Type:     "TRACE",
-		DestHash: hex.EncodeToString(buf[5:11]),
-		SrcHash:  hex.EncodeToString(buf[11:12]),
-		Tag:      binary.LittleEndian.Uint32(buf[1:5]),
+	tag := binary.LittleEndian.Uint32(buf[0:4])
+	authCode := binary.LittleEndian.Uint32(buf[4:8])
+	flags := int(buf[8])
+	p := Payload{
+		Type:       "TRACE",
+		Tag:        tag,
+		AuthCode:   authCode,
+		TraceFlags: &flags,
 	}
+	if len(buf) > 9 {
+		p.PathData = hex.EncodeToString(buf[9:])
+	}
+	return p
 }

 func decodePayload(payloadType int, buf []byte) Payload {
@@ -327,8 +347,7 @@ func DecodePacket(hexString string) (*DecodedPacket, error) {
 	}

 	header := decodeHeader(buf[0])
-	pathByte := buf[1]
-	offset := 2
+	offset := 1

 	var tc *TransportCodes
 	if isTransportRoute(header.RouteType) {
@@ -336,12 +355,18 @@ func DecodePacket(hexString string) (*DecodedPacket, error) {
 			return nil, fmt.Errorf("packet too short for transport codes")
 		}
 		tc = &TransportCodes{
-			NextHop: strings.ToUpper(hex.EncodeToString(buf[offset : offset+2])),
-			LastHop: strings.ToUpper(hex.EncodeToString(buf[offset+2 : offset+4])),
+			Code1: strings.ToUpper(hex.EncodeToString(buf[offset : offset+2])),
+			Code2: strings.ToUpper(hex.EncodeToString(buf[offset+2 : offset+4])),
 		}
 		offset += 4
 	}

+	if offset >= len(buf) {
+		return nil, fmt.Errorf("packet too short (no path byte)")
+	}
+	pathByte := buf[offset]
+	offset++
+
 	path, bytesConsumed := decodePath(pathByte, buf, offset)
 	offset += bytesConsumed

@@ -367,16 +392,24 @@ func ComputeContentHash(rawHex string) string {
 		return rawHex
 	}

-	pathByte := buf[1]
+	headerByte := buf[0]
+	offset := 1
+	if isTransportRoute(int(headerByte & 0x03)) {
+		offset += 4
+	}
+	if offset >= len(buf) {
+		if len(rawHex) >= 16 {
+			return rawHex[:16]
+		}
+		return rawHex
+	}
+	pathByte := buf[offset]
+	offset++
 	hashSize := int((pathByte>>6)&0x3) + 1
 	hashCount := int(pathByte & 0x3F)
 	pathBytes := hashSize * hashCount

-	headerByte := buf[0]
-	payloadStart := 2 + pathBytes
-	if isTransportRoute(int(headerByte & 0x03)) {
-		payloadStart += 4
-	}
+	payloadStart := offset + pathBytes
 	if payloadStart > len(buf) {
 		if len(rawHex) >= 16 {
 			return rawHex[:16]
--- a/decoder.js
+++ b/decoder.js
@@ -2,8 +2,8 @@
 * MeshCore Packet Decoder
 * Custom implementation — does NOT use meshcore-decoder library (known path_length bug).
 *
- * Packet layout:
- *   [header(1)] [pathLength(1)] [transportCodes?] [path hops] [payload...]
+ * Packet layout (per firmware docs/packet_format.md):
+ *   [header(1)] [transportCodes?(4)] [pathLength(1)] [path hops] [payload...]
 *
 * Header byte (LSB first):
 *   bits 1-0: routeType (0=TRANSPORT_FLOOD, 1=FLOOD, 2=DIRECT, 3=TRANSPORT_DIRECT)
@@ -42,7 +42,7 @@ const PAYLOAD_TYPES = {
  0x0F: 'RAW_CUSTOM',
 };

-// Route types that carry transport codes (nextHop + lastHop, 2 bytes each)
+// Route types that carry transport codes (2x uint16_t, 4 bytes total)
 const TRANSPORT_ROUTES = new Set([0, 3]); // TRANSPORT_FLOOD, TRANSPORT_DIRECT

 // --- Header parsing ---
@@ -94,13 +94,11 @@ function decodeEncryptedPayload(buf) {
  };
 }

-/** ACK: dest(1) + src(1) + ack_hash(4) (per Mesh.cpp) */
+/** ACK: checksum(4) — CRC of message timestamp + text + sender pubkey (per Mesh.cpp createAck) */
 function decodeAck(buf) {
-  if (buf.length < 6) return { error: 'too short', raw: buf.toString('hex') };
+  if (buf.length < 4) return { error: 'too short', raw: buf.toString('hex') };
  return {
-    destHash: buf.subarray(0, 1).toString('hex'),
-    srcHash: buf.subarray(1, 2).toString('hex'),
-    extraHash: buf.subarray(2, 6).toString('hex'),
+    ackChecksum: buf.subarray(0, 4).toString('hex'),
  };
 }

@@ -125,6 +123,8 @@ function decodeAdvert(buf) {
      room: advType === 3,
      sensor: advType === 4,
      hasLocation: !!(flags & 0x10),
+      hasFeat1: !!(flags & 0x20),
+      hasFeat2: !!(flags & 0x40),
      hasName: !!(flags & 0x80),
    };

@@ -134,6 +134,14 @@ function decodeAdvert(buf) {
      result.lon = appdata.readInt32LE(off + 4) / 1e6;
      off += 8;
    }
+    if (result.flags.hasFeat1 && appdata.length >= off + 2) {
+      result.feat1 = appdata.readUInt16LE(off);
+      off += 2;
+    }
+    if (result.flags.hasFeat2 && appdata.length >= off + 2) {
+      result.feat2 = appdata.readUInt16LE(off);
+      off += 2;
+    }
    if (result.flags.hasName) {
      // Find null terminator to separate name from trailing telemetry bytes
      let nameEnd = appdata.length;
@@ -231,7 +239,7 @@ function decodeGrpTxt(buf, channelKeys) {
  return { type: 'GRP_TXT', channelHash, channelHashHex, decryptionStatus: 'no_key', mac, encryptedData };
 }

-/** ANON_REQ: dest(6) + ephemeral_pubkey(32) + MAC(4) + encrypted */
+/** ANON_REQ: dest(1) + ephemeral_pubkey(32) + MAC(2) + encrypted */
 function decodeAnonReq(buf) {
  if (buf.length < 35) return { error: 'too short', raw: buf.toString('hex') };
  return {
@@ -242,7 +250,7 @@ function decodeAnonReq(buf) {
  };
 }

-/** PATH: dest(6) + src(6) + MAC(4) + path_data */
+/** PATH: dest(1) + src(1) + MAC(2) + path_data */
 function decodePath_payload(buf) {
  if (buf.length < 4) return { error: 'too short', raw: buf.toString('hex') };
  return {
@@ -253,14 +261,14 @@ function decodePath_payload(buf) {
  };
 }

