Merge branch 'master' into fix/remove-packets-v-fallbacks

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.env.example

@@ -1,44 +1,17 @@
 # MeshCore Analyzer — Environment Configuration
-# Copy to .env and customize. All values have sensible defaults.
+# Copy to .env and customize. All values have sensible defaults in docker-compose.yml.
 #
-# This file is read by BOTH docker compose AND manage.sh — one source of truth.
 # Each environment keeps config + data together in one directory:
 #   ~/meshcore-data/config.json, meshcore.db, Caddyfile, theme.json
 #   ~/meshcore-staging-data/config.json, meshcore.db, Caddyfile
 
 # --- Production ---
-# Data directory (database, theme, etc.)
-# Default: ~/meshcore-data
-# Used by: docker compose, manage.sh
+PROD_HTTP_PORT=80
+PROD_HTTPS_PORT=443
+PROD_MQTT_PORT=1883
 PROD_DATA_DIR=~/meshcore-data
 
-# HTTP port for web UI
-# Default: 80
-# Used by: docker compose
-PROD_HTTP_PORT=80
-
-# HTTPS port for web UI (TLS via Caddy)
-# Default: 443
-# Used by: docker compose
-PROD_HTTPS_PORT=443
-
-# MQTT port for observer connections
-# Default: 1883
-# Used by: docker compose
-PROD_MQTT_PORT=1883
-
 # --- Staging (HTTP only, no HTTPS) ---
-# Data directory
-# Default: ~/meshcore-staging-data
-# Used by: docker compose
-STAGING_DATA_DIR=~/meshcore-staging-data
-
-# HTTP port
-# Default: 81
-# Used by: docker compose
 STAGING_HTTP_PORT=81
-
-# MQTT port
-# Default: 1884
-# Used by: docker compose
 STAGING_MQTT_PORT=1884
+STAGING_DATA_DIR=~/meshcore-staging-data

.github/workflows/deploy.yml

@@ -10,9 +10,14 @@ on:
       - 'docs/**'
   pull_request:
     branches: [master]
+    paths-ignore:
+      - '**.md'
+      - 'LICENSE'
+      - '.gitignore'
+      - 'docs/**'
 
 concurrency:
-  group: deploy-${{ github.event.pull_request.number || github.ref }}
+  group: deploy
   cancel-in-progress: true
 
 env:
@@ -36,25 +41,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-
-      - name: Skip if docs-only change
-        id: docs-check
-        run: |
-          if [ "${{ github.event_name }}" = "pull_request" ]; then
-            CHANGED=$(git diff --name-only origin/${{ github.base_ref }}...HEAD)
-            NON_DOCS=$(echo "$CHANGED" | grep -cvE '\.(md)$|^LICENSE$|^\.gitignore$|^docs/' || true)
-            if [ "$NON_DOCS" -eq 0 ]; then
-              echo "docs_only=true" >> $GITHUB_OUTPUT
-              echo "📄 Docs-only PR — skipping heavy CI"
-            fi
-          fi
+        uses: actions/checkout@v4
 
       - name: Set up Go 1.22
-        if: steps.docs-check.outputs.docs_only != 'true'
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
           go-version: '1.22'
           cache-dependency-path: |
@@ -62,7 +52,6 @@ jobs:
             cmd/ingestor/go.sum
 
       - name: Build and test Go server (with coverage)
-        if: steps.docs-check.outputs.docs_only != 'true'
         run: |
           set -e -o pipefail
           cd cmd/server
@@ -72,7 +61,6 @@ jobs:
           go tool cover -func=server-coverage.out | tail -1
 
       - name: Build and test Go ingestor (with coverage)
-        if: steps.docs-check.outputs.docs_only != 'true'
         run: |
           set -e -o pipefail
           cd cmd/ingestor
@@ -82,7 +70,6 @@ jobs:
           go tool cover -func=ingestor-coverage.out | tail -1
 
       - name: Verify proto syntax (all .proto files compile)
-        if: steps.docs-check.outputs.docs_only != 'true'
         run: |
           set -e
           echo "Installing protoc..."
@@ -97,7 +84,7 @@ jobs:
           echo "✅ All .proto files are syntactically valid"
 
       - name: Generate Go coverage badges
-        if: always() && steps.docs-check.outputs.docs_only != 'true'
+        if: always()
         run: |
           mkdir -p .badges
 
@@ -135,16 +122,9 @@ jobs:
           echo "| Server | ${SERVER_COV}% |" >> $GITHUB_STEP_SUMMARY
           echo "| Ingestor | ${INGESTOR_COV}% |" >> $GITHUB_STEP_SUMMARY
 
-      - name: Cancel workflow on failure
-        if: failure()
-        run: |
-          curl -s -X POST \
-            -H "Authorization: Bearer ${{ github.token }}" \
-            "https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/cancel"
-
       - name: Upload Go coverage badges
         if: always()
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v4
         with:
           name: go-badges
           path: .badges/go-*.json
@@ -156,54 +136,22 @@ jobs:
   # ───────────────────────────────────────────────────────────────
   node-test:
     name: "🧪 Node.js Tests"
-    runs-on: [self-hosted, Linux]
-    defaults:
-      run:
-        shell: bash
+    runs-on: self-hosted
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
         with:
-          fetch-depth: 0
-
-      - name: Skip if docs-only change
-        id: docs-check
-        run: |
-          if [ "${{ github.event_name }}" = "pull_request" ]; then
-            CHANGED=$(git diff --name-only origin/${{ github.base_ref }}...HEAD)
-            NON_DOCS=$(echo "$CHANGED" | grep -cvE '\.(md)$|^LICENSE$|^\.gitignore$|^docs/' || true)
-            if [ "$NON_DOCS" -eq 0 ]; then
-              echo "docs_only=true" >> $GITHUB_OUTPUT
-              echo "📄 Docs-only PR — skipping heavy CI"
-            fi
-          fi
+          fetch-depth: 2
 
       - name: Set up Node.js 22
-        if: steps.docs-check.outputs.docs_only != 'true'
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v4
         with:
           node-version: '22'
 
-      - name: Set up Go 1.22
-        if: steps.docs-check.outputs.docs_only != 'true'
-        uses: actions/setup-go@v6
-        with:
-          go-version: '1.22'
-          cache-dependency-path: cmd/server/go.sum
-
-      - name: Build Go server for E2E tests
-        if: steps.docs-check.outputs.docs_only != 'true'
-        run: |
-          cd cmd/server
-          go build -o ../../corescope-server .
-          echo "Go server built successfully"
-
       - name: Install npm dependencies
-        if: steps.docs-check.outputs.docs_only != 'true'
         run: npm ci --production=false
 
       - name: Detect changed files
-        if: steps.docs-check.outputs.docs_only != 'true'
         id: changes
         run: |
           BACKEND=$(git diff --name-only HEAD~1 | grep -cE '^(server|db|decoder|packet-store|server-helpers|iata-coords)\.js$' || true)
@@ -219,7 +167,7 @@ jobs:
           echo "Changes: backend=$BACKEND frontend=$FRONTEND tests=$TESTS ci=$CI"
 
       - name: Run backend tests with coverage
-        if: steps.docs-check.outputs.docs_only != 'true' && steps.changes.outputs.backend == 'true'
+        if: steps.changes.outputs.backend == 'true'
         run: |
           npx c8 --reporter=text-summary --reporter=text sh test-all.sh 2>&1 | tee test-output.txt
           
@@ -237,28 +185,24 @@ jobs:
           echo "## Backend: ${TOTAL_PASS} tests, ${BE_COVERAGE}% coverage" >> $GITHUB_STEP_SUMMARY
 
       - name: Run backend tests (quick, no coverage)
-        if: steps.docs-check.outputs.docs_only != 'true' && steps.changes.outputs.backend == 'false'
+        if: steps.changes.outputs.backend == 'false'
         run: npm run test:unit
 
       - name: Install Playwright browser
-        if: steps.docs-check.outputs.docs_only != 'true' && steps.changes.outputs.frontend == 'true'
-        run: |
-          # Install chromium (skips download if already cached on self-hosted runner)
-          npx playwright install chromium 2>/dev/null || true
-          # Install system deps only if missing (apt-get is slow)
-          npx playwright install-deps chromium 2>/dev/null || true
+        if: steps.changes.outputs.frontend == 'true'
+        run: npx playwright install chromium --with-deps 2>/dev/null || true
 
       - name: Instrument frontend JS for coverage
-        if: steps.docs-check.outputs.docs_only != 'true' && steps.changes.outputs.frontend == 'true'
+        if: steps.changes.outputs.frontend == 'true'
         run: sh scripts/instrument-frontend.sh
 
       - name: Start instrumented test server on port 13581
-        if: steps.docs-check.outputs.docs_only != 'true' && steps.changes.outputs.frontend == 'true'
+        if: steps.changes.outputs.frontend == 'true'
         run: |
           # Kill any stale server on 13581
           fuser -k 13581/tcp 2>/dev/null || true
           sleep 2
-          ./corescope-server -port 13581 -public public-instrumented &
+          COVERAGE=1 PORT=13581 node server.js &
           echo $! > .server.pid
           echo "Server PID: $(cat .server.pid)"
           # Health-check poll loop (up to 30s)
@@ -270,38 +214,25 @@ jobs:
             if [ "$i" -eq 30 ]; then
               echo "Server failed to start within 30s"
               echo "Last few lines from server logs:"
-              ps aux | grep "corescope-server" || echo "No server process found"
+              ps aux | grep "PORT=13581" || echo "No server process found"
               exit 1
             fi
             sleep 1
           done
 
-      - name: Run Playwright E2E + coverage collection concurrently
-        if: steps.docs-check.outputs.docs_only != 'true' && steps.changes.outputs.frontend == 'true'
-        run: |
-          # Run E2E tests and coverage collection in parallel — both use the same server
-          BASE_URL=http://localhost:13581 node test-e2e-playwright.js 2>&1 | tee e2e-output.txt &
-          E2E_PID=$!
-          BASE_URL=http://localhost:13581 node scripts/collect-frontend-coverage.js 2>&1 | tee fe-coverage-output.txt &
-          COV_PID=$!
-
-          # Wait for both — E2E must pass, coverage is best-effort
-          E2E_EXIT=0
-          wait $E2E_PID || E2E_EXIT=$?
-          wait $COV_PID || true
-
-          # Fail if E2E failed
-          [ $E2E_EXIT -ne 0 ] && exit $E2E_EXIT
-          true
-
-      - name: Generate frontend coverage badges
-        if: always() && steps.docs-check.outputs.docs_only != 'true' && steps.changes.outputs.frontend == 'true'
+      - name: Run Playwright E2E tests
+        if: steps.changes.outputs.frontend == 'true'
+        run: BASE_URL=http://localhost:13581 node test-e2e-playwright.js 2>&1 | tee e2e-output.txt
+
+      - name: Collect frontend coverage report
+        if: always() && steps.changes.outputs.frontend == 'true'
         run: |
+          BASE_URL=http://localhost:13581 node scripts/collect-frontend-coverage.js 2>&1 | tee fe-coverage-output.txt
+          
           E2E_PASS=$(grep -oP '[0-9]+(?=/)' e2e-output.txt | tail -1)
           
           mkdir -p .badges
-          # Merge E2E + coverage collector data if both exist
-          if [ -f .nyc_output/frontend-coverage.json ] || [ -f .nyc_output/e2e-coverage.json ]; then
+          if [ -f .nyc_output/frontend-coverage.json ]; then
             npx nyc report --reporter=text-summary --reporter=text 2>&1 | tee fe-report.txt
             FE_COVERAGE=$(grep 'Statements' fe-report.txt | head -1 | grep -oP '[\d.]+(?=%)' || echo "0")
             FE_COVERAGE=${FE_COVERAGE:-0}
@@ -314,7 +245,7 @@ jobs:
           echo "{\"schemaVersion\":1,\"label\":\"frontend tests\",\"message\":\"${E2E_PASS:-0} E2E passed\",\"color\":\"brightgreen\"}" > .badges/frontend-tests.json
 
       - name: Stop test server
-        if: always() && steps.docs-check.outputs.docs_only != 'true' && steps.changes.outputs.frontend == 'true'
+        if: always() && steps.changes.outputs.frontend == 'true'
         run: |
           if [ -f .server.pid ]; then
             kill $(cat .server.pid) 2>/dev/null || true
@@ -323,29 +254,18 @@ jobs:
           fi
 
       - name: Run frontend E2E (quick, no coverage)
-        if: steps.docs-check.outputs.docs_only != 'true' && steps.changes.outputs.frontend == 'false'
+        if: steps.changes.outputs.frontend == 'false'
         run: |
           fuser -k 13581/tcp 2>/dev/null || true
-          ./corescope-server -port 13581 -public public &
+          PORT=13581 node server.js &
           SERVER_PID=$!
-          # Wait for server to be ready (up to 15s)
-          for i in $(seq 1 15); do
-            curl -sf http://localhost:13581/api/stats > /dev/null 2>&1 && break
-            sleep 1
-          done
+          sleep 5
           BASE_URL=http://localhost:13581 node test-e2e-playwright.js || true
           kill $SERVER_PID 2>/dev/null || true
 
-      - name: Cancel workflow on failure
-        if: failure()
-        run: |
-          curl -s -X POST \
-            -H "Authorization: Bearer ${{ github.token }}" \
-            "https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/cancel"
-
       - name: Upload Node.js test badges
         if: always()
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v4
         with:
           name: node-badges
           path: .badges/
@@ -358,14 +278,14 @@ jobs:
   build:
     name: "🏗️ Build Docker Image"
     if: github.event_name == 'push'
-    needs: [go-test, node-test]
-    runs-on: [self-hosted, Linux]
+    needs: [go-test]
+    runs-on: self-hosted
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
 
       - name: Set up Node.js 22
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v4
         with:
           node-version: '22'
 
@@ -384,10 +304,10 @@ jobs:
     name: "🚀 Deploy Staging"
     if: github.event_name == 'push'
     needs: [build]
-    runs-on: [self-hosted, Linux]
+    runs-on: self-hosted
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
 
       - name: Start staging on port 82
         run: |
@@ -429,21 +349,21 @@ jobs:
     name: "📝 Publish Badges & Summary"
     if: github.event_name == 'push'
     needs: [deploy]
-    runs-on: [self-hosted, Linux]
+    runs-on: self-hosted
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
 
       - name: Download Go coverage badges
         continue-on-error: true
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v4
         with:
           name: go-badges
           path: .badges/
 
       - name: Download Node.js test badges
         continue-on-error: true
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v4
         with:
           name: node-badges
           path: .badges/

README.md

@@ -8,7 +8,7 @@
 
 > High-performance mesh network analyzer powered by Go. Sub-millisecond packet queries, ~300 MB memory for 56K+ packets, real-time WebSocket broadcast, full channel decryption.
 
-Self-hosted, open-source MeshCore packet analyzer. Collects MeshCore packets via MQTT, decodes them in real time, and presents a full web UI with live packet feed, interactive maps, channel chat, packet tracing, and per-node analytics.
+Self-hosted, open-source MeshCore packet analyzer — a community alternative to the closed-source `analyzer.letsmesh.net`. Collects MeshCore packets via MQTT, decodes them in real time, and presents a full web UI with live packet feed, interactive maps, channel chat, packet tracing, and per-node analytics.
 
 ## ⚡ Performance
 

RELEASE-v3.1.0.md

@@ -1,144 +0,0 @@
-# v3.1.0 — Now It's CoreScope
-
-MeshCore Analyzer has a new name: **CoreScope**. Same mesh analysis you rely on, sharper identity, and a boatload of fixes and performance wins since v3.0.0.
-
-48 commits, 30+ issues closed. Here's what changed.
-
----
-
-## 🏷️ Renamed to CoreScope
-
-The project is now **CoreScope** — frontend, backend, Docker images, manage.sh, docs, CI — everything has been updated. The URL, the API, the database, and your config all stay the same. Just a better name for the tool the community built.
-
----
-
-## ⚡ Performance
-
-| What | Before | After |
-|------|--------|-------|
-| Subpath analytics | 900 ms | **5 ms** (precomputed at ingest) |
-| Distance analytics | 1.2 s | **15 ms** (precomputed at ingest) |
-| Packet ingest (prepend) | O(n) slice copy | **O(1) append** |
-| Go runtime stats | GC stop-the-world on every call | **cached ReadMemStats** |
-| All analytics endpoints | computed per-request | **TTL-cached** |
-
-The in-memory store now precomputes subpaths and distance data as packets arrive, eliminating expensive full-table scans on the analytics endpoints. The O(n) slice prepend on every ingest — the single hottest line in the server — is gone. `ReadMemStats` calls are cached to prevent GC pause spikes under load.
-
----
-
-## 🆕 New Features
-
-### Telemetry Decode
-Sensor nodes now report **battery voltage** and **temperature** parsed from advert payloads. Telemetry is gated on the sensor flag — only real sensors emit data, and 0°C is no longer falsely reported. Safe migration with `PRAGMA` column checks.
-
-### Channel Decryption for Custom Channels
-The `hashChannels` config now works in the Go ingestor. Key derivation has been ported from Node.js with full AES-128-ECB support and garbage text detection — wrong keys silently fail instead of producing garbled output.
-
-### Node Pruning
-Stale nodes are automatically moved to an `inactive_nodes` table after the configurable retention window. Pruning runs hourly. Your active node list stays clean. (#202)
-
-### Duplicate Node Name Badges
-Nodes with the same display name but different public keys are flagged with a badge so you can spot collisions instantly.
-
-### Sortable Channels Table
-Channel columns are now sortable with click-to-sort headers. Sort preferences persist in `localStorage` across sessions. (#167)
-
-### Go Runtime Metrics
-The performance page exposes goroutine count, heap allocation, GC pause percentiles, and memory breakdown when connected to a Go backend.
-
----
-
-## 🐛 Bug Fixes
-
-- **Channel decryption regression** (#176) — full AES-128-ECB in Go, garbage text detection, hashChannels key derivation ported correctly (#218)
-- **Packets page not live-updating** (#172) — WebSocket broadcast now includes the nested packet object and timestamp fields the frontend expects; multiple fixes across broadcast and render paths
-- **Node detail page crashes** (#190) — `Number()` casts and `Array.isArray` guards prevent rendering errors on unexpected data shapes
-- **Observation count staleness** (#174) — trace page and packet detail now show correct observation counts
-- **Phantom node cleanup** (#133) — `autoLearnHopNodes` no longer creates fake nodes from 1-byte repeater IDs
-- **Advert count inflation** (#200) — counts unique transmissions, not total observations (8 observers × 1 advert = 1, not 8)
-- **SQLite BUSY contention** (#214) — `MaxOpenConns(1)` + `MaxIdleConns(1)` serializes writes; load-tested under concurrent ingest
-- **Decoder bounds check** (#183) — corrupt/malformed packets no longer crash the decoder with buffer overruns
-- **noise_floor / battery_mv type mismatches** — consistent `float64` scanning handles SQLite REAL values correctly
-- **packetsLastHour always zero** (#182) — early `break` in observer loop prevented counting
-- **Channels stale messages** (#171) — latest message sorted by observation timestamp, not first-seen
-- **pprof port conflict** — non-fatal bind with separate ports prevents Go server crash on startup
-
----
-
-## ♿ Accessibility & 📱 Mobile
-
-### WCAG AA Compliance (10 fixes)
-- Search results keyboard-accessible with `tabindex`, `role`, and arrow-key navigation (#208)
-- 40+ table headers given `scope` attributes (#211)
-- 9 Chart.js canvases given accessible names (#210)
-- Form inputs in customizer/filters paired with labels (#212)
-
-### Mobile Responsive
-- **Live page**: bottom-sheet panel instead of full-screen overlay (#203)
-- **Perf page**: responsive layout with stacked cards (#204)
-- **Nodes table**: column hiding at narrow viewports (#205)
-- **Analytics/Compare**: horizontal scroll wrappers (#206)
-- **VCR bar**: 44px minimum touch targets (#207)
-
----
-
-## 🏗️ Infrastructure
-
-### manage.sh Refactored (#230)
-`manage.sh` is now a thin wrapper around `docker compose` — no custom container management, no divergent logic. It reads `.env` for data paths, matching how `docker-compose.yml` works. One source of truth.
-
-### .env Support
-Data directory, ports, and image tags are configured via `.env`. Both `docker compose` and `manage.sh` read the same file.
-
-### Branch Protection & CI on PRs
-- Branch protection enabled on `master` — CI must pass, PRs required
-- CI now triggers on `pull_request`, not just `push` — catch failures before merge (#199)
-
-### Protobuf API Contract
-10 `.proto` files, 33 golden fixtures, CI validation on every push. API shape drift is caught automatically.
-
-### pprof Profiling
-Controlled by `ENABLE_PPROF` env var. When enabled, exposes Go profiling endpoints on separate ports — zero overhead when off.
-
-### Test Coverage
-- Go backend: **92%+** coverage
-- **49 Playwright E2E tests**
-- Both tracks gate deploy in CI
-
----
-
-## 📦 Upgrading
-
-```bash
-git pull
-./manage.sh stop
-./manage.sh setup
-```
-
-That's it. Your existing `config.json` and database work as-is. The rename is cosmetic — no schema changes, no API changes, no config changes.
-
-### Verify
-
-```bash
-curl -s http://localhost/api/health | grep engine
-# "engine": "go"
-```
-
----
-
-## ⚠️ Breaking Changes
-
-**None.** All API endpoints, WebSocket messages, and config options are backwards-compatible. The rename affects branding only — Docker image names, page titles, and documentation.
-
----
-
-## 🙏 Thank You
-
-- **efiten** — PR #222 performance fix (O(n) slice prepend elimination)
-- **jade-on-mesh**, **lincomatic**, **LitBomb**, **mibzzer15** — ongoing testing, feedback, and issue reports
-
-And to everyone running CoreScope on their mesh networks — your real-world data drives every fix and feature in this release. 48 commits since v3.0.0, and every one of them came from something the community found, reported, or requested.
-
----
-
-*Previous release: [v3.0.0](RELEASE-v3.0.0.md)*

cmd/ingestor/config.go

@@ -26,14 +26,13 @@ type MQTTLegacy struct {
 
 // Config holds the ingestor configuration, compatible with the Node.js config.json format.
 type Config struct {
-	DBPath          string            `json:"dbPath"`
-	MQTT            *MQTTLegacy       `json:"mqtt,omitempty"`
-	MQTTSources     []MQTTSource      `json:"mqttSources,omitempty"`
-	LogLevel        string            `json:"logLevel,omitempty"`
-	ChannelKeysPath string            `json:"channelKeysPath,omitempty"`
-	ChannelKeys     map[string]string `json:"channelKeys,omitempty"`
-	HashChannels    []string          `json:"hashChannels,omitempty"`
-	Retention       *RetentionConfig  `json:"retention,omitempty"`
+	DBPath         string            `json:"dbPath"`
+	MQTT           *MQTTLegacy       `json:"mqtt,omitempty"`
+	MQTTSources    []MQTTSource      `json:"mqttSources,omitempty"`
+	LogLevel       string            `json:"logLevel,omitempty"`
+	ChannelKeysPath string           `json:"channelKeysPath,omitempty"`
+	ChannelKeys    map[string]string `json:"channelKeys,omitempty"`
+	Retention      *RetentionConfig  `json:"retention,omitempty"`
 }
 
