Merge branch 'master' into fix/remove-packets-v-fallbacks

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.env.example

@@ -1,44 +1,17 @@
 # MeshCore Analyzer — Environment Configuration
-# Copy to .env and customize. All values have sensible defaults.
+# Copy to .env and customize. All values have sensible defaults in docker-compose.yml.
 #
-# This file is read by BOTH docker compose AND manage.sh — one source of truth.
 # Each environment keeps config + data together in one directory:
 #   ~/meshcore-data/config.json, meshcore.db, Caddyfile, theme.json
 #   ~/meshcore-staging-data/config.json, meshcore.db, Caddyfile
 
 # --- Production ---
-# Data directory (database, theme, etc.)
+PROD_HTTP_PORT=80
-# Default: ~/meshcore-data
+PROD_HTTPS_PORT=443
-# Used by: docker compose, manage.sh
+PROD_MQTT_PORT=1883
 PROD_DATA_DIR=~/meshcore-data
 
-# HTTP port for web UI
-# Default: 80
-# Used by: docker compose
-PROD_HTTP_PORT=80
-
-# HTTPS port for web UI (TLS via Caddy)
-# Default: 443
-# Used by: docker compose
-PROD_HTTPS_PORT=443
-
-# MQTT port for observer connections
-# Default: 1883
-# Used by: docker compose
-PROD_MQTT_PORT=1883
-
 # --- Staging (HTTP only, no HTTPS) ---
-# Data directory
-# Default: ~/meshcore-staging-data
-# Used by: docker compose
-STAGING_DATA_DIR=~/meshcore-staging-data
-
-# HTTP port
-# Default: 81
-# Used by: docker compose
 STAGING_HTTP_PORT=81
-
-# MQTT port
-# Default: 1884
-# Used by: docker compose
 STAGING_MQTT_PORT=1884
+STAGING_DATA_DIR=~/meshcore-staging-data

.github/workflows/deploy.yml

@@ -17,7 +17,7 @@ on:
       - 'docs/**'
 
 concurrency:
-  group: deploy-${{ github.event.pull_request.number || github.ref }}
+  group: deploy
   cancel-in-progress: true
 
 env:
@@ -122,13 +122,6 @@ jobs:
           echo "| Server | ${SERVER_COV}% |" >> $GITHUB_STEP_SUMMARY
           echo "| Ingestor | ${INGESTOR_COV}% |" >> $GITHUB_STEP_SUMMARY
 
-      - name: Cancel workflow on failure
-        if: failure()
-        run: |
-          curl -s -X POST \
-            -H "Authorization: Bearer ${{ github.token }}" \
-            "https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/cancel"
-
       - name: Upload Go coverage badges
         if: always()
         uses: actions/upload-artifact@v4
@@ -270,13 +263,6 @@ jobs:
           BASE_URL=http://localhost:13581 node test-e2e-playwright.js || true
           kill $SERVER_PID 2>/dev/null || true
 
-      - name: Cancel workflow on failure
-        if: failure()
-        run: |
-          curl -s -X POST \
-            -H "Authorization: Bearer ${{ github.token }}" \
-            "https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/cancel"
-
       - name: Upload Node.js test badges
         if: always()
         uses: actions/upload-artifact@v4
@@ -292,7 +278,7 @@ jobs:
   build:
     name: "🏗️ Build Docker Image"
     if: github.event_name == 'push'
-    needs: [go-test, node-test]
+    needs: [go-test]
     runs-on: self-hosted
     steps:
       - name: Checkout code

RELEASE-v3.1.0.md

@@ -1,144 +0,0 @@
-# v3.1.0 — Now It's CoreScope
-
-MeshCore Analyzer has a new name: **CoreScope**. Same mesh analysis you rely on, sharper identity, and a boatload of fixes and performance wins since v3.0.0.
-
-48 commits, 30+ issues closed. Here's what changed.
-
----
-
-## 🏷️ Renamed to CoreScope
-
-The project is now **CoreScope** — frontend, backend, Docker images, manage.sh, docs, CI — everything has been updated. The URL, the API, the database, and your config all stay the same. Just a better name for the tool the community built.
-
----
-
-## ⚡ Performance
-
-| What | Before | After |
-|------|--------|-------|
-| Subpath analytics | 900 ms | **5 ms** (precomputed at ingest) |
-| Distance analytics | 1.2 s | **15 ms** (precomputed at ingest) |
-| Packet ingest (prepend) | O(n) slice copy | **O(1) append** |
-| Go runtime stats | GC stop-the-world on every call | **cached ReadMemStats** |
-| All analytics endpoints | computed per-request | **TTL-cached** |
-
-The in-memory store now precomputes subpaths and distance data as packets arrive, eliminating expensive full-table scans on the analytics endpoints. The O(n) slice prepend on every ingest — the single hottest line in the server — is gone. `ReadMemStats` calls are cached to prevent GC pause spikes under load.
-
----
-
-## 🆕 New Features
-
-### Telemetry Decode
-Sensor nodes now report **battery voltage** and **temperature** parsed from advert payloads. Telemetry is gated on the sensor flag — only real sensors emit data, and 0°C is no longer falsely reported. Safe migration with `PRAGMA` column checks.
-
-### Channel Decryption for Custom Channels
-The `hashChannels` config now works in the Go ingestor. Key derivation has been ported from Node.js with full AES-128-ECB support and garbage text detection — wrong keys silently fail instead of producing garbled output.
-
-### Node Pruning
-Stale nodes are automatically moved to an `inactive_nodes` table after the configurable retention window. Pruning runs hourly. Your active node list stays clean. (#202)
-
-### Duplicate Node Name Badges
-Nodes with the same display name but different public keys are flagged with a badge so you can spot collisions instantly.
-
-### Sortable Channels Table
-Channel columns are now sortable with click-to-sort headers. Sort preferences persist in `localStorage` across sessions. (#167)
-
-### Go Runtime Metrics
-The performance page exposes goroutine count, heap allocation, GC pause percentiles, and memory breakdown when connected to a Go backend.
-
----
-
-## 🐛 Bug Fixes
-
-- **Channel decryption regression** (#176) — full AES-128-ECB in Go, garbage text detection, hashChannels key derivation ported correctly (#218)
-- **Packets page not live-updating** (#172) — WebSocket broadcast now includes the nested packet object and timestamp fields the frontend expects; multiple fixes across broadcast and render paths
-- **Node detail page crashes** (#190) — `Number()` casts and `Array.isArray` guards prevent rendering errors on unexpected data shapes
-- **Observation count staleness** (#174) — trace page and packet detail now show correct observation counts
-- **Phantom node cleanup** (#133) — `autoLearnHopNodes` no longer creates fake nodes from 1-byte repeater IDs
-- **Advert count inflation** (#200) — counts unique transmissions, not total observations (8 observers × 1 advert = 1, not 8)
-- **SQLite BUSY contention** (#214) — `MaxOpenConns(1)` + `MaxIdleConns(1)` serializes writes; load-tested under concurrent ingest
-- **Decoder bounds check** (#183) — corrupt/malformed packets no longer crash the decoder with buffer overruns
-- **noise_floor / battery_mv type mismatches** — consistent `float64` scanning handles SQLite REAL values correctly
-- **packetsLastHour always zero** (#182) — early `break` in observer loop prevented counting
-- **Channels stale messages** (#171) — latest message sorted by observation timestamp, not first-seen
-- **pprof port conflict** — non-fatal bind with separate ports prevents Go server crash on startup
-
----
-
-## ♿ Accessibility & 📱 Mobile
-
-### WCAG AA Compliance (10 fixes)
-- Search results keyboard-accessible with `tabindex`, `role`, and arrow-key navigation (#208)
-- 40+ table headers given `scope` attributes (#211)
-- 9 Chart.js canvases given accessible names (#210)
-- Form inputs in customizer/filters paired with labels (#212)
-
-### Mobile Responsive
-- **Live page**: bottom-sheet panel instead of full-screen overlay (#203)
-- **Perf page**: responsive layout with stacked cards (#204)
-- **Nodes table**: column hiding at narrow viewports (#205)
-- **Analytics/Compare**: horizontal scroll wrappers (#206)
-- **VCR bar**: 44px minimum touch targets (#207)
-
----
-
-## 🏗️ Infrastructure
-
-### manage.sh Refactored (#230)
-`manage.sh` is now a thin wrapper around `docker compose` — no custom container management, no divergent logic. It reads `.env` for data paths, matching how `docker-compose.yml` works. One source of truth.
-
-### .env Support
-Data directory, ports, and image tags are configured via `.env`. Both `docker compose` and `manage.sh` read the same file.
-
-### Branch Protection & CI on PRs
-- Branch protection enabled on `master` — CI must pass, PRs required
-- CI now triggers on `pull_request`, not just `push` — catch failures before merge (#199)
-
-### Protobuf API Contract
-10 `.proto` files, 33 golden fixtures, CI validation on every push. API shape drift is caught automatically.
-
-### pprof Profiling
-Controlled by `ENABLE_PPROF` env var. When enabled, exposes Go profiling endpoints on separate ports — zero overhead when off.
-
-### Test Coverage
-- Go backend: **92%+** coverage
-- **49 Playwright E2E tests**
-- Both tracks gate deploy in CI
-
----
-
-## 📦 Upgrading
-
-```bash
-git pull
-./manage.sh stop
-./manage.sh setup
-```
-
-That's it. Your existing `config.json` and database work as-is. The rename is cosmetic — no schema changes, no API changes, no config changes.
-
-### Verify
-
-```bash
-curl -s http://localhost/api/health | grep engine
-# "engine": "go"
-```
-
----
-
-## ⚠️ Breaking Changes
-
-**None.** All API endpoints, WebSocket messages, and config options are backwards-compatible. The rename affects branding only — Docker image names, page titles, and documentation.
-
----
-
-## 🙏 Thank You
-
-- **efiten** — PR #222 performance fix (O(n) slice prepend elimination)
-- **jade-on-mesh**, **lincomatic**, **LitBomb**, **mibzzer15** — ongoing testing, feedback, and issue reports
-
-And to everyone running CoreScope on their mesh networks — your real-world data drives every fix and feature in this release. 48 commits since v3.0.0, and every one of them came from something the community found, reported, or requested.
-
----
-
-*Previous release: [v3.0.0](RELEASE-v3.0.0.md)*

cmd/ingestor/config.go

@@ -26,14 +26,13 @@ type MQTTLegacy struct {
 
 // Config holds the ingestor configuration, compatible with the Node.js config.json format.
 type Config struct {
-	DBPath          string            `json:"dbPath"`
+	DBPath         string            `json:"dbPath"`
-	MQTT            *MQTTLegacy       `json:"mqtt,omitempty"`
+	MQTT           *MQTTLegacy       `json:"mqtt,omitempty"`
-	MQTTSources     []MQTTSource      `json:"mqttSources,omitempty"`
+	MQTTSources    []MQTTSource      `json:"mqttSources,omitempty"`
-	LogLevel        string            `json:"logLevel,omitempty"`
+	LogLevel       string            `json:"logLevel,omitempty"`
-	ChannelKeysPath string            `json:"channelKeysPath,omitempty"`
+	ChannelKeysPath string           `json:"channelKeysPath,omitempty"`
-	ChannelKeys     map[string]string `json:"channelKeys,omitempty"`
+	ChannelKeys    map[string]string `json:"channelKeys,omitempty"`
-	HashChannels    []string          `json:"hashChannels,omitempty"`
+	Retention      *RetentionConfig  `json:"retention,omitempty"`
-	Retention       *RetentionConfig  `json:"retention,omitempty"`
 }
 