-/** TRACE: flags(1) + tag(4) + dest(6) + src(1) */
+/** TRACE: tag(4) + authCode(4) + flags(1) + pathData (per Mesh.cpp onRecvPacket TRACE) */
 function decodeTrace(buf) {
-  if (buf.length < 12) return { error: 'too short', raw: buf.toString('hex') };
+  if (buf.length < 9) return { error: 'too short', raw: buf.toString('hex') };
  return {
-    flags: buf[0],
-    tag: buf.readUInt32LE(1),
-    destHash: buf.subarray(5, 11).toString('hex'),
-    srcHash: buf.subarray(11, 12).toString('hex'),
+    tag: buf.readUInt32LE(0),
+    authCode: buf.subarray(4, 8).toString('hex'),
+    flags: buf[8],
+    pathData: buf.subarray(9).toString('hex'),
  };
 }

@@ -289,20 +297,22 @@ function decodePacket(hexString, channelKeys) {
  if (buf.length < 2) throw new Error('Packet too short (need at least header + pathLength)');

  const header = decodeHeader(buf[0]);
-  const pathByte = buf[1];
-  let offset = 2;
+  let offset = 1;

-  // Transport codes for TRANSPORT_FLOOD / TRANSPORT_DIRECT
+  // Transport codes for TRANSPORT_FLOOD / TRANSPORT_DIRECT — BEFORE path_length per spec
  let transportCodes = null;
  if (TRANSPORT_ROUTES.has(header.routeType)) {
    if (buf.length < offset + 4) throw new Error('Packet too short for transport codes');
    transportCodes = {
-      nextHop: buf.subarray(offset, offset + 2).toString('hex').toUpperCase(),
-      lastHop: buf.subarray(offset + 2, offset + 4).toString('hex').toUpperCase(),
+      code1: buf.subarray(offset, offset + 2).toString('hex').toUpperCase(),
+      code2: buf.subarray(offset + 2, offset + 4).toString('hex').toUpperCase(),
    };
    offset += 4;
  }

+  // Path length byte — AFTER transport codes per spec
+  const pathByte = buf[offset++];
+
  // Path
  const path = decodePath(pathByte, buf, offset);
  offset += path.bytesConsumed;
@@ -386,7 +396,7 @@ module.exports = { decodePacket, validateAdvert, hasNonPrintableChars, ROUTE_TYP

 // --- Tests ---
 if (require.main === module) {
-  console.log('=== Test 1: ADVERT, FLOOD, 5 hops (2-byte hashes), "Test Repeater" ===');
+  console.log('=== Test 1: ADVERT, FLOOD, 5 hops (2-byte hashes), "Kpa Roof Solar" ===');
  const pkt1 = decodePacket(
    '11451000D818206D3AAC152C8A91F89957E6D30CA51F36E28790228971C473B755F244F718754CF5EE4A2FD58D944466E42CDED140C66D0CC590183E32BAF40F112BE8F3F2BDF6012B4B2793C52F1D36F69EE054D9A05593286F78453E56C0EC4A3EB95DDA2A7543FCCC00B939CACC009278603902FC12BCF84B706120526F6F6620536F6C6172'
  );
@@ -402,7 +412,7 @@ if (require.main === module) {
  assert(pkt1.path.hops[0] === '1000', 'first hop should be 1000');
  assert(pkt1.path.hops[1] === 'D818', 'second hop should be D818');
  assert(pkt1.transportCodes === null, 'FLOOD has no transport codes');
-  assert(pkt1.payload.name === 'Test Repeater', 'name should be "Test Repeater"');
+  assert(pkt1.payload.name === 'Kpa Roof Solar', 'name should be "Kpa Roof Solar"');
  console.log('✅ Test 1 passed\n');

  console.log('=== Test 2: ADVERT, FLOOD, 0 hops (zero-path) ===');
--- a/public/index.html
+++ b/public/index.html
@@ -22,9 +22,9 @@
  <meta name="twitter:title" content="CoreScope">
  <meta name="twitter:description" content="Real-time MeshCore LoRa mesh network analyzer — live packet visualization, node tracking, channel decryption, and route analysis.">
  <meta name="twitter:image" content="https://raw.githubusercontent.com/Kpa-clawbot/corescope/master/public/og-image.png">
-  <link rel="stylesheet" href="style.css?v=1774731523">
-  <link rel="stylesheet" href="home.css?v=1774731523">
-  <link rel="stylesheet" href="live.css?v=1774731523">
+  <link rel="stylesheet" href="style.css?v=1774786038">
+  <link rel="stylesheet" href="home.css?v=1774786038">
+  <link rel="stylesheet" href="live.css?v=1774786038">
  <link rel="stylesheet" href="https://unpkg.com/leaflet@1.9.4/dist/leaflet.css"
    integrity="sha256-p4NxAoJBhIIN+hmNHrzRCf9tD/miZyoHS5obTRR9BMY="
    crossorigin="anonymous">
@@ -81,29 +81,29 @@
  <main id="app" role="main"></main>