 // RetentionConfig controls how long stale nodes are kept before being moved to inactive_nodes.

cmd/ingestor/decoder.go

@@ -72,8 +72,8 @@ type Header struct {
 
 // TransportCodes are present on TRANSPORT_FLOOD and TRANSPORT_DIRECT routes.
 type TransportCodes struct {
-	Code1 string `json:"code1"`
-	Code2 string `json:"code2"`
+	NextHop string `json:"nextHop"`
+	LastHop string `json:"lastHop"`
 }
 
 // Path holds decoded path/hop information.
@@ -92,8 +92,6 @@ type AdvertFlags struct {
 	Room        bool `json:"room"`
 	Sensor      bool `json:"sensor"`
 	HasLocation bool `json:"hasLocation"`
-	HasFeat1    bool `json:"hasFeat1"`
-	HasFeat2    bool `json:"hasFeat2"`
 	HasName     bool `json:"hasName"`
 }
 
@@ -113,8 +111,6 @@ type Payload struct {
 	Lat           *float64     `json:"lat,omitempty"`
 	Lon           *float64     `json:"lon,omitempty"`
 	Name          string       `json:"name,omitempty"`
-	Feat1         *int         `json:"feat1,omitempty"`
-	Feat2         *int         `json:"feat2,omitempty"`
 	BatteryMv     *int         `json:"battery_mv,omitempty"`
 	TemperatureC  *float64     `json:"temperature_c,omitempty"`
 	ChannelHash   int          `json:"channelHash,omitempty"`
@@ -127,8 +123,6 @@ type Payload struct {
 	EphemeralPubKey string     `json:"ephemeralPubKey,omitempty"`
 	PathData      string       `json:"pathData,omitempty"`
 	Tag           uint32       `json:"tag,omitempty"`
-	AuthCode      uint32       `json:"authCode,omitempty"`
-	TraceFlags    *int         `json:"traceFlags,omitempty"`
 	RawHex        string       `json:"raw,omitempty"`
 	Error         string       `json:"error,omitempty"`
 }
@@ -205,13 +199,14 @@ func decodeEncryptedPayload(typeName string, buf []byte) Payload {
 }
 
 func decodeAck(buf []byte) Payload {
-	if len(buf) < 4 {
+	if len(buf) < 6 {
 		return Payload{Type: "ACK", Error: "too short", RawHex: hex.EncodeToString(buf)}
 	}
-	checksum := binary.LittleEndian.Uint32(buf[0:4])
 	return Payload{
 		Type:      "ACK",
-		ExtraHash: fmt.Sprintf("%08x", checksum),
+		DestHash:  hex.EncodeToString(buf[0:1]),
+		SrcHash:   hex.EncodeToString(buf[1:2]),
+		ExtraHash: hex.EncodeToString(buf[2:6]),
 	}
 }
 
@@ -236,8 +231,6 @@ func decodeAdvert(buf []byte) Payload {
 	if len(appdata) > 0 {
 		flags := appdata[0]
 		advType := int(flags & 0x0F)
-		hasFeat1 := flags&0x20 != 0
-		hasFeat2 := flags&0x40 != 0
 		p.Flags = &AdvertFlags{
 			Raw:         int(flags),
 			Type:        advType,
@@ -246,8 +239,6 @@ func decodeAdvert(buf []byte) Payload {
 			Room:        advType == 3,
 			Sensor:      advType == 4,
 			HasLocation: flags&0x10 != 0,
-			HasFeat1:    hasFeat1,
-			HasFeat2:    hasFeat2,
 			HasName:     flags&0x80 != 0,
 		}
 
@@ -261,16 +252,6 @@ func decodeAdvert(buf []byte) Payload {
 			p.Lon = &lon
 			off += 8
 		}
-		if hasFeat1 && len(appdata) >= off+2 {
-			feat1 := int(binary.LittleEndian.Uint16(appdata[off : off+2]))
-			p.Feat1 = &feat1
-			off += 2
-		}
-		if hasFeat2 && len(appdata) >= off+2 {
-			feat2 := int(binary.LittleEndian.Uint16(appdata[off : off+2]))
-			p.Feat2 = &feat2
-			off += 2
-		}
 		if p.Flags.HasName {
 			// Find null terminator to separate name from trailing telemetry bytes
 			nameEnd := len(appdata)
@@ -488,22 +469,15 @@ func decodePathPayload(buf []byte) Payload {
 }
 
 func decodeTrace(buf []byte) Payload {
-	if len(buf) < 9 {
+	if len(buf) < 12 {
 		return Payload{Type: "TRACE", Error: "too short", RawHex: hex.EncodeToString(buf)}
 	}
-	tag := binary.LittleEndian.Uint32(buf[0:4])
-	authCode := binary.LittleEndian.Uint32(buf[4:8])
-	flags := int(buf[8])
-	p := Payload{
-		Type:       "TRACE",
-		Tag:        tag,
-		AuthCode:   authCode,
-		TraceFlags: &flags,
+	return Payload{
+		Type:     "TRACE",
+		DestHash: hex.EncodeToString(buf[5:11]),
+		SrcHash:  hex.EncodeToString(buf[11:12]),
+		Tag:      binary.LittleEndian.Uint32(buf[1:5]),
 	}
-	if len(buf) > 9 {
-		p.PathData = hex.EncodeToString(buf[9:])
-	}
-	return p
 }
 
 func decodePayload(payloadType int, buf []byte, channelKeys map[string]string) Payload {
@@ -546,7 +520,8 @@ func DecodePacket(hexString string, channelKeys map[string]string) (*DecodedPack
 	}
 
 	header := decodeHeader(buf[0])
-	offset := 1
+	pathByte := buf[1]
+	offset := 2
 
 	var tc *TransportCodes
 	if isTransportRoute(header.RouteType) {
@@ -554,18 +529,12 @@ func DecodePacket(hexString string, channelKeys map[string]string) (*DecodedPack
 			return nil, fmt.Errorf("packet too short for transport codes")
 		}
 		tc = &TransportCodes{
-			Code1: strings.ToUpper(hex.EncodeToString(buf[offset : offset+2])),
-			Code2: strings.ToUpper(hex.EncodeToString(buf[offset+2 : offset+4])),
+			NextHop: strings.ToUpper(hex.EncodeToString(buf[offset : offset+2])),
+			LastHop: strings.ToUpper(hex.EncodeToString(buf[offset+2 : offset+4])),
 		}
 		offset += 4
 	}
 
-	if offset >= len(buf) {
-		return nil, fmt.Errorf("packet too short (no path byte)")
-	}
-	pathByte := buf[offset]
-	offset++
-
 	path, bytesConsumed := decodePath(pathByte, buf, offset)
 	offset += bytesConsumed
 
@@ -593,24 +562,16 @@ func ComputeContentHash(rawHex string) string {
 		return rawHex
 	}
 
-	headerByte := buf[0]
-	offset := 1
-	if isTransportRoute(int(headerByte & 0x03)) {
-		offset += 4
-	}
-	if offset >= len(buf) {
-		if len(rawHex) >= 16 {
-			return rawHex[:16]
-		}
-		return rawHex
-	}
-	pathByte := buf[offset]
-	offset++
+	pathByte := buf[1]
 	hashSize := int((pathByte>>6)&0x3) + 1
 	hashCount := int(pathByte & 0x3F)
 	pathBytes := hashSize * hashCount
 
-	payloadStart := offset + pathBytes
+	headerByte := buf[0]
+	payloadStart := 2 + pathBytes
+	if isTransportRoute(int(headerByte & 0x03)) {
+		payloadStart += 4
+	}
 	if payloadStart > len(buf) {
 		if len(rawHex) >= 16 {
 			return rawHex[:16]

cmd/ingestor/decoder_test.go

@@ -129,8 +129,7 @@ func TestDecodePath3ByteHashes(t *testing.T) {
 
 func TestTransportCodes(t *testing.T) {
 	// Route type 0 (TRANSPORT_FLOOD) should have transport codes
-	// Firmware order: header + transport_codes(4) + path_len + path + payload
-	hex := "14" + "AABB" + "CCDD" + "00" + strings.Repeat("00", 10)
+	hex := "1400" + "AABB" + "CCDD" + "1A" + strings.Repeat("00", 10)
 	pkt, err := DecodePacket(hex, nil)
 	if err != nil {
 		t.Fatal(err)
@@ -141,11 +140,11 @@ func TestTransportCodes(t *testing.T) {
 	if pkt.TransportCodes == nil {
 		t.Fatal("transportCodes should not be nil for TRANSPORT_FLOOD")
 	}
-	if pkt.TransportCodes.Code1 != "AABB" {
-		t.Errorf("code1=%s, want AABB", pkt.TransportCodes.Code1)
+	if pkt.TransportCodes.NextHop != "AABB" {
+		t.Errorf("nextHop=%s, want AABB", pkt.TransportCodes.NextHop)
 	}
-	if pkt.TransportCodes.Code2 != "CCDD" {
-		t.Errorf("code2=%s, want CCDD", pkt.TransportCodes.Code2)
+	if pkt.TransportCodes.LastHop != "CCDD" {
+		t.Errorf("lastHop=%s, want CCDD", pkt.TransportCodes.LastHop)
 	}
 
 	// Route type 1 (FLOOD) should NOT have transport codes
@@ -538,11 +537,10 @@ func TestDecodeTraceShort(t *testing.T) {
 
 func TestDecodeTraceValid(t *testing.T) {
 	buf := make([]byte, 16)
-	// tag(4) + authCode(4) + flags(1) + pathData
-	binary.LittleEndian.PutUint32(buf[0:4], 1)          // tag = 1
-	binary.LittleEndian.PutUint32(buf[4:8], 0xDEADBEEF) // authCode
-	buf[8] = 0x02                                         // flags
-	buf[9] = 0xAA                                         // path data
+	buf[0] = 0x00
+	buf[1] = 0x01 // tag LE uint32 = 1
+	buf[5] = 0xAA // destHash start
+	buf[11] = 0xBB
 	p := decodeTrace(buf)
 	if p.Error != "" {
 		t.Errorf("unexpected error: %s", p.Error)
@@ -550,18 +548,9 @@ func TestDecodeTraceValid(t *testing.T) {
 	if p.Tag != 1 {
 		t.Errorf("tag=%d, want 1", p.Tag)
 	}
-	if p.AuthCode != 0xDEADBEEF {
-		t.Errorf("authCode=%d, want 0xDEADBEEF", p.AuthCode)
-	}
-	if p.TraceFlags == nil || *p.TraceFlags != 2 {
-		t.Errorf("traceFlags=%v, want 2", p.TraceFlags)
-	}
 	if p.Type != "TRACE" {
 		t.Errorf("type=%s, want TRACE", p.Type)
 	}
-	if p.PathData == "" {
-		t.Error("pathData should not be empty")
-	}
 }
 
 func TestDecodeAdvertShort(t *testing.T) {
@@ -844,9 +833,10 @@ func TestComputeContentHashShortHex(t *testing.T) {
 }
 
 func TestComputeContentHashTransportRoute(t *testing.T) {
-	// Route type 0 (TRANSPORT_FLOOD) with transport codes then path=0x00 (0 hops)
-	// header=0x14 (TRANSPORT_FLOOD, ADVERT), transport(4), path=0x00
-	hex := "14" + "AABBCCDD" + "00" + strings.Repeat("EE", 10)
+	// Route type 0 (TRANSPORT_FLOOD) with no path hops + 4 transport code bytes
+	// header=0x14 (TRANSPORT_FLOOD, ADVERT), path=0x00 (0 hops)
+	// transport codes = 4 bytes, then payload
+	hex := "1400" + "AABBCCDD" + strings.Repeat("EE", 10)
 	hash := ComputeContentHash(hex)
 	if len(hash) != 16 {
 		t.Errorf("hash length=%d, want 16", len(hash))
@@ -880,10 +870,12 @@ func TestComputeContentHashPayloadBeyondBufferLongHex(t *testing.T) {
 
 func TestComputeContentHashTransportBeyondBuffer(t *testing.T) {
 	// Transport route (0x00 = TRANSPORT_FLOOD) with path claiming some bytes
-	// header=0x00, transport(4), pathByte=0x02 (2 hops, 1-byte hash)
-	// offset=1+4+1+2=8, buffer needs to be >= 8
-	hex := "00" + "AABB" + "CCDD" + "02" + strings.Repeat("CC", 6) // 20 chars = 10 bytes  
+	// total buffer too short for transport codes + path
+	// header=0x00, pathByte=0x02 (2 hops, 1-byte hash), then only 2 more bytes
+	// payloadStart = 2 + 2 + 4(transport) = 8, but buffer only 6 bytes
+	hex := "0002" + "AABB" + strings.Repeat("CC", 6) // 20 chars = 10 bytes
 	hash := ComputeContentHash(hex)
+	// payloadStart = 2 + 2 + 4 = 8, buffer is 10 bytes → should work
 	if len(hash) != 16 {
 		t.Errorf("hash length=%d, want 16", len(hash))
 	}
@@ -921,8 +913,8 @@ func TestDecodePacketWithNewlines(t *testing.T) {
 }
 
 func TestDecodePacketTransportRouteTooShort(t *testing.T) {
-	// TRANSPORT_FLOOD (route=0) but only 2 bytes total → too short for transport codes
-	_, err := DecodePacket("1400", nil)
+	// TRANSPORT_FLOOD (route=0) but only 3 bytes total → too short for transport codes
+	_, err := DecodePacket("140011", nil)
 	if err == nil {
 		t.Error("expected error for transport route with too-short buffer")
 	}
@@ -939,19 +931,16 @@ func TestDecodeAckShort(t *testing.T) {
 }
 
 func TestDecodeAckValid(t *testing.T) {
-	buf := []byte{0xAA, 0xBB, 0xCC, 0xDD}
+	buf := []byte{0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF}
 	p := decodeAck(buf)
 	if p.Error != "" {
 		t.Errorf("unexpected error: %s", p.Error)
 	}
-	if p.ExtraHash != "ddccbbaa" {
-		t.Errorf("extraHash=%s, want ddccbbaa", p.ExtraHash)
+	if p.DestHash != "aa" {
+		t.Errorf("destHash=%s, want aa", p.DestHash)
 	}
-	if p.DestHash != "" {
-		t.Errorf("destHash should be empty, got %s", p.DestHash)
-	}
-	if p.SrcHash != "" {
-		t.Errorf("srcHash should be empty, got %s", p.SrcHash)
+	if p.ExtraHash != "ccddeeff" {
+		t.Errorf("extraHash=%s, want ccddeeff", p.ExtraHash)
 	}
 }
 

cmd/ingestor/main.go

@@ -512,64 +512,34 @@ func firstNonEmpty(vals ...string) string {
 	return ""
 }
 
-// deriveHashtagChannelKey derives an AES-128 key from a channel name.
-// Same algorithm as Node.js: SHA-256(channelName) → first 32 hex chars (16 bytes).
-func deriveHashtagChannelKey(channelName string) string {
-	h := sha256.Sum256([]byte(channelName))
-	return hex.EncodeToString(h[:16])
-}
-
 // loadChannelKeys loads channel decryption keys from config and/or a JSON file.
-// Merge priority: rainbow (lowest) → derived from hashChannels → explicit config (highest).
+// Priority: CHANNEL_KEYS_PATH env var > cfg.ChannelKeysPath > channel-rainbow.json next to config.
 func loadChannelKeys(cfg *Config, configPath string) map[string]string {
 	keys := make(map[string]string)
 
-	// 1. Rainbow table keys (lowest priority)
+	// Determine file path for rainbow keys
 	keysPath := os.Getenv("CHANNEL_KEYS_PATH")
 	if keysPath == "" {
 		keysPath = cfg.ChannelKeysPath
 	}
 	if keysPath == "" {
+		// Default: look for channel-rainbow.json next to config file
 		keysPath = filepath.Join(filepath.Dir(configPath), "channel-rainbow.json")
 	}
 
-	rainbowCount := 0
 	if data, err := os.ReadFile(keysPath); err == nil {
 		var fileKeys map[string]string
 		if err := json.Unmarshal(data, &fileKeys); err == nil {
 			for k, v := range fileKeys {
 				keys[k] = v
 			}
-			rainbowCount = len(fileKeys)
-			log.Printf("Loaded %d channel keys from %s", rainbowCount, keysPath)
+			log.Printf("Loaded %d channel keys from %s", len(fileKeys), keysPath)
 		} else {
 			log.Printf("Warning: failed to parse channel keys file %s: %v", keysPath, err)
 		}
 	}
 
-	// 2. Derived keys from hashChannels (middle priority)
-	derivedCount := 0
-	for _, raw := range cfg.HashChannels {
-		trimmed := strings.TrimSpace(raw)
-		if trimmed == "" {
-			continue
-		}
-		channelName := trimmed
-		if !strings.HasPrefix(channelName, "#") {
-			channelName = "#" + channelName
-		}
-		// Skip if explicit config already has this key
-		if _, exists := cfg.ChannelKeys[channelName]; exists {
-			continue
-		}
-		keys[channelName] = deriveHashtagChannelKey(channelName)
-		derivedCount++
-	}
-	if derivedCount > 0 {
-		log.Printf("[channels] %d derived from hashChannels", derivedCount)
-	}
-
-	// 3. Explicit config keys (highest priority — overrides rainbow + derived)
+	// Merge inline config keys (override file keys)
 	for k, v := range cfg.ChannelKeys {
 		keys[k] = v
 	}

cmd/ingestor/main_test.go

@@ -3,8 +3,6 @@ package main
 import (
 	"encoding/json"
 	"math"
-	"os"
-	"path/filepath"
 	"testing"
 	"time"
 )
@@ -494,132 +492,3 @@ func TestAdvertRole(t *testing.T) {
 		})
 	}
 }
-
-func TestDeriveHashtagChannelKey(t *testing.T) {
-	// Test vectors validated against Node.js server-helpers.js
-	tests := []struct {
-		name string
-		want string
-	}{
-		{"#General", "649af2cab73ed5a890890a5485a0c004"},
-		{"#test", "9cd8fcf22a47333b591d96a2b848b73f"},
-		{"#MeshCore", "dcf73f393fa217f6b28fcec6ffc411ad"},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := deriveHashtagChannelKey(tt.name)
-			if got != tt.want {
-				t.Errorf("deriveHashtagChannelKey(%q) = %q, want %q", tt.name, got, tt.want)
-			}
-		})
-	}
-
-	// Deterministic
-	k1 := deriveHashtagChannelKey("#foo")
-	k2 := deriveHashtagChannelKey("#foo")
-	if k1 != k2 {
-		t.Error("deriveHashtagChannelKey should be deterministic")
-	}
-
-	// Returns 32-char hex string (16 bytes)
-	if len(k1) != 32 {
-		t.Errorf("key length = %d, want 32", len(k1))
-	}
-
-	// Different inputs → different keys
-	k3 := deriveHashtagChannelKey("#bar")
-	if k1 == k3 {
-		t.Error("different inputs should produce different keys")
-	}
-}
-
-func TestLoadChannelKeysMergePriority(t *testing.T) {
-	dir := t.TempDir()
-	cfgPath := filepath.Join(dir, "config.json")
-
-	// Create a rainbow file with two keys: #rainbow (unique) and #override (to be overridden)
-	rainbowPath := filepath.Join(dir, "channel-rainbow.json")
-	t.Setenv("CHANNEL_KEYS_PATH", rainbowPath)
-	rainbow := map[string]string{
-		"#rainbow":  "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-		"#override": "rainbow_value_should_be_overridden",
-	}
-	rainbowJSON, err := json.Marshal(rainbow)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(rainbowPath, rainbowJSON, 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	cfg := &Config{
-		HashChannels: []string{"General", "#override"},
-		ChannelKeys:  map[string]string{"#override": "explicit_wins"},
-	}
-
-	keys := loadChannelKeys(cfg, cfgPath)
-
-	// Rainbow key loaded
-	if keys["#rainbow"] != "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" {
-		t.Errorf("rainbow key missing or wrong: %q", keys["#rainbow"])
-	}
-
-	// HashChannels derived #General
-	expected := deriveHashtagChannelKey("#General")
-	if keys["#General"] != expected {
-		t.Errorf("#General = %q, want %q (derived)", keys["#General"], expected)
-	}
-
-	// Explicit config wins over both rainbow and derived
-	if keys["#override"] != "explicit_wins" {
-		t.Errorf("#override = %q, want explicit_wins", keys["#override"])
-	}
-}
-
-func TestLoadChannelKeysHashChannelsNormalization(t *testing.T) {
-	t.Setenv("CHANNEL_KEYS_PATH", "")
-	dir := t.TempDir()
-	cfgPath := filepath.Join(dir, "config.json")
-
-	cfg := &Config{
-		HashChannels: []string{
-			"NoPound",       // should become #NoPound
-			"#HasPound",     // stays #HasPound
-			"  Spaced  ",   // trimmed → #Spaced
-			"",              // skipped
-		},
-	}
-
-	keys := loadChannelKeys(cfg, cfgPath)
-
-	if _, ok := keys["#NoPound"]; !ok {
-		t.Error("should derive key for #NoPound (auto-prefixed)")
-	}
-	if _, ok := keys["#HasPound"]; !ok {
-		t.Error("should derive key for #HasPound")
-	}
-	if _, ok := keys["#Spaced"]; !ok {
-		t.Error("should derive key for #Spaced (trimmed)")
-	}
-	if len(keys) != 3 {
-		t.Errorf("expected 3 keys, got %d", len(keys))
-	}
-}
-
-func TestLoadChannelKeysSkipExplicit(t *testing.T) {
-	t.Setenv("CHANNEL_KEYS_PATH", "")
-	dir := t.TempDir()
-	cfgPath := filepath.Join(dir, "config.json")
-
-	cfg := &Config{
-		HashChannels: []string{"General"},
-		ChannelKeys:  map[string]string{"#General": "my_explicit_key"},
-	}
-
-	keys := loadChannelKeys(cfg, cfgPath)
-
-	// Explicit key should win — hashChannels derivation should be skipped
-	if keys["#General"] != "my_explicit_key" {
-		t.Errorf("#General = %q, want my_explicit_key", keys["#General"])
-	}
-}

cmd/server/config.go

@@ -60,10 +60,10 @@ func (c *Config) NodeDaysOrDefault() int {
 }
 
 type HealthThresholds struct {
-	InfraDegradedHours float64 `json:"infraDegradedHours"`
-	InfraSilentHours   float64 `json:"infraSilentHours"`
-	NodeDegradedHours  float64 `json:"nodeDegradedHours"`
-	NodeSilentHours    float64 `json:"nodeSilentHours"`
+	InfraDegradedMs int `json:"infraDegradedMs"`
+	InfraSilentMs   int `json:"infraSilentMs"`
+	NodeDegradedMs  int `json:"nodeDegradedMs"`
+	NodeSilentMs    int `json:"nodeSilentMs"`
 }
 