 // RetentionConfig controls how long stale nodes are kept before being moved to inactive_nodes.

cmd/ingestor/main.go

@@ -512,64 +512,34 @@ func firstNonEmpty(vals ...string) string {
 	return ""
 }
 
-// deriveHashtagChannelKey derives an AES-128 key from a channel name.
-// Same algorithm as Node.js: SHA-256(channelName) → first 32 hex chars (16 bytes).
-func deriveHashtagChannelKey(channelName string) string {
-	h := sha256.Sum256([]byte(channelName))
-	return hex.EncodeToString(h[:16])
-}
-
 // loadChannelKeys loads channel decryption keys from config and/or a JSON file.
-// Merge priority: rainbow (lowest) → derived from hashChannels → explicit config (highest).
+// Priority: CHANNEL_KEYS_PATH env var > cfg.ChannelKeysPath > channel-rainbow.json next to config.
 func loadChannelKeys(cfg *Config, configPath string) map[string]string {
 	keys := make(map[string]string)
 
-	// 1. Rainbow table keys (lowest priority)
+	// Determine file path for rainbow keys
 	keysPath := os.Getenv("CHANNEL_KEYS_PATH")
 	if keysPath == "" {
 		keysPath = cfg.ChannelKeysPath
 	}
 	if keysPath == "" {
+		// Default: look for channel-rainbow.json next to config file
 		keysPath = filepath.Join(filepath.Dir(configPath), "channel-rainbow.json")
 	}
 
-	rainbowCount := 0
 	if data, err := os.ReadFile(keysPath); err == nil {
 		var fileKeys map[string]string
 		if err := json.Unmarshal(data, &fileKeys); err == nil {
 			for k, v := range fileKeys {
 				keys[k] = v
 			}
-			rainbowCount = len(fileKeys)
+			log.Printf("Loaded %d channel keys from %s", len(fileKeys), keysPath)
-			log.Printf("Loaded %d channel keys from %s", rainbowCount, keysPath)
 		} else {
 			log.Printf("Warning: failed to parse channel keys file %s: %v", keysPath, err)
 		}
 	}
 
-	// 2. Derived keys from hashChannels (middle priority)
+	// Merge inline config keys (override file keys)
-	derivedCount := 0
-	for _, raw := range cfg.HashChannels {
-		trimmed := strings.TrimSpace(raw)
-		if trimmed == "" {
-			continue
-		}
-		channelName := trimmed
-		if !strings.HasPrefix(channelName, "#") {
-			channelName = "#" + channelName
-		}
-		// Skip if explicit config already has this key
-		if _, exists := cfg.ChannelKeys[channelName]; exists {
-			continue
-		}
-		keys[channelName] = deriveHashtagChannelKey(channelName)
-		derivedCount++
-	}
-	if derivedCount > 0 {
-		log.Printf("[channels] %d derived from hashChannels", derivedCount)
-	}
-
-	// 3. Explicit config keys (highest priority — overrides rainbow + derived)
 	for k, v := range cfg.ChannelKeys {
 		keys[k] = v
 	}

cmd/ingestor/main_test.go

@@ -3,8 +3,6 @@ package main
 import (
 	"encoding/json"
 	"math"
-	"os"
-	"path/filepath"
 	"testing"
 	"time"
 )
@@ -494,132 +492,3 @@ func TestAdvertRole(t *testing.T) {
 		})
 	}
 }
-
-func TestDeriveHashtagChannelKey(t *testing.T) {
-	// Test vectors validated against Node.js server-helpers.js
-	tests := []struct {
-		name string
-		want string
-	}{
-		{"#General", "649af2cab73ed5a890890a5485a0c004"},
-		{"#test", "9cd8fcf22a47333b591d96a2b848b73f"},
-		{"#MeshCore", "dcf73f393fa217f6b28fcec6ffc411ad"},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := deriveHashtagChannelKey(tt.name)
-			if got != tt.want {
-				t.Errorf("deriveHashtagChannelKey(%q) = %q, want %q", tt.name, got, tt.want)
-			}
-		})
-	}
-
-	// Deterministic
-	k1 := deriveHashtagChannelKey("#foo")
-	k2 := deriveHashtagChannelKey("#foo")
-	if k1 != k2 {
-		t.Error("deriveHashtagChannelKey should be deterministic")
-	}
-
-	// Returns 32-char hex string (16 bytes)
-	if len(k1) != 32 {
-		t.Errorf("key length = %d, want 32", len(k1))
-	}
-
-	// Different inputs → different keys
-	k3 := deriveHashtagChannelKey("#bar")
-	if k1 == k3 {
-		t.Error("different inputs should produce different keys")
-	}
-}
-
-func TestLoadChannelKeysMergePriority(t *testing.T) {
-	dir := t.TempDir()
-	cfgPath := filepath.Join(dir, "config.json")
-
-	// Create a rainbow file with two keys: #rainbow (unique) and #override (to be overridden)
-	rainbowPath := filepath.Join(dir, "channel-rainbow.json")
-	t.Setenv("CHANNEL_KEYS_PATH", rainbowPath)
-	rainbow := map[string]string{
-		"#rainbow":  "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-		"#override": "rainbow_value_should_be_overridden",
-	}
-	rainbowJSON, err := json.Marshal(rainbow)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(rainbowPath, rainbowJSON, 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	cfg := &Config{
-		HashChannels: []string{"General", "#override"},
-		ChannelKeys:  map[string]string{"#override": "explicit_wins"},
-	}
-
-	keys := loadChannelKeys(cfg, cfgPath)
-
-	// Rainbow key loaded
-	if keys["#rainbow"] != "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" {
-		t.Errorf("rainbow key missing or wrong: %q", keys["#rainbow"])
-	}
-
-	// HashChannels derived #General
-	expected := deriveHashtagChannelKey("#General")
-	if keys["#General"] != expected {
-		t.Errorf("#General = %q, want %q (derived)", keys["#General"], expected)
-	}
-
-	// Explicit config wins over both rainbow and derived
-	if keys["#override"] != "explicit_wins" {
-		t.Errorf("#override = %q, want explicit_wins", keys["#override"])
-	}
-}
-
-func TestLoadChannelKeysHashChannelsNormalization(t *testing.T) {
-	t.Setenv("CHANNEL_KEYS_PATH", "")
-	dir := t.TempDir()
-	cfgPath := filepath.Join(dir, "config.json")
-
-	cfg := &Config{
-		HashChannels: []string{
-			"NoPound",       // should become #NoPound
-			"#HasPound",     // stays #HasPound
-			"  Spaced  ",   // trimmed → #Spaced
-			"",              // skipped
-		},
-	}
-
-	keys := loadChannelKeys(cfg, cfgPath)
-
-	if _, ok := keys["#NoPound"]; !ok {
-		t.Error("should derive key for #NoPound (auto-prefixed)")
-	}
-	if _, ok := keys["#HasPound"]; !ok {
-		t.Error("should derive key for #HasPound")
-	}
-	if _, ok := keys["#Spaced"]; !ok {
-		t.Error("should derive key for #Spaced (trimmed)")
-	}
-	if len(keys) != 3 {
-		t.Errorf("expected 3 keys, got %d", len(keys))
-	}
-}
-
-func TestLoadChannelKeysSkipExplicit(t *testing.T) {
-	t.Setenv("CHANNEL_KEYS_PATH", "")
-	dir := t.TempDir()
-	cfgPath := filepath.Join(dir, "config.json")
-
-	cfg := &Config{
-		HashChannels: []string{"General"},
-		ChannelKeys:  map[string]string{"#General": "my_explicit_key"},
-	}
-
-	keys := loadChannelKeys(cfg, cfgPath)
-
-	// Explicit key should win — hashChannels derivation should be skipped
-	if keys["#General"] != "my_explicit_key" {
-		t.Errorf("#General = %q, want my_explicit_key", keys["#General"])
-	}
-}

cmd/server/routes.go

@@ -33,11 +33,6 @@ type Server struct {
 	memStatsMu   sync.Mutex
 	memStatsCache runtime.MemStats
 	memStatsCachedAt time.Time
-
-	// Cached /api/stats response — recomputed at most once every 10s
-	statsMu      sync.Mutex
-	statsCache   *StatsResponse
-	statsCachedAt time.Time
 }
 