  <script src="vendor/qrcode.js"></script>
-  <script src="roles.js?v=1774731523"></script>
-  <script src="customize.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="region-filter.js?v=1774731523"></script>
-  <script src="hop-resolver.js?v=1774731523"></script>
-  <script src="hop-display.js?v=1774731523"></script>
-  <script src="app.js?v=1774731523"></script>
-  <script src="home.js?v=1774731523"></script>
-  <script src="packet-filter.js?v=1774731523"></script>
-  <script src="packets.js?v=1774731523"></script>
-  <script src="map.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="channels.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="nodes.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="traces.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="analytics.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="audio.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="audio-v1-constellation.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="audio-v2-constellation.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="audio-lab.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="live.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="observers.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="observer-detail.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="compare.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="node-analytics.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="perf.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="roles.js?v=1774786038"></script>
+  <script src="customize.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="region-filter.js?v=1774786038"></script>
+  <script src="hop-resolver.js?v=1774786038"></script>
+  <script src="hop-display.js?v=1774786038"></script>
+  <script src="app.js?v=1774786038"></script>
+  <script src="home.js?v=1774786038"></script>
+  <script src="packet-filter.js?v=1774786038"></script>
+  <script src="packets.js?v=1774786038"></script>
+  <script src="map.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="channels.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="nodes.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="traces.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="analytics.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="audio.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="audio-v1-constellation.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="audio-v2-constellation.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="audio-lab.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="live.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="observers.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="observer-detail.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="compare.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="node-analytics.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="perf.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
 </body>
 </html>
--- a/public/packets.js
+++ b/public/packets.js
@@ -1512,14 +1512,12 @@
      rows += fieldRow(off + 1, 'Sender', decoded.sender || '—', '');
      if (decoded.sender_timestamp) rows += fieldRow(off + 2, 'Sender Time', decoded.sender_timestamp, '');
    } else if (decoded.type === 'ACK') {
-      rows += fieldRow(off, 'Dest Hash (6B)', decoded.destHash || '', '');
-      rows += fieldRow(off + 6, 'Src Hash (6B)', decoded.srcHash || '', '');
-      rows += fieldRow(off + 12, 'Extra (6B)', decoded.extraHash || '', '');
+      rows += fieldRow(off, 'Checksum (4B)', decoded.ackChecksum || '', '');
    } else if (decoded.destHash !== undefined) {
-      rows += fieldRow(off, 'Dest Hash (6B)', decoded.destHash || '', '');
-      rows += fieldRow(off + 6, 'Src Hash (6B)', decoded.srcHash || '', '');
-      rows += fieldRow(off + 12, 'MAC (4B)', decoded.mac || '', '');
-      rows += fieldRow(off + 16, 'Encrypted Data', truncate(decoded.encryptedData || '', 30), '');
+      rows += fieldRow(off, 'Dest Hash (1B)', decoded.destHash || '', '');
+      rows += fieldRow(off + 1, 'Src Hash (1B)', decoded.srcHash || '', '');
+      rows += fieldRow(off + 2, 'MAC (2B)', decoded.mac || '', '');
+      rows += fieldRow(off + 4, 'Encrypted Data', truncate(decoded.encryptedData || '', 30), '');
    } else {
      rows += fieldRow(off, 'Raw', truncate(buf.slice(off * 2), 40), '');
    }
--- a/public/perf.js
+++ b/public/perf.js
@@ -40,12 +40,12 @@
          html += `<h3>🔧 Go Runtime</h3><div style="display:flex;gap:16px;flex-wrap:wrap;margin:8px 0;">
            <div class="perf-card"><div class="perf-num">${gr.goroutines}</div><div class="perf-label">Goroutines</div></div>
            <div class="perf-card"><div class="perf-num">${gr.numGC}</div><div class="perf-label">GC Collections</div></div>
-            <div class="perf-card"><div class="perf-num" style="color:${gcColor}">${gr.pauseTotalMs}ms</div><div class="perf-label">GC Pause Total</div></div>
-            <div class="perf-card"><div class="perf-num">${gr.lastPauseMs}ms</div><div class="perf-label">Last GC Pause</div></div>
-            <div class="perf-card"><div class="perf-num">${gr.heapAllocMB}MB</div><div class="perf-label">Heap Alloc</div></div>
-            <div class="perf-card"><div class="perf-num">${gr.heapSysMB}MB</div><div class="perf-label">Heap Sys</div></div>
-            <div class="perf-card"><div class="perf-num">${gr.heapInuseMB}MB</div><div class="perf-label">Heap Inuse</div></div>
-            <div class="perf-card"><div class="perf-num">${gr.heapIdleMB}MB</div><div class="perf-label">Heap Idle</div></div>
+            <div class="perf-card"><div class="perf-num" style="color:${gcColor}">${(+gr.pauseTotalMs).toFixed(1)}ms</div><div class="perf-label">GC Pause Total</div></div>
+            <div class="perf-card"><div class="perf-num">${(+gr.lastPauseMs).toFixed(1)}ms</div><div class="perf-label">Last GC Pause</div></div>
+            <div class="perf-card"><div class="perf-num">${(+gr.heapAllocMB).toFixed(1)}MB</div><div class="perf-label">Heap Alloc</div></div>
+            <div class="perf-card"><div class="perf-num">${(+gr.heapSysMB).toFixed(1)}MB</div><div class="perf-label">Heap Sys</div></div>
+            <div class="perf-card"><div class="perf-num">${(+gr.heapInuseMB).toFixed(1)}MB</div><div class="perf-label">Heap Inuse</div></div>
+            <div class="perf-card"><div class="perf-num">${(+gr.heapIdleMB).toFixed(1)}MB</div><div class="perf-label">Heap Idle</div></div>
            <div class="perf-card"><div class="perf-num">${gr.numCPU}</div><div class="perf-label">CPUs</div></div>
            <div class="perf-card"><div class="perf-num">${health.websocket.clients}</div><div class="perf-label">WS Clients</div></div>
          </div>`;
--- a/public/style.css
+++ b/public/style.css
@@ -155,7 +155,7 @@ a:focus-visible, button:focus-visible, input:focus-visible, select:focus-visible
 /* === Nav Stats === */
 .nav-stats {
  display: flex; gap: 12px; align-items: center; font-size: 12px; color: var(--nav-text-muted);
-  font-family: var(--mono); margin-right: 4px;
+  font-family: var(--mono); margin-right: 4px; white-space: nowrap;
 }
 .nav-stats .stat-val { color: var(--nav-text); font-weight: 600; transition: color 0.3s ease; }
 .nav-stats .stat-val.updated { color: var(--accent); }
--- a/scripts/collect-frontend-coverage.js
+++ b/scripts/collect-frontend-coverage.js
@@ -64,9 +64,9 @@ async function collectCoverage() {
  // ══════════════════════════════════════════════
  console.log('  [coverage] Home page — chooser...');
  // Clear localStorage to get chooser
-  await page.goto(BASE, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
+  await page.goto(BASE, { waitUntil: 'domcontentloaded', timeout: 10000 }).catch(() => {});
  await page.evaluate(() => localStorage.clear()).catch(() => {});
-  await page.goto(`${BASE}/#/home`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
+  await page.goto(`${BASE}/#/home`, { waitUntil: 'domcontentloaded', timeout: 10000 }).catch(() => {});

  // Click "I'm new"
  await safeClick('#chooseNew');
@@ -105,7 +105,7 @@ async function collectCoverage() {

  // Switch to experienced mode
  await page.evaluate(() => localStorage.clear()).catch(() => {});
-  await page.goto(`${BASE}/#/home`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
+  await page.goto(`${BASE}/#/home`, { waitUntil: 'domcontentloaded', timeout: 10000 }).catch(() => {});
  await safeClick('#chooseExp');

  // Interact with experienced home page
@@ -120,7 +120,7 @@ async function collectCoverage() {
  // NODES PAGE
  // ══════════════════════════════════════════════
  console.log('  [coverage] Nodes page...');
-  await page.goto(`${BASE}/#/nodes`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
+  await page.goto(`${BASE}/#/nodes`, { waitUntil: 'domcontentloaded', timeout: 10000 }).catch(() => {});

  // Sort by EVERY column
  for (const col of ['name', 'public_key', 'role', 'last_seen', 'advert_count']) {
@@ -168,7 +168,7 @@ async function collectCoverage() {
  try {
    const firstNodeKey = await page.$eval('#nodesBody tr td:nth-child(2)', el => el.textContent.trim());
    if (firstNodeKey) {
-      await page.goto(`${BASE}/#/nodes/${firstNodeKey}`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
+      await page.goto(`${BASE}/#/nodes/${firstNodeKey}`, { waitUntil: 'domcontentloaded', timeout: 10000 }).catch(() => {});