 // ThemeFile mirrors theme.json overlay.
@@ -126,46 +126,34 @@ func LoadTheme(baseDirs ...string) *ThemeFile {
 
 func (c *Config) GetHealthThresholds() HealthThresholds {
 	h := HealthThresholds{
-		InfraDegradedHours: 24,
-		InfraSilentHours:   72,
-		NodeDegradedHours:  1,
-		NodeSilentHours:    24,
+		InfraDegradedMs: 86400000,
+		InfraSilentMs:   259200000,
+		NodeDegradedMs:  3600000,
+		NodeSilentMs:    86400000,
 	}
 	if c.HealthThresholds != nil {
-		if c.HealthThresholds.InfraDegradedHours > 0 {
-			h.InfraDegradedHours = c.HealthThresholds.InfraDegradedHours
+		if c.HealthThresholds.InfraDegradedMs > 0 {
+			h.InfraDegradedMs = c.HealthThresholds.InfraDegradedMs
 		}
-		if c.HealthThresholds.InfraSilentHours > 0 {
-			h.InfraSilentHours = c.HealthThresholds.InfraSilentHours
+		if c.HealthThresholds.InfraSilentMs > 0 {
+			h.InfraSilentMs = c.HealthThresholds.InfraSilentMs
 		}
-		if c.HealthThresholds.NodeDegradedHours > 0 {
-			h.NodeDegradedHours = c.HealthThresholds.NodeDegradedHours
+		if c.HealthThresholds.NodeDegradedMs > 0 {
+			h.NodeDegradedMs = c.HealthThresholds.NodeDegradedMs
 		}
-		if c.HealthThresholds.NodeSilentHours > 0 {
-			h.NodeSilentHours = c.HealthThresholds.NodeSilentHours
+		if c.HealthThresholds.NodeSilentMs > 0 {
+			h.NodeSilentMs = c.HealthThresholds.NodeSilentMs
 		}
 	}
 	return h
 }
 
-// GetHealthMs returns degraded/silent thresholds in ms for a given role.
+// GetHealthMs returns degraded/silent thresholds for a given role.
 func (h HealthThresholds) GetHealthMs(role string) (degradedMs, silentMs int) {
-	const hourMs = 3600000
 	if role == "repeater" || role == "room" {
-		return int(h.InfraDegradedHours * hourMs), int(h.InfraSilentHours * hourMs)
-	}
-	return int(h.NodeDegradedHours * hourMs), int(h.NodeSilentHours * hourMs)
-}
-
-// ToClientMs returns the thresholds as ms for the frontend.
-func (h HealthThresholds) ToClientMs() map[string]int {
-	const hourMs = 3600000
-	return map[string]int{
-		"infraDegradedMs": int(h.InfraDegradedHours * hourMs),
-		"infraSilentMs":   int(h.InfraSilentHours * hourMs),
-		"nodeDegradedMs":  int(h.NodeDegradedHours * hourMs),
-		"nodeSilentMs":    int(h.NodeSilentHours * hourMs),
+		return h.InfraDegradedMs, h.InfraSilentMs
 	}
+	return h.NodeDegradedMs, h.NodeSilentMs
 }
 
 func (c *Config) ResolveDBPath(baseDir string) string {

cmd/server/config_test.go

@@ -23,10 +23,10 @@ func TestLoadConfigValidJSON(t *testing.T) {
 			"SJC": "San Jose",
 		},
 		"healthThresholds": map[string]interface{}{
-			"infraDegradedHours": 2,
-			"infraSilentHours":   4,
-			"nodeDegradedHours":  0.5,
-			"nodeSilentHours":    2,
+			"infraDegradedMs": 100000,
+			"infraSilentMs":   200000,
+			"nodeDegradedMs":  50000,
+			"nodeSilentMs":    100000,
 		},
 		"liveMap": map[string]interface{}{
 			"propagationBufferMs": 3000,
@@ -178,68 +178,68 @@ func TestGetHealthThresholdsDefaults(t *testing.T) {
 	cfg := &Config{}
 	ht := cfg.GetHealthThresholds()
 
-	if ht.InfraDegradedHours != 24 {
-		t.Errorf("expected 24, got %v", ht.InfraDegradedHours)
+	if ht.InfraDegradedMs != 86400000 {
+		t.Errorf("expected 86400000, got %d", ht.InfraDegradedMs)
 	}
-	if ht.InfraSilentHours != 72 {
-		t.Errorf("expected 72, got %v", ht.InfraSilentHours)
+	if ht.InfraSilentMs != 259200000 {
+		t.Errorf("expected 259200000, got %d", ht.InfraSilentMs)
 	}
-	if ht.NodeDegradedHours != 1 {
-		t.Errorf("expected 1, got %v", ht.NodeDegradedHours)
+	if ht.NodeDegradedMs != 3600000 {
+		t.Errorf("expected 3600000, got %d", ht.NodeDegradedMs)
 	}
-	if ht.NodeSilentHours != 24 {
-		t.Errorf("expected 24, got %v", ht.NodeSilentHours)
+	if ht.NodeSilentMs != 86400000 {
+		t.Errorf("expected 86400000, got %d", ht.NodeSilentMs)
 	}
 }
 
 func TestGetHealthThresholdsCustom(t *testing.T) {
 	cfg := &Config{
 		HealthThresholds: &HealthThresholds{
-			InfraDegradedHours: 2,
-			InfraSilentHours:   4,
-			NodeDegradedHours:  0.5,
-			NodeSilentHours:    2,
+			InfraDegradedMs: 100000,
+			InfraSilentMs:   200000,
+			NodeDegradedMs:  50000,
+			NodeSilentMs:    100000,
 		},
 	}
 	ht := cfg.GetHealthThresholds()
 
-	if ht.InfraDegradedHours != 2 {
-		t.Errorf("expected 2, got %v", ht.InfraDegradedHours)
+	if ht.InfraDegradedMs != 100000 {
+		t.Errorf("expected 100000, got %d", ht.InfraDegradedMs)
 	}
-	if ht.InfraSilentHours != 4 {
-		t.Errorf("expected 4, got %v", ht.InfraSilentHours)
+	if ht.InfraSilentMs != 200000 {
+		t.Errorf("expected 200000, got %d", ht.InfraSilentMs)
 	}
-	if ht.NodeDegradedHours != 0.5 {
-		t.Errorf("expected 0.5, got %v", ht.NodeDegradedHours)
+	if ht.NodeDegradedMs != 50000 {
+		t.Errorf("expected 50000, got %d", ht.NodeDegradedMs)
 	}
-	if ht.NodeSilentHours != 2 {
-		t.Errorf("expected 2, got %v", ht.NodeSilentHours)
+	if ht.NodeSilentMs != 100000 {
+		t.Errorf("expected 100000, got %d", ht.NodeSilentMs)
 	}
 }
 
 func TestGetHealthThresholdsPartialCustom(t *testing.T) {
 	cfg := &Config{
 		HealthThresholds: &HealthThresholds{
-			InfraDegradedHours: 2,
+			InfraDegradedMs: 100000,
 			// Others left as zero → should use defaults
 		},
 	}
 	ht := cfg.GetHealthThresholds()
 
-	if ht.InfraDegradedHours != 2 {
-		t.Errorf("expected 2, got %v", ht.InfraDegradedHours)
+	if ht.InfraDegradedMs != 100000 {
+		t.Errorf("expected 100000, got %d", ht.InfraDegradedMs)
 	}
-	if ht.InfraSilentHours != 72 {
-		t.Errorf("expected default 72, got %v", ht.InfraSilentHours)
+	if ht.InfraSilentMs != 259200000 {
+		t.Errorf("expected default 259200000, got %d", ht.InfraSilentMs)
 	}
 }
 
 func TestGetHealthMs(t *testing.T) {
 	ht := HealthThresholds{
-		InfraDegradedHours: 24,
-		InfraSilentHours:   72,
-		NodeDegradedHours:  1,
-		NodeSilentHours:    24,
+		InfraDegradedMs: 86400000,
+		InfraSilentMs:   259200000,
+		NodeDegradedMs:  3600000,
+		NodeSilentMs:    86400000,
 	}
 
 	tests := []struct {

cmd/server/db_test.go

@@ -17,8 +17,6 @@ func setupTestDB(t *testing.T) *DB {
 	if err != nil {
 		t.Fatal(err)
 	}
-	// Force single connection so all goroutines share the same in-memory DB
-	conn.SetMaxOpenConns(1)
 
 	// Create schema matching MeshCore Analyzer v3
 	schema := `
@@ -513,10 +511,10 @@ func TestGetNetworkStatus(t *testing.T) {
 	seedTestData(t, db)
 
 	ht := HealthThresholds{
-		InfraDegradedHours: 24,
-		InfraSilentHours:   72,
-		NodeDegradedHours:  1,
-		NodeSilentHours:    24,
+		InfraDegradedMs: 86400000,
+		InfraSilentMs:   259200000,
+		NodeDegradedMs:  3600000,
+		NodeSilentMs:    86400000,
 	}
 	result, err := db.GetNetworkStatus(ht)
 	if err != nil {
@@ -1050,10 +1048,10 @@ func TestGetNetworkStatusDateFormats(t *testing.T) {
 		VALUES ('node4444', 'NodeBad', 'sensor', 'not-a-date')`)
 
 	ht := HealthThresholds{
-		InfraDegradedHours: 24,
-		InfraSilentHours:   72,
-		NodeDegradedHours:  1,
-		NodeSilentHours:    24,
+		InfraDegradedMs: 86400000,
+		InfraSilentMs:   259200000,
+		NodeDegradedMs:  3600000,
+		NodeSilentMs:    86400000,
 	}
 	result, err := db.GetNetworkStatus(ht)
 	if err != nil {

cmd/server/decoder.go

@@ -54,8 +54,8 @@ type Header struct {
 
 // TransportCodes are present on TRANSPORT_FLOOD and TRANSPORT_DIRECT routes.
 type TransportCodes struct {
-	Code1 string `json:"code1"`
-	Code2 string `json:"code2"`
+	NextHop string `json:"nextHop"`
+	LastHop string `json:"lastHop"`
 }
 
 // Path holds decoded path/hop information.
@@ -74,8 +74,6 @@ type AdvertFlags struct {
 	Room        bool `json:"room"`
 	Sensor      bool `json:"sensor"`
 	HasLocation bool `json:"hasLocation"`
-	HasFeat1    bool `json:"hasFeat1"`
-	HasFeat2    bool `json:"hasFeat2"`
 	HasName     bool `json:"hasName"`
 }
 
@@ -99,8 +97,6 @@ type Payload struct {
 	EphemeralPubKey string       `json:"ephemeralPubKey,omitempty"`
 	PathData        string       `json:"pathData,omitempty"`
 	Tag             uint32       `json:"tag,omitempty"`
-	AuthCode        uint32       `json:"authCode,omitempty"`
-	TraceFlags      *int         `json:"traceFlags,omitempty"`
 	RawHex          string       `json:"raw,omitempty"`
 	Error           string       `json:"error,omitempty"`
 }
@@ -177,13 +173,14 @@ func decodeEncryptedPayload(typeName string, buf []byte) Payload {
 }
 
 func decodeAck(buf []byte) Payload {
-	if len(buf) < 4 {
+	if len(buf) < 6 {
 		return Payload{Type: "ACK", Error: "too short", RawHex: hex.EncodeToString(buf)}
 	}
-	checksum := binary.LittleEndian.Uint32(buf[0:4])
 	return Payload{
 		Type:      "ACK",
-		ExtraHash: fmt.Sprintf("%08x", checksum),
+		DestHash:  hex.EncodeToString(buf[0:1]),
+		SrcHash:   hex.EncodeToString(buf[1:2]),
+		ExtraHash: hex.EncodeToString(buf[2:6]),
 	}
 }
 
@@ -208,8 +205,6 @@ func decodeAdvert(buf []byte) Payload {
 	if len(appdata) > 0 {
 		flags := appdata[0]
 		advType := int(flags & 0x0F)
-		hasFeat1 := flags&0x20 != 0
-		hasFeat2 := flags&0x40 != 0
 		p.Flags = &AdvertFlags{
 			Raw:         int(flags),
 			Type:        advType,
@@ -218,8 +213,6 @@ func decodeAdvert(buf []byte) Payload {
 			Room:        advType == 3,
 			Sensor:      advType == 4,
 			HasLocation: flags&0x10 != 0,
-			HasFeat1:    hasFeat1,
-			HasFeat2:    hasFeat2,
 			HasName:     flags&0x80 != 0,
 		}
 
@@ -233,12 +226,6 @@ func decodeAdvert(buf []byte) Payload {
 			p.Lon = &lon
 			off += 8
 		}
-		if hasFeat1 && len(appdata) >= off+2 {
-			off += 2  // skip feat1 bytes (reserved for future use)
-		}
-		if hasFeat2 && len(appdata) >= off+2 {
-			off += 2  // skip feat2 bytes (reserved for future use)
-		}
 		if p.Flags.HasName {
 			name := string(appdata[off:])
 			name = strings.TrimRight(name, "\x00")
@@ -289,22 +276,15 @@ func decodePathPayload(buf []byte) Payload {
 }
 
 func decodeTrace(buf []byte) Payload {
-	if len(buf) < 9 {
+	if len(buf) < 12 {
 		return Payload{Type: "TRACE", Error: "too short", RawHex: hex.EncodeToString(buf)}
 	}
-	tag := binary.LittleEndian.Uint32(buf[0:4])
-	authCode := binary.LittleEndian.Uint32(buf[4:8])
-	flags := int(buf[8])
-	p := Payload{
-		Type:       "TRACE",
-		Tag:        tag,
-		AuthCode:   authCode,
-		TraceFlags: &flags,
+	return Payload{
+		Type:     "TRACE",
+		DestHash: hex.EncodeToString(buf[5:11]),
+		SrcHash:  hex.EncodeToString(buf[11:12]),
+		Tag:      binary.LittleEndian.Uint32(buf[1:5]),
 	}
-	if len(buf) > 9 {
-		p.PathData = hex.EncodeToString(buf[9:])
-	}
-	return p
 }
 
 func decodePayload(payloadType int, buf []byte) Payload {
@@ -347,7 +327,8 @@ func DecodePacket(hexString string) (*DecodedPacket, error) {
 	}
 
 	header := decodeHeader(buf[0])
-	offset := 1
+	pathByte := buf[1]
+	offset := 2
 
 	var tc *TransportCodes
 	if isTransportRoute(header.RouteType) {
@@ -355,18 +336,12 @@ func DecodePacket(hexString string) (*DecodedPacket, error) {
 			return nil, fmt.Errorf("packet too short for transport codes")
 		}
 		tc = &TransportCodes{
-			Code1: strings.ToUpper(hex.EncodeToString(buf[offset : offset+2])),
-			Code2: strings.ToUpper(hex.EncodeToString(buf[offset+2 : offset+4])),
+			NextHop: strings.ToUpper(hex.EncodeToString(buf[offset : offset+2])),
+			LastHop: strings.ToUpper(hex.EncodeToString(buf[offset+2 : offset+4])),
 		}
 		offset += 4
 	}
 
-	if offset >= len(buf) {
-		return nil, fmt.Errorf("packet too short (no path byte)")
-	}
-	pathByte := buf[offset]
-	offset++
-
 	path, bytesConsumed := decodePath(pathByte, buf, offset)
 	offset += bytesConsumed
 
@@ -392,24 +367,16 @@ func ComputeContentHash(rawHex string) string {
 		return rawHex
 	}
 
-	headerByte := buf[0]
-	offset := 1
-	if isTransportRoute(int(headerByte & 0x03)) {
-		offset += 4
-	}
-	if offset >= len(buf) {
-		if len(rawHex) >= 16 {
-			return rawHex[:16]
-		}
-		return rawHex
-	}
-	pathByte := buf[offset]
-	offset++
+	pathByte := buf[1]
 	hashSize := int((pathByte>>6)&0x3) + 1
 	hashCount := int(pathByte & 0x3F)
 	pathBytes := hashSize * hashCount
 
-	payloadStart := offset + pathBytes
+	headerByte := buf[0]
+	payloadStart := 2 + pathBytes
+	if isTransportRoute(int(headerByte & 0x03)) {
+		payloadStart += 4
+	}
 	if payloadStart > len(buf) {
 		if len(rawHex) >= 16 {
 			return rawHex[:16]