 // PerfStats tracks request performance.
@@ -385,17 +380,6 @@ func (s *Server) handleHealth(w http.ResponseWriter, r *http.Request) {
 }
 
 func (s *Server) handleStats(w http.ResponseWriter, r *http.Request) {
-	const statsTTL = 10 * time.Second
-
-	s.statsMu.Lock()
-	if s.statsCache != nil && time.Since(s.statsCachedAt) < statsTTL {
-		cached := s.statsCache
-		s.statsMu.Unlock()
-		writeJSON(w, cached)
-		return
-	}
-	s.statsMu.Unlock()
-
 	var stats *Stats
 	var err error
 	if s.store != nil {
@@ -408,7 +392,7 @@ func (s *Server) handleStats(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	counts := s.db.GetRoleCounts()
-	resp := &StatsResponse{
+	writeJSON(w, StatsResponse{
 		TotalPackets:       stats.TotalPackets,
 		TotalTransmissions: &stats.TotalTransmissions,
 		TotalObservations:  stats.TotalObservations,
@@ -427,14 +411,7 @@ func (s *Server) handleStats(w http.ResponseWriter, r *http.Request) {
 			Companions: counts["companions"],
 			Sensors:    counts["sensors"],
 		},
-	}
+	})
-
-	s.statsMu.Lock()
-	s.statsCache = resp
-	s.statsCachedAt = time.Now()
-	s.statsMu.Unlock()
-
-	writeJSON(w, resp)
 }
 
 func (s *Server) handlePerf(w http.ResponseWriter, r *http.Request) {

cmd/server/store.go

@@ -62,7 +62,7 @@ type StoreObs struct {
 type PacketStore struct {
 	mu            sync.RWMutex
 	db            *DB
-	packets       []*StoreTx                 // sorted by first_seen ASC (oldest first; newest at tail)
+	packets       []*StoreTx                 // sorted by first_seen DESC
 	byHash        map[string]*StoreTx        // hash → *StoreTx
 	byTxID        map[int]*StoreTx           // transmission_id → *StoreTx
 	byObsID       map[int]*StoreObs          // observation_id → *StoreObs
@@ -98,11 +98,6 @@ type PacketStore struct {
 	// computed during Load() and incrementally updated on ingest.
 	distHops  []distHopRecord
 	distPaths []distPathRecord
-
-	// Cached GetNodeHashSizeInfo result — recomputed at most once every 15s
-	hashSizeInfoMu    sync.Mutex
-	hashSizeInfoCache map[string]*hashSizeNodeInfo
-	hashSizeInfoAt    time.Time
 }
 
 // Precomputed distance records for fast analytics aggregation.
@@ -181,7 +176,7 @@ func (s *PacketStore) Load() error {
 			FROM transmissions t
 			LEFT JOIN observations o ON o.transmission_id = t.id
 			LEFT JOIN observers obs ON obs.rowid = o.observer_idx
-			ORDER BY t.first_seen ASC, o.timestamp DESC`
+			ORDER BY t.first_seen DESC, o.timestamp DESC`
 	} else {
 		loadSQL = `SELECT t.id, t.raw_hex, t.hash, t.first_seen, t.route_type,
 				t.payload_type, t.payload_version, t.decoded_json,
@@ -189,7 +184,7 @@ func (s *PacketStore) Load() error {
 				o.snr, o.rssi, o.score, o.path_json, o.timestamp
 			FROM transmissions t
 			LEFT JOIN observations o ON o.transmission_id = t.id
-			ORDER BY t.first_seen ASC, o.timestamp DESC`
+			ORDER BY t.first_seen DESC, o.timestamp DESC`
 	}
 
 	rows, err := s.db.conn.Query(loadSQL)
@@ -373,32 +368,28 @@ func (s *PacketStore) QueryPackets(q PacketQuery) *PacketResult {
 	results := s.filterPackets(q)
 	total := len(results)
 
-	// results is oldest-first (ASC). For DESC (default) read backwards from the tail;
+	if q.Order == "ASC" {
-	// for ASC read forwards. Both are O(page_size) — no sort copy needed.
+		sorted := make([]*StoreTx, len(results))
-	start := q.Offset
+		copy(sorted, results)
-	if start >= total {
+		sort.Slice(sorted, func(i, j int) bool {
-		return &PacketResult{Packets: []map[string]interface{}{}, Total: total}
+			return sorted[i].FirstSeen < sorted[j].FirstSeen
-	}
+		})
-	pageSize := q.Limit
+		results = sorted
-	if start+pageSize > total {
-		pageSize = total - start
 	}
 
-	packets := make([]map[string]interface{}, 0, pageSize)
+	// Paginate
-	if q.Order == "ASC" {
+	start := q.Offset
-		for _, tx := range results[start : start+pageSize] {
+	if start >= len(results) {
-			packets = append(packets, txToMap(tx))
+		return &PacketResult{Packets: []map[string]interface{}{}, Total: total}
-		}
+	}
-	} else {
+	end := start + q.Limit
-		// DESC: newest items are at the tail; page 0 = last pageSize items reversed
+	if end > len(results) {
-		endIdx := total - start
+		end = len(results)
-		startIdx := endIdx - pageSize
+	}
-		if startIdx < 0 {
+
-			startIdx = 0
+	packets := make([]map[string]interface{}, 0, end-start)
-		}
+	for _, tx := range results[start:end] {
-		for i := endIdx - 1; i >= startIdx; i-- {
+		packets = append(packets, txToMap(tx))
-			packets = append(packets, txToMap(results[i]))
-		}
 	}
 	return &PacketResult{Packets: packets, Total: total}
 }
@@ -728,16 +719,15 @@ func (s *PacketStore) GetTimestamps(since string) []string {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
 
-	// packets sorted oldest-first — scan from tail until we reach items older than since
+	// packets sorted newest first — scan from start until older than since
 	var result []string
-	for i := len(s.packets) - 1; i >= 0; i-- {
+	for _, tx := range s.packets {
-		tx := s.packets[i]
 		if tx.FirstSeen <= since {
 			break
 		}
 		result = append(result, tx.FirstSeen)
 	}
-	// result is currently newest-first; reverse to return ASC order
+	// Reverse to get ASC order
 	for i, j := 0, len(result)-1; i < j; i, j = i+1, j-1 {
 		result[i], result[j] = result[j], result[i]
 	}
@@ -787,30 +777,23 @@ func (s *PacketStore) QueryMultiNodePackets(pubkeys []string, limit, offset int,
 
 	total := len(filtered)
 
-	// filtered is oldest-first (built by iterating s.packets forward).
+	if order == "ASC" {
-	// Apply same DESC/ASC pagination logic as QueryPackets.
+		sort.Slice(filtered, func(i, j int) bool {
+			return filtered[i].FirstSeen < filtered[j].FirstSeen
+		})
+	}
+
 	if offset >= total {
 		return &PacketResult{Packets: []map[string]interface{}{}, Total: total}
 	}
-	pageSize := limit
+	end := offset + limit
-	if offset+pageSize > total {
+	if end > total {
-		pageSize = total - offset
+		end = total
 	}
 
-	packets := make([]map[string]interface{}, 0, pageSize)
+	packets := make([]map[string]interface{}, 0, end-offset)
-	if order == "ASC" {
+	for _, tx := range filtered[offset:end] {
-		for _, tx := range filtered[offset : offset+pageSize] {
+		packets = append(packets, txToMap(tx))
-			packets = append(packets, txToMap(tx))
-		}
-	} else {
-		endIdx := total - offset
-		startIdx := endIdx - pageSize
-		if startIdx < 0 {
-			startIdx = 0
-		}
-		for i := endIdx - 1; i >= startIdx; i-- {
-			packets = append(packets, txToMap(filtered[i]))
-		}
 	}
 	return &PacketResult{Packets: packets, Total: total}
 }
@@ -943,14 +926,15 @@ func (s *PacketStore) IngestNewFromDB(sinceID, limit int) ([]map[string]interfac
 				DecodedJSON: r.decodedJSON,
 			}
 			s.byHash[r.hash] = tx
-			s.packets = append(s.packets, tx) // oldest-first; new items go to tail
+			// Prepend (newest first)
+			s.packets = append([]*StoreTx{tx}, s.packets...)
 			s.byTxID[r.txID] = tx
 			s.indexByNode(tx)
 			if tx.PayloadType != nil {
 				pt := *tx.PayloadType
-				// Append to maintain oldest-first order (matches Load ordering)
+				// Prepend to maintain newest-first order (matches Load ordering)
 				// so GetChannelMessages reverse iteration stays correct
-				s.byPayloadType[pt] = append(s.byPayloadType[pt], tx)
+				s.byPayloadType[pt] = append([]*StoreTx{tx}, s.byPayloadType[pt]...)
 			}
 
 			if _, exists := broadcastTxs[r.txID]; !exists {
@@ -1095,6 +1079,8 @@ func (s *PacketStore) IngestNewFromDB(sinceID, limit int) ([]map[string]interfac
 		s.cacheMu.Unlock()
 	}
 
+	log.Printf("[poller] IngestNewFromDB: found %d new txs, maxID %d->%d", len(result), sinceID, newMaxID)
+
 	return result, newMaxID
 }
 
@@ -1277,7 +1263,8 @@ func (s *PacketStore) IngestNewObservations(sinceObsID, limit int) int {
 		s.subpathCache = make(map[string]*cachedResult)
 		s.cacheMu.Unlock()
 
-		// analytics caches cleared; no per-cycle log to avoid stdout overhead
+		log.Printf("[poller] IngestNewObservations: updated %d existing txs, maxObsID %d->%d",
+			len(updatedTxs), sinceObsID, newMaxObsID)
 	}
 
 	return newMaxObsID
@@ -1901,7 +1888,7 @@ func (s *PacketStore) GetChannelMessages(channelHash string, limit, offset int)
 	msgMap := map[string]*msgEntry{}
 	var msgOrder []string
 
-	// Iterate type-5 packets oldest-first (byPayloadType is ASC = oldest first)
+	// Iterate type-5 packets oldest-first (byPayloadType is in load order = newest first)
 	type decodedMsg struct {
 		Type            string      `json:"type"`
 		Channel         string      `json:"channel"`
@@ -1912,7 +1899,8 @@ func (s *PacketStore) GetChannelMessages(channelHash string, limit, offset int)
 	}
 
 	grpTxts := s.byPayloadType[5]
-	for _, tx := range grpTxts {
+	for i := len(grpTxts) - 1; i >= 0; i-- {
+		tx := grpTxts[i]
 		if tx.DecodedJSON == "" {
 			continue
 		}
@@ -3727,26 +3715,8 @@ type hashSizeNodeInfo struct {
 	Inconsistent bool
 }
 
-// GetNodeHashSizeInfo returns cached per-node hash size data, recomputing at most every 15s.
+// GetNodeHashSizeInfo scans advert packets to compute per-node hash size data.
 func (s *PacketStore) GetNodeHashSizeInfo() map[string]*hashSizeNodeInfo {
-	const ttl = 15 * time.Second
-	s.hashSizeInfoMu.Lock()
-	if s.hashSizeInfoCache != nil && time.Since(s.hashSizeInfoAt) < ttl {
-		cached := s.hashSizeInfoCache
-		s.hashSizeInfoMu.Unlock()
-		return cached
-	}
-	s.hashSizeInfoMu.Unlock()
-	result := s.computeNodeHashSizeInfo()
-	s.hashSizeInfoMu.Lock()
-	s.hashSizeInfoCache = result
-	s.hashSizeInfoAt = time.Now()
-	s.hashSizeInfoMu.Unlock()
-	return result
-}
-
-// computeNodeHashSizeInfo scans advert packets to compute per-node hash size data.
-func (s *PacketStore) computeNodeHashSizeInfo() map[string]*hashSizeNodeInfo {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
 