      // Click tabs on detail page
      await clickAll('.tab-btn, [data-tab]', 10);
@@ -191,7 +191,7 @@ async function collectCoverage() {
  try {
    const firstKey = await page.$eval('#nodesBody tr td:nth-child(2)', el => el.textContent.trim()).catch(() => null);
    if (firstKey) {
-      await page.goto(`${BASE}/#/nodes/${firstKey}?scroll=paths`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
+      await page.goto(`${BASE}/#/nodes/${firstKey}?scroll=paths`, { waitUntil: 'domcontentloaded', timeout: 10000 }).catch(() => {});
    }
  } catch {}

@@ -199,7 +199,7 @@ async function collectCoverage() {
  // PACKETS PAGE
  // ══════════════════════════════════════════════
  console.log('  [coverage] Packets page...');
-  await page.goto(`${BASE}/#/packets`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
+  await page.goto(`${BASE}/#/packets`, { waitUntil: 'domcontentloaded', timeout: 10000 }).catch(() => {});

  // Open filter bar
  await safeClick('#filterToggleBtn');
@@ -285,13 +285,13 @@ async function collectCoverage() {
  } catch {}

  // Navigate to specific packet by hash
-  await page.goto(`${BASE}/#/packets/deadbeef`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
+  await page.goto(`${BASE}/#/packets/deadbeef`, { waitUntil: 'domcontentloaded', timeout: 10000 }).catch(() => {});

  // ══════════════════════════════════════════════
  // MAP PAGE
  // ══════════════════════════════════════════════
  console.log('  [coverage] Map page...');
-  await page.goto(`${BASE}/#/map`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
+  await page.goto(`${BASE}/#/map`, { waitUntil: 'domcontentloaded', timeout: 10000 }).catch(() => {});

  // Toggle controls panel
  await safeClick('#mapControlsToggle');
@@ -345,7 +345,7 @@ async function collectCoverage() {
  // ANALYTICS PAGE
  // ══════════════════════════════════════════════
  console.log('  [coverage] Analytics page...');
-  await page.goto(`${BASE}/#/analytics`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
+  await page.goto(`${BASE}/#/analytics`, { waitUntil: 'domcontentloaded', timeout: 10000 }).catch(() => {});

  // Click EVERY analytics tab
  const analyticsTabs = ['overview', 'rf', 'topology', 'channels', 'hashsizes', 'collisions', 'subpaths', 'nodes', 'distance'];
@@ -383,7 +383,7 @@ async function collectCoverage() {

  // Deep-link to each analytics tab via URL
  for (const tab of analyticsTabs) {
-    await page.goto(`${BASE}/#/analytics?tab=${tab}`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
+    await page.goto(`${BASE}/#/analytics?tab=${tab}`, { waitUntil: 'domcontentloaded', timeout: 10000 }).catch(() => {});
  }

  // Region filter on analytics
@@ -396,7 +396,7 @@ async function collectCoverage() {
  // CUSTOMIZE
  // ══════════════════════════════════════════════
  console.log('  [coverage] Customizer...');
-  await page.goto(BASE, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
+  await page.goto(BASE, { waitUntil: 'domcontentloaded', timeout: 10000 }).catch(() => {});
  await safeClick('#customizeToggle');

  // Click EVERY customizer tab
@@ -503,7 +503,7 @@ async function collectCoverage() {
  // CHANNELS PAGE
  // ══════════════════════════════════════════════
  console.log('  [coverage] Channels page...');
-  await page.goto(`${BASE}/#/channels`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
+  await page.goto(`${BASE}/#/channels`, { waitUntil: 'domcontentloaded', timeout: 10000 }).catch(() => {});
  // Click channel rows/items
  await clickAll('.channel-item, .channel-row, .channel-card', 3);
  await clickAll('table tbody tr', 3);
@@ -512,7 +512,7 @@ async function collectCoverage() {
  try {
    const channelHash = await page.$eval('table tbody tr td:first-child', el => el.textContent.trim()).catch(() => null);
    if (channelHash) {
-      await page.goto(`${BASE}/#/channels/${channelHash}`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
+      await page.goto(`${BASE}/#/channels/${channelHash}`, { waitUntil: 'domcontentloaded', timeout: 10000 }).catch(() => {});
    }
  } catch {}

@@ -520,7 +520,7 @@ async function collectCoverage() {
  // LIVE PAGE
  // ══════════════════════════════════════════════
  console.log('  [coverage] Live page...');
-  await page.goto(`${BASE}/#/live`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
+  await page.goto(`${BASE}/#/live`, { waitUntil: 'domcontentloaded', timeout: 10000 }).catch(() => {});

  // VCR controls
  await safeClick('#vcrPauseBtn');
@@ -603,14 +603,14 @@ async function collectCoverage() {
  // TRACES PAGE
  // ══════════════════════════════════════════════
  console.log('  [coverage] Traces page...');
-  await page.goto(`${BASE}/#/traces`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
+  await page.goto(`${BASE}/#/traces`, { waitUntil: 'domcontentloaded', timeout: 10000 }).catch(() => {});
  await clickAll('table tbody tr', 3);

  // ══════════════════════════════════════════════
  // OBSERVERS PAGE
  // ══════════════════════════════════════════════
  console.log('  [coverage] Observers page...');
-  await page.goto(`${BASE}/#/observers`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
+  await page.goto(`${BASE}/#/observers`, { waitUntil: 'domcontentloaded', timeout: 10000 }).catch(() => {});
  // Click observer rows
  const obsRows = await page.$$('table tbody tr, .observer-card, .observer-row');
  for (let i = 0; i < Math.min(obsRows.length, 3); i++) {
@@ -631,7 +631,7 @@ async function collectCoverage() {
  // PERF PAGE
  // ══════════════════════════════════════════════
  console.log('  [coverage] Perf page...');
-  await page.goto(`${BASE}/#/perf`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
+  await page.goto(`${BASE}/#/perf`, { waitUntil: 'domcontentloaded', timeout: 10000 }).catch(() => {});
  await safeClick('#perfRefresh');
  await safeClick('#perfReset');

@@ -641,14 +641,14 @@ async function collectCoverage() {
  console.log('  [coverage] App.js — router + global...');

  // Navigate to bad route to trigger error/404
-  await page.goto(`${BASE}/#/nonexistent-route`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
+  await page.goto(`${BASE}/#/nonexistent-route`, { waitUntil: 'domcontentloaded', timeout: 10000 }).catch(() => {});

  // Navigate to every route via hash
  const allRoutes = ['home', 'nodes', 'packets', 'map', 'live', 'channels', 'traces', 'observers', 'analytics', 'perf'];
  for (const route of allRoutes) {
    try {
      await page.evaluate((r) => { location.hash = '#/' + r; }, route);
-      await page.waitForLoadState('networkidle').catch(() => {});
+      await new Promise(r => setTimeout(r, 200));
    } catch {}
  }