cmd/server/parity_test.go

@@ -1,506 +1,403 @@
-package main
-
-// parity_test.go — Golden fixture shape tests.
-// Validates that Go API responses match the shape of Node.js API responses.
-// Shapes were captured from the production Node.js server and stored in
-// testdata/golden/shapes.json.
-
-import (
-	"encoding/json"
-	"fmt"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"runtime"
-	"sort"
-	"strings"
-	"testing"
-	"time"
-)
-
-// shapeSpec describes the expected JSON structure from the Node.js server.
-type shapeSpec struct {
-	Type         string               `json:"type"`
-	Keys         map[string]shapeSpec `json:"keys,omitempty"`
-	ElementShape *shapeSpec           `json:"elementShape,omitempty"`
-	DynamicKeys  bool                 `json:"dynamicKeys,omitempty"`
-	ValueShape   *shapeSpec           `json:"valueShape,omitempty"`
-	RequiredKeys map[string]shapeSpec `json:"requiredKeys,omitempty"`
-}
-
-// loadShapes reads testdata/golden/shapes.json relative to this source file.
-func loadShapes(t *testing.T) map[string]shapeSpec {
-	t.Helper()
-	_, thisFile, _, _ := runtime.Caller(0)
-	dir := filepath.Dir(thisFile)
-	data, err := os.ReadFile(filepath.Join(dir, "testdata", "golden", "shapes.json"))
-	if err != nil {
-		t.Fatalf("cannot load shapes.json: %v", err)
-	}
-	var shapes map[string]shapeSpec
-	if err := json.Unmarshal(data, &shapes); err != nil {
-		t.Fatalf("cannot parse shapes.json: %v", err)
-	}
-	return shapes
-}
-
-// validateShape recursively checks that `actual` matches the expected `spec`.
-// `path` tracks the JSON path for error messages.
-// Returns a list of mismatch descriptions.
-func validateShape(actual interface{}, spec shapeSpec, path string) []string {
-	var errs []string
-
-	switch spec.Type {
-	case "null", "nullable":
-		// nullable means: value can be null OR matching type. Accept anything.
-		return nil
-	case "nullable_number":
-		// Can be null or number
-		if actual != nil {
-			if _, ok := actual.(float64); !ok {
-				errs = append(errs, fmt.Sprintf("%s: expected number or null, got %T", path, actual))
-			}
-		}
-		return errs
-	case "string":
-		if actual == nil {
-			errs = append(errs, fmt.Sprintf("%s: expected string, got null", path))
-		} else if _, ok := actual.(string); !ok {
-			errs = append(errs, fmt.Sprintf("%s: expected string, got %T", path, actual))
-		}
-	case "number":
-		if actual == nil {
-			errs = append(errs, fmt.Sprintf("%s: expected number, got null", path))
-		} else if _, ok := actual.(float64); !ok {
-			errs = append(errs, fmt.Sprintf("%s: expected number, got %T (%v)", path, actual, actual))
-		}
-	case "boolean":
-		if actual == nil {
-			errs = append(errs, fmt.Sprintf("%s: expected boolean, got null", path))
-		} else if _, ok := actual.(bool); !ok {
-			errs = append(errs, fmt.Sprintf("%s: expected boolean, got %T", path, actual))
-		}
-	case "array":
-		if actual == nil {
-			errs = append(errs, fmt.Sprintf("%s: expected array, got null (arrays must be [] not null)", path))
-			return errs
-		}
-		arr, ok := actual.([]interface{})
-		if !ok {
-			errs = append(errs, fmt.Sprintf("%s: expected array, got %T", path, actual))
-			return errs
-		}
-		if spec.ElementShape != nil && len(arr) > 0 {
-			errs = append(errs, validateShape(arr[0], *spec.ElementShape, path+"[0]")...)
-		}
-	case "object":
-		if actual == nil {
-			errs = append(errs, fmt.Sprintf("%s: expected object, got null", path))
-			return errs
-		}
-		obj, ok := actual.(map[string]interface{})
-		if !ok {
-			errs = append(errs, fmt.Sprintf("%s: expected object, got %T", path, actual))
-			return errs
-		}
-
-		if spec.DynamicKeys {
-			// Object with dynamic keys — validate value shapes
-			if spec.ValueShape != nil && len(obj) > 0 {
-				for k, v := range obj {
-					errs = append(errs, validateShape(v, *spec.ValueShape, path+"."+k)...)
-					break // check just one sample
-				}
-			}
-			if spec.RequiredKeys != nil {
-				for rk, rs := range spec.RequiredKeys {
-					v, exists := obj[rk]
-					if !exists {
-						errs = append(errs, fmt.Sprintf("%s: missing required key %q in dynamic-key object", path, rk))
-					} else {
-						errs = append(errs, validateShape(v, rs, path+"."+rk)...)
-					}
-				}
-			}
-		} else if spec.Keys != nil {
-			// Object with known keys — check each expected key exists and has correct type
-			for key, keySpec := range spec.Keys {
-				val, exists := obj[key]
-				if !exists {
-					errs = append(errs, fmt.Sprintf("%s: missing field %q (expected %s)", path, key, keySpec.Type))
-				} else {
-					errs = append(errs, validateShape(val, keySpec, path+"."+key)...)
-				}
-			}
-		}
-	}
-
-	return errs
-}
-
-// parityEndpoint defines one endpoint to test for parity.
-type parityEndpoint struct {
-	name string // key in shapes.json
-	path string // HTTP path to request
-}
-
-func TestParityShapes(t *testing.T) {
-	shapes := loadShapes(t)
-	_, router := setupTestServer(t)
-
-	endpoints := []parityEndpoint{
-		{"stats", "/api/stats"},
-		{"nodes", "/api/nodes?limit=5"},
-		{"packets", "/api/packets?limit=5"},
-		{"packets_grouped", "/api/packets?limit=5&groupByHash=true"},
-		{"observers", "/api/observers"},
-		{"channels", "/api/channels"},
-		{"channel_messages", "/api/channels/0000000000000000/messages?limit=5"},
-		{"analytics_rf", "/api/analytics/rf?days=7"},
-		{"analytics_topology", "/api/analytics/topology?days=7"},
-		{"analytics_hash_sizes", "/api/analytics/hash-sizes?days=7"},
-		{"analytics_distance", "/api/analytics/distance?days=7"},
-		{"analytics_subpaths", "/api/analytics/subpaths?days=7"},
-		{"bulk_health", "/api/nodes/bulk-health"},
-		{"health", "/api/health"},
-		{"perf", "/api/perf"},
-	}
-
-	for _, ep := range endpoints {
-		t.Run("Parity_"+ep.name, func(t *testing.T) {
-			spec, ok := shapes[ep.name]
-			if !ok {
-				t.Fatalf("no shape spec found for %q in shapes.json", ep.name)
-			}
-
-			req := httptest.NewRequest("GET", ep.path, nil)
-			w := httptest.NewRecorder()
-			router.ServeHTTP(w, req)
-
-			if w.Code != 200 {
-				t.Fatalf("GET %s returned %d, expected 200. Body: %s",
-					ep.path, w.Code, w.Body.String())
-			}
-
-			var body interface{}
-			if err := json.Unmarshal(w.Body.Bytes(), &body); err != nil {
-				t.Fatalf("GET %s returned invalid JSON: %v\nBody: %s",
-					ep.path, err, w.Body.String())
-			}
-
-			mismatches := validateShape(body, spec, ep.path)
-			if len(mismatches) > 0 {
-				t.Errorf("Go %s has %d shape mismatches vs Node.js golden:\n  %s",
-					ep.path, len(mismatches), strings.Join(mismatches, "\n  "))
-			}
-		})
-	}
-}
-
-// TestParityNodeDetail tests node detail endpoint shape.
-// Uses a known test node public key from seeded data.
-func TestParityNodeDetail(t *testing.T) {
-	shapes := loadShapes(t)
-	_, router := setupTestServer(t)
-
-	spec, ok := shapes["node_detail"]
-	if !ok {
-		t.Fatal("no shape spec for node_detail in shapes.json")
-	}
-
-	req := httptest.NewRequest("GET", "/api/nodes/aabbccdd11223344", nil)
-	w := httptest.NewRecorder()
-	router.ServeHTTP(w, req)
-
-	if w.Code != 200 {
-		t.Fatalf("node detail returned %d: %s", w.Code, w.Body.String())
-	}
-
-	var body interface{}
-	json.Unmarshal(w.Body.Bytes(), &body)
-
-	mismatches := validateShape(body, spec, "/api/nodes/{pubkey}")
-	if len(mismatches) > 0 {
-		t.Errorf("Go node detail has %d shape mismatches vs Node.js golden:\n  %s",
-			len(mismatches), strings.Join(mismatches, "\n  "))
-	}
-}
-
-// TestParityArraysNotNull verifies that array-typed fields in Go responses are
-// [] (empty array) rather than null. This is a common Go/JSON pitfall where
-// nil slices marshal as null instead of [].
-// Uses shapes.json to know which fields SHOULD be arrays.
-func TestParityArraysNotNull(t *testing.T) {
-	shapes := loadShapes(t)
-	_, router := setupTestServer(t)
-
-	endpoints := []struct {
-		name string
-		path string
-	}{
-		{"stats", "/api/stats"},
-		{"nodes", "/api/nodes?limit=5"},
-		{"packets", "/api/packets?limit=5"},
-		{"packets_grouped", "/api/packets?limit=5&groupByHash=true"},
-		{"observers", "/api/observers"},
-		{"channels", "/api/channels"},
-		{"bulk_health", "/api/nodes/bulk-health"},
-		{"analytics_rf", "/api/analytics/rf?days=7"},
-		{"analytics_topology", "/api/analytics/topology?days=7"},
-		{"analytics_hash_sizes", "/api/analytics/hash-sizes?days=7"},
-		{"analytics_distance", "/api/analytics/distance?days=7"},
-		{"analytics_subpaths", "/api/analytics/subpaths?days=7"},
-	}
-
-	for _, ep := range endpoints {
-		t.Run("NullArrayCheck_"+ep.name, func(t *testing.T) {
-			spec, ok := shapes[ep.name]
-			if !ok {
-				t.Skipf("no shape spec for %s", ep.name)
-			}
-
-			req := httptest.NewRequest("GET", ep.path, nil)
-			w := httptest.NewRecorder()
-			router.ServeHTTP(w, req)
-
-			if w.Code != 200 {
-				t.Skipf("GET %s returned %d, skipping null-array check", ep.path, w.Code)
-			}
-
-			var body interface{}
-			json.Unmarshal(w.Body.Bytes(), &body)
-
-			nullArrays := findNullArrays(body, spec, ep.path)
-			if len(nullArrays) > 0 {
-				t.Errorf("Go %s has null where [] expected:\n  %s\n"+
-					"Go nil slices marshal as null — initialize with make() or literal",
-					ep.path, strings.Join(nullArrays, "\n  "))
-			}
-		})
-	}
-}
-
-// findNullArrays walks JSON data alongside a shape spec and returns paths
-// where the spec says the field should be an array but Go returned null.
-func findNullArrays(actual interface{}, spec shapeSpec, path string) []string {
-	var nulls []string
-
-	switch spec.Type {
-	case "array":
-		if actual == nil {
-			nulls = append(nulls, fmt.Sprintf("%s: null (should be [])", path))
-		} else if arr, ok := actual.([]interface{}); ok && spec.ElementShape != nil {
-			for i, elem := range arr {
-				nulls = append(nulls, findNullArrays(elem, *spec.ElementShape, fmt.Sprintf("%s[%d]", path, i))...)
-			}
-		}
-	case "object":
-		obj, ok := actual.(map[string]interface{})
-		if !ok || obj == nil {
-			return nulls
-		}
-		if spec.Keys != nil {
-			for key, keySpec := range spec.Keys {
-				if val, exists := obj[key]; exists {
-					nulls = append(nulls, findNullArrays(val, keySpec, path+"."+key)...)
-				} else if keySpec.Type == "array" {
-					// Key missing entirely — also a null-array problem
-					nulls = append(nulls, fmt.Sprintf("%s.%s: missing (should be [])", path, key))
-				}
-			}
-		}
-		if spec.DynamicKeys && spec.ValueShape != nil {
-			for k, v := range obj {
-				nulls = append(nulls, findNullArrays(v, *spec.ValueShape, path+"."+k)...)
-				break // sample one
-			}
-		}
-	}
-
-	return nulls
-}
-
-// TestParityHealthEngine verifies Go health endpoint declares engine=go
-// while Node declares engine=node (or omits it). The Go server must always
-// identify itself.
-func TestParityHealthEngine(t *testing.T) {
-	_, router := setupTestServer(t)
-
-	req := httptest.NewRequest("GET", "/api/health", nil)
-	w := httptest.NewRecorder()
-	router.ServeHTTP(w, req)
-
-	var body map[string]interface{}
-	json.Unmarshal(w.Body.Bytes(), &body)
-
-	engine, ok := body["engine"]
-	if !ok {
-		t.Error("health response missing 'engine' field (Go server must include engine=go)")
-	} else if engine != "go" {
-		t.Errorf("health engine=%v, expected 'go'", engine)
-	}
-}
-
-// TestValidateShapeFunction directly tests the shape validator itself.
-func TestValidateShapeFunction(t *testing.T) {
-	t.Run("string match", func(t *testing.T) {
-		errs := validateShape("hello", shapeSpec{Type: "string"}, "$.x")
-		if len(errs) != 0 {
-			t.Errorf("unexpected errors: %v", errs)
-		}
-	})
-
-	t.Run("string mismatch", func(t *testing.T) {
-		errs := validateShape(42.0, shapeSpec{Type: "string"}, "$.x")
-		if len(errs) != 1 {
-			t.Errorf("expected 1 error, got %d: %v", len(errs), errs)
-		}
-	})
-
-	t.Run("null array rejected", func(t *testing.T) {
-		errs := validateShape(nil, shapeSpec{Type: "array"}, "$.arr")
-		if len(errs) != 1 || !strings.Contains(errs[0], "null") {
-			t.Errorf("expected null-array error, got: %v", errs)
-		}
-	})
-
-	t.Run("empty array OK", func(t *testing.T) {
-		errs := validateShape([]interface{}{}, shapeSpec{Type: "array"}, "$.arr")
-		if len(errs) != 0 {
-			t.Errorf("unexpected errors for empty array: %v", errs)
-		}
-	})
-
-	t.Run("missing object key", func(t *testing.T) {
-		spec := shapeSpec{Type: "object", Keys: map[string]shapeSpec{
-			"name": {Type: "string"},
-			"age":  {Type: "number"},
-		}}
-		obj := map[string]interface{}{"name": "test"}
-		errs := validateShape(obj, spec, "$.user")
-		if len(errs) != 1 || !strings.Contains(errs[0], "age") {
-			t.Errorf("expected missing age error, got: %v", errs)
-		}
-	})
-
-	t.Run("nullable allows null", func(t *testing.T) {
-		errs := validateShape(nil, shapeSpec{Type: "nullable"}, "$.x")
-		if len(errs) != 0 {
-			t.Errorf("nullable should accept null: %v", errs)
-		}
-	})
-
-	t.Run("dynamic keys validates value shape", func(t *testing.T) {
-		spec := shapeSpec{
-			Type:        "object",
-			DynamicKeys: true,
-			ValueShape:  &shapeSpec{Type: "number"},
-		}
-		obj := map[string]interface{}{"a": 1.0, "b": 2.0}
-		errs := validateShape(obj, spec, "$.dyn")
-		if len(errs) != 0 {
-			t.Errorf("unexpected errors: %v", errs)
-		}
-	})
-}
-
-func TestParityWSMultiObserverGolden(t *testing.T) {
-	db := setupTestDB(t)
-	defer db.Close()
-	seedTestData(t, db)
-	hub := NewHub()
-	store := NewPacketStore(db)
-	if err := store.Load(); err != nil {
-		t.Fatalf("store load failed: %v", err)
-	}
-
-	poller := NewPoller(db, hub, 50*time.Millisecond)
-	poller.store = store
-
-	client := &Client{send: make(chan []byte, 256)}
-	hub.Register(client)
-	defer hub.Unregister(client)
-
-	go poller.Start()
-	defer poller.Stop()
-
-	// Wait for poller to initialize its lastID/lastObsID cursors before
-	// inserting new data; otherwise the poller may snapshot a lastID that
-	// already includes the test data and never broadcast it.
-	time.Sleep(100 * time.Millisecond)
-
-	now := time.Now().UTC().Format(time.RFC3339)
-	if _, err := db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
-		VALUES ('BEEF', 'goldenstarburst237', ?, 1, 4, '{"pubKey":"aabbccdd11223344","type":"ADVERT"}')`, now); err != nil {
-		t.Fatalf("insert tx failed: %v", err)
-	}
-	var txID int
-	if err := db.conn.QueryRow(`SELECT id FROM transmissions WHERE hash='goldenstarburst237'`).Scan(&txID); err != nil {
-		t.Fatalf("query tx id failed: %v", err)
-	}
-	ts := time.Now().Unix()
-	if _, err := db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
-		VALUES (?, 1, 11.0, -88, '["p1"]', ?),
-		       (?, 2, 9.0, -92, '["p1","p2"]', ?),
-		       (?, 1, 7.0, -96, '["p1","p2","p3"]', ?)`,
-		txID, ts, txID, ts+1, txID, ts+2); err != nil {
-		t.Fatalf("insert obs failed: %v", err)
-	}
-
-	type golden struct {
-		Hash        string
-		Count       int
-		Paths       []string
-		ObserverIDs []string
-	}
-	expected := golden{
-		Hash:        "goldenstarburst237",
-		Count:       3,
-		Paths:       []string{`["p1"]`, `["p1","p2"]`, `["p1","p2","p3"]`},
-		ObserverIDs: []string{"obs1", "obs2"},
-	}
-
-	gotPaths := make([]string, 0, expected.Count)
-	gotObservers := make(map[string]bool)
-	deadline := time.After(2 * time.Second)
-	for len(gotPaths) < expected.Count {
-		select {
-		case raw := <-client.send:
-			var msg map[string]interface{}
-			if err := json.Unmarshal(raw, &msg); err != nil {
-				t.Fatalf("unmarshal ws message failed: %v", err)
-			}
-			if msg["type"] != "packet" {
-				continue
-			}
-			data, _ := msg["data"].(map[string]interface{})
-			if data == nil || data["hash"] != expected.Hash {
-				continue
-			}
-			if path, ok := data["path_json"].(string); ok {
-				gotPaths = append(gotPaths, path)
-			}
-			if oid, ok := data["observer_id"].(string); ok && oid != "" {
-				gotObservers[oid] = true
-			}
-		case <-deadline:
-			t.Fatalf("timed out waiting for %d ws messages, got %d", expected.Count, len(gotPaths))
-		}
-	}
-
-	sort.Strings(gotPaths)
-	sort.Strings(expected.Paths)
-	if len(gotPaths) != len(expected.Paths) {
-		t.Fatalf("path count mismatch: got %d want %d", len(gotPaths), len(expected.Paths))
-	}
-	for i := range expected.Paths {
-		if gotPaths[i] != expected.Paths[i] {
-			t.Fatalf("path mismatch at %d: got %q want %q", i, gotPaths[i], expected.Paths[i])
-		}
-	}
-	for _, oid := range expected.ObserverIDs {
-		if !gotObservers[oid] {
-			t.Fatalf("missing expected observer %q in ws messages", oid)
-		}
-	}
-}
+package main
+
+// parity_test.go — Golden fixture shape tests.
+// Validates that Go API responses match the shape of Node.js API responses.
+// Shapes were captured from the production Node.js server and stored in
+// testdata/golden/shapes.json.
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+)
+
+// shapeSpec describes the expected JSON structure from the Node.js server.
+type shapeSpec struct {
+	Type        string               `json:"type"`
+	Keys        map[string]shapeSpec `json:"keys,omitempty"`
+	ElementShape *shapeSpec           `json:"elementShape,omitempty"`
+	DynamicKeys  bool                 `json:"dynamicKeys,omitempty"`
+	ValueShape   *shapeSpec           `json:"valueShape,omitempty"`
+	RequiredKeys map[string]shapeSpec `json:"requiredKeys,omitempty"`
+}
+
+// loadShapes reads testdata/golden/shapes.json relative to this source file.
+func loadShapes(t *testing.T) map[string]shapeSpec {
+	t.Helper()
+	_, thisFile, _, _ := runtime.Caller(0)
+	dir := filepath.Dir(thisFile)
+	data, err := os.ReadFile(filepath.Join(dir, "testdata", "golden", "shapes.json"))
+	if err != nil {
+		t.Fatalf("cannot load shapes.json: %v", err)
+	}
+	var shapes map[string]shapeSpec
+	if err := json.Unmarshal(data, &shapes); err != nil {
+		t.Fatalf("cannot parse shapes.json: %v", err)
+	}
+	return shapes
+}
+
+// validateShape recursively checks that `actual` matches the expected `spec`.
+// `path` tracks the JSON path for error messages.
+// Returns a list of mismatch descriptions.
+func validateShape(actual interface{}, spec shapeSpec, path string) []string {
+	var errs []string
+
+	switch spec.Type {
+	case "null", "nullable":
+		// nullable means: value can be null OR matching type. Accept anything.
+		return nil
+	case "nullable_number":
+		// Can be null or number
+		if actual != nil {
+			if _, ok := actual.(float64); !ok {
+				errs = append(errs, fmt.Sprintf("%s: expected number or null, got %T", path, actual))
+			}
+		}
+		return errs
+	case "string":
+		if actual == nil {
+			errs = append(errs, fmt.Sprintf("%s: expected string, got null", path))
+		} else if _, ok := actual.(string); !ok {
+			errs = append(errs, fmt.Sprintf("%s: expected string, got %T", path, actual))
+		}
+	case "number":
+		if actual == nil {
+			errs = append(errs, fmt.Sprintf("%s: expected number, got null", path))
+		} else if _, ok := actual.(float64); !ok {
+			errs = append(errs, fmt.Sprintf("%s: expected number, got %T (%v)", path, actual, actual))
+		}
+	case "boolean":
+		if actual == nil {
+			errs = append(errs, fmt.Sprintf("%s: expected boolean, got null", path))
+		} else if _, ok := actual.(bool); !ok {
+			errs = append(errs, fmt.Sprintf("%s: expected boolean, got %T", path, actual))
+		}
+	case "array":
+		if actual == nil {
+			errs = append(errs, fmt.Sprintf("%s: expected array, got null (arrays must be [] not null)", path))
+			return errs
+		}
+		arr, ok := actual.([]interface{})
+		if !ok {
+			errs = append(errs, fmt.Sprintf("%s: expected array, got %T", path, actual))
+			return errs
+		}
+		if spec.ElementShape != nil && len(arr) > 0 {
+			errs = append(errs, validateShape(arr[0], *spec.ElementShape, path+"[0]")...)
+		}
+	case "object":
+		if actual == nil {
+			errs = append(errs, fmt.Sprintf("%s: expected object, got null", path))
+			return errs
+		}
+		obj, ok := actual.(map[string]interface{})
+		if !ok {
+			errs = append(errs, fmt.Sprintf("%s: expected object, got %T", path, actual))
+			return errs
+		}
+
+		if spec.DynamicKeys {
+			// Object with dynamic keys — validate value shapes
+			if spec.ValueShape != nil && len(obj) > 0 {
+				for k, v := range obj {
+					errs = append(errs, validateShape(v, *spec.ValueShape, path+"."+k)...)
+					break // check just one sample
+				}
+			}
+			if spec.RequiredKeys != nil {
+				for rk, rs := range spec.RequiredKeys {
+					v, exists := obj[rk]
+					if !exists {
+						errs = append(errs, fmt.Sprintf("%s: missing required key %q in dynamic-key object", path, rk))
+					} else {
+						errs = append(errs, validateShape(v, rs, path+"."+rk)...)
+					}
+				}
+			}
+		} else if spec.Keys != nil {
+			// Object with known keys — check each expected key exists and has correct type
+			for key, keySpec := range spec.Keys {
+				val, exists := obj[key]
+				if !exists {
+					errs = append(errs, fmt.Sprintf("%s: missing field %q (expected %s)", path, key, keySpec.Type))
+				} else {
+					errs = append(errs, validateShape(val, keySpec, path+"."+key)...)
+				}
+			}
+		}
+	}
+
+	return errs
+}
+
+// parityEndpoint defines one endpoint to test for parity.
+type parityEndpoint struct {
+	name     string // key in shapes.json
+	path     string // HTTP path to request
+}
+
+func TestParityShapes(t *testing.T) {
+	shapes := loadShapes(t)
+	_, router := setupTestServer(t)
+
+	endpoints := []parityEndpoint{
+		{"stats", "/api/stats"},
+		{"nodes", "/api/nodes?limit=5"},
+		{"packets", "/api/packets?limit=5"},
+		{"packets_grouped", "/api/packets?limit=5&groupByHash=true"},
+		{"observers", "/api/observers"},
+		{"channels", "/api/channels"},
+		{"channel_messages", "/api/channels/0000000000000000/messages?limit=5"},
+		{"analytics_rf", "/api/analytics/rf?days=7"},
+		{"analytics_topology", "/api/analytics/topology?days=7"},
+		{"analytics_hash_sizes", "/api/analytics/hash-sizes?days=7"},
+		{"analytics_distance", "/api/analytics/distance?days=7"},
+		{"analytics_subpaths", "/api/analytics/subpaths?days=7"},
+		{"bulk_health", "/api/nodes/bulk-health"},
+		{"health", "/api/health"},
+		{"perf", "/api/perf"},
+	}
+
+	for _, ep := range endpoints {
+		t.Run("Parity_"+ep.name, func(t *testing.T) {
+			spec, ok := shapes[ep.name]
+			if !ok {
+				t.Fatalf("no shape spec found for %q in shapes.json", ep.name)
+			}
+
+			req := httptest.NewRequest("GET", ep.path, nil)
+			w := httptest.NewRecorder()
+			router.ServeHTTP(w, req)
+
+			if w.Code != 200 {
+				t.Fatalf("GET %s returned %d, expected 200. Body: %s",
+					ep.path, w.Code, w.Body.String())
+			}
+
+			var body interface{}
+			if err := json.Unmarshal(w.Body.Bytes(), &body); err != nil {
+				t.Fatalf("GET %s returned invalid JSON: %v\nBody: %s",
+					ep.path, err, w.Body.String())
+			}
+
+			mismatches := validateShape(body, spec, ep.path)
+			if len(mismatches) > 0 {
+				t.Errorf("Go %s has %d shape mismatches vs Node.js golden:\n  %s",
+					ep.path, len(mismatches), strings.Join(mismatches, "\n  "))
+			}
+		})
+	}
+}
+
+// TestParityNodeDetail tests node detail endpoint shape.
+// Uses a known test node public key from seeded data.
+func TestParityNodeDetail(t *testing.T) {
+	shapes := loadShapes(t)
+	_, router := setupTestServer(t)
+
+	spec, ok := shapes["node_detail"]
+	if !ok {
+		t.Fatal("no shape spec for node_detail in shapes.json")
+	}
+
+	req := httptest.NewRequest("GET", "/api/nodes/aabbccdd11223344", nil)
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+
+	if w.Code != 200 {
+		t.Fatalf("node detail returned %d: %s", w.Code, w.Body.String())
+	}
+
+	var body interface{}
+	json.Unmarshal(w.Body.Bytes(), &body)
+
+	mismatches := validateShape(body, spec, "/api/nodes/{pubkey}")
+	if len(mismatches) > 0 {
+		t.Errorf("Go node detail has %d shape mismatches vs Node.js golden:\n  %s",
+			len(mismatches), strings.Join(mismatches, "\n  "))
+	}
+}
+
+// TestParityArraysNotNull verifies that array-typed fields in Go responses are
+// [] (empty array) rather than null. This is a common Go/JSON pitfall where
+// nil slices marshal as null instead of [].
+// Uses shapes.json to know which fields SHOULD be arrays.
+func TestParityArraysNotNull(t *testing.T) {
+	shapes := loadShapes(t)
+	_, router := setupTestServer(t)
+
+	endpoints := []struct {
+		name string
+		path string
+	}{
+		{"stats", "/api/stats"},
+		{"nodes", "/api/nodes?limit=5"},
+		{"packets", "/api/packets?limit=5"},
+		{"packets_grouped", "/api/packets?limit=5&groupByHash=true"},
+		{"observers", "/api/observers"},
+		{"channels", "/api/channels"},
+		{"bulk_health", "/api/nodes/bulk-health"},
+		{"analytics_rf", "/api/analytics/rf?days=7"},
+		{"analytics_topology", "/api/analytics/topology?days=7"},
+		{"analytics_hash_sizes", "/api/analytics/hash-sizes?days=7"},
+		{"analytics_distance", "/api/analytics/distance?days=7"},
+		{"analytics_subpaths", "/api/analytics/subpaths?days=7"},
+	}
+
+	for _, ep := range endpoints {
+		t.Run("NullArrayCheck_"+ep.name, func(t *testing.T) {
+			spec, ok := shapes[ep.name]
+			if !ok {
+				t.Skipf("no shape spec for %s", ep.name)
+			}
+
+			req := httptest.NewRequest("GET", ep.path, nil)
+			w := httptest.NewRecorder()
+			router.ServeHTTP(w, req)
+
+			if w.Code != 200 {
+				t.Skipf("GET %s returned %d, skipping null-array check", ep.path, w.Code)
+			}
+
+			var body interface{}
+			json.Unmarshal(w.Body.Bytes(), &body)
+
+			nullArrays := findNullArrays(body, spec, ep.path)
+			if len(nullArrays) > 0 {
+				t.Errorf("Go %s has null where [] expected:\n  %s\n"+
+					"Go nil slices marshal as null — initialize with make() or literal",
+					ep.path, strings.Join(nullArrays, "\n  "))
+			}
+		})
+	}
+}
+
+// findNullArrays walks JSON data alongside a shape spec and returns paths
+// where the spec says the field should be an array but Go returned null.
+func findNullArrays(actual interface{}, spec shapeSpec, path string) []string {
+	var nulls []string
+
+	switch spec.Type {
+	case "array":
+		if actual == nil {
+			nulls = append(nulls, fmt.Sprintf("%s: null (should be [])", path))
+		} else if arr, ok := actual.([]interface{}); ok && spec.ElementShape != nil {
+			for i, elem := range arr {
+				nulls = append(nulls, findNullArrays(elem, *spec.ElementShape, fmt.Sprintf("%s[%d]", path, i))...)
+			}
+		}
+	case "object":
+		obj, ok := actual.(map[string]interface{})
+		if !ok || obj == nil {
+			return nulls
+		}
+		if spec.Keys != nil {
+			for key, keySpec := range spec.Keys {
+				if val, exists := obj[key]; exists {
+					nulls = append(nulls, findNullArrays(val, keySpec, path+"."+key)...)
+				} else if keySpec.Type == "array" {
+					// Key missing entirely — also a null-array problem
+					nulls = append(nulls, fmt.Sprintf("%s.%s: missing (should be [])", path, key))
+				}
+			}
+		}
+		if spec.DynamicKeys && spec.ValueShape != nil {
+			for k, v := range obj {
+				nulls = append(nulls, findNullArrays(v, *spec.ValueShape, path+"."+k)...)
+				break // sample one
+			}
+		}
+	}
+
+	return nulls
+}
+
+// TestParityHealthEngine verifies Go health endpoint declares engine=go
+// while Node declares engine=node (or omits it). The Go server must always
+// identify itself.
+func TestParityHealthEngine(t *testing.T) {
+	_, router := setupTestServer(t)
+
+	req := httptest.NewRequest("GET", "/api/health", nil)
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+
+	var body map[string]interface{}
+	json.Unmarshal(w.Body.Bytes(), &body)
+
+	engine, ok := body["engine"]
+	if !ok {
+		t.Error("health response missing 'engine' field (Go server must include engine=go)")
+	} else if engine != "go" {
+		t.Errorf("health engine=%v, expected 'go'", engine)
+	}
+}
+
+// TestValidateShapeFunction directly tests the shape validator itself.
+func TestValidateShapeFunction(t *testing.T) {
+	t.Run("string match", func(t *testing.T) {
+		errs := validateShape("hello", shapeSpec{Type: "string"}, "$.x")
+		if len(errs) != 0 {
+			t.Errorf("unexpected errors: %v", errs)
+		}
+	})
+
+	t.Run("string mismatch", func(t *testing.T) {
+		errs := validateShape(42.0, shapeSpec{Type: "string"}, "$.x")
+		if len(errs) != 1 {
+			t.Errorf("expected 1 error, got %d: %v", len(errs), errs)
+		}
+	})
+
+	t.Run("null array rejected", func(t *testing.T) {
+		errs := validateShape(nil, shapeSpec{Type: "array"}, "$.arr")
+		if len(errs) != 1 || !strings.Contains(errs[0], "null") {
+			t.Errorf("expected null-array error, got: %v", errs)
+		}
+	})
+
+	t.Run("empty array OK", func(t *testing.T) {
+		errs := validateShape([]interface{}{}, shapeSpec{Type: "array"}, "$.arr")
+		if len(errs) != 0 {
+			t.Errorf("unexpected errors for empty array: %v", errs)
+		}
+	})
+
+	t.Run("missing object key", func(t *testing.T) {
+		spec := shapeSpec{Type: "object", Keys: map[string]shapeSpec{
+			"name": {Type: "string"},
+			"age":  {Type: "number"},
+		}}
+		obj := map[string]interface{}{"name": "test"}
+		errs := validateShape(obj, spec, "$.user")
+		if len(errs) != 1 || !strings.Contains(errs[0], "age") {
+			t.Errorf("expected missing age error, got: %v", errs)
+		}
+	})
+
+	t.Run("nullable allows null", func(t *testing.T) {
+		errs := validateShape(nil, shapeSpec{Type: "nullable"}, "$.x")
+		if len(errs) != 0 {
+			t.Errorf("nullable should accept null: %v", errs)
+		}
+	})
+
+	t.Run("dynamic keys validates value shape", func(t *testing.T) {
+		spec := shapeSpec{
+			Type:        "object",
+			DynamicKeys: true,
+			ValueShape:  &shapeSpec{Type: "number"},
+		}
+		obj := map[string]interface{}{"a": 1.0, "b": 2.0}
+		errs := validateShape(obj, spec, "$.dyn")
+		if len(errs) != 0 {
+			t.Errorf("unexpected errors: %v", errs)
+		}
+	})
+}