@@ -4099,13 +4069,13 @@ func (s *PacketStore) GetNodeHealth(pubkey string) (map[string]interface{}, erro
 		lhVal = lastHeard
 	}
 
-	// Recent packets (up to 20, newest first — read from tail of oldest-first slice)
+	// Recent packets (up to 20, newest first — packets are already sorted DESC)
 	recentLimit := 20
 	if len(packets) < recentLimit {
 		recentLimit = len(packets)
 	}
 	recentPackets := make([]map[string]interface{}, 0, recentLimit)
-	for i := len(packets) - 1; i >= len(packets)-recentLimit; i-- {
+	for i := 0; i < recentLimit; i++ {
 		p := txToMap(packets[i])
 		delete(p, "observations")
 		recentPackets = append(recentPackets, p)

decoder.js

@@ -2,8 +2,8 @@
  * MeshCore Packet Decoder
  * Custom implementation — does NOT use meshcore-decoder library (known path_length bug).
  *
- * Packet layout (per firmware docs/packet_format.md):
+ * Packet layout:
- *   [header(1)] [transportCodes?(4)] [pathLength(1)] [path hops] [payload...]
+ *   [header(1)] [pathLength(1)] [transportCodes?] [path hops] [payload...]
  *
  * Header byte (LSB first):
  *   bits 1-0: routeType (0=TRANSPORT_FLOOD, 1=FLOOD, 2=DIRECT, 3=TRANSPORT_DIRECT)
@@ -42,7 +42,7 @@ const PAYLOAD_TYPES = {
   0x0F: 'RAW_CUSTOM',
 };
 
-// Route types that carry transport codes (2x uint16_t, 4 bytes total)
+// Route types that carry transport codes (nextHop + lastHop, 2 bytes each)
 const TRANSPORT_ROUTES = new Set([0, 3]); // TRANSPORT_FLOOD, TRANSPORT_DIRECT
 
 // --- Header parsing ---
@@ -94,11 +94,13 @@ function decodeEncryptedPayload(buf) {
   };
 }
 
-/** ACK: checksum(4) — CRC of message timestamp + text + sender pubkey (per Mesh.cpp createAck) */
+/** ACK: dest(1) + src(1) + ack_hash(4) (per Mesh.cpp) */
 function decodeAck(buf) {
-  if (buf.length < 4) return { error: 'too short', raw: buf.toString('hex') };
+  if (buf.length < 6) return { error: 'too short', raw: buf.toString('hex') };
   return {
-    ackChecksum: buf.subarray(0, 4).toString('hex'),
+    destHash: buf.subarray(0, 1).toString('hex'),
+    srcHash: buf.subarray(1, 2).toString('hex'),
+    extraHash: buf.subarray(2, 6).toString('hex'),
   };
 }
 
@@ -123,8 +125,6 @@ function decodeAdvert(buf) {
       room: advType === 3,
       sensor: advType === 4,
       hasLocation: !!(flags & 0x10),
-      hasFeat1: !!(flags & 0x20),
-      hasFeat2: !!(flags & 0x40),
       hasName: !!(flags & 0x80),
     };
 
@@ -134,14 +134,6 @@ function decodeAdvert(buf) {
       result.lon = appdata.readInt32LE(off + 4) / 1e6;
       off += 8;
     }
-    if (result.flags.hasFeat1 && appdata.length >= off + 2) {
-      result.feat1 = appdata.readUInt16LE(off);
-      off += 2;
-    }
-    if (result.flags.hasFeat2 && appdata.length >= off + 2) {
-      result.feat2 = appdata.readUInt16LE(off);
-      off += 2;
-    }
     if (result.flags.hasName) {
       // Find null terminator to separate name from trailing telemetry bytes
       let nameEnd = appdata.length;
@@ -239,7 +231,7 @@ function decodeGrpTxt(buf, channelKeys) {
   return { type: 'GRP_TXT', channelHash, channelHashHex, decryptionStatus: 'no_key', mac, encryptedData };
 }
 
-/** ANON_REQ: dest(1) + ephemeral_pubkey(32) + MAC(2) + encrypted */
+/** ANON_REQ: dest(6) + ephemeral_pubkey(32) + MAC(4) + encrypted */
 function decodeAnonReq(buf) {
   if (buf.length < 35) return { error: 'too short', raw: buf.toString('hex') };
   return {
@@ -250,7 +242,7 @@ function decodeAnonReq(buf) {
   };
 }
 
-/** PATH: dest(1) + src(1) + MAC(2) + path_data */
+/** PATH: dest(6) + src(6) + MAC(4) + path_data */
 function decodePath_payload(buf) {
   if (buf.length < 4) return { error: 'too short', raw: buf.toString('hex') };
   return {
@@ -261,14 +253,14 @@ function decodePath_payload(buf) {
   };
 }
 
-/** TRACE: tag(4) + authCode(4) + flags(1) + pathData (per Mesh.cpp onRecvPacket TRACE) */
+/** TRACE: flags(1) + tag(4) + dest(6) + src(1) */
 function decodeTrace(buf) {
-  if (buf.length < 9) return { error: 'too short', raw: buf.toString('hex') };
+  if (buf.length < 12) return { error: 'too short', raw: buf.toString('hex') };
   return {
-    tag: buf.readUInt32LE(0),
+    flags: buf[0],
-    authCode: buf.subarray(4, 8).toString('hex'),
+    tag: buf.readUInt32LE(1),
-    flags: buf[8],
+    destHash: buf.subarray(5, 11).toString('hex'),
-    pathData: buf.subarray(9).toString('hex'),
+    srcHash: buf.subarray(11, 12).toString('hex'),
   };
 }
 
@@ -297,22 +289,20 @@ function decodePacket(hexString, channelKeys) {
   if (buf.length < 2) throw new Error('Packet too short (need at least header + pathLength)');
 
   const header = decodeHeader(buf[0]);
-  let offset = 1;
+  const pathByte = buf[1];
+  let offset = 2;
 
-  // Transport codes for TRANSPORT_FLOOD / TRANSPORT_DIRECT — BEFORE path_length per spec
+  // Transport codes for TRANSPORT_FLOOD / TRANSPORT_DIRECT
   let transportCodes = null;
   if (TRANSPORT_ROUTES.has(header.routeType)) {
     if (buf.length < offset + 4) throw new Error('Packet too short for transport codes');
     transportCodes = {
-      code1: buf.subarray(offset, offset + 2).toString('hex').toUpperCase(),
+      nextHop: buf.subarray(offset, offset + 2).toString('hex').toUpperCase(),
-      code2: buf.subarray(offset + 2, offset + 4).toString('hex').toUpperCase(),
+      lastHop: buf.subarray(offset + 2, offset + 4).toString('hex').toUpperCase(),
     };
     offset += 4;
   }
 
-  // Path length byte — AFTER transport codes per spec
-  const pathByte = buf[offset++];
-
   // Path
   const path = decodePath(pathByte, buf, offset);
   offset += path.bytesConsumed;
@@ -396,7 +386,7 @@ module.exports = { decodePacket, validateAdvert, hasNonPrintableChars, ROUTE_TYP
 
 // --- Tests ---
 if (require.main === module) {
-  console.log('=== Test 1: ADVERT, FLOOD, 5 hops (2-byte hashes), "Kpa Roof Solar" ===');
+  console.log('=== Test 1: ADVERT, FLOOD, 5 hops (2-byte hashes), "Test Repeater" ===');
   const pkt1 = decodePacket(
     '11451000D818206D3AAC152C8A91F89957E6D30CA51F36E28790228971C473B755F244F718754CF5EE4A2FD58D944466E42CDED140C66D0CC590183E32BAF40F112BE8F3F2BDF6012B4B2793C52F1D36F69EE054D9A05593286F78453E56C0EC4A3EB95DDA2A7543FCCC00B939CACC009278603902FC12BCF84B706120526F6F6620536F6C6172'
   );
@@ -412,7 +402,7 @@ if (require.main === module) {
   assert(pkt1.path.hops[0] === '1000', 'first hop should be 1000');
   assert(pkt1.path.hops[1] === 'D818', 'second hop should be D818');
   assert(pkt1.transportCodes === null, 'FLOOD has no transport codes');
-  assert(pkt1.payload.name === 'Kpa Roof Solar', 'name should be "Kpa Roof Solar"');
+  assert(pkt1.payload.name === 'Test Repeater', 'name should be "Test Repeater"');
   console.log('✅ Test 1 passed\n');
 
   console.log('=== Test 2: ADVERT, FLOOD, 0 hops (zero-path) ===');

docker-compose.yml

@@ -1,16 +1,11 @@
-# All container config lives here. manage.sh is just a wrapper around docker compose.
+# Volume paths unified with manage.sh — see manage.sh lines 9-12, 56-68, 98-113
 # Override defaults via .env or environment variables.
-# CRITICAL: All data mounts use bind mounts (~/path), NOT named volumes.
-# This ensures the DB and theme are visible on the host filesystem for backup.
 
 services:
   prod:
-    build: .
     image: corescope:latest
     container_name: corescope-prod
     restart: unless-stopped
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
     ports:
       - "${PROD_HTTP_PORT:-80}:${PROD_HTTP_PORT:-80}"
       - "${PROD_HTTPS_PORT:-443}:${PROD_HTTPS_PORT:-443}"
@@ -29,12 +24,9 @@ services:
       retries: 3
 
   staging:
-    build: .
     image: corescope:latest
     container_name: corescope-staging
     restart: unless-stopped
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
     ports:
       - "${STAGING_HTTP_PORT:-81}:${STAGING_HTTP_PORT:-81}"
       - "${STAGING_MQTT_PORT:-1884}:1883"
@@ -63,8 +55,6 @@ services:
     image: corescope-go:latest
     container_name: corescope-staging-go
     restart: unless-stopped
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
     ports:
       - "${STAGING_GO_HTTP_PORT:-82}:80"
       - "${STAGING_GO_MQTT_PORT:-1885}:1883"
@@ -86,7 +76,6 @@ services:
       - staging-go
 
 volumes:
-  # Named volumes for Caddy TLS certificates (not user data — managed by Caddy internally)
   caddy-data:
   caddy-data-staging:
   caddy-data-staging-go:

docs/rename-migration.md

@@ -1,101 +0,0 @@
-# CoreScope Migration Guide
-
-MeshCore Analyzer has been renamed to **CoreScope**. This document covers what you need to update.
-
-## What Changed
-
-- **Repository name**: `meshcore-analyzer` → `corescope`
-- **Docker image name**: `meshcore-analyzer:latest` → `corescope:latest`
-- **Docker container prefixes**: `meshcore-*` → `corescope-*`
-- **Default site name**: "MeshCore Analyzer" → "CoreScope"
-
-## What Did NOT Change
-
-- **Data directories** — `~/meshcore-data/` stays as-is
-- **Database filename** — `meshcore.db` is unchanged
-- **MQTT topics** — `meshcore/#` topics are protocol-level and unchanged
-- **Browser state** — Favorites, localStorage keys, and settings are preserved
-- **Config file format** — `config.json` structure is the same
-
----
-
-## 1. Git Remote Update
-
-Update your local clone to point to the new repository URL:
-
-```bash
-git remote set-url origin https://github.com/Kpa-clawbot/corescope.git
-git pull
-```
-
-## 2. Docker (manage.sh) Users
-
-Rebuild with the new image name:
-
-```bash
-./manage.sh stop
-git pull
-./manage.sh setup
-```
-
-The new image is `corescope:latest`. You can clean up the old image:
-
-```bash
-docker rmi meshcore-analyzer:latest
-```
-
-## 3. Docker Compose Users
-
-Rebuild containers with the new names:
-
-```bash
-docker compose down
-git pull
-docker compose build
-docker compose up -d
-```
-
-Container names change from `meshcore-*` to `corescope-*`. Old containers are removed by `docker compose down`.
-
-## 4. Data Directories
-
-**No action required.** The data directory `~/meshcore-data/` and database file `meshcore.db` are unchanged. Your existing data carries over automatically.
-
-## 5. Config
-
-If you customized `branding.siteName` in your `config.json`, update it to your preferred name. Otherwise the new default "CoreScope" applies automatically.
-
-No other config keys changed.
-
-## 6. MQTT
-
-**No action required.** MQTT topics (`meshcore/#`) are protocol-level and are not affected by the rename.
-
-## 7. Browser
-
-**No action required.** Bookmarks/favorites will continue to work at the same host and port. localStorage keys are unchanged, so your settings and preferences are preserved.
-
-## 8. CI/CD
-
-If you have custom CI/CD pipelines that reference:
-
-- The old repository URL (`meshcore-analyzer`)
-- The old Docker image name (`meshcore-analyzer:latest`)
-- Old container names (`meshcore-*`)
-
-Update those references to use the new names.
-
----
-
-## Summary Checklist
-
-| Item | Action Required? | What to Do |
-|------|-----------------|------------|
-| Git remote | ✅ Yes | `git remote set-url origin …corescope.git` |
-| Docker image | ✅ Yes | Rebuild; optionally `docker rmi` old image |
-| Docker Compose | ✅ Yes | `docker compose down && build && up` |
-| Data directories | ❌ No | Unchanged |
-| Config | ⚠️ Maybe | Only if you customized `branding.siteName` |
-| MQTT | ❌ No | Topics unchanged |
-| Browser | ❌ No | Settings preserved |
-| CI/CD | ⚠️ Maybe | Update if referencing old repo/image names |

manage.sh

@@ -2,20 +2,26 @@
 # CoreScope — Setup & Management Helper
 # Usage: ./manage.sh [command]
 #
-# All container management goes through docker compose.
-# Container config lives in docker-compose.yml — this script is just a wrapper.
-#
 # Idempotent: safe to cancel and re-run at any point.
 # Each step checks what's already done and skips it.
 set -e
 
+CONTAINER_NAME="corescope"
 IMAGE_NAME="corescope"
+DATA_VOLUME="meshcore-data"
+CADDY_VOLUME="caddy-data"
 STATE_FILE=".setup-state"
 
-# Source .env for port/path overrides (same file docker compose reads)
+# Source .env for port/path overrides (if present)
 [ -f .env ] && set -a && . ./.env && set +a
 
-# Resolved paths for prod/staging data (must match docker-compose.yml)
+# Docker Compose mode detection
+COMPOSE_MODE=false
+if [ -f docker-compose.yml ]; then
+  COMPOSE_MODE=true
+fi
+
+# Resolved paths for prod/staging data
 PROD_DATA="${PROD_DATA_DIR:-$HOME/meshcore-data}"
 STAGING_DATA="${STAGING_DATA_DIR:-$HOME/meshcore-staging-data}"
 
@@ -45,6 +51,83 @@ is_done()    { [ -f "$STATE_FILE" ] && grep -qx "$1" "$STATE_FILE" 2>/dev/null;
 
 # ─── Helpers ──────────────────────────────────────────────────────────────
 
+# Determine the correct data volume/mount args for docker run.
+# Detects existing host data directories and uses bind mounts if found.
+get_data_mount_args() {
+  # Check for existing host data directories with a DB file
+  if [ -d "$HOME/meshcore-data" ] && [ -f "$HOME/meshcore-data/meshcore.db" ]; then
+    echo "-v $HOME/meshcore-data:/app/data"
+    return
+  fi
+  if [ -d "$(pwd)/data" ] && [ -f "$(pwd)/data/meshcore.db" ]; then
+    echo "-v $(pwd)/data:/app/data"
+    return
+  fi
+  # Default: Docker named volume
+  echo "-v ${DATA_VOLUME}:/app/data"
+}
+
+# Determine the required port mappings from Caddyfile
+get_required_ports() {
+  local caddyfile_domain
+  caddyfile_domain=$(grep -v '^#' caddy-config/Caddyfile 2>/dev/null | head -1 | tr -d ' {')
+  if echo "$caddyfile_domain" | grep -qE '^:[0-9]+$'; then
+    # HTTP-only on a specific port (e.g., :80, :8080)
+    echo "${caddyfile_domain#:}"
+  else
+    # Domain name — needs 80 + 443 for Caddy auto-TLS
+    echo "80 443"
+  fi
+}
+
+# Get current container port mappings (just the host ports)
+get_current_ports() {
+  docker inspect "$CONTAINER_NAME" 2>/dev/null | \
+    grep -oP '"HostPort":\s*"\K[0-9]+' | sort -u | tr '\n' ' ' | sed 's/ $//'
+}
+
+# Check if container port mappings match what's needed.
+# Returns 0 if they match, 1 if mismatch.
+check_port_match() {
+  local required current
+  required=$(get_required_ports | tr ' ' '\n' | sort | tr '\n' ' ' | sed 's/ $//')
+  current=$(get_current_ports | tr ' ' '\n' | sort | tr '\n' ' ' | sed 's/ $//')
+  [ "$required" = "$current" ]
+}
+
+# Build the docker run command args (ports + volumes)
+get_docker_run_args() {
+  local ports_arg=""
+  for port in $(get_required_ports); do
+    ports_arg="$ports_arg -p ${port}:${port}"
+  done
+
+  local data_mount
+  data_mount=$(get_data_mount_args)
+
+  echo "$ports_arg \
+    -v $(pwd)/config.json:/app/config.json:ro \
+    -v $(pwd)/caddy-config/Caddyfile:/etc/caddy/Caddyfile:ro \
+    $data_mount \
+    -v ${CADDY_VOLUME}:/data/caddy"
+}
+
+# Recreate the container with current settings
+recreate_container() {
+  info "Stopping and removing old container..."
+  docker stop "$CONTAINER_NAME" 2>/dev/null || true
+  docker rm "$CONTAINER_NAME" 2>/dev/null || true
+
+  local run_args
+  run_args=$(get_docker_run_args)
+
+  eval docker run -d \
+    --name "$CONTAINER_NAME" \
+    --restart unless-stopped \
+    $run_args \
+    "$IMAGE_NAME"
+}
+
 # Check config.json for placeholder values
 check_config_placeholders() {
   if [ -f config.json ]; then
@@ -57,7 +140,7 @@ check_config_placeholders() {
 
 # Verify the running container is actually healthy
 verify_health() {
-  local container="corescope-prod"
+  local base_url="http://localhost:3000"
   local use_https=false
 
   # Check if Caddyfile has a real domain (not :80)
@@ -73,7 +156,7 @@ verify_health() {
   info "Waiting for server to respond..."
   local healthy=false
   for i in $(seq 1 45); do
-    if docker exec "$container" wget -qO- http://localhost:3000/api/stats &>/dev/null; then
+    if docker exec "$CONTAINER_NAME" wget -qO- http://localhost:3000/api/stats &>/dev/null; then
       healthy=true
       break
     fi
@@ -89,7 +172,7 @@ verify_health() {
 
   # Check for MQTT errors in recent logs
   local mqtt_errors
-  mqtt_errors=$(docker logs "$container" --tail 50 2>&1 | grep -i 'mqtt.*error\|mqtt.*fail\|ECONNREFUSED.*1883' || true)
+  mqtt_errors=$(docker logs "$CONTAINER_NAME" --tail 50 2>&1 | grep -i 'mqtt.*error\|mqtt.*fail\|ECONNREFUSED.*1883' || true)
   if [ -n "$mqtt_errors" ]; then
     warn "MQTT errors detected in logs:"
     echo "$mqtt_errors" | head -5 | sed 's/^/   /'
@@ -151,13 +234,6 @@ cmd_setup() {
   fi
 
   log "Docker $(docker --version | grep -oP 'version \K[^ ,]+')"
-  
-  # Check docker compose (separate check since it's a plugin/separate binary)
-  if ! docker compose version &>/dev/null; then
-    err "docker compose is required. Install Docker Desktop or docker-compose-plugin."
-    exit 1
-  fi
-  
   mark_done "docker"
 
   # ── Step 2: Config ──
@@ -295,12 +371,12 @@ cmd_setup() {
   if [ -n "$IMAGE_EXISTS" ] && is_done "build"; then
     log "Image already built."
     if confirm "Rebuild? (only needed if you updated the code)"; then
-      docker compose build prod
+      docker build --build-arg APP_VERSION=$(node -p "require('./package.json').version" 2>/dev/null || echo "unknown") --build-arg GIT_COMMIT=$(git rev-parse --short HEAD 2>/dev/null || echo "unknown") --build-arg BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ) -t "$IMAGE_NAME" .
       log "Image rebuilt."
     fi
   else
     info "This takes 1-2 minutes the first time..."
-    docker compose build prod
+    docker build --build-arg APP_VERSION=$(node -p "require('./package.json').version" 2>/dev/null || echo "unknown") --build-arg GIT_COMMIT=$(git rev-parse --short HEAD 2>/dev/null || echo "unknown") --build-arg BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ) -t "$IMAGE_NAME" .
     log "Image built."
   fi
   mark_done "build"
@@ -309,15 +385,45 @@ cmd_setup() {
   step 5 "Starting container"
 