@@ -788,14 +788,14 @@ async function collectCoverage() {
  console.log('  [coverage] Region filter...');
  try {
    // Open region filter on nodes page
-    await page.goto(`${BASE}/#/nodes`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
+    await page.goto(`${BASE}/#/nodes`, { waitUntil: 'domcontentloaded', timeout: 10000 }).catch(() => {});
    await safeClick('#nodesRegionFilter');
    await clickAll('#nodesRegionFilter input[type="checkbox"]', 3);
  } catch {}

  // Region filter on packets
  try {
-    await page.goto(`${BASE}/#/packets`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
+    await page.goto(`${BASE}/#/packets`, { waitUntil: 'domcontentloaded', timeout: 10000 }).catch(() => {});
    await safeClick('#packetsRegionFilter');
    await clickAll('#packetsRegionFilter input[type="checkbox"]', 3);
  } catch {}
@@ -807,7 +807,7 @@ async function collectCoverage() {
  for (const route of allRoutes) {
    try {
      await page.evaluate((r) => { location.hash = '#/' + r; }, route);
-      await page.waitForLoadState('networkidle').catch(() => {});
+      await new Promise(r => setTimeout(r, 200));
    } catch {}
  }

--- a/server.js
+++ b/server.js
@@ -207,6 +207,13 @@ class TTLCache {
      if (key.startsWith(prefix)) this.store.delete(key);
    }
  }
+  debouncedInvalidateBulkHealth() {
+    if (this._bulkHealthTimer) return;
+    this._bulkHealthTimer = setTimeout(() => {
+      this._bulkHealthTimer = null;
+      this.invalidate('bulk-health');
+    }, 30000);
+  }
  debouncedInvalidateAll() {
    if (this._debounceTimer) return;
    this._debounceTimer = setTimeout(() => {
@@ -410,7 +417,7 @@ app.get('/api/perf', (req, res) => {
    avgMs: perfStats.requests ? Math.round(perfStats.totalMs / perfStats.requests * 10) / 10 : 0,
    endpoints: Object.fromEntries(sorted),
    slowQueries: perfStats.slowQueries.slice(-20),
-    cache: { size: cache.size, hits: cache.hits, misses: cache.misses, staleHits: cache.staleHits, recomputes: cache.recomputes, hitRate: cache.hits + cache.misses > 0 ? Math.round(cache.hits / (cache.hits + cache.misses) * 1000) / 10 : 0 },
+    cache: { size: cache.size, hits: cache.hits, misses: cache.misses, staleHits: cache.staleHits, recomputes: cache.recomputes, hitRate: cache.hits + cache.staleHits + cache.misses > 0 ? Math.round((cache.hits + cache.staleHits) / (cache.hits + cache.staleHits + cache.misses) * 1000) / 10 : 0 },
    packetStore: pktStore.getStats(),
    sqlite: (() => {
      try {
@@ -519,7 +526,7 @@ app.get('/api/health', (req, res) => {
      misses: cache.misses,
      staleHits: cache.staleHits,
      recomputes: cache.recomputes,
-      hitRate: cache.hits + cache.misses > 0 ? Math.round(cache.hits / (cache.hits + cache.misses) * 1000) / 10 : 0,
+      hitRate: cache.hits + cache.staleHits + cache.misses > 0 ? Math.round((cache.hits + cache.staleHits) / (cache.hits + cache.staleHits + cache.misses) * 1000) / 10 : 0,
    },
    websocket: {
      clients: wsClients,
@@ -723,7 +730,7 @@ for (const source of mqttSources) {
            // Invalidate this node's caches on advert
            cache.invalidate('node:' + p.pubKey);
            cache.invalidate('health:' + p.pubKey);
-            cache.invalidate('bulk-health');
+            cache.debouncedInvalidateBulkHealth();

            // Cross-reference: if this node's pubkey matches an existing observer, backfill observer name
            if (p.name && p.pubKey) {
--- a/test-decoder-spec.js
+++ b/test-decoder-spec.js
@@ -122,13 +122,14 @@ console.log('── Spec Tests: Transport Codes ──');

 {
  // Route type 0 (TRANSPORT_FLOOD) and 3 (TRANSPORT_DIRECT) should have 4-byte transport codes
-  // Route type 0: header byte = 0bPPPPPP00, e.g. 0x14 = payloadType 5 (GRP_TXT), routeType 0
-  const hex = '1400' + 'AABB' + 'CCDD' + '1A' + '00'.repeat(10); // transport codes + GRP_TXT payload
+  // Route type 0: header=0x14 = payloadType 5 (GRP_TXT), routeType 0 (TRANSPORT_FLOOD)
+  // Format: header(1) + transportCodes(4) + pathByte(1) + payload
+  const hex = '14' + 'AABB' + 'CCDD' + '00' + '1A' + '00'.repeat(10); // transport codes + pathByte + GRP_TXT payload
  const p = decodePacket(hex);
  assertEq(p.header.routeType, 0, 'transport: routeType=0 (TRANSPORT_FLOOD)');
  assert(p.transportCodes !== null, 'transport: transportCodes present for TRANSPORT_FLOOD');
-  assertEq(p.transportCodes.nextHop, 'AABB', 'transport: nextHop');
-  assertEq(p.transportCodes.lastHop, 'CCDD', 'transport: lastHop');
+  assertEq(p.transportCodes.code1, 'AABB', 'transport: code1');
+  assertEq(p.transportCodes.code2, 'CCDD', 'transport: code2');
 }

 {
@@ -257,13 +258,13 @@ console.log('── Spec Tests: Advert Payload ──');

 console.log('── Spec Tests: Encrypted Payload Format ──');

-// NOTE: Spec says v1 encrypted payloads have dest(1) + src(1) + MAC(2) + ciphertext
-// But decoder reads dest(6) + src(6) + MAC(4) + ciphertext
-// This is a known discrepancy — the decoder matches production behavior, not the spec.
-// The spec may describe the firmware's internal addressing while the OTA format differs,
-// or the decoder may be parsing the fields differently. Production data validates the decoder.
+// Spec says v1 encrypted payloads: dest(1)+src(1)+MAC(2)+cipher — decoder matches this.
 {
-  note('Spec says v1 encrypted payloads: dest(1)+src(1)+MAC(2)+cipher, but decoder reads dest(6)+src(6)+MAC(4)+cipher — decoder matches prod data');
+  const hex = '0100' + 'AA' + 'BB' + 'CCDD' + '00'.repeat(10);
+  const p = decodePacket(hex);
+  assertEq(p.payload.destHash, 'aa', 'encrypted payload: dest is 1 byte');
+  assertEq(p.payload.srcHash, 'bb', 'encrypted payload: src is 1 byte');
+  assertEq(p.payload.mac, 'ccdd', 'encrypted payload: MAC is 2 bytes');
 }

 console.log('── Spec Tests: validateAdvert ──');
--- a/test-decoder.js
+++ b/test-decoder.js
@@ -28,22 +28,22 @@ test('FLOOD + ADVERT = 0x11', () => {
 });