cmd/server/routes.go

@@ -33,11 +33,6 @@ type Server struct {
 	memStatsMu   sync.Mutex
 	memStatsCache runtime.MemStats
 	memStatsCachedAt time.Time
-
-	// Cached /api/stats response — recomputed at most once every 10s
-	statsMu      sync.Mutex
-	statsCache   *StatsResponse
-	statsCachedAt time.Time
 }
 
 // PerfStats tracks request performance.
@@ -213,7 +208,7 @@ func (s *Server) handleConfigCache(w http.ResponseWriter, r *http.Request) {
 func (s *Server) handleConfigClient(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, ClientConfigResponse{
 		Roles:               s.cfg.Roles,
-		HealthThresholds:    s.cfg.GetHealthThresholds().ToClientMs(),
+		HealthThresholds:    s.cfg.HealthThresholds,
 		Tiles:               s.cfg.Tiles,
 		SnrThresholds:       s.cfg.SnrThresholds,
 		DistThresholds:      s.cfg.DistThresholds,
@@ -385,17 +380,6 @@ func (s *Server) handleHealth(w http.ResponseWriter, r *http.Request) {
 }
 
 func (s *Server) handleStats(w http.ResponseWriter, r *http.Request) {
-	const statsTTL = 10 * time.Second
-
-	s.statsMu.Lock()
-	if s.statsCache != nil && time.Since(s.statsCachedAt) < statsTTL {
-		cached := s.statsCache
-		s.statsMu.Unlock()
-		writeJSON(w, cached)
-		return
-	}
-	s.statsMu.Unlock()
-
 	var stats *Stats
 	var err error
 	if s.store != nil {
@@ -408,7 +392,7 @@ func (s *Server) handleStats(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	counts := s.db.GetRoleCounts()
-	resp := &StatsResponse{
+	writeJSON(w, StatsResponse{
 		TotalPackets:       stats.TotalPackets,
 		TotalTransmissions: &stats.TotalTransmissions,
 		TotalObservations:  stats.TotalObservations,
@@ -427,14 +411,7 @@ func (s *Server) handleStats(w http.ResponseWriter, r *http.Request) {
 			Companions: counts["companions"],
 			Sensors:    counts["sensors"],
 		},
-	}
-
-	s.statsMu.Lock()
-	s.statsCache = resp
-	s.statsCachedAt = time.Now()
-	s.statsMu.Unlock()
-
-	writeJSON(w, resp)
+	})
 }
 
 func (s *Server) handlePerf(w http.ResponseWriter, r *http.Request) {

cmd/server/store.go

@@ -62,7 +62,7 @@ type StoreObs struct {
 type PacketStore struct {
 	mu            sync.RWMutex
 	db            *DB
-	packets       []*StoreTx                 // sorted by first_seen ASC (oldest first; newest at tail)
+	packets       []*StoreTx                 // sorted by first_seen DESC
 	byHash        map[string]*StoreTx        // hash → *StoreTx
 	byTxID        map[int]*StoreTx           // transmission_id → *StoreTx
 	byObsID       map[int]*StoreObs          // observation_id → *StoreObs
@@ -98,11 +98,6 @@ type PacketStore struct {
 	// computed during Load() and incrementally updated on ingest.
 	distHops  []distHopRecord
 	distPaths []distPathRecord
-
-	// Cached GetNodeHashSizeInfo result — recomputed at most once every 15s
-	hashSizeInfoMu    sync.Mutex
-	hashSizeInfoCache map[string]*hashSizeNodeInfo
-	hashSizeInfoAt    time.Time
 }
 
 // Precomputed distance records for fast analytics aggregation.
@@ -181,7 +176,7 @@ func (s *PacketStore) Load() error {
 			FROM transmissions t
 			LEFT JOIN observations o ON o.transmission_id = t.id
 			LEFT JOIN observers obs ON obs.rowid = o.observer_idx
-			ORDER BY t.first_seen ASC, o.timestamp DESC`
+			ORDER BY t.first_seen DESC, o.timestamp DESC`
 	} else {
 		loadSQL = `SELECT t.id, t.raw_hex, t.hash, t.first_seen, t.route_type,
 				t.payload_type, t.payload_version, t.decoded_json,
@@ -189,7 +184,7 @@ func (s *PacketStore) Load() error {
 				o.snr, o.rssi, o.score, o.path_json, o.timestamp
 			FROM transmissions t
 			LEFT JOIN observations o ON o.transmission_id = t.id
-			ORDER BY t.first_seen ASC, o.timestamp DESC`
+			ORDER BY t.first_seen DESC, o.timestamp DESC`
 	}
 
 	rows, err := s.db.conn.Query(loadSQL)
@@ -373,32 +368,28 @@ func (s *PacketStore) QueryPackets(q PacketQuery) *PacketResult {
 	results := s.filterPackets(q)
 	total := len(results)
 
-	// results is oldest-first (ASC). For DESC (default) read backwards from the tail;
-	// for ASC read forwards. Both are O(page_size) — no sort copy needed.
-	start := q.Offset
-	if start >= total {
-		return &PacketResult{Packets: []map[string]interface{}{}, Total: total}
-	}
-	pageSize := q.Limit
-	if start+pageSize > total {
-		pageSize = total - start
+	if q.Order == "ASC" {
+		sorted := make([]*StoreTx, len(results))
+		copy(sorted, results)
+		sort.Slice(sorted, func(i, j int) bool {
+			return sorted[i].FirstSeen < sorted[j].FirstSeen
+		})
+		results = sorted
 	}
 
-	packets := make([]map[string]interface{}, 0, pageSize)
-	if q.Order == "ASC" {
-		for _, tx := range results[start : start+pageSize] {
-			packets = append(packets, txToMap(tx))
-		}
-	} else {
-		// DESC: newest items are at the tail; page 0 = last pageSize items reversed
-		endIdx := total - start
-		startIdx := endIdx - pageSize
-		if startIdx < 0 {
-			startIdx = 0
-		}
-		for i := endIdx - 1; i >= startIdx; i-- {
-			packets = append(packets, txToMap(results[i]))
-		}
+	// Paginate
+	start := q.Offset
+	if start >= len(results) {
+		return &PacketResult{Packets: []map[string]interface{}{}, Total: total}
+	}
+	end := start + q.Limit
+	if end > len(results) {
+		end = len(results)
+	}
+
+	packets := make([]map[string]interface{}, 0, end-start)
+	for _, tx := range results[start:end] {
+		packets = append(packets, txToMap(tx))
 	}
 	return &PacketResult{Packets: packets, Total: total}
 }
@@ -728,16 +719,15 @@ func (s *PacketStore) GetTimestamps(since string) []string {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
 
-	// packets sorted oldest-first — scan from tail until we reach items older than since
+	// packets sorted newest first — scan from start until older than since
 	var result []string
-	for i := len(s.packets) - 1; i >= 0; i-- {
-		tx := s.packets[i]
+	for _, tx := range s.packets {
 		if tx.FirstSeen <= since {
 			break
 		}
 		result = append(result, tx.FirstSeen)
 	}
-	// result is currently newest-first; reverse to return ASC order
+	// Reverse to get ASC order
 	for i, j := 0, len(result)-1; i < j; i, j = i+1, j-1 {
 		result[i], result[j] = result[j], result[i]
 	}
@@ -787,30 +777,23 @@ func (s *PacketStore) QueryMultiNodePackets(pubkeys []string, limit, offset int,
 
 	total := len(filtered)
 
-	// filtered is oldest-first (built by iterating s.packets forward).
-	// Apply same DESC/ASC pagination logic as QueryPackets.
+	if order == "ASC" {
+		sort.Slice(filtered, func(i, j int) bool {
+			return filtered[i].FirstSeen < filtered[j].FirstSeen
+		})
+	}
+
 	if offset >= total {
 		return &PacketResult{Packets: []map[string]interface{}{}, Total: total}
 	}
-	pageSize := limit
-	if offset+pageSize > total {
-		pageSize = total - offset
+	end := offset + limit
+	if end > total {
+		end = total
 	}
 
-	packets := make([]map[string]interface{}, 0, pageSize)
-	if order == "ASC" {
-		for _, tx := range filtered[offset : offset+pageSize] {
-			packets = append(packets, txToMap(tx))
-		}
-	} else {
-		endIdx := total - offset
-		startIdx := endIdx - pageSize
-		if startIdx < 0 {
-			startIdx = 0
-		}
-		for i := endIdx - 1; i >= startIdx; i-- {
-			packets = append(packets, txToMap(filtered[i]))
-		}
+	packets := make([]map[string]interface{}, 0, end-offset)
+	for _, tx := range filtered[offset:end] {
+		packets = append(packets, txToMap(tx))
 	}
 	return &PacketResult{Packets: packets, Total: total}
 }
@@ -943,14 +926,15 @@ func (s *PacketStore) IngestNewFromDB(sinceID, limit int) ([]map[string]interfac
 				DecodedJSON: r.decodedJSON,
 			}
 			s.byHash[r.hash] = tx
-			s.packets = append(s.packets, tx) // oldest-first; new items go to tail
+			// Prepend (newest first)
+			s.packets = append([]*StoreTx{tx}, s.packets...)
 			s.byTxID[r.txID] = tx
 			s.indexByNode(tx)
 			if tx.PayloadType != nil {
 				pt := *tx.PayloadType
-				// Append to maintain oldest-first order (matches Load ordering)
+				// Prepend to maintain newest-first order (matches Load ordering)
 				// so GetChannelMessages reverse iteration stays correct
-				s.byPayloadType[pt] = append(s.byPayloadType[pt], tx)
+				s.byPayloadType[pt] = append([]*StoreTx{tx}, s.byPayloadType[pt]...)
 			}
 
 			if _, exists := broadcastTxs[r.txID]; !exists {
@@ -1039,7 +1023,7 @@ func (s *PacketStore) IngestNewFromDB(sinceID, limit int) ([]map[string]interfac
 		}
 	}
 
-	// Build broadcast maps (same shape as Node.js WS broadcast), one per observation.
+	// Build broadcast maps (same shape as Node.js WS broadcast)
 	result := make([]map[string]interface{}, 0, len(broadcastOrder))
 	for _, txID := range broadcastOrder {
 		tx := broadcastTxs[txID]
@@ -1055,34 +1039,32 @@ func (s *PacketStore) IngestNewFromDB(sinceID, limit int) ([]map[string]interfac
 				decoded["payload"] = payload
 			}
 		}
-		for _, obs := range tx.Observations {
-			// Build the nested packet object (packets.js checks m.data.packet)
-			pkt := map[string]interface{}{
-				"id":                tx.ID,
-				"raw_hex":           strOrNil(tx.RawHex),
-				"hash":              strOrNil(tx.Hash),
-				"first_seen":        strOrNil(tx.FirstSeen),
-				"timestamp":         strOrNil(tx.FirstSeen),
-				"route_type":        intPtrOrNil(tx.RouteType),
-				"payload_type":      intPtrOrNil(tx.PayloadType),
-				"decoded_json":      strOrNil(tx.DecodedJSON),
-				"observer_id":       strOrNil(obs.ObserverID),
-				"observer_name":     strOrNil(obs.ObserverName),
-				"snr":               floatPtrOrNil(obs.SNR),
-				"rssi":              floatPtrOrNil(obs.RSSI),
-				"path_json":         strOrNil(obs.PathJSON),
-				"direction":         strOrNil(obs.Direction),
-				"observation_count": tx.ObservationCount,
-			}
-			// Broadcast map: top-level fields for live.js + nested packet for packets.js
-			broadcastMap := make(map[string]interface{}, len(pkt)+2)
-			for k, v := range pkt {
-				broadcastMap[k] = v
-			}
-			broadcastMap["decoded"] = decoded
-			broadcastMap["packet"] = pkt
-			result = append(result, broadcastMap)
+		// Build the nested packet object (packets.js checks m.data.packet)
+		pkt := map[string]interface{}{
+			"id":                tx.ID,
+			"raw_hex":           strOrNil(tx.RawHex),
+			"hash":              strOrNil(tx.Hash),
+			"first_seen":        strOrNil(tx.FirstSeen),
+			"timestamp":         strOrNil(tx.FirstSeen),
+			"route_type":        intPtrOrNil(tx.RouteType),
+			"payload_type":      intPtrOrNil(tx.PayloadType),
+			"decoded_json":      strOrNil(tx.DecodedJSON),
+			"observer_id":       strOrNil(tx.ObserverID),
+			"observer_name":     strOrNil(tx.ObserverName),
+			"snr":               floatPtrOrNil(tx.SNR),
+			"rssi":              floatPtrOrNil(tx.RSSI),
+			"path_json":         strOrNil(tx.PathJSON),
+			"direction":         strOrNil(tx.Direction),
+			"observation_count": tx.ObservationCount,
 		}
+		// Broadcast map: top-level fields for live.js + nested packet for packets.js
+		broadcastMap := make(map[string]interface{}, len(pkt)+2)
+		for k, v := range pkt {
+			broadcastMap[k] = v
+		}
+		broadcastMap["decoded"] = decoded
+		broadcastMap["packet"] = pkt
+		result = append(result, broadcastMap)
 	}
 
 	// Invalidate analytics caches since new data was ingested
@@ -1097,13 +1079,15 @@ func (s *PacketStore) IngestNewFromDB(sinceID, limit int) ([]map[string]interfac
 		s.cacheMu.Unlock()
 	}
 
+	log.Printf("[poller] IngestNewFromDB: found %d new txs, maxID %d->%d", len(result), sinceID, newMaxID)
+
 	return result, newMaxID
 }
 
 // IngestNewObservations loads new observations for transmissions already in the
 // store. This catches observations that arrive after IngestNewFromDB has already
 // advanced past the transmission's ID (fixes #174).
-func (s *PacketStore) IngestNewObservations(sinceObsID, limit int) []map[string]interface{} {
+func (s *PacketStore) IngestNewObservations(sinceObsID, limit int) int {
 	if limit <= 0 {
 		limit = 500
 	}
@@ -1129,7 +1113,7 @@ func (s *PacketStore) IngestNewObservations(sinceObsID, limit int) []map[string]
 	rows, err := s.db.conn.Query(querySQL, sinceObsID, limit)
 	if err != nil {
 		log.Printf("[store] ingest observations query error: %v", err)
-		return nil
+		return sinceObsID
 	}
 	defer rows.Close()
 
@@ -1172,16 +1156,20 @@ func (s *PacketStore) IngestNewObservations(sinceObsID, limit int) []map[string]
 	}
 
 	if len(obsRows) == 0 {
-		return nil
+		return sinceObsID
 	}
 
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
+	newMaxObsID := sinceObsID
 	updatedTxs := make(map[int]*StoreTx)
-	broadcastMaps := make([]map[string]interface{}, 0, len(obsRows))
 
 	for _, r := range obsRows {
+		if r.obsID > newMaxObsID {
+			newMaxObsID = r.obsID
+		}
+
 		// Already ingested (e.g. by IngestNewFromDB in same cycle)
 		if _, exists := s.byObsID[r.obsID]; exists {
 			continue
@@ -1224,43 +1212,6 @@ func (s *PacketStore) IngestNewObservations(sinceObsID, limit int) []map[string]
 		}
 		s.totalObs++
 		updatedTxs[r.txID] = tx
-
-		decoded := map[string]interface{}{
-			"header": map[string]interface{}{
-				"payloadTypeName": resolvePayloadTypeName(tx.PayloadType),
-			},
-		}
-		if tx.DecodedJSON != "" {
-			var payload map[string]interface{}
-			if json.Unmarshal([]byte(tx.DecodedJSON), &payload) == nil {
-				decoded["payload"] = payload
-			}
-		}
-
-		pkt := map[string]interface{}{
-			"id":                tx.ID,
-			"raw_hex":           strOrNil(tx.RawHex),
-			"hash":              strOrNil(tx.Hash),
-			"first_seen":        strOrNil(tx.FirstSeen),
-			"timestamp":         strOrNil(tx.FirstSeen),
-			"route_type":        intPtrOrNil(tx.RouteType),
-			"payload_type":      intPtrOrNil(tx.PayloadType),
-			"decoded_json":      strOrNil(tx.DecodedJSON),
-			"observer_id":       strOrNil(obs.ObserverID),
-			"observer_name":     strOrNil(obs.ObserverName),
-			"snr":               floatPtrOrNil(obs.SNR),
-			"rssi":              floatPtrOrNil(obs.RSSI),
-			"path_json":         strOrNil(obs.PathJSON),
-			"direction":         strOrNil(obs.Direction),
-			"observation_count": tx.ObservationCount,
-		}
-		broadcastMap := make(map[string]interface{}, len(pkt)+2)
-		for k, v := range pkt {
-			broadcastMap[k] = v
-		}
-		broadcastMap["decoded"] = decoded
-		broadcastMap["packet"] = pkt
-		broadcastMaps = append(broadcastMaps, broadcastMap)
 	}
 