   # Detect existing data directories
-  if [ -d "$PROD_DATA" ] && [ -f "$PROD_DATA/meshcore.db" ]; then
+  if [ -d "$HOME/meshcore-data" ] && [ -f "$HOME/meshcore-data/meshcore.db" ]; then
-    info "Found existing data at $PROD_DATA/ — will use bind mount."
+    info "Found existing data at \$HOME/meshcore-data/ — will use bind mount."
+  elif [ -d "$(pwd)/data" ] && [ -f "$(pwd)/data/meshcore.db" ]; then
+    info "Found existing data at ./data/ — will use bind mount."
   fi
 
-  if docker ps --format '{{.Names}}' | grep -q "^corescope-prod$"; then
+  if docker ps --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
     log "Container already running."
+    # Check port mappings match
+    if ! check_port_match; then
+      warn "Container port mappings don't match Caddyfile configuration."
+      warn "Current ports: $(get_current_ports)"
+      warn "Required ports: $(get_required_ports)"
+      if confirm "Recreate container with correct ports?"; then
+        recreate_container
+        log "Container recreated with correct ports."
+      fi
+    fi
+  elif docker ps -a --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
+    # Exists but stopped — check ports before starting
+    if ! check_port_match; then
+      warn "Stopped container has wrong port mappings."
+      warn "Current ports: $(get_current_ports)"
+      warn "Required ports: $(get_required_ports)"
+      if confirm "Recreate container with correct ports?"; then
+        recreate_container
+        log "Container recreated with correct ports."
+      else
+        info "Starting existing container (ports unchanged)..."
+        docker start "$CONTAINER_NAME"
+        log "Started (with old port mappings)."
+      fi
+    else
+      info "Container exists but is stopped. Starting..."
+      docker start "$CONTAINER_NAME"
+      log "Started."
+    fi
   else
-    mkdir -p "$PROD_DATA"
+    recreate_container
-    docker compose up -d prod
     log "Container started."
   fi
   mark_done "container"
@@ -325,7 +431,7 @@ cmd_setup() {
   # ── Step 6: Verify ──
   step 6 "Verifying"
 
-  if docker ps --format '{{.Names}}' | grep -q "^corescope-prod$"; then
+  if docker ps --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
     verify_health
 
     CADDYFILE_DOMAIN=$(grep -v '^#' caddy-config/Caddyfile 2>/dev/null | head -1 | tr -d ' {')
@@ -357,7 +463,7 @@ cmd_setup() {
     err "Container failed to start."
     echo ""
     echo "   Check what went wrong:"
-    echo "     docker compose logs prod"
+    echo "     docker logs ${CONTAINER_NAME}"
     echo ""
     echo "   Common fixes:"
     echo "     • Invalid config.json — check JSON syntax"
@@ -429,72 +535,132 @@ cmd_start() {
     WITH_STAGING=true
   fi
 
-  if $WITH_STAGING; then
+  if $COMPOSE_MODE; then
-    # Prepare staging data and config
+    if $WITH_STAGING; then
-    prepare_staging_db
+      # Prepare staging data and config
-    prepare_staging_config
+      prepare_staging_db
+      prepare_staging_config
 
-    info "Starting production container (corescope-prod) on ports ${PROD_HTTP_PORT:-80}/${PROD_HTTPS_PORT:-443}..."
+      info "Starting production container (corescope-prod) on ports ${PROD_HTTP_PORT:-80}/${PROD_HTTPS_PORT:-443}..."
-    info "Starting staging container (corescope-staging) on port ${STAGING_HTTP_PORT:-81}..."
+      info "Starting staging container (corescope-staging) on port ${STAGING_HTTP_PORT:-81}..."
-    docker compose --profile staging up -d
+      docker compose --profile staging up -d
-    log "Production started on ports ${PROD_HTTP_PORT:-80}/${PROD_HTTPS_PORT:-443}/${PROD_MQTT_PORT:-1883}"
+      log "Production started on ports ${PROD_HTTP_PORT:-80}/${PROD_HTTPS_PORT:-443}/${PROD_MQTT_PORT:-1883}"
-    log "Staging started on port ${STAGING_HTTP_PORT:-81} (MQTT: ${STAGING_MQTT_PORT:-1884})"
+      log "Staging started on port ${STAGING_HTTP_PORT:-81} (MQTT: ${STAGING_MQTT_PORT:-1884})"
+    else
+      info "Starting production container (corescope-prod) on ports ${PROD_HTTP_PORT:-80}/${PROD_HTTPS_PORT:-443}..."
+      docker compose up -d prod
+      log "Production started. Staging NOT running (use --with-staging to start both)."
+    fi
   else
-    info "Starting production container (corescope-prod) on ports ${PROD_HTTP_PORT:-80}/${PROD_HTTPS_PORT:-443}..."
+    # Legacy single-container mode
-    docker compose up -d prod
+    if $WITH_STAGING; then
-    log "Production started. Staging NOT running (use --with-staging to start both)."
+      err "--with-staging requires docker-compose.yml. Run setup or add docker-compose.yml first."
+      exit 1
+    fi
+    warn "No docker-compose.yml found — using legacy single-container mode."
+    if docker ps --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
+      warn "Already running."
+    elif docker ps -a --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
+      if ! check_port_match; then
+        warn "Container port mappings don't match Caddyfile configuration."
+        warn "Current ports: $(get_current_ports)"
+        warn "Required ports: $(get_required_ports)"
+        if confirm "Recreate container with correct ports?"; then
+          recreate_container
+          log "Container recreated and started with correct ports."
+          return
+        fi
+      fi
+      docker start "$CONTAINER_NAME"
+      log "Started."
+    else
+      err "Container doesn't exist. Run './manage.sh setup' first."
+      exit 1
+    fi
   fi
 }
 
 cmd_stop() {
   local TARGET="${1:-all}"
 
-  case "$TARGET" in
+  if $COMPOSE_MODE; then
-    prod)
+    case "$TARGET" in
-      info "Stopping production container (corescope-prod)..."
+      prod)
-      docker compose stop prod
+        info "Stopping production container (corescope-prod)..."
-      log "Production stopped."
+        docker compose stop prod
-      ;;
+        log "Production stopped."
-    staging)
+        ;;
-      info "Stopping staging container (corescope-staging)..."
+      staging)
-      docker compose --profile staging stop staging
+        info "Stopping staging container (corescope-staging)..."
-      log "Staging stopped."
+        docker compose stop staging
-      ;;
+        log "Staging stopped."
-    all)
+        ;;
-      info "Stopping all containers..."
+      all)
-      docker compose --profile staging --profile staging-go down
+        info "Stopping all containers..."
-      log "All containers stopped."
+        docker compose --profile staging --profile staging-go down 2>/dev/null
-      ;;
+        docker rm -f "$CONTAINER_NAME" 2>/dev/null
-    *)
+        log "All containers stopped."
-      err "Usage: ./manage.sh stop [prod|staging|all]"
+        ;;
-      exit 1
+      *)
-      ;;
+        err "Usage: ./manage.sh stop [prod|staging|all]"
-  esac
+        exit 1
+        ;;
+    esac
+  else
+    # Legacy mode
+    docker stop "$CONTAINER_NAME" 2>/dev/null && log "Stopped." || warn "Not running."
+  fi
 }
 
 cmd_restart() {
-  local TARGET="${1:-prod}"
+  if $COMPOSE_MODE; then
-  case "$TARGET" in
+    local TARGET="${1:-prod}"
-    prod)
+    case "$TARGET" in
-      info "Restarting production container (corescope-prod)..."
+      prod)
-      docker compose up -d --force-recreate prod
+        info "Restarting production container (corescope-prod)..."
-      log "Production restarted."
+        docker compose up -d --force-recreate prod
-      ;;
+        log "Production restarted."
-    staging)
+        ;;
-      info "Restarting staging container (corescope-staging)..."
+      staging)
-      docker compose --profile staging up -d --force-recreate staging
+        info "Restarting staging container (corescope-staging)..."
-      log "Staging restarted."
+        docker compose --profile staging up -d --force-recreate staging
-      ;;
+        log "Staging restarted."
-    all)
+        ;;
-      info "Restarting all containers..."
+      all)
-      docker compose --profile staging up -d --force-recreate
+        info "Restarting all containers..."
-      log "All containers restarted."
+        docker compose --profile staging up -d --force-recreate
-      ;;
+        log "All containers restarted."
-    *)
+        ;;
-      err "Usage: ./manage.sh restart [prod|staging|all]"
+      *)
+        err "Usage: ./manage.sh restart [prod|staging|all]"
+        exit 1
+        ;;
+    esac
+  else
+    # Legacy mode
+    if docker ps --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
+      if ! check_port_match; then
+        warn "Port mappings have changed. Recreating container..."
+        recreate_container
+        log "Container recreated with correct ports."
+      else
+        docker restart "$CONTAINER_NAME"
+        log "Restarted."
+      fi
+    elif docker ps -a --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
+      if ! check_port_match; then
+        warn "Port mappings have changed. Recreating container..."
+        recreate_container
+        log "Container recreated with correct ports."
+      else
+        docker start "$CONTAINER_NAME"
+        log "Started."
+      fi
+    else
+      err "Not running. Use './manage.sh setup'."
       exit 1
-      ;;
+    fi
-  esac
+  fi
 }
 
 # ─── Status ───────────────────────────────────────────────────────────────
@@ -529,68 +695,143 @@ show_container_status() {
 
 cmd_status() {
   echo ""
-  echo "═══════════════════════════════════════"
-  echo "  CoreScope Status"
-  echo "═══════════════════════════════════════"
-  echo ""
 
-  # Production
+  if $COMPOSE_MODE; then
-  show_container_status "corescope-prod" "Production"
+    echo "═══════════════════════════════════════"
-  echo ""
+    echo "  CoreScope Status (Compose)"
+    echo "═══════════════════════════════════════"
+    echo ""
+
+    # Production
+    show_container_status "corescope-prod" "Production"
+    echo ""
+
+    # Staging
+    if container_running "corescope-staging"; then
+      show_container_status "corescope-staging" "Staging"
+    else
+      info "Staging (corescope-staging): Not running (use --with-staging to start both)"
+    fi
+    echo ""
+
+    # Disk usage
+    if [ -d "$PROD_DATA" ] && [ -f "$PROD_DATA/meshcore.db" ]; then
+      local db_size
+      db_size=$(du -h "$PROD_DATA/meshcore.db" 2>/dev/null | cut -f1)
+      info "Production DB: ${db_size}"
+    fi
+    if [ -d "$STAGING_DATA" ] && [ -f "$STAGING_DATA/meshcore.db" ]; then
+      local staging_db_size
+      staging_db_size=$(du -h "$STAGING_DATA/meshcore.db" 2>/dev/null | cut -f1)
+      info "Staging DB: ${staging_db_size}"
+    fi
 