 test('TRANSPORT_FLOOD = routeType 0', () => {
-  // 0x00 = TRANSPORT_FLOOD + REQ(0), needs transport codes + 16 byte payload
-  const hex = '0000' + 'AABB' + 'CCDD' + '00'.repeat(16);
+  // header=0x00 (TRANSPORT_FLOOD + REQ), transportCodes=AABB+CCDD, pathByte=0x00, payload
+  const hex = '00' + 'AABB' + 'CCDD' + '00' + '00'.repeat(16);
  const p = decodePacket(hex);
  assert.strictEqual(p.header.routeType, 0);
  assert.strictEqual(p.header.routeTypeName, 'TRANSPORT_FLOOD');
  assert.notStrictEqual(p.transportCodes, null);
-  assert.strictEqual(p.transportCodes.nextHop, 'AABB');
-  assert.strictEqual(p.transportCodes.lastHop, 'CCDD');
+  assert.strictEqual(p.transportCodes.code1, 'AABB');
+  assert.strictEqual(p.transportCodes.code2, 'CCDD');
 });

 test('TRANSPORT_DIRECT = routeType 3', () => {
-  const hex = '0300' + '1122' + '3344' + '00'.repeat(16);
+  const hex = '03' + '1122' + '3344' + '00' + '00'.repeat(16);
  const p = decodePacket(hex);
  assert.strictEqual(p.header.routeType, 3);
  assert.strictEqual(p.header.routeTypeName, 'TRANSPORT_DIRECT');
-  assert.strictEqual(p.transportCodes.nextHop, '1122');
+  assert.strictEqual(p.transportCodes.code1, '1122');
 });

 test('DIRECT = routeType 2, no transport codes', () => {
@@ -358,9 +358,7 @@ test('ACK decode', () => {
  const hex = '0D00' + '00'.repeat(18);
  const p = decodePacket(hex);
  assert.strictEqual(p.payload.type, 'ACK');
-  assert(p.payload.destHash);
-  assert(p.payload.srcHash);
-  assert(p.payload.extraHash);
+  assert(p.payload.ackChecksum);
 });

 test('ACK too short', () => {
@@ -424,9 +422,9 @@ test('TRACE decode', () => {
  const hex = '2500' + '00'.repeat(12);
  const p = decodePacket(hex);
  assert.strictEqual(p.payload.type, 'TRACE');
-  assert.strictEqual(p.payload.flags, 0);
  assert(p.payload.tag !== undefined);
-  assert(p.payload.destHash);
+  assert(p.payload.authCode !== undefined);
+  assert.strictEqual(p.payload.flags, 0);
 });

 test('TRACE too short', () => {
@@ -460,16 +458,18 @@ test('Transport route too short throws', () => {
  assert.throws(() => decodePacket('0000'), /too short for transport/);
 });

-test('Corrupt packet #183 — path overflow capped to buffer', () => {
+test('Corrupt packet #183 — TRANSPORT_DIRECT with correct field order', () => {
  const hex = 'BBAD6797EC8751D500BF95A1A776EF580E665BCBF6A0BBE03B5E730707C53489B8C728FD3FB902397197E1263CEC21E52465362243685DBBAD6797EC8751C90A75D9FD8213155D';
  const p = decodePacket(hex);
  assert.strictEqual(p.header.routeType, 3, 'routeType should be TRANSPORT_DIRECT');
  assert.strictEqual(p.header.payloadTypeName, 'UNKNOWN');
-  // pathByte 0xAD claims 45 hops × 3 bytes = 135, but only 65 bytes available
+  // transport codes are bytes 1-4, pathByte=0x87 at byte 5
+  assert.strictEqual(p.transportCodes.code1, 'AD67');
+  assert.strictEqual(p.transportCodes.code2, '97EC');
+  // pathByte 0x87: hashSize=3, hashCount=7
  assert.strictEqual(p.path.hashSize, 3);
-  assert.strictEqual(p.path.hashCount, 21, 'hashCount capped to fit buffer');
-  assert.strictEqual(p.path.hops.length, 21);
-  assert.strictEqual(p.path.truncated, true);
+  assert.strictEqual(p.path.hashCount, 7);
+  assert.strictEqual(p.path.hops.length, 7);
  // No empty strings in hops
  assert(p.path.hops.every(h => h.length > 0), 'no empty hops');
 });
--- a/test-e2e-playwright.js
+++ b/test-e2e-playwright.js
@@ -354,10 +354,17 @@ async function run() {
  await test('Packets clicking row shows detail pane', async () => {
    // Fresh navigation to avoid stale row references from previous test
    await page.goto(`${BASE}/#/packets`, { waitUntil: 'domcontentloaded' });
+    // Wait for table rows AND initial API data to settle
    await page.waitForSelector('table tbody tr[data-action]', { timeout: 15000 });
+    await page.waitForLoadState('networkidle');
    const firstRow = await page.$('table tbody tr[data-action]');
    assert(firstRow, 'No clickable packet rows found');
-    await firstRow.click();
+    // Click the row and wait for the /packets/{hash} API response
+    const [response] = await Promise.all([
+      page.waitForResponse(resp => resp.url().includes('/packets/') && resp.status() === 200, { timeout: 15000 }),
+      firstRow.click(),
+    ]);
+    assert(response, 'API response for packet detail not received');
    await page.waitForFunction(() => {
      const panel = document.getElementById('pktRight');
      return panel && !panel.classList.contains('empty');
@@ -375,12 +382,16 @@ async function run() {
    if (!pktRight) {
      await page.goto(`${BASE}/#/packets`, { waitUntil: 'domcontentloaded' });
      await page.waitForSelector('table tbody tr[data-action]', { timeout: 15000 });
+      await page.waitForLoadState('networkidle');
    }
    const panelOpen = await page.$eval('#pktRight', el => !el.classList.contains('empty'));
    if (!panelOpen) {
      const firstRow = await page.$('table tbody tr[data-action]');
      if (!firstRow) { console.log('    ⏭️  Skipped (no clickable rows)'); return; }
-      await firstRow.click();
+      await Promise.all([
+        page.waitForResponse(resp => resp.url().includes('/packets/') && resp.status() === 200, { timeout: 15000 }),
+        firstRow.click(),
+      ]);
      await page.waitForFunction(() => {
        const panel = document.getElementById('pktRight');
        return panel && !panel.classList.contains('empty');
@@ -909,6 +920,19 @@ async function run() {
    assert(hexDump, 'Hex dump should be visible after selecting a packet');
  });

+  // Extract frontend coverage if instrumented server is running
+  try {
+    const coverage = await page.evaluate(() => window.__coverage__);
+    if (coverage) {
+      const fs = require('fs');
+      const path = require('path');
+      const outDir = path.join(__dirname, '.nyc_output');
+      if (!fs.existsSync(outDir)) fs.mkdirSync(outDir, { recursive: true });
+      fs.writeFileSync(path.join(outDir, 'e2e-coverage.json'), JSON.stringify(coverage));
+      console.log(`Frontend coverage from E2E: ${Object.keys(coverage).length} files`);
+    }
+  } catch {}
+
  await browser.close();