 	// Re-pick best observation for updated transmissions and update subpath index
@@ -1312,10 +1263,11 @@ func (s *PacketStore) IngestNewObservations(sinceObsID, limit int) []map[string]
 		s.subpathCache = make(map[string]*cachedResult)
 		s.cacheMu.Unlock()
 
-		// analytics caches cleared; no per-cycle log to avoid stdout overhead
+		log.Printf("[poller] IngestNewObservations: updated %d existing txs, maxObsID %d->%d",
+			len(updatedTxs), sinceObsID, newMaxObsID)
 	}
 
-	return broadcastMaps
+	return newMaxObsID
 }
 
 // MaxTransmissionID returns the highest transmission ID in the store.
@@ -1936,7 +1888,7 @@ func (s *PacketStore) GetChannelMessages(channelHash string, limit, offset int)
 	msgMap := map[string]*msgEntry{}
 	var msgOrder []string
 
-	// Iterate type-5 packets oldest-first (byPayloadType is ASC = oldest first)
+	// Iterate type-5 packets oldest-first (byPayloadType is in load order = newest first)
 	type decodedMsg struct {
 		Type            string      `json:"type"`
 		Channel         string      `json:"channel"`
@@ -1947,7 +1899,8 @@ func (s *PacketStore) GetChannelMessages(channelHash string, limit, offset int)
 	}
 
 	grpTxts := s.byPayloadType[5]
-	for _, tx := range grpTxts {
+	for i := len(grpTxts) - 1; i >= 0; i-- {
+		tx := grpTxts[i]
 		if tx.DecodedJSON == "" {
 			continue
 		}
@@ -3762,26 +3715,8 @@ type hashSizeNodeInfo struct {
 	Inconsistent bool
 }
 
-// GetNodeHashSizeInfo returns cached per-node hash size data, recomputing at most every 15s.
+// GetNodeHashSizeInfo scans advert packets to compute per-node hash size data.
 func (s *PacketStore) GetNodeHashSizeInfo() map[string]*hashSizeNodeInfo {
-	const ttl = 15 * time.Second
-	s.hashSizeInfoMu.Lock()
-	if s.hashSizeInfoCache != nil && time.Since(s.hashSizeInfoAt) < ttl {
-		cached := s.hashSizeInfoCache
-		s.hashSizeInfoMu.Unlock()
-		return cached
-	}
-	s.hashSizeInfoMu.Unlock()
-	result := s.computeNodeHashSizeInfo()
-	s.hashSizeInfoMu.Lock()
-	s.hashSizeInfoCache = result
-	s.hashSizeInfoAt = time.Now()
-	s.hashSizeInfoMu.Unlock()
-	return result
-}
-
-// computeNodeHashSizeInfo scans advert packets to compute per-node hash size data.
-func (s *PacketStore) computeNodeHashSizeInfo() map[string]*hashSizeNodeInfo {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
 
@@ -4134,13 +4069,13 @@ func (s *PacketStore) GetNodeHealth(pubkey string) (map[string]interface{}, erro
 		lhVal = lastHeard
 	}
 
-	// Recent packets (up to 20, newest first — read from tail of oldest-first slice)
+	// Recent packets (up to 20, newest first — packets are already sorted DESC)
 	recentLimit := 20
 	if len(packets) < recentLimit {
 		recentLimit = len(packets)
 	}
 	recentPackets := make([]map[string]interface{}, 0, recentLimit)
-	for i := len(packets) - 1; i >= len(packets)-recentLimit; i-- {
+	for i := 0; i < recentLimit; i++ {
 		p := txToMap(packets[i])
 		delete(p, "observations")
 		recentPackets = append(recentPackets, p)

cmd/server/websocket.go

@@ -1,245 +1,229 @@
-package main
-
-import (
-	"encoding/json"
-	"log"
-	"net/http"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/gorilla/websocket"
-)
-
-var upgrader = websocket.Upgrader{
-	ReadBufferSize:  1024,
-	WriteBufferSize: 4096,
-	CheckOrigin:     func(r *http.Request) bool { return true },
-}
-
-// Hub manages WebSocket clients and broadcasts.
-type Hub struct {
-	mu      sync.RWMutex
-	clients map[*Client]bool
-}
-
-// Client is a single WebSocket connection.
-type Client struct {
-	conn *websocket.Conn
-	send chan []byte
-}
-
-func NewHub() *Hub {
-	return &Hub{
-		clients: make(map[*Client]bool),
-	}
-}
-
-func (h *Hub) ClientCount() int {
-	h.mu.RLock()
-	defer h.mu.RUnlock()
-	return len(h.clients)
-}
-
-func (h *Hub) Register(c *Client) {
-	h.mu.Lock()
-	h.clients[c] = true
-	h.mu.Unlock()
-	log.Printf("[ws] client connected (%d total)", h.ClientCount())
-}
-
-func (h *Hub) Unregister(c *Client) {
-	h.mu.Lock()
-	if _, ok := h.clients[c]; ok {
-		delete(h.clients, c)
-		close(c.send)
-	}
-	h.mu.Unlock()
-	log.Printf("[ws] client disconnected (%d total)", h.ClientCount())
-}
-
-// Broadcast sends a message to all connected clients.
-func (h *Hub) Broadcast(msg interface{}) {
-	data, err := json.Marshal(msg)
-	if err != nil {
-		log.Printf("[ws] marshal error: %v", err)
-		return
-	}
-	h.mu.RLock()
-	defer h.mu.RUnlock()
-	for c := range h.clients {
-		select {
-		case c.send <- data:
-		default:
-			// Client buffer full — drop
-		}
-	}
-}
-
-// ServeWS handles the WebSocket upgrade and runs the client.
-func (h *Hub) ServeWS(w http.ResponseWriter, r *http.Request) {
-	conn, err := upgrader.Upgrade(w, r, nil)
-	if err != nil {
-		log.Printf("[ws] upgrade error: %v", err)
-		return
-	}
-
-	client := &Client{
-		conn: conn,
-		send: make(chan []byte, 256),
-	}
-	h.Register(client)
-
-	go client.writePump()
-	go client.readPump(h)
-}
-
-// wsOrStatic upgrades WebSocket requests at any path, serves static files otherwise.
-func wsOrStatic(hub *Hub, static http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if strings.EqualFold(r.Header.Get("Upgrade"), "websocket") {
-			hub.ServeWS(w, r)
-			return
-		}
-		static.ServeHTTP(w, r)
-	})
-}
-
-func (c *Client) readPump(hub *Hub) {
-	defer func() {
-		hub.Unregister(c)
-		c.conn.Close()
-	}()
-	c.conn.SetReadLimit(512)
-	c.conn.SetReadDeadline(time.Now().Add(60 * time.Second))
-	c.conn.SetPongHandler(func(string) error {
-		c.conn.SetReadDeadline(time.Now().Add(60 * time.Second))
-		return nil
-	})
-	for {
-		_, _, err := c.conn.ReadMessage()
-		if err != nil {
-			break
-		}
-	}
-}
-
-func (c *Client) writePump() {
-	ticker := time.NewTicker(30 * time.Second)
-	defer func() {
-		ticker.Stop()
-		c.conn.Close()
-	}()
-	for {
-		select {
-		case message, ok := <-c.send:
-			c.conn.SetWriteDeadline(time.Now().Add(10 * time.Second))
-			if !ok {
-				c.conn.WriteMessage(websocket.CloseMessage, []byte{})
-				return
-			}
-			if err := c.conn.WriteMessage(websocket.TextMessage, message); err != nil {
-				return
-			}
-		case <-ticker.C:
-			c.conn.SetWriteDeadline(time.Now().Add(10 * time.Second))
-			if err := c.conn.WriteMessage(websocket.PingMessage, nil); err != nil {
-				return
-			}
-		}
-	}
-}
-
-// Poller watches for new transmissions in SQLite and broadcasts them.
-type Poller struct {
-	db       *DB
-	hub      *Hub
-	store    *PacketStore // optional: if set, new transmissions are ingested into memory
-	interval time.Duration
-	stop     chan struct{}
-}
-
-func NewPoller(db *DB, hub *Hub, interval time.Duration) *Poller {
-	return &Poller{db: db, hub: hub, interval: interval, stop: make(chan struct{})}
-}
-
-func (p *Poller) Start() {
-	lastID := p.db.GetMaxTransmissionID()
-	lastObsID := p.db.GetMaxObservationID()
-	log.Printf("[poller] starting from transmission ID %d, obs ID %d, interval %v", lastID, lastObsID, p.interval)
-
-	ticker := time.NewTicker(p.interval)
-	defer ticker.Stop()
-
-	for {
-		select {
-		case <-ticker.C:
-			if p.store != nil {
-				// Ingest new transmissions into in-memory store and broadcast
-				newTxs, newMax := p.store.IngestNewFromDB(lastID, 100)
-				if newMax > lastID {
-					lastID = newMax
-				}
-				// Ingest new observations for existing transmissions (fixes #174)
-				nextObsID := lastObsID
-				if err := p.db.conn.QueryRow(`
-					SELECT COALESCE(MAX(id), ?) FROM (
-						SELECT id FROM observations
-						WHERE id > ?
-						ORDER BY id ASC
-						LIMIT 500
-					)`, lastObsID, lastObsID).Scan(&nextObsID); err != nil {
-					nextObsID = lastObsID
-				}
-				newObs := p.store.IngestNewObservations(lastObsID, 500)
-				if nextObsID > lastObsID {
-					lastObsID = nextObsID
-				}
-				if len(newTxs) > 0 {
-					log.Printf("[broadcast] sending %d packets to %d clients (lastID now %d)", len(newTxs), p.hub.ClientCount(), lastID)
-				}
-				for _, tx := range newTxs {
-					p.hub.Broadcast(WSMessage{
-						Type: "packet",
-						Data: tx,
-					})
-				}
-				for _, obs := range newObs {
-					p.hub.Broadcast(WSMessage{
-						Type: "packet",
-						Data: obs,
-					})
-				}
-			} else {
-				// Fallback: direct DB query (used when store is nil, e.g. tests)
-				newTxs, err := p.db.GetNewTransmissionsSince(lastID, 100)
-				if err != nil {
-					log.Printf("[poller] error: %v", err)
-					continue
-				}
-				for _, tx := range newTxs {
-					id, _ := tx["id"].(int)
-					if id > lastID {
-						lastID = id
-					}
-					// Copy packet fields for the nested packet (avoids circular ref)
-					pkt := make(map[string]interface{}, len(tx))
-					for k, v := range tx {
-						pkt[k] = v
-					}
-					tx["packet"] = pkt
-					p.hub.Broadcast(WSMessage{
-						Type: "packet",
-						Data: tx,
-					})
-				}
-			}
-		case <-p.stop:
-			return
-		}
-	}
-}
-
-func (p *Poller) Stop() {
-	close(p.stop)
-}
+package main
+
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/gorilla/websocket"
+)
+
+var upgrader = websocket.Upgrader{
+	ReadBufferSize:  1024,
+	WriteBufferSize: 4096,
+	CheckOrigin:     func(r *http.Request) bool { return true },
+}
+
+// Hub manages WebSocket clients and broadcasts.
+type Hub struct {
+	mu      sync.RWMutex
+	clients map[*Client]bool
+}
+
+// Client is a single WebSocket connection.
+type Client struct {
+	conn *websocket.Conn
+	send chan []byte
+}
+
+func NewHub() *Hub {
+	return &Hub{
+		clients: make(map[*Client]bool),
+	}
+}
+
+func (h *Hub) ClientCount() int {
+	h.mu.RLock()
+	defer h.mu.RUnlock()
+	return len(h.clients)
+}
+
+func (h *Hub) Register(c *Client) {
+	h.mu.Lock()
+	h.clients[c] = true
+	h.mu.Unlock()
+	log.Printf("[ws] client connected (%d total)", h.ClientCount())
+}
+
+func (h *Hub) Unregister(c *Client) {
+	h.mu.Lock()
+	if _, ok := h.clients[c]; ok {
+		delete(h.clients, c)
+		close(c.send)
+	}
+	h.mu.Unlock()
+	log.Printf("[ws] client disconnected (%d total)", h.ClientCount())
+}
+
+// Broadcast sends a message to all connected clients.
+func (h *Hub) Broadcast(msg interface{}) {
+	data, err := json.Marshal(msg)
+	if err != nil {
+		log.Printf("[ws] marshal error: %v", err)
+		return
+	}
+	h.mu.RLock()
+	defer h.mu.RUnlock()
+	for c := range h.clients {
+		select {
+		case c.send <- data:
+		default:
+			// Client buffer full — drop
+		}
+	}
+}
+
+// ServeWS handles the WebSocket upgrade and runs the client.
+func (h *Hub) ServeWS(w http.ResponseWriter, r *http.Request) {
+	conn, err := upgrader.Upgrade(w, r, nil)
+	if err != nil {
+		log.Printf("[ws] upgrade error: %v", err)
+		return
+	}
+
+	client := &Client{
+		conn: conn,
+		send: make(chan []byte, 256),
+	}
+	h.Register(client)
+
+	go client.writePump()
+	go client.readPump(h)
+}
+
+// wsOrStatic upgrades WebSocket requests at any path, serves static files otherwise.
+func wsOrStatic(hub *Hub, static http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if strings.EqualFold(r.Header.Get("Upgrade"), "websocket") {
+			hub.ServeWS(w, r)
+			return
+		}
+		static.ServeHTTP(w, r)
+	})
+}
+
+func (c *Client) readPump(hub *Hub) {
+	defer func() {
+		hub.Unregister(c)
+		c.conn.Close()
+	}()
+	c.conn.SetReadLimit(512)
+	c.conn.SetReadDeadline(time.Now().Add(60 * time.Second))
+	c.conn.SetPongHandler(func(string) error {
+		c.conn.SetReadDeadline(time.Now().Add(60 * time.Second))
+		return nil
+	})
+	for {
+		_, _, err := c.conn.ReadMessage()
+		if err != nil {
+			break
+		}
+	}
+}
+
+func (c *Client) writePump() {
+	ticker := time.NewTicker(30 * time.Second)
+	defer func() {
+		ticker.Stop()
+		c.conn.Close()
+	}()
+	for {
+		select {
+		case message, ok := <-c.send:
+			c.conn.SetWriteDeadline(time.Now().Add(10 * time.Second))
+			if !ok {
+				c.conn.WriteMessage(websocket.CloseMessage, []byte{})
+				return
+			}
+			if err := c.conn.WriteMessage(websocket.TextMessage, message); err != nil {
+				return
+			}
+		case <-ticker.C:
+			c.conn.SetWriteDeadline(time.Now().Add(10 * time.Second))
+			if err := c.conn.WriteMessage(websocket.PingMessage, nil); err != nil {
+				return
+			}
+		}
+	}
+}
+
+// Poller watches for new transmissions in SQLite and broadcasts them.
+type Poller struct {
+	db       *DB
+	hub      *Hub
+	store    *PacketStore // optional: if set, new transmissions are ingested into memory
+	interval time.Duration
+	stop     chan struct{}
+}
+
+func NewPoller(db *DB, hub *Hub, interval time.Duration) *Poller {
+	return &Poller{db: db, hub: hub, interval: interval, stop: make(chan struct{})}
+}
+
+func (p *Poller) Start() {
+	lastID := p.db.GetMaxTransmissionID()
+	lastObsID := p.db.GetMaxObservationID()
+	log.Printf("[poller] starting from transmission ID %d, obs ID %d, interval %v", lastID, lastObsID, p.interval)
+
+	ticker := time.NewTicker(p.interval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			if p.store != nil {
+				// Ingest new transmissions into in-memory store and broadcast
+				newTxs, newMax := p.store.IngestNewFromDB(lastID, 100)
+				if newMax > lastID {
+					lastID = newMax
+				}
+				// Ingest new observations for existing transmissions (fixes #174)
+				newObsMax := p.store.IngestNewObservations(lastObsID, 500)
+				if newObsMax > lastObsID {
+					lastObsID = newObsMax
+				}
+				if len(newTxs) > 0 {
+					log.Printf("[broadcast] sending %d packets to %d clients (lastID now %d)", len(newTxs), p.hub.ClientCount(), lastID)
+				}
+				for _, tx := range newTxs {
+					p.hub.Broadcast(WSMessage{
+						Type: "packet",
+						Data: tx,
+					})
+				}
+			} else {
+				// Fallback: direct DB query (used when store is nil, e.g. tests)
+				newTxs, err := p.db.GetNewTransmissionsSince(lastID, 100)
+				if err != nil {
+					log.Printf("[poller] error: %v", err)
+					continue
+				}
+				for _, tx := range newTxs {
+					id, _ := tx["id"].(int)
+					if id > lastID {
+						lastID = id
+					}
+					// Copy packet fields for the nested packet (avoids circular ref)
+					pkt := make(map[string]interface{}, len(tx))
+					for k, v := range tx {
+						pkt[k] = v
+					}
+					tx["packet"] = pkt
+					p.hub.Broadcast(WSMessage{
+						Type: "packet",
+						Data: tx,
+					})
+				}
+			}
+		case <-p.stop:
+			return
+		}
+	}
+}
+
+func (p *Poller) Stop() {
+	close(p.stop)
+}