-  # Staging
-  if container_running "corescope-staging"; then
-    show_container_status "corescope-staging" "Staging"
   else
-    info "Staging (corescope-staging): Not running (use --with-staging to start both)"
+    # Legacy single-container status
-  fi
+    if docker ps --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
-  echo ""
+      log "Container is running."
+      echo ""
+      docker ps --filter "name=${CONTAINER_NAME}" --format "   Status: {{.Status}}"
+      docker ps --filter "name=${CONTAINER_NAME}" --format "   Ports:  {{.Ports}}"
+      echo ""
 
-  # Disk usage
+      info "Service health:"
-  if [ -d "$PROD_DATA" ] && [ -f "$PROD_DATA/meshcore.db" ]; then
+      # Server
-    local db_size
+      if docker exec "$CONTAINER_NAME" wget -qO /dev/null http://localhost:3000/api/stats 2>/dev/null; then
-    db_size=$(du -h "$PROD_DATA/meshcore.db" 2>/dev/null | cut -f1)
+        STATS=$(docker exec "$CONTAINER_NAME" wget -qO- http://localhost:3000/api/stats 2>/dev/null)
-    info "Production DB: ${db_size}"
+        PACKETS=$(echo "$STATS" | grep -oP '"totalPackets":\K[0-9]+' 2>/dev/null || echo "?")
-  fi
+        NODES=$(echo "$STATS" | grep -oP '"totalNodes":\K[0-9]+' 2>/dev/null || echo "?")
-  if [ -d "$STAGING_DATA" ] && [ -f "$STAGING_DATA/meshcore.db" ]; then
+        log "  Server — ${PACKETS} packets, ${NODES} nodes"
-    local staging_db_size
+      else
-    staging_db_size=$(du -h "$STAGING_DATA/meshcore.db" 2>/dev/null | cut -f1)
+        err "  Server — not responding"
-    info "Staging DB: ${staging_db_size}"
+      fi
-  fi
 
+      # Mosquitto
+      if docker exec "$CONTAINER_NAME" pgrep mosquitto &>/dev/null; then
+        log "  Mosquitto — running"
+      else
+        err "  Mosquitto — not running"
+      fi
+
+      # Caddy
+      if docker exec "$CONTAINER_NAME" pgrep caddy &>/dev/null; then
+        log "  Caddy — running"
+      else
+        err "  Caddy — not running"
+      fi
+
+      # Check for MQTT errors in recent logs
+      MQTT_ERRORS=$(docker logs "$CONTAINER_NAME" --tail 50 2>&1 | grep -i 'mqtt.*error\|mqtt.*fail\|ECONNREFUSED.*1883' || true)
+      if [ -n "$MQTT_ERRORS" ]; then
+        echo ""
+        warn "MQTT errors in recent logs:"
+        echo "$MQTT_ERRORS" | head -3 | sed 's/^/   /'
+      fi
+
+      # Port mapping check
+      if ! check_port_match; then
+        echo ""
+        warn "Port mappings don't match Caddyfile. Run './manage.sh restart' to fix."
+      fi
+
+      # Disk usage
+      DB_SIZE=$(docker exec "$CONTAINER_NAME" du -h /app/data/meshcore.db 2>/dev/null | cut -f1)
+      if [ -n "$DB_SIZE" ]; then
+        echo ""
+        info "Database size: ${DB_SIZE}"
+      fi
+    else
+      err "Container is not running."
+      if docker ps -a --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
+        echo "   Start with: ./manage.sh start"
+      else
+        echo "   Set up with: ./manage.sh setup"
+      fi
+    fi
+  fi
   echo ""
 }
 
 # ─── Logs ─────────────────────────────────────────────────────────────────
 
 cmd_logs() {
-  local TARGET="${1:-prod}"
+  if $COMPOSE_MODE; then
-  local LINES="${2:-100}"
+    local TARGET="${1:-prod}"
-  case "$TARGET" in
+    local LINES="${2:-100}"
-    prod)
+    case "$TARGET" in
-      info "Tailing production logs..."
+      prod)
-      docker compose logs -f --tail="$LINES" prod
+        info "Tailing production logs..."
-      ;;
+        docker compose logs -f --tail="$LINES" prod
-    staging)
+        ;;
-      if container_running "corescope-staging"; then
+      staging)
-        info "Tailing staging logs..."
+        if container_running "corescope-staging"; then
-        docker compose logs -f --tail="$LINES" staging
+          info "Tailing staging logs..."
-      else
+          docker compose logs -f --tail="$LINES" staging
-        err "Staging container is not running."
+        else
-        info "Start with: ./manage.sh start --with-staging"
+          err "Staging container is not running."
+          info "Start with: ./manage.sh start --with-staging"
+          exit 1
+        fi
+        ;;
+      *)
+        err "Usage: ./manage.sh logs [prod|staging] [lines]"
         exit 1
-      fi
+        ;;
-      ;;
+    esac
-    *)
+  else
-      err "Usage: ./manage.sh logs [prod|staging] [lines]"
+    # Legacy mode
-      exit 1
+    docker logs -f "$CONTAINER_NAME" --tail "${1:-100}"
-      ;;
+  fi
-  esac
 }
 
 # ─── Promote ──────────────────────────────────────────────────────────────
 
 cmd_promote() {
+  if ! $COMPOSE_MODE; then
+    err "Promotion requires Docker Compose setup (docker-compose.yml)."
+    exit 1
+  fi
+
   echo ""
   info "Promotion Flow: Staging → Production"
   echo ""
@@ -665,10 +906,10 @@ cmd_update() {
   git pull
 
   info "Rebuilding image..."
-  docker compose build prod
+  docker build --build-arg APP_VERSION=$(node -p "require('./package.json').version" 2>/dev/null || echo "unknown") --build-arg GIT_COMMIT=$(git rev-parse --short HEAD 2>/dev/null || echo "unknown") --build-arg BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ) -t "$IMAGE_NAME" .
 
   info "Restarting with new image..."
-  docker compose up -d --force-recreate prod
+  recreate_container
 
   log "Updated and restarted. Data preserved."
 }
@@ -683,13 +924,12 @@ cmd_backup() {
   info "Backing up to ${BACKUP_DIR}/"
 
   # Database
-  # Always use bind mount path (from .env or default)
+  DB_PATH=$(docker volume inspect "$DATA_VOLUME" --format '{{ .Mountpoint }}' 2>/dev/null)/meshcore.db
-  DB_PATH="$PROD_DATA/meshcore.db"
   if [ -f "$DB_PATH" ]; then
     cp "$DB_PATH" "$BACKUP_DIR/meshcore.db"
     log "Database ($(du -h "$BACKUP_DIR/meshcore.db" | cut -f1))"
-  elif container_running "corescope-prod"; then
+  elif docker ps --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
-    docker cp corescope-prod:/app/data/meshcore.db "$BACKUP_DIR/meshcore.db" 2>/dev/null && \
+    docker cp "${CONTAINER_NAME}:/app/data/meshcore.db" "$BACKUP_DIR/meshcore.db" 2>/dev/null && \
       log "Database (via docker cp)" || warn "Could not backup database"
   else
     warn "Database not found (container not running?)"
@@ -708,8 +948,7 @@ cmd_backup() {
   fi
 
   # Theme
-  # Always use bind mount path (from .env or default)
+  THEME_PATH=$(docker volume inspect "$DATA_VOLUME" --format '{{ .Mountpoint }}' 2>/dev/null)/theme.json
-  THEME_PATH="$PROD_DATA/theme.json"
   if [ -f "$THEME_PATH" ]; then
     cp "$THEME_PATH" "$BACKUP_DIR/theme.json"
     log "theme.json"
@@ -782,12 +1021,15 @@ cmd_restore() {
   info "Backing up current state..."
   cmd_backup "./backups/corescope-pre-restore-$(date +%Y%m%d-%H%M%S)"
 
-  docker compose stop prod 2>/dev/null || true
+  docker stop "$CONTAINER_NAME" 2>/dev/null || true
 
   # Restore database
-  mkdir -p "$PROD_DATA"
+  DEST_DB=$(docker volume inspect "$DATA_VOLUME" --format '{{ .Mountpoint }}' 2>/dev/null)/meshcore.db
-  DEST_DB="$PROD_DATA/meshcore.db"
+  if [ -d "$(dirname "$DEST_DB")" ]; then
-  cp "$DB_FILE" "$DEST_DB"
+    cp "$DB_FILE" "$DEST_DB"
+  else
+    docker cp "$DB_FILE" "${CONTAINER_NAME}:/app/data/meshcore.db"
+  fi
   log "Database restored"
 
   # Restore config if present
@@ -805,25 +1047,27 @@ cmd_restore() {
 
   # Restore theme if present
   if [ -n "$THEME_FILE" ] && [ -f "$THEME_FILE" ]; then
-    DEST_THEME="$PROD_DATA/theme.json"
+    DEST_THEME=$(docker volume inspect "$DATA_VOLUME" --format '{{ .Mountpoint }}' 2>/dev/null)/theme.json
-    cp "$THEME_FILE" "$DEST_THEME"
+    if [ -d "$(dirname "$DEST_THEME")" ]; then
+      cp "$THEME_FILE" "$DEST_THEME"
+    fi
     log "theme.json restored"
   fi
 
-  docker compose up -d prod
+  docker start "$CONTAINER_NAME"
   log "Restored and restarted."
 }
 
 # ─── MQTT Test ────────────────────────────────────────────────────────────
 
 cmd_mqtt_test() {
-  if ! container_running "corescope-prod"; then
+  if ! docker ps --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
     err "Container not running. Start with: ./manage.sh start"
     exit 1
   fi
 
   info "Listening for MQTT messages (10 second timeout)..."
-  MSG=$(docker exec corescope-prod mosquitto_sub -h localhost -t 'meshcore/#' -C 1 -W 10 2>/dev/null)
+  MSG=$(docker exec "$CONTAINER_NAME" mosquitto_sub -h localhost -t 'meshcore/#' -C 1 -W 10 2>/dev/null)
   if [ -n "$MSG" ]; then
     log "Received MQTT message:"
     echo "   $MSG" | head -c 200
@@ -840,19 +1084,21 @@ cmd_mqtt_test() {
 
 cmd_reset() {
   echo ""
-  warn "This will remove all containers, images, and setup state."
+  warn "This will remove the container, image, and setup state."
-  warn "Your config.json, Caddyfile, and data directory are NOT deleted."
+  warn "Your config.json, Caddyfile, and data volume are NOT deleted."
   echo ""
   if ! confirm "Continue?"; then
     echo "   Aborted."
     exit 0
   fi
 