  // Summary
--- a/test-frontend-helpers.js
+++ b/test-frontend-helpers.js
@@ -1322,7 +1322,7 @@ console.log('\n=== app.js: formatVersionBadge ===');
    assert.ok(result.includes('>v2.6.0</a>'), 'version text has v prefix');
    assert.ok(result.includes(`href="${GH}/commit/abc1234def5678"`), 'commit links to full hash');
    assert.ok(result.includes('>abc1234</a>'), 'commit display is truncated to 7');
-    assert.ok(result.includes('[node]'), 'should show engine');
+    assert.ok(result.includes('engine-badge'), 'should show engine badge'); assert.ok(result.includes('>node<'), 'should show engine name');
  });
  test('prod port 80: shows version', () => {
    const { formatVersionBadge } = makeBadgeSandbox('80');
@@ -1348,7 +1348,7 @@ console.log('\n=== app.js: formatVersionBadge ===');
    assert.ok(!result.includes('v2.6.0'), 'staging should NOT show version');
    assert.ok(result.includes('>abc1234</a>'), 'should show commit hash');
    assert.ok(result.includes(`href="${GH}/commit/abc1234def5678"`), 'commit is linked');
-    assert.ok(result.includes('[go]'), 'should show engine');
+    assert.ok(result.includes('engine-badge'), 'should show engine badge'); assert.ok(result.includes('>go<'), 'should show engine name');
  });
  test('staging port 81: hides version', () => {
    const { formatVersionBadge } = makeBadgeSandbox('81');
@@ -1369,18 +1369,18 @@ console.log('\n=== app.js: formatVersionBadge ===');
    const result = formatVersionBadge('2.6.0', 'unknown', 'node');
    assert.ok(result.includes('>v2.6.0</a>'), 'should show version');
    assert.ok(!result.includes('unknown'), 'should not show unknown commit');
-    assert.ok(result.includes('[node]'), 'should show engine');
+    assert.ok(result.includes('engine-badge'), 'should show engine badge'); assert.ok(result.includes('>node<'), 'should show engine name');
  });
  test('skips commit when missing', () => {
    const { formatVersionBadge } = makeBadgeSandbox('');
    const result = formatVersionBadge('2.6.0', null, 'go');
    assert.ok(result.includes('>v2.6.0</a>'), 'should show version');
-    assert.ok(result.includes('[go]'), 'should show engine');
+    assert.ok(result.includes('engine-badge'), 'should show engine badge'); assert.ok(result.includes('>go<'), 'should show engine name');
  });
  test('shows only engine when version/commit missing', () => {
    const { formatVersionBadge } = makeBadgeSandbox('3000');
    const result = formatVersionBadge(null, null, 'go');
-    assert.ok(result.includes('[go]'), 'should show engine');
+    assert.ok(result.includes('engine-badge'), 'should show engine badge'); assert.ok(result.includes('>go<'), 'should show engine name');
    assert.ok(result.includes('version-badge'), 'should use version-badge class');
  });
  test('short commit not truncated in display', () => {
@@ -1398,7 +1398,7 @@ console.log('\n=== app.js: formatVersionBadge ===');
    const { formatVersionBadge } = makeBadgeSandbox('8080');
    const result = formatVersionBadge('2.6.0', null, 'go');
    assert.ok(!result.includes('2.6.0'), 'no version on staging');
-    assert.ok(result.includes('[go]'), 'engine shown');
+    assert.ok(result.includes('engine-badge'), 'engine badge shown'); assert.ok(result.includes('>go<'), 'engine name shown');
  });
 }

--- a/test-server-routes.js
+++ b/test-server-routes.js
@@ -1254,6 +1254,24 @@ seedTestData();
    lastPathSeenMap.delete(liveNode);
  });