cmd/server/websocket_test.go

@@ -1,415 +1,275 @@
-package main
-
-import (
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"sort"
-	"testing"
-	"time"
-
-	"github.com/gorilla/websocket"
-)
-
-func TestHubBroadcast(t *testing.T) {
-	hub := NewHub()
-
-	if hub.ClientCount() != 0 {
-		t.Errorf("expected 0 clients, got %d", hub.ClientCount())
-	}
-
-	// Create a test server with WebSocket endpoint
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		hub.ServeWS(w, r)
-	}))
-	defer srv.Close()
-
-	// Connect a WebSocket client
-	wsURL := "ws" + srv.URL[4:] // replace http with ws
-	conn, _, err := websocket.DefaultDialer.Dial(wsURL, nil)
-	if err != nil {
-		t.Fatalf("dial error: %v", err)
-	}
-	defer conn.Close()
-
-	// Wait for registration
-	time.Sleep(50 * time.Millisecond)
-
-	if hub.ClientCount() != 1 {
-		t.Errorf("expected 1 client, got %d", hub.ClientCount())
-	}
-
-	// Broadcast a message
-	hub.Broadcast(map[string]interface{}{
-		"type": "packet",
-		"data": map[string]interface{}{"id": 1, "hash": "test123"},
-	})
-
-	// Read the message
-	conn.SetReadDeadline(time.Now().Add(2 * time.Second))
-	_, msg, err := conn.ReadMessage()
-	if err != nil {
-		t.Fatalf("read error: %v", err)
-	}
-	if len(msg) == 0 {
-		t.Error("expected non-empty message")
-	}
-
-	// Disconnect
-	conn.Close()
-	time.Sleep(100 * time.Millisecond)
-}
-
-func TestPollerCreation(t *testing.T) {
-	db := setupTestDB(t)
-	defer db.Close()
-	seedTestData(t, db)
-	hub := NewHub()
-
-	poller := NewPoller(db, hub, 100*time.Millisecond)
-	if poller == nil {
-		t.Fatal("expected poller")
-	}
-
-	// Start and stop
-	go poller.Start()
-	time.Sleep(200 * time.Millisecond)
-	poller.Stop()
-}
-
-func TestHubMultipleClients(t *testing.T) {
-	hub := NewHub()
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		hub.ServeWS(w, r)
-	}))
-	defer srv.Close()
-
-	wsURL := "ws" + srv.URL[4:]
-
-	// Connect two clients
-	conn1, _, err := websocket.DefaultDialer.Dial(wsURL, nil)
-	if err != nil {
-		t.Fatalf("dial error: %v", err)
-	}
-	defer conn1.Close()
-
-	conn2, _, err := websocket.DefaultDialer.Dial(wsURL, nil)
-	if err != nil {
-		t.Fatalf("dial error: %v", err)
-	}
-	defer conn2.Close()
-
-	time.Sleep(100 * time.Millisecond)
-
-	if hub.ClientCount() != 2 {
-		t.Errorf("expected 2 clients, got %d", hub.ClientCount())
-	}
-
-	// Broadcast and both should receive
-	hub.Broadcast(map[string]interface{}{"type": "test", "data": "hello"})
-
-	conn1.SetReadDeadline(time.Now().Add(2 * time.Second))
-	_, msg1, err := conn1.ReadMessage()
-	if err != nil {
-		t.Fatalf("conn1 read error: %v", err)
-	}
-	if len(msg1) == 0 {
-		t.Error("expected non-empty message on conn1")
-	}
-
-	conn2.SetReadDeadline(time.Now().Add(2 * time.Second))
-	_, msg2, err := conn2.ReadMessage()
-	if err != nil {
-		t.Fatalf("conn2 read error: %v", err)
-	}
-	if len(msg2) == 0 {
-		t.Error("expected non-empty message on conn2")
-	}
-
-	// Disconnect one
-	conn1.Close()
-	time.Sleep(100 * time.Millisecond)
-
-	// Remaining client should still work
-	hub.Broadcast(map[string]interface{}{"type": "test2"})
-
-	conn2.SetReadDeadline(time.Now().Add(2 * time.Second))
-	_, msg3, err := conn2.ReadMessage()
-	if err != nil {
-		t.Fatalf("conn2 read error after disconnect: %v", err)
-	}
-	if len(msg3) == 0 {
-		t.Error("expected non-empty message")
-	}
-}
-
-func TestBroadcastFullBuffer(t *testing.T) {
-	hub := NewHub()
-
-	// Create a client with tiny buffer (1)
-	client := &Client{
-		send: make(chan []byte, 1),
-	}
-	hub.mu.Lock()
-	hub.clients[client] = true
-	hub.mu.Unlock()
-
-	// Fill the buffer
-	client.send <- []byte("first")
-
-	// This broadcast should drop the message (buffer full)
-	hub.Broadcast(map[string]interface{}{"type": "dropped"})
-
-	// Channel should still only have the first message
-	select {
-	case msg := <-client.send:
-		if string(msg) != "first" {
-			t.Errorf("expected 'first', got %s", string(msg))
-		}
-	default:
-		t.Error("expected message in channel")
-	}
-
-	// Clean up
-	hub.mu.Lock()
-	delete(hub.clients, client)
-	hub.mu.Unlock()
-}
-
-func TestBroadcastMarshalError(t *testing.T) {
-	hub := NewHub()
-
-	// Marshal error: functions can't be marshaled to JSON
-	hub.Broadcast(map[string]interface{}{"bad": func() {}})
-	// Should not panic — just log and return
-}
-
-func TestPollerBroadcastsNewData(t *testing.T) {
-	db := setupTestDB(t)
-	defer db.Close()
-	seedTestData(t, db)
-	hub := NewHub()
-
-	// Create a client to receive broadcasts
-	client := &Client{
-		send: make(chan []byte, 256),
-	}
-	hub.mu.Lock()
-	hub.clients[client] = true
-	hub.mu.Unlock()
-
-	poller := NewPoller(db, hub, 50*time.Millisecond)
-	go poller.Start()
-
-	// Insert new data to trigger broadcast
-	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type)
-		VALUES ('EEFF', 'newhash123456789', '2026-01-16T10:00:00Z', 1, 4)`)
-
-	time.Sleep(200 * time.Millisecond)
-	poller.Stop()
-
-	// Check if client received broadcast with packet field (fixes #162)
-	select {
-	case msg := <-client.send:
-		if len(msg) == 0 {
-			t.Error("expected non-empty broadcast message")
-		}
-		var parsed map[string]interface{}
-		if err := json.Unmarshal(msg, &parsed); err != nil {
-			t.Fatalf("failed to parse broadcast: %v", err)
-		}
-		if parsed["type"] != "packet" {
-			t.Errorf("expected type=packet, got %v", parsed["type"])
-		}
-		data, ok := parsed["data"].(map[string]interface{})
-		if !ok {
-			t.Fatal("expected data to be an object")
-		}
-		// packets.js filters on m.data.packet — must exist
-		pkt, ok := data["packet"]
-		if !ok || pkt == nil {
-			t.Error("expected data.packet to exist (required by packets.js WS handler)")
-		}
-		pktMap, ok := pkt.(map[string]interface{})
-		if !ok {
-			t.Fatal("expected data.packet to be an object")
-		}
-		// Verify key fields exist in nested packet (timestamp required by packets.js)
-		for _, field := range []string{"id", "hash", "payload_type", "timestamp"} {
-			if _, exists := pktMap[field]; !exists {
-				t.Errorf("expected data.packet.%s to exist", field)
-			}
-		}
-	default:
-		// Might not have received due to timing
-	}
-
-	// Clean up
-	hub.mu.Lock()
-	delete(hub.clients, client)
-	hub.mu.Unlock()
-}
-
-func TestPollerBroadcastsMultipleObservations(t *testing.T) {
-	db := setupTestDB(t)
-	defer db.Close()
-	seedTestData(t, db)
-	hub := NewHub()
-
-	client := &Client{
-		send: make(chan []byte, 256),
-	}
-	hub.mu.Lock()
-	hub.clients[client] = true
-	hub.mu.Unlock()
-	defer func() {
-		hub.mu.Lock()
-		delete(hub.clients, client)
-		hub.mu.Unlock()
-	}()
-
-	poller := NewPoller(db, hub, 50*time.Millisecond)
-	store := NewPacketStore(db)
-	if err := store.Load(); err != nil {
-		t.Fatalf("store load failed: %v", err)
-	}
-	poller.store = store
-	go poller.Start()
-	defer poller.Stop()
-
-	// Wait for poller to initialize its lastID/lastObsID cursors before
-	// inserting new data; otherwise the poller may snapshot a lastID that
-	// already includes the test data and never broadcast it.
-	time.Sleep(100 * time.Millisecond)
-
-	now := time.Now().UTC().Format(time.RFC3339)
-	if _, err := db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json)
-		VALUES ('FACE', 'starbursthash237a', ?, 1, 4, '{"pubKey":"aabbccdd11223344","type":"ADVERT"}')`, now); err != nil {
-		t.Fatalf("insert tx failed: %v", err)
-	}
-	var txID int
-	if err := db.conn.QueryRow(`SELECT id FROM transmissions WHERE hash='starbursthash237a'`).Scan(&txID); err != nil {
-		t.Fatalf("query tx id failed: %v", err)
-	}
-	ts := time.Now().Unix()
-	if _, err := db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
-		VALUES (?, 1, 14.0, -82, '["aa"]', ?),
-		       (?, 2, 10.5, -90, '["aa","bb"]', ?),
-		       (?, 1, 7.0, -96, '["aa","bb","cc"]', ?)`,
-		txID, ts, txID, ts+1, txID, ts+2); err != nil {
-		t.Fatalf("insert observations failed: %v", err)
-	}
-
-	deadline := time.After(2 * time.Second)
-	var dataMsgs []map[string]interface{}
-	for len(dataMsgs) < 3 {
-		select {
-		case raw := <-client.send:
-			var parsed map[string]interface{}
-			if err := json.Unmarshal(raw, &parsed); err != nil {
-				t.Fatalf("unmarshal ws msg failed: %v", err)
-			}
-			if parsed["type"] != "packet" {
-				continue
-			}
-			data, ok := parsed["data"].(map[string]interface{})
-			if !ok {
-				continue
-			}
-			if data["hash"] == "starbursthash237a" {
-				dataMsgs = append(dataMsgs, data)
-			}
-		case <-deadline:
-			t.Fatalf("timed out waiting for 3 observation broadcasts, got %d", len(dataMsgs))
-		}
-	}
-
-	if len(dataMsgs) != 3 {
-		t.Fatalf("expected 3 messages, got %d", len(dataMsgs))
-	}
-
-	paths := make([]string, 0, 3)
-	observers := make(map[string]bool)
-	for _, m := range dataMsgs {
-		hash, _ := m["hash"].(string)
-		if hash != "starbursthash237a" {
-			t.Fatalf("unexpected hash %q", hash)
-		}
-		p, _ := m["path_json"].(string)
-		paths = append(paths, p)
-		if oid, ok := m["observer_id"].(string); ok && oid != "" {
-			observers[oid] = true
-		}
-	}
-	sort.Strings(paths)
-	wantPaths := []string{`["aa","bb","cc"]`, `["aa","bb"]`, `["aa"]`}
-	sort.Strings(wantPaths)
-	for i := range wantPaths {
-		if paths[i] != wantPaths[i] {
-			t.Fatalf("path mismatch at %d: got %q want %q", i, paths[i], wantPaths[i])
-		}
-	}
-	if len(observers) < 2 {
-		t.Fatalf("expected observations from >=2 observers, got %d", len(observers))
-	}
-}
-
-func TestIngestNewObservationsBroadcast(t *testing.T) {
-	db := setupTestDB(t)
-	defer db.Close()
-	seedTestData(t, db)
-	store := NewPacketStore(db)
-	if err := store.Load(); err != nil {
-		t.Fatalf("store load failed: %v", err)
-	}
-
-	maxObs := db.GetMaxObservationID()
-	now := time.Now().Unix()
-	if _, err := db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
-		VALUES (1, 2, 6.0, -100, '["aa","zz"]', ?),
-		       (1, 1, 5.0, -101, '["aa","yy"]', ?)`, now, now+1); err != nil {
-		t.Fatalf("insert new observations failed: %v", err)
-	}
-
-	maps := store.IngestNewObservations(maxObs, 500)
-	if len(maps) != 2 {
-		t.Fatalf("expected 2 broadcast maps, got %d", len(maps))
-	}
-	for _, m := range maps {
-		if m["hash"] != "abc123def4567890" {
-			t.Fatalf("unexpected hash in map: %v", m["hash"])
-		}
-		path, ok := m["path_json"].(string)
-		if !ok || path == "" {
-			t.Fatalf("missing path_json in map: %#v", m)
-		}
-		if _, ok := m["observer_id"]; !ok {
-			t.Fatalf("missing observer_id in map: %#v", m)
-		}
-	}
-}
-
-func TestHubRegisterUnregister(t *testing.T) {
-	hub := NewHub()
-
-	client := &Client{
-		send: make(chan []byte, 256),
-	}
-
-	hub.Register(client)
-	if hub.ClientCount() != 1 {
-		t.Errorf("expected 1 client after register, got %d", hub.ClientCount())
-	}
-
-	hub.Unregister(client)
-	if hub.ClientCount() != 0 {
-		t.Errorf("expected 0 clients after unregister, got %d", hub.ClientCount())
-	}
-
-	// Unregister again should be safe
-	hub.Unregister(client)
-	if hub.ClientCount() != 0 {
-		t.Errorf("expected 0 clients, got %d", hub.ClientCount())
-	}
-}
+package main
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/gorilla/websocket"
+)
+
+func TestHubBroadcast(t *testing.T) {
+	hub := NewHub()
+
+	if hub.ClientCount() != 0 {
+		t.Errorf("expected 0 clients, got %d", hub.ClientCount())
+	}
+
+	// Create a test server with WebSocket endpoint
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		hub.ServeWS(w, r)
+	}))
+	defer srv.Close()
+
+	// Connect a WebSocket client
+	wsURL := "ws" + srv.URL[4:] // replace http with ws
+	conn, _, err := websocket.DefaultDialer.Dial(wsURL, nil)
+	if err != nil {
+		t.Fatalf("dial error: %v", err)
+	}
+	defer conn.Close()
+
+	// Wait for registration
+	time.Sleep(50 * time.Millisecond)
+
+	if hub.ClientCount() != 1 {
+		t.Errorf("expected 1 client, got %d", hub.ClientCount())
+	}
+
+	// Broadcast a message
+	hub.Broadcast(map[string]interface{}{
+		"type": "packet",
+		"data": map[string]interface{}{"id": 1, "hash": "test123"},
+	})
+
+	// Read the message
+	conn.SetReadDeadline(time.Now().Add(2 * time.Second))
+	_, msg, err := conn.ReadMessage()
+	if err != nil {
+		t.Fatalf("read error: %v", err)
+	}
+	if len(msg) == 0 {
+		t.Error("expected non-empty message")
+	}
+
+	// Disconnect
+	conn.Close()
+	time.Sleep(100 * time.Millisecond)
+}
+
+func TestPollerCreation(t *testing.T) {
+	db := setupTestDB(t)
+	defer db.Close()
+	seedTestData(t, db)
+	hub := NewHub()
+
+	poller := NewPoller(db, hub, 100*time.Millisecond)
+	if poller == nil {
+		t.Fatal("expected poller")
+	}
+
+	// Start and stop
+	go poller.Start()
+	time.Sleep(200 * time.Millisecond)
+	poller.Stop()
+}
+
+func TestHubMultipleClients(t *testing.T) {
+	hub := NewHub()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		hub.ServeWS(w, r)
+	}))
+	defer srv.Close()
+
+	wsURL := "ws" + srv.URL[4:]
+
+	// Connect two clients
+	conn1, _, err := websocket.DefaultDialer.Dial(wsURL, nil)
+	if err != nil {
+		t.Fatalf("dial error: %v", err)
+	}
+	defer conn1.Close()
+
+	conn2, _, err := websocket.DefaultDialer.Dial(wsURL, nil)
+	if err != nil {
+		t.Fatalf("dial error: %v", err)
+	}
+	defer conn2.Close()
+
+	time.Sleep(100 * time.Millisecond)
+
+	if hub.ClientCount() != 2 {
+		t.Errorf("expected 2 clients, got %d", hub.ClientCount())
+	}
+
+	// Broadcast and both should receive
+	hub.Broadcast(map[string]interface{}{"type": "test", "data": "hello"})
+
+	conn1.SetReadDeadline(time.Now().Add(2 * time.Second))
+	_, msg1, err := conn1.ReadMessage()
+	if err != nil {
+		t.Fatalf("conn1 read error: %v", err)
+	}
+	if len(msg1) == 0 {
+		t.Error("expected non-empty message on conn1")
+	}
+
+	conn2.SetReadDeadline(time.Now().Add(2 * time.Second))
+	_, msg2, err := conn2.ReadMessage()
+	if err != nil {
+		t.Fatalf("conn2 read error: %v", err)
+	}
+	if len(msg2) == 0 {
+		t.Error("expected non-empty message on conn2")
+	}
+
+	// Disconnect one
+	conn1.Close()
+	time.Sleep(100 * time.Millisecond)
+
+	// Remaining client should still work
+	hub.Broadcast(map[string]interface{}{"type": "test2"})
+
+	conn2.SetReadDeadline(time.Now().Add(2 * time.Second))
+	_, msg3, err := conn2.ReadMessage()
+	if err != nil {
+		t.Fatalf("conn2 read error after disconnect: %v", err)
+	}
+	if len(msg3) == 0 {
+		t.Error("expected non-empty message")
+	}
+}
+
+func TestBroadcastFullBuffer(t *testing.T) {
+	hub := NewHub()
+
+	// Create a client with tiny buffer (1)
+	client := &Client{
+		send: make(chan []byte, 1),
+	}
+	hub.mu.Lock()
+	hub.clients[client] = true
+	hub.mu.Unlock()
+
+	// Fill the buffer
+	client.send <- []byte("first")
+
+	// This broadcast should drop the message (buffer full)
+	hub.Broadcast(map[string]interface{}{"type": "dropped"})
+
+	// Channel should still only have the first message
+	select {
+	case msg := <-client.send:
+		if string(msg) != "first" {
+			t.Errorf("expected 'first', got %s", string(msg))
+		}
+	default:
+		t.Error("expected message in channel")
+	}
+
+	// Clean up
+	hub.mu.Lock()
+	delete(hub.clients, client)
+	hub.mu.Unlock()
+}
+
+func TestBroadcastMarshalError(t *testing.T) {
+	hub := NewHub()
+
+	// Marshal error: functions can't be marshaled to JSON
+	hub.Broadcast(map[string]interface{}{"bad": func() {}})
+	// Should not panic — just log and return
+}
+
+func TestPollerBroadcastsNewData(t *testing.T) {
+	db := setupTestDB(t)
+	defer db.Close()
+	seedTestData(t, db)
+	hub := NewHub()
+
+	// Create a client to receive broadcasts
+	client := &Client{
+		send: make(chan []byte, 256),
+	}
+	hub.mu.Lock()
+	hub.clients[client] = true
+	hub.mu.Unlock()
+
+	poller := NewPoller(db, hub, 50*time.Millisecond)
+	go poller.Start()
+
+	// Insert new data to trigger broadcast
+	db.conn.Exec(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type)
+		VALUES ('EEFF', 'newhash123456789', '2026-01-16T10:00:00Z', 1, 4)`)
+
+	time.Sleep(200 * time.Millisecond)
+	poller.Stop()
+
+	// Check if client received broadcast with packet field (fixes #162)
+	select {
+	case msg := <-client.send:
+		if len(msg) == 0 {
+			t.Error("expected non-empty broadcast message")
+		}
+		var parsed map[string]interface{}
+		if err := json.Unmarshal(msg, &parsed); err != nil {
+			t.Fatalf("failed to parse broadcast: %v", err)
+		}
+		if parsed["type"] != "packet" {
+			t.Errorf("expected type=packet, got %v", parsed["type"])
+		}
+		data, ok := parsed["data"].(map[string]interface{})
+		if !ok {
+			t.Fatal("expected data to be an object")
+		}
+		// packets.js filters on m.data.packet — must exist
+		pkt, ok := data["packet"]
+		if !ok || pkt == nil {
+			t.Error("expected data.packet to exist (required by packets.js WS handler)")
+		}
+		pktMap, ok := pkt.(map[string]interface{})
+		if !ok {
+			t.Fatal("expected data.packet to be an object")
+		}
+		// Verify key fields exist in nested packet (timestamp required by packets.js)
+		for _, field := range []string{"id", "hash", "payload_type", "timestamp"} {
+			if _, exists := pktMap[field]; !exists {
+				t.Errorf("expected data.packet.%s to exist", field)
+			}
+		}
+	default:
+		// Might not have received due to timing
+	}
+
+	// Clean up
+	hub.mu.Lock()
+	delete(hub.clients, client)
+	hub.mu.Unlock()
+}
+
+func TestHubRegisterUnregister(t *testing.T) {
+	hub := NewHub()
+
+	client := &Client{
+		send: make(chan []byte, 256),
+	}
+
+	hub.Register(client)
+	if hub.ClientCount() != 1 {
+		t.Errorf("expected 1 client after register, got %d", hub.ClientCount())
+	}
+
+	hub.Unregister(client)
+	if hub.ClientCount() != 0 {
+		t.Errorf("expected 0 clients after unregister, got %d", hub.ClientCount())
+	}
+
+	// Unregister again should be safe
+	hub.Unregister(client)
+	if hub.ClientCount() != 0 {
+		t.Errorf("expected 0 clients, got %d", hub.ClientCount())
+	}
+}

config.example.json

@@ -98,13 +98,6 @@
     "#bookclub",
     "#shtf"
   ],
-  "healthThresholds": {
-    "infraDegradedHours": 24,
-    "infraSilentHours": 72,
-    "nodeDegradedHours": 1,
-    "nodeSilentHours": 24,
-    "_comment": "How long (hours) before nodes show as degraded/silent. 'infra' = repeaters & rooms, 'node' = companions & others."
-  },
   "defaultRegion": "SJC",
   "mapDefaults": {
     "center": [

decoder.js

@@ -2,8 +2,8 @@
  * MeshCore Packet Decoder
  * Custom implementation — does NOT use meshcore-decoder library (known path_length bug).
  *
- * Packet layout (per firmware docs/packet_format.md):
- *   [header(1)] [transportCodes?(4)] [pathLength(1)] [path hops] [payload...]
+ * Packet layout:
+ *   [header(1)] [pathLength(1)] [transportCodes?] [path hops] [payload...]
  *
  * Header byte (LSB first):
  *   bits 1-0: routeType (0=TRANSPORT_FLOOD, 1=FLOOD, 2=DIRECT, 3=TRANSPORT_DIRECT)
@@ -42,7 +42,7 @@ const PAYLOAD_TYPES = {
   0x0F: 'RAW_CUSTOM',
 };
 
-// Route types that carry transport codes (2x uint16_t, 4 bytes total)
+// Route types that carry transport codes (nextHop + lastHop, 2 bytes each)
 const TRANSPORT_ROUTES = new Set([0, 3]); // TRANSPORT_FLOOD, TRANSPORT_DIRECT
 
 // --- Header parsing ---
@@ -94,11 +94,13 @@ function decodeEncryptedPayload(buf) {
   };
 }
 
-/** ACK: checksum(4) — CRC of message timestamp + text + sender pubkey (per Mesh.cpp createAck) */
+/** ACK: dest(1) + src(1) + ack_hash(4) (per Mesh.cpp) */
 function decodeAck(buf) {
-  if (buf.length < 4) return { error: 'too short', raw: buf.toString('hex') };
+  if (buf.length < 6) return { error: 'too short', raw: buf.toString('hex') };
   return {
-    ackChecksum: buf.subarray(0, 4).toString('hex'),
+    destHash: buf.subarray(0, 1).toString('hex'),
+    srcHash: buf.subarray(1, 2).toString('hex'),
+    extraHash: buf.subarray(2, 6).toString('hex'),
   };
 }
 
@@ -123,8 +125,6 @@ function decodeAdvert(buf) {
       room: advType === 3,
       sensor: advType === 4,
       hasLocation: !!(flags & 0x10),
-      hasFeat1: !!(flags & 0x20),
-      hasFeat2: !!(flags & 0x40),
       hasName: !!(flags & 0x80),
     };
 
@@ -134,14 +134,6 @@ function decodeAdvert(buf) {
       result.lon = appdata.readInt32LE(off + 4) / 1e6;
       off += 8;
     }
-    if (result.flags.hasFeat1 && appdata.length >= off + 2) {
-      result.feat1 = appdata.readUInt16LE(off);
-      off += 2;
-    }
-    if (result.flags.hasFeat2 && appdata.length >= off + 2) {
-      result.feat2 = appdata.readUInt16LE(off);
-      off += 2;
-    }
     if (result.flags.hasName) {
       // Find null terminator to separate name from trailing telemetry bytes
       let nameEnd = appdata.length;
@@ -239,7 +231,7 @@ function decodeGrpTxt(buf, channelKeys) {
   return { type: 'GRP_TXT', channelHash, channelHashHex, decryptionStatus: 'no_key', mac, encryptedData };
 }
 
-/** ANON_REQ: dest(1) + ephemeral_pubkey(32) + MAC(2) + encrypted */
+/** ANON_REQ: dest(6) + ephemeral_pubkey(32) + MAC(4) + encrypted */
 function decodeAnonReq(buf) {
   if (buf.length < 35) return { error: 'too short', raw: buf.toString('hex') };
   return {
@@ -250,7 +242,7 @@ function decodeAnonReq(buf) {
   };
 }
 
-/** PATH: dest(1) + src(1) + MAC(2) + path_data */
+/** PATH: dest(6) + src(6) + MAC(4) + path_data */
 function decodePath_payload(buf) {
   if (buf.length < 4) return { error: 'too short', raw: buf.toString('hex') };
   return {
@@ -261,14 +253,14 @@ function decodePath_payload(buf) {
   };
 }
 
-/** TRACE: tag(4) + authCode(4) + flags(1) + pathData (per Mesh.cpp onRecvPacket TRACE) */
+/** TRACE: flags(1) + tag(4) + dest(6) + src(1) */
 function decodeTrace(buf) {
-  if (buf.length < 9) return { error: 'too short', raw: buf.toString('hex') };
+  if (buf.length < 12) return { error: 'too short', raw: buf.toString('hex') };
   return {
-    tag: buf.readUInt32LE(0),
-    authCode: buf.subarray(4, 8).toString('hex'),
-    flags: buf[8],
-    pathData: buf.subarray(9).toString('hex'),
+    flags: buf[0],
+    tag: buf.readUInt32LE(1),
+    destHash: buf.subarray(5, 11).toString('hex'),
+    srcHash: buf.subarray(11, 12).toString('hex'),
   };
 }
 
@@ -297,22 +289,20 @@ function decodePacket(hexString, channelKeys) {
   if (buf.length < 2) throw new Error('Packet too short (need at least header + pathLength)');
 
   const header = decodeHeader(buf[0]);
-  let offset = 1;
+  const pathByte = buf[1];
+  let offset = 2;
 
-  // Transport codes for TRANSPORT_FLOOD / TRANSPORT_DIRECT — BEFORE path_length per spec
+  // Transport codes for TRANSPORT_FLOOD / TRANSPORT_DIRECT
   let transportCodes = null;
   if (TRANSPORT_ROUTES.has(header.routeType)) {
     if (buf.length < offset + 4) throw new Error('Packet too short for transport codes');
     transportCodes = {
-      code1: buf.subarray(offset, offset + 2).toString('hex').toUpperCase(),
-      code2: buf.subarray(offset + 2, offset + 4).toString('hex').toUpperCase(),
+      nextHop: buf.subarray(offset, offset + 2).toString('hex').toUpperCase(),
+      lastHop: buf.subarray(offset + 2, offset + 4).toString('hex').toUpperCase(),
     };
     offset += 4;
   }
 
-  // Path length byte — AFTER transport codes per spec
-  const pathByte = buf[offset++];
-
   // Path
   const path = decodePath(pathByte, buf, offset);
   offset += path.bytesConsumed;
@@ -396,7 +386,7 @@ module.exports = { decodePacket, validateAdvert, hasNonPrintableChars, ROUTE_TYP
 
 // --- Tests ---
 if (require.main === module) {
-  console.log('=== Test 1: ADVERT, FLOOD, 5 hops (2-byte hashes), "Kpa Roof Solar" ===');
+  console.log('=== Test 1: ADVERT, FLOOD, 5 hops (2-byte hashes), "Test Repeater" ===');
   const pkt1 = decodePacket(
     '11451000D818206D3AAC152C8A91F89957E6D30CA51F36E28790228971C473B755F244F718754CF5EE4A2FD58D944466E42CDED140C66D0CC590183E32BAF40F112BE8F3F2BDF6012B4B2793C52F1D36F69EE054D9A05593286F78453E56C0EC4A3EB95DDA2A7543FCCC00B939CACC009278603902FC12BCF84B706120526F6F6620536F6C6172'
   );
@@ -412,7 +402,7 @@ if (require.main === module) {
   assert(pkt1.path.hops[0] === '1000', 'first hop should be 1000');
   assert(pkt1.path.hops[1] === 'D818', 'second hop should be D818');
   assert(pkt1.transportCodes === null, 'FLOOD has no transport codes');
-  assert(pkt1.payload.name === 'Kpa Roof Solar', 'name should be "Kpa Roof Solar"');
+  assert(pkt1.payload.name === 'Test Repeater', 'name should be "Test Repeater"');
   console.log('✅ Test 1 passed\n');
 
   console.log('=== Test 2: ADVERT, FLOOD, 0 hops (zero-path) ===');

docker-compose.yml

@@ -1,16 +1,11 @@
-# All container config lives here. manage.sh is just a wrapper around docker compose.
+# Volume paths unified with manage.sh — see manage.sh lines 9-12, 56-68, 98-113
 # Override defaults via .env or environment variables.
-# CRITICAL: All data mounts use bind mounts (~/path), NOT named volumes.
-# This ensures the DB and theme are visible on the host filesystem for backup.
 
 services:
   prod:
-    build: .
     image: corescope:latest
     container_name: corescope-prod
     restart: unless-stopped
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
     ports:
       - "${PROD_HTTP_PORT:-80}:${PROD_HTTP_PORT:-80}"
       - "${PROD_HTTPS_PORT:-443}:${PROD_HTTPS_PORT:-443}"
@@ -29,12 +24,9 @@ services:
       retries: 3
 
   staging:
-    build: .
     image: corescope:latest
     container_name: corescope-staging
     restart: unless-stopped
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
     ports:
       - "${STAGING_HTTP_PORT:-81}:${STAGING_HTTP_PORT:-81}"
       - "${STAGING_MQTT_PORT:-1884}:1883"
@@ -63,8 +55,6 @@ services:
     image: corescope-go:latest
     container_name: corescope-staging-go
     restart: unless-stopped
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
     ports:
       - "${STAGING_GO_HTTP_PORT:-82}:80"
       - "${STAGING_GO_MQTT_PORT:-1885}:1883"
@@ -86,7 +76,6 @@ services:
       - staging-go
 
 volumes:
-  # Named volumes for Caddy TLS certificates (not user data — managed by Caddy internally)
   caddy-data:
   caddy-data-staging:
   caddy-data-staging-go:

docs/rename-migration.md

@@ -1,101 +0,0 @@
-# CoreScope Migration Guide
-
-MeshCore Analyzer has been renamed to **CoreScope**. This document covers what you need to update.
-
-## What Changed
-
-- **Repository name**: `meshcore-analyzer` → `corescope`
-- **Docker image name**: `meshcore-analyzer:latest` → `corescope:latest`
-- **Docker container prefixes**: `meshcore-*` → `corescope-*`
-- **Default site name**: "MeshCore Analyzer" → "CoreScope"
-
-## What Did NOT Change
-
-- **Data directories** — `~/meshcore-data/` stays as-is
-- **Database filename** — `meshcore.db` is unchanged
-- **MQTT topics** — `meshcore/#` topics are protocol-level and unchanged
-- **Browser state** — Favorites, localStorage keys, and settings are preserved
-- **Config file format** — `config.json` structure is the same
-
----
-
-## 1. Git Remote Update
-
-Update your local clone to point to the new repository URL:
-
-```bash
-git remote set-url origin https://github.com/Kpa-clawbot/corescope.git
-git pull
-```
-
-## 2. Docker (manage.sh) Users
-
-Rebuild with the new image name:
-
-```bash
-./manage.sh stop
-git pull
-./manage.sh setup
-```
-
-The new image is `corescope:latest`. You can clean up the old image:
-
-```bash
-docker rmi meshcore-analyzer:latest
-```
-
-## 3. Docker Compose Users
-
-Rebuild containers with the new names:
-
-```bash
-docker compose down
-git pull
-docker compose build
-docker compose up -d
-```
-
-Container names change from `meshcore-*` to `corescope-*`. Old containers are removed by `docker compose down`.
-
-## 4. Data Directories
-
-**No action required.** The data directory `~/meshcore-data/` and database file `meshcore.db` are unchanged. Your existing data carries over automatically.
-
-## 5. Config
-
-If you customized `branding.siteName` in your `config.json`, update it to your preferred name. Otherwise the new default "CoreScope" applies automatically.
-
-No other config keys changed.
-
-## 6. MQTT
-
-**No action required.** MQTT topics (`meshcore/#`) are protocol-level and are not affected by the rename.
-
-## 7. Browser
-
-**No action required.** Bookmarks/favorites will continue to work at the same host and port. localStorage keys are unchanged, so your settings and preferences are preserved.
-
-## 8. CI/CD
-
-If you have custom CI/CD pipelines that reference:
-
-- The old repository URL (`meshcore-analyzer`)
-- The old Docker image name (`meshcore-analyzer:latest`)
-- Old container names (`meshcore-*`)
-
-Update those references to use the new names.
-
----
-
-## Summary Checklist
-
-| Item | Action Required? | What to Do |
-|------|-----------------|------------|
-| Git remote | ✅ Yes | `git remote set-url origin …corescope.git` |
-| Docker image | ✅ Yes | Rebuild; optionally `docker rmi` old image |
-| Docker Compose | ✅ Yes | `docker compose down && build && up` |
-| Data directories | ❌ No | Unchanged |
-| Config | ⚠️ Maybe | Only if you customized `branding.siteName` |
-| MQTT | ❌ No | Topics unchanged |
-| Browser | ❌ No | Settings preserved |
-| CI/CD | ⚠️ Maybe | Update if referencing old repo/image names |

manage.sh

@@ -2,20 +2,26 @@
 # CoreScope — Setup & Management Helper
 # Usage: ./manage.sh [command]
 #
-# All container management goes through docker compose.
-# Container config lives in docker-compose.yml — this script is just a wrapper.
-#
 # Idempotent: safe to cancel and re-run at any point.
 # Each step checks what's already done and skips it.
 set -e
 
+CONTAINER_NAME="corescope"
 IMAGE_NAME="corescope"
+DATA_VOLUME="meshcore-data"
+CADDY_VOLUME="caddy-data"
 STATE_FILE=".setup-state"
 
-# Source .env for port/path overrides (same file docker compose reads)
+# Source .env for port/path overrides (if present)
 [ -f .env ] && set -a && . ./.env && set +a
 
-# Resolved paths for prod/staging data (must match docker-compose.yml)
+# Docker Compose mode detection
+COMPOSE_MODE=false
+if [ -f docker-compose.yml ]; then
+  COMPOSE_MODE=true
+fi
+
+# Resolved paths for prod/staging data
 PROD_DATA="${PROD_DATA_DIR:-$HOME/meshcore-data}"
 STAGING_DATA="${STAGING_DATA_DIR:-$HOME/meshcore-staging-data}"
 
@@ -45,6 +51,83 @@ is_done()    { [ -f "$STATE_FILE" ] && grep -qx "$1" "$STATE_FILE" 2>/dev/null;
 
 # ─── Helpers ──────────────────────────────────────────────────────────────
 
+# Determine the correct data volume/mount args for docker run.
+# Detects existing host data directories and uses bind mounts if found.
+get_data_mount_args() {
+  # Check for existing host data directories with a DB file
+  if [ -d "$HOME/meshcore-data" ] && [ -f "$HOME/meshcore-data/meshcore.db" ]; then
+    echo "-v $HOME/meshcore-data:/app/data"
+    return
+  fi
+  if [ -d "$(pwd)/data" ] && [ -f "$(pwd)/data/meshcore.db" ]; then
+    echo "-v $(pwd)/data:/app/data"
+    return
+  fi
+  # Default: Docker named volume
+  echo "-v ${DATA_VOLUME}:/app/data"
+}
+
+# Determine the required port mappings from Caddyfile
+get_required_ports() {
+  local caddyfile_domain
+  caddyfile_domain=$(grep -v '^#' caddy-config/Caddyfile 2>/dev/null | head -1 | tr -d ' {')
+  if echo "$caddyfile_domain" | grep -qE '^:[0-9]+$'; then
+    # HTTP-only on a specific port (e.g., :80, :8080)
+    echo "${caddyfile_domain#:}"
+  else
+    # Domain name — needs 80 + 443 for Caddy auto-TLS
+    echo "80 443"
+  fi
+}
+
+# Get current container port mappings (just the host ports)
+get_current_ports() {
+  docker inspect "$CONTAINER_NAME" 2>/dev/null | \
+    grep -oP '"HostPort":\s*"\K[0-9]+' | sort -u | tr '\n' ' ' | sed 's/ $//'
+}
+
+# Check if container port mappings match what's needed.
+# Returns 0 if they match, 1 if mismatch.
+check_port_match() {
+  local required current
+  required=$(get_required_ports | tr ' ' '\n' | sort | tr '\n' ' ' | sed 's/ $//')
+  current=$(get_current_ports | tr ' ' '\n' | sort | tr '\n' ' ' | sed 's/ $//')
+  [ "$required" = "$current" ]
+}
+
+# Build the docker run command args (ports + volumes)
+get_docker_run_args() {
+  local ports_arg=""
+  for port in $(get_required_ports); do
+    ports_arg="$ports_arg -p ${port}:${port}"
+  done
+
+  local data_mount
+  data_mount=$(get_data_mount_args)
+
+  echo "$ports_arg \
+    -v $(pwd)/config.json:/app/config.json:ro \
+    -v $(pwd)/caddy-config/Caddyfile:/etc/caddy/Caddyfile:ro \
+    $data_mount \
+    -v ${CADDY_VOLUME}:/data/caddy"
+}
+
+# Recreate the container with current settings
+recreate_container() {
+  info "Stopping and removing old container..."
+  docker stop "$CONTAINER_NAME" 2>/dev/null || true
+  docker rm "$CONTAINER_NAME" 2>/dev/null || true
+
+  local run_args
+  run_args=$(get_docker_run_args)
+
+  eval docker run -d \
+    --name "$CONTAINER_NAME" \
+    --restart unless-stopped \
+    $run_args \
+    "$IMAGE_NAME"
+}
+
 # Check config.json for placeholder values
 check_config_placeholders() {
   if [ -f config.json ]; then
@@ -57,7 +140,7 @@ check_config_placeholders() {
 
 # Verify the running container is actually healthy
 verify_health() {
-  local container="corescope-prod"
+  local base_url="http://localhost:3000"
   local use_https=false
 
   # Check if Caddyfile has a real domain (not :80)
@@ -73,7 +156,7 @@ verify_health() {
   info "Waiting for server to respond..."
   local healthy=false
   for i in $(seq 1 45); do
-    if docker exec "$container" wget -qO- http://localhost:3000/api/stats &>/dev/null; then
+    if docker exec "$CONTAINER_NAME" wget -qO- http://localhost:3000/api/stats &>/dev/null; then
       healthy=true
       break
     fi
@@ -89,7 +172,7 @@ verify_health() {
 
   # Check for MQTT errors in recent logs
   local mqtt_errors
-  mqtt_errors=$(docker logs "$container" --tail 50 2>&1 | grep -i 'mqtt.*error\|mqtt.*fail\|ECONNREFUSED.*1883' || true)
+  mqtt_errors=$(docker logs "$CONTAINER_NAME" --tail 50 2>&1 | grep -i 'mqtt.*error\|mqtt.*fail\|ECONNREFUSED.*1883' || true)
   if [ -n "$mqtt_errors" ]; then
     warn "MQTT errors detected in logs:"
     echo "$mqtt_errors" | head -5 | sed 's/^/   /'
@@ -151,13 +234,6 @@ cmd_setup() {
   fi
 
   log "Docker $(docker --version | grep -oP 'version \K[^ ,]+')"
-  
-  # Check docker compose (separate check since it's a plugin/separate binary)
-  if ! docker compose version &>/dev/null; then
-    err "docker compose is required. Install Docker Desktop or docker-compose-plugin."
-    exit 1
-  fi
-  
   mark_done "docker"
 
   # ── Step 2: Config ──
@@ -295,12 +371,12 @@ cmd_setup() {
   if [ -n "$IMAGE_EXISTS" ] && is_done "build"; then
     log "Image already built."
     if confirm "Rebuild? (only needed if you updated the code)"; then
-      docker compose build prod
+      docker build --build-arg APP_VERSION=$(node -p "require('./package.json').version" 2>/dev/null || echo "unknown") --build-arg GIT_COMMIT=$(git rev-parse --short HEAD 2>/dev/null || echo "unknown") --build-arg BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ) -t "$IMAGE_NAME" .
       log "Image rebuilt."
     fi
   else
     info "This takes 1-2 minutes the first time..."
-    docker compose build prod
+    docker build --build-arg APP_VERSION=$(node -p "require('./package.json').version" 2>/dev/null || echo "unknown") --build-arg GIT_COMMIT=$(git rev-parse --short HEAD 2>/dev/null || echo "unknown") --build-arg BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ) -t "$IMAGE_NAME" .
     log "Image built."
   fi
   mark_done "build"
@@ -309,15 +385,45 @@ cmd_setup() {
   step 5 "Starting container"
 
   # Detect existing data directories
-  if [ -d "$PROD_DATA" ] && [ -f "$PROD_DATA/meshcore.db" ]; then
-    info "Found existing data at $PROD_DATA/ — will use bind mount."
+  if [ -d "$HOME/meshcore-data" ] && [ -f "$HOME/meshcore-data/meshcore.db" ]; then
+    info "Found existing data at \$HOME/meshcore-data/ — will use bind mount."
+  elif [ -d "$(pwd)/data" ] && [ -f "$(pwd)/data/meshcore.db" ]; then
+    info "Found existing data at ./data/ — will use bind mount."
   fi
 
-  if docker ps --format '{{.Names}}' | grep -q "^corescope-prod$"; then
+  if docker ps --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
     log "Container already running."
+    # Check port mappings match
+    if ! check_port_match; then
+      warn "Container port mappings don't match Caddyfile configuration."
+      warn "Current ports: $(get_current_ports)"
+      warn "Required ports: $(get_required_ports)"
+      if confirm "Recreate container with correct ports?"; then
+        recreate_container
+        log "Container recreated with correct ports."
+      fi
+    fi
+  elif docker ps -a --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
+    # Exists but stopped — check ports before starting
+    if ! check_port_match; then
+      warn "Stopped container has wrong port mappings."
+      warn "Current ports: $(get_current_ports)"
+      warn "Required ports: $(get_required_ports)"
+      if confirm "Recreate container with correct ports?"; then
+        recreate_container
+        log "Container recreated with correct ports."
+      else
+        info "Starting existing container (ports unchanged)..."
+        docker start "$CONTAINER_NAME"
+        log "Started (with old port mappings)."
+      fi
+    else
+      info "Container exists but is stopped. Starting..."
+      docker start "$CONTAINER_NAME"
+      log "Started."
+    fi
   else
-    mkdir -p "$PROD_DATA"
-    docker compose up -d prod
+    recreate_container
     log "Container started."
   fi
   mark_done "container"
@@ -325,7 +431,7 @@ cmd_setup() {
   # ── Step 6: Verify ──
   step 6 "Verifying"
 
-  if docker ps --format '{{.Names}}' | grep -q "^corescope-prod$"; then
+  if docker ps --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
     verify_health
 
     CADDYFILE_DOMAIN=$(grep -v '^#' caddy-config/Caddyfile 2>/dev/null | head -1 | tr -d ' {')
@@ -357,7 +463,7 @@ cmd_setup() {
     err "Container failed to start."
     echo ""
     echo "   Check what went wrong:"
-    echo "     docker compose logs prod"
+    echo "     docker logs ${CONTAINER_NAME}"
     echo ""
     echo "   Common fixes:"
     echo "     • Invalid config.json — check JSON syntax"
@@ -429,72 +535,132 @@ cmd_start() {
     WITH_STAGING=true
   fi
 
-  if $WITH_STAGING; then
-    # Prepare staging data and config
-    prepare_staging_db
-    prepare_staging_config
+  if $COMPOSE_MODE; then
+    if $WITH_STAGING; then
+      # Prepare staging data and config
+      prepare_staging_db
+      prepare_staging_config
 
-    info "Starting production container (corescope-prod) on ports ${PROD_HTTP_PORT:-80}/${PROD_HTTPS_PORT:-443}..."
-    info "Starting staging container (corescope-staging) on port ${STAGING_HTTP_PORT:-81}..."
-    docker compose --profile staging up -d
-    log "Production started on ports ${PROD_HTTP_PORT:-80}/${PROD_HTTPS_PORT:-443}/${PROD_MQTT_PORT:-1883}"
-    log "Staging started on port ${STAGING_HTTP_PORT:-81} (MQTT: ${STAGING_MQTT_PORT:-1884})"
+      info "Starting production container (corescope-prod) on ports ${PROD_HTTP_PORT:-80}/${PROD_HTTPS_PORT:-443}..."
+      info "Starting staging container (corescope-staging) on port ${STAGING_HTTP_PORT:-81}..."
+      docker compose --profile staging up -d
+      log "Production started on ports ${PROD_HTTP_PORT:-80}/${PROD_HTTPS_PORT:-443}/${PROD_MQTT_PORT:-1883}"
+      log "Staging started on port ${STAGING_HTTP_PORT:-81} (MQTT: ${STAGING_MQTT_PORT:-1884})"
+    else
+      info "Starting production container (corescope-prod) on ports ${PROD_HTTP_PORT:-80}/${PROD_HTTPS_PORT:-443}..."
+      docker compose up -d prod
+      log "Production started. Staging NOT running (use --with-staging to start both)."
+    fi
   else
-    info "Starting production container (corescope-prod) on ports ${PROD_HTTP_PORT:-80}/${PROD_HTTPS_PORT:-443}..."
-    docker compose up -d prod
-    log "Production started. Staging NOT running (use --with-staging to start both)."
+    # Legacy single-container mode
+    if $WITH_STAGING; then
+      err "--with-staging requires docker-compose.yml. Run setup or add docker-compose.yml first."
+      exit 1
+    fi
+    warn "No docker-compose.yml found — using legacy single-container mode."
+    if docker ps --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
+      warn "Already running."
+    elif docker ps -a --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
+      if ! check_port_match; then
+        warn "Container port mappings don't match Caddyfile configuration."
+        warn "Current ports: $(get_current_ports)"
+        warn "Required ports: $(get_required_ports)"
+        if confirm "Recreate container with correct ports?"; then
+          recreate_container
+          log "Container recreated and started with correct ports."
+          return
+        fi
+      fi
+      docker start "$CONTAINER_NAME"
+      log "Started."
+    else
+      err "Container doesn't exist. Run './manage.sh setup' first."
+      exit 1
+    fi
   fi
 }
 
 cmd_stop() {
   local TARGET="${1:-all}"
 
-  case "$TARGET" in
-    prod)
-      info "Stopping production container (corescope-prod)..."
-      docker compose stop prod
-      log "Production stopped."
-      ;;
-    staging)
-      info "Stopping staging container (corescope-staging)..."
-      docker compose --profile staging stop staging
-      log "Staging stopped."
-      ;;
-    all)
-      info "Stopping all containers..."
-      docker compose --profile staging --profile staging-go down
-      log "All containers stopped."
-      ;;
-    *)
-      err "Usage: ./manage.sh stop [prod|staging|all]"
-      exit 1
-      ;;
-  esac
+  if $COMPOSE_MODE; then
+    case "$TARGET" in
+      prod)
+        info "Stopping production container (corescope-prod)..."
+        docker compose stop prod
+        log "Production stopped."
+        ;;
+      staging)
+        info "Stopping staging container (corescope-staging)..."
+        docker compose stop staging
+        log "Staging stopped."
+        ;;
+      all)
+        info "Stopping all containers..."
+        docker compose --profile staging --profile staging-go down 2>/dev/null
+        docker rm -f "$CONTAINER_NAME" 2>/dev/null
+        log "All containers stopped."
+        ;;
+      *)
+        err "Usage: ./manage.sh stop [prod|staging|all]"
+        exit 1
+        ;;
+    esac
+  else
+    # Legacy mode
+    docker stop "$CONTAINER_NAME" 2>/dev/null && log "Stopped." || warn "Not running."
+  fi
 }
 
 cmd_restart() {
-  local TARGET="${1:-prod}"
-  case "$TARGET" in
-    prod)
-      info "Restarting production container (corescope-prod)..."
-      docker compose up -d --force-recreate prod
-      log "Production restarted."
-      ;;
-    staging)
-      info "Restarting staging container (corescope-staging)..."
-      docker compose --profile staging up -d --force-recreate staging
-      log "Staging restarted."
-      ;;
-    all)
-      info "Restarting all containers..."
-      docker compose --profile staging up -d --force-recreate
-      log "All containers restarted."
-      ;;
-    *)
-      err "Usage: ./manage.sh restart [prod|staging|all]"
+  if $COMPOSE_MODE; then
+    local TARGET="${1:-prod}"
+    case "$TARGET" in
+      prod)
+        info "Restarting production container (corescope-prod)..."
+        docker compose up -d --force-recreate prod
+        log "Production restarted."
+        ;;
+      staging)
+        info "Restarting staging container (corescope-staging)..."
+        docker compose --profile staging up -d --force-recreate staging
+        log "Staging restarted."
+        ;;
+      all)
+        info "Restarting all containers..."
+        docker compose --profile staging up -d --force-recreate
+        log "All containers restarted."
+        ;;