-  docker compose --profile staging --profile staging-go down --rmi local 2>/dev/null || true
+  docker stop "$CONTAINER_NAME" 2>/dev/null || true
+  docker rm "$CONTAINER_NAME" 2>/dev/null || true
+  docker rmi "$IMAGE_NAME" 2>/dev/null || true
   rm -f "$STATE_FILE"
 
   log "Reset complete. Run './manage.sh setup' to start over."
-  echo "   Data directory: $PROD_DATA (not removed)"
+  echo "   Data volume preserved. To delete it: docker volume rm ${DATA_VOLUME}"
 }
 
 # ─── Help ─────────────────────────────────────────────────────────────────
@@ -882,7 +1128,11 @@ cmd_help() {
   echo "    restore <d>        Restore from backup dir or .db file"
   echo "    mqtt-test          Check if MQTT data is flowing"
   echo ""
-  echo "All commands use docker compose with docker-compose.yml."
+  if $COMPOSE_MODE; then
+    info "Docker Compose mode detected (docker-compose.yml present)."
+  else
+    warn "Legacy mode (no docker-compose.yml). Some commands unavailable."
+  fi
   echo ""
 }
 

public/packets.js

@@ -1512,12 +1512,14 @@
       rows += fieldRow(off + 1, 'Sender', decoded.sender || '—', '');
       if (decoded.sender_timestamp) rows += fieldRow(off + 2, 'Sender Time', decoded.sender_timestamp, '');
     } else if (decoded.type === 'ACK') {
-      rows += fieldRow(off, 'Checksum (4B)', decoded.ackChecksum || '', '');
+      rows += fieldRow(off, 'Dest Hash (6B)', decoded.destHash || '', '');
+      rows += fieldRow(off + 6, 'Src Hash (6B)', decoded.srcHash || '', '');
+      rows += fieldRow(off + 12, 'Extra (6B)', decoded.extraHash || '', '');
     } else if (decoded.destHash !== undefined) {
-      rows += fieldRow(off, 'Dest Hash (1B)', decoded.destHash || '', '');
+      rows += fieldRow(off, 'Dest Hash (6B)', decoded.destHash || '', '');
-      rows += fieldRow(off + 1, 'Src Hash (1B)', decoded.srcHash || '', '');
+      rows += fieldRow(off + 6, 'Src Hash (6B)', decoded.srcHash || '', '');
-      rows += fieldRow(off + 2, 'MAC (2B)', decoded.mac || '', '');
+      rows += fieldRow(off + 12, 'MAC (4B)', decoded.mac || '', '');
-      rows += fieldRow(off + 4, 'Encrypted Data', truncate(decoded.encryptedData || '', 30), '');
+      rows += fieldRow(off + 16, 'Encrypted Data', truncate(decoded.encryptedData || '', 30), '');
     } else {
       rows += fieldRow(off, 'Raw', truncate(buf.slice(off * 2), 40), '');
     }

test-decoder-spec.js

@@ -122,14 +122,13 @@ console.log('── Spec Tests: Transport Codes ──');
 
 {
   // Route type 0 (TRANSPORT_FLOOD) and 3 (TRANSPORT_DIRECT) should have 4-byte transport codes
-  // Route type 0: header=0x14 = payloadType 5 (GRP_TXT), routeType 0 (TRANSPORT_FLOOD)
+  // Route type 0: header byte = 0bPPPPPP00, e.g. 0x14 = payloadType 5 (GRP_TXT), routeType 0
-  // Format: header(1) + transportCodes(4) + pathByte(1) + payload
+  const hex = '1400' + 'AABB' + 'CCDD' + '1A' + '00'.repeat(10); // transport codes + GRP_TXT payload
-  const hex = '14' + 'AABB' + 'CCDD' + '00' + '1A' + '00'.repeat(10); // transport codes + pathByte + GRP_TXT payload
   const p = decodePacket(hex);
   assertEq(p.header.routeType, 0, 'transport: routeType=0 (TRANSPORT_FLOOD)');
   assert(p.transportCodes !== null, 'transport: transportCodes present for TRANSPORT_FLOOD');
-  assertEq(p.transportCodes.code1, 'AABB', 'transport: code1');
+  assertEq(p.transportCodes.nextHop, 'AABB', 'transport: nextHop');
-  assertEq(p.transportCodes.code2, 'CCDD', 'transport: code2');
+  assertEq(p.transportCodes.lastHop, 'CCDD', 'transport: lastHop');
 }
 
 {
@@ -258,13 +257,13 @@ console.log('── Spec Tests: Advert Payload ──');
 
 console.log('── Spec Tests: Encrypted Payload Format ──');
 
-// Spec says v1 encrypted payloads: dest(1)+src(1)+MAC(2)+cipher — decoder matches this.
+// NOTE: Spec says v1 encrypted payloads have dest(1) + src(1) + MAC(2) + ciphertext
+// But decoder reads dest(6) + src(6) + MAC(4) + ciphertext
+// This is a known discrepancy — the decoder matches production behavior, not the spec.
+// The spec may describe the firmware's internal addressing while the OTA format differs,
+// or the decoder may be parsing the fields differently. Production data validates the decoder.
 {
-  const hex = '0100' + 'AA' + 'BB' + 'CCDD' + '00'.repeat(10);
+  note('Spec says v1 encrypted payloads: dest(1)+src(1)+MAC(2)+cipher, but decoder reads dest(6)+src(6)+MAC(4)+cipher — decoder matches prod data');
-  const p = decodePacket(hex);
-  assertEq(p.payload.destHash, 'aa', 'encrypted payload: dest is 1 byte');
-  assertEq(p.payload.srcHash, 'bb', 'encrypted payload: src is 1 byte');
-  assertEq(p.payload.mac, 'ccdd', 'encrypted payload: MAC is 2 bytes');
 }
 
 console.log('── Spec Tests: validateAdvert ──');

test-decoder.js

@@ -28,22 +28,22 @@ test('FLOOD + ADVERT = 0x11', () => {
 });
 
 test('TRANSPORT_FLOOD = routeType 0', () => {
-  // header=0x00 (TRANSPORT_FLOOD + REQ), transportCodes=AABB+CCDD, pathByte=0x00, payload
+  // 0x00 = TRANSPORT_FLOOD + REQ(0), needs transport codes + 16 byte payload
-  const hex = '00' + 'AABB' + 'CCDD' + '00' + '00'.repeat(16);
+  const hex = '0000' + 'AABB' + 'CCDD' + '00'.repeat(16);
   const p = decodePacket(hex);
   assert.strictEqual(p.header.routeType, 0);
   assert.strictEqual(p.header.routeTypeName, 'TRANSPORT_FLOOD');
   assert.notStrictEqual(p.transportCodes, null);
-  assert.strictEqual(p.transportCodes.code1, 'AABB');
+  assert.strictEqual(p.transportCodes.nextHop, 'AABB');
-  assert.strictEqual(p.transportCodes.code2, 'CCDD');
+  assert.strictEqual(p.transportCodes.lastHop, 'CCDD');
 });
 
 test('TRANSPORT_DIRECT = routeType 3', () => {
-  const hex = '03' + '1122' + '3344' + '00' + '00'.repeat(16);
+  const hex = '0300' + '1122' + '3344' + '00'.repeat(16);
   const p = decodePacket(hex);
   assert.strictEqual(p.header.routeType, 3);
   assert.strictEqual(p.header.routeTypeName, 'TRANSPORT_DIRECT');
-  assert.strictEqual(p.transportCodes.code1, '1122');
+  assert.strictEqual(p.transportCodes.nextHop, '1122');
 });
 
 test('DIRECT = routeType 2, no transport codes', () => {
@@ -358,7 +358,9 @@ test('ACK decode', () => {
   const hex = '0D00' + '00'.repeat(18);
   const p = decodePacket(hex);
   assert.strictEqual(p.payload.type, 'ACK');
-  assert(p.payload.ackChecksum);
+  assert(p.payload.destHash);
+  assert(p.payload.srcHash);
+  assert(p.payload.extraHash);
 });
 
 test('ACK too short', () => {
@@ -422,9 +424,9 @@ test('TRACE decode', () => {
   const hex = '2500' + '00'.repeat(12);
   const p = decodePacket(hex);
   assert.strictEqual(p.payload.type, 'TRACE');
-  assert(p.payload.tag !== undefined);
-  assert(p.payload.authCode !== undefined);
   assert.strictEqual(p.payload.flags, 0);
+  assert(p.payload.tag !== undefined);
+  assert(p.payload.destHash);
 });
 
 test('TRACE too short', () => {
@@ -458,18 +460,16 @@ test('Transport route too short throws', () => {
   assert.throws(() => decodePacket('0000'), /too short for transport/);
 });
 
-test('Corrupt packet #183 — TRANSPORT_DIRECT with correct field order', () => {
+test('Corrupt packet #183 — path overflow capped to buffer', () => {
   const hex = 'BBAD6797EC8751D500BF95A1A776EF580E665BCBF6A0BBE03B5E730707C53489B8C728FD3FB902397197E1263CEC21E52465362243685DBBAD6797EC8751C90A75D9FD8213155D';
   const p = decodePacket(hex);
   assert.strictEqual(p.header.routeType, 3, 'routeType should be TRANSPORT_DIRECT');
   assert.strictEqual(p.header.payloadTypeName, 'UNKNOWN');
-  // transport codes are bytes 1-4, pathByte=0x87 at byte 5
+  // pathByte 0xAD claims 45 hops × 3 bytes = 135, but only 65 bytes available
-  assert.strictEqual(p.transportCodes.code1, 'AD67');
-  assert.strictEqual(p.transportCodes.code2, '97EC');
-  // pathByte 0x87: hashSize=3, hashCount=7
   assert.strictEqual(p.path.hashSize, 3);
-  assert.strictEqual(p.path.hashCount, 7);
+  assert.strictEqual(p.path.hashCount, 21, 'hashCount capped to fit buffer');
-  assert.strictEqual(p.path.hops.length, 7);
+  assert.strictEqual(p.path.hops.length, 21);
+  assert.strictEqual(p.path.truncated, true);
   // No empty strings in hops
   assert(p.path.hops.every(h => h.length > 0), 'no empty hops');
 });