+  // ── Cache hit rate includes stale hits ──
+  await t('Cache hitRate includes staleHits in formula', async () => {
+    cache.clear();
+    cache.hits = 0;
+    cache.misses = 0;
+    cache.staleHits = 0;
+    // Simulate: 3 hits, 2 stale hits, 5 misses => rate = (3+2)/(3+2+5) = 50%
+    cache.hits = 3;
+    cache.staleHits = 2;
+    cache.misses = 5;
+    const r = await request(app).get('/api/health').expect(200);
+    assert(r.body.cache.hitRate === 50, 'hitRate should be (hits+staleHits)/(hits+staleHits+misses) = 50%, got ' + r.body.cache.hitRate);
+    // Reset
+    cache.hits = 0;
+    cache.misses = 0;
+    cache.staleHits = 0;
+  });
+
  // ── Summary ──
  console.log(`\n═══ Server Route Tests: ${passed} passed, ${failed} failed ═══`);
  if (failed > 0) process.exit(1);
Author	SHA1	Message	Date
you	d8f2ef199b	merge master + fix flaky E2E packet detail tests - Merge latest master (concurrent E2E + coverage, Playwright install split) - Fix 'Packets clicking row shows detail pane' and 'Packet detail pane closes on ✕ click' E2E tests: wait for networkidle before interacting with table rows, and use waitForResponse to ensure the /packets/{hash} API call completes before asserting panel state. The row click triggers an async fetch that was silently failing in CI due to race conditions.	2026-03-29 16:17:41 +00:00
you	12d1174e39	perf: speed up frontend coverage tests (~3x faster) Three optimizations to the CI frontend test pipeline: 1. Run E2E tests and coverage collection concurrently - Previously sequential (E2E ~1.5min, then coverage ~5.75min) - Now both run in parallel against the same instrumented server - Expected savings: ~5 min (coverage runs alongside E2E instead of after) 2. Replace networkidle with domcontentloaded in coverage collector - SPA uses hash routing — networkidle waits 500ms for network silence on every navigation, adding ~10-15s of dead time across 23 navigations - domcontentloaded fires immediately once HTML is parsed; JS initializes the route handler synchronously - For in-page hash changes, use 200ms setTimeout instead of waitForLoadState (which would never re-fire for same-document nav) 3. Extract coverage from E2E tests too - E2E tests already exercise the app against the instrumented server - Now writes window.__coverage__ to .nyc_output/e2e-coverage.json - nyc merges both coverage files for higher total coverage Also: - Split Playwright install into browser + deps steps (deps skip if present) - Replace sleep 5 with health-check poll in quick E2E path	2026-03-29 09:12:23 -07:00
Kpa-clawbot	96ed40a3e0	fix: update engine tests to match engine-badge HTML format Tests expected [go]/[node] text but formatVersionBadge now renders <span class="engine-badge">go</span>. Updated 6 assertions to check for engine-badge class and engine name in HTML output.	2026-03-29 16:02:25 +00:00
Kpa-clawbot	fb03fa80cf	merge master + fix CI: add shell:bash for self-hosted runner Resolves merge conflict with master (action version bumps). Adds defaults.run.shell=bash to node-test job to fix PowerShell parse errors on self-hosted runner that defaults to pwsh.	2026-03-29 15:38:02 +00:00
you	3bbd986d41	fix: add sleep before poller data insert to prevent race condition in tests The poller's Start() calls GetMaxTransmissionID() to initialize its cursor. When the test goroutine inserts data between go poller.Start() and the actual GetMaxTransmissionID() call, the poller's cursor skips past the test data and never broadcasts it, causing a timeout. Adding a 100ms sleep after go poller.Start() ensures the poller has initialized its cursors before the test inserts new data.	2026-03-29 08:32:37 -07:00
you	712fa15a8c	fix: force single SQLite connection in test DBs to prevent in-memory table visibility issues SQLite :memory: databases create separate databases per connection. When the connection pool opens multiple connections (e.g. poller goroutine vs main test goroutine), tables created on one connection are invisible to others. Setting MaxOpenConns(1) ensures all queries use the same in-memory database, fixing TestPollerBroadcastsMultipleObservations.	2026-03-29 08:32:37 -07:00
Kpa-clawbot	ab03b142f5	fix: per-observation WS broadcast for live view starburst — fixes #237 IngestNewFromDB now broadcasts one message per observation (not per transmission). IngestNewObservations also broadcasts late arrivals. Tests verify multi-observer packets produce multiple WS messages. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-03-29 08:32:37 -07:00
you	def95aae64	fix: align packet decoder with MeshCore firmware spec Compared decoder.js against the MeshCore firmware source (Dispatcher.cpp, Packet.h, Mesh.cpp, AdvertDataHelpers.h) and fixed all mismatches: 1. Field order: transport codes now parsed BEFORE path_length byte, matching the spec: [header][transport_codes?][path_length][path][payload] 2. ACK payload: was incorrectly decoded as dest(1)+src(1)+ackHash(4). Firmware shows ACK is just checksum(4) — no dest/src hashes. 3. TRACE payload: was incorrectly decoded as flags(1)+tag(4)+dest(6)+src(1). Firmware shows tag(4)+authCode(4)+flags(1)+pathData. 4. ADVERT appdata: added missing feature1 (0x20 flag) and feature2 (0x40 flag) parsing — 2-byte fields between location and name. 5. Transport code field naming: renamed nextHop/lastHop to code1/code2 to match spec terminology (transport_code_1/transport_code_2). 6. Fixed incorrect field size labels in packets.js hex breakdown: dest/src are 1 byte, MAC is 2 bytes (not 6B/6B/4B). 7. Fixed ANON_REQ/PATH comment typos (dest was listed as 6 bytes, MAC as 4 bytes — both wrong, code was already correct). All 329 tests pass (66 decoder + 263 spec/golden).	2026-03-29 08:32:16 -07:00
you	1b09c733f5	ci: restrict self-hosted jobs to Linux runners The Windows self-hosted runner picks up jobs and fails because bash scripts run in PowerShell. Node.js tests need Chromium/Playwright (Linux-only), and build/deploy/publish use Docker (Linux-only). Changes: - node-test: runs-on: [self-hosted, Linux] - build: runs-on: [self-hosted, Linux] - deploy: runs-on: [self-hosted, Linux] - publish: runs-on: [self-hosted, Linux] - go-test: unchanged (ubuntu-latest)	2026-03-29 14:58:15 +00:00
Kpa-clawbot	553c0e4963	ci: bump GitHub Actions to Node 24 compatible versions checkout v4→v5, setup-go v5→v6, setup-node v4→v5, upload-artifact v4→v5, download-artifact v4→v5 Fixes the Node.js 20 deprecation warning. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-03-29 07:51:48 -07:00
efiten	8ede8427c8	fix: round Go Runtime floats to 1dp, prevent nav stats dot wrapping - perf.js: toFixed(1) on all ms/MB values in Go Runtime section - style.css: white-space: nowrap on .nav-stats to prevent the · separator from wrapping onto its own line Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-29 07:51:26 -07:00
you	8e66c68d6f	fix: cache hit rate excludes stale hits + debounce bulk-health invalidation Two cache bugs fixed: 1. Hit rate formula excluded stale hits — reported rate was artificially low because stale-while-revalidate responses (which ARE cache hits from the caller's perspective) were not counted. Changed formula from hits/(hits+misses) to (hits+staleHits)/(hits+staleHits+misses). 2. Bulk-health cache invalidated on every advert packet — in a mesh with dozens of nodes advertising every few seconds, this caused the expensive bulk-health query to be recomputed on nearly every request, defeating the cache entirely. Switched to 30s debounced invalidation via debouncedInvalidateBulkHealth(). Added regression test for hit rate formula in test-server-routes.js.	2026-03-29 07:51:08 -07:00
you	37396823ad	fix: align Go packet decoder with MeshCore firmware spec Match the C++ firmware wire format (Packet::writeTo/readFrom): 1. Field order: transport codes are parsed BEFORE path_length byte, matching firmware's header → transport_codes → path_len → path → payload 2. ACK payload: just 4-byte CRC checksum, not dest+src+ackHash. Firmware createAck() writes only ack_crc (4 bytes). 3. TRACE payload: tag(4) + authCode(4) + flags(1) + pathData, matching firmware createTrace() and onRecvPacket() TRACE handler. 4. ADVERT features: parse feat1 (0x20) and feat2 (0x40) optional 2-byte fields between location and name, matching AdvertDataBuilder and AdvertDataParser in the firmware. 5. Transport code naming: code1/code2 instead of nextHop/lastHop, matching firmware's transport_codes[0]/transport_codes[1] naming. Fixes applied to both cmd/ingestor/decoder.go and cmd/server/decoder.go. Tests updated to match new behavior.	2026-03-29 07:50:51 -07:00
you	113f68aea7	ci: skip heavy CI jobs for docs-only PRs Instead of using paths-ignore (which skips the entire workflow and blocks required status checks), detect docs-only changes at the start of each job and skip heavy steps while still reporting success. This allows doc-only PRs to merge without waiting for Go builds, Node.js tests, or Playwright E2E runs. Reverts the approach from `7546ece` (removing paths-ignore entirely) in favor of a proper conditional skip within the jobs themselves.	2026-03-29 07:48:15 -07:00
Kpa-clawbot	f4cccdff2f	ci: remove paths-ignore from pull_request trigger PR #233 only touches .md files, which were excluded by paths-ignore, causing CI to be skipped entirely. Remove paths-ignore from the pull_request trigger so all PRs get validated. Keep paths-ignore on push to avoid unnecessary deploys for docs-only changes to master.	2026-03-29 07:48:15 -07:00
Kpa-clawbot	5536b4c67c	docs: remove letsmesh.net reference from README Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-03-29 07:48:15 -07:00
you	074f3d3760	ci: cancel workflow run immediately when any test job fails When go-test or node-test fails, the workflow run is now cancelled via the GitHub API so the sibling job doesn't sit queued/running. Also fixed build job to need both go-test AND node-test (was only waiting on go-test despite the pipeline comment saying both gate it).	2026-03-29 14:20:22 +00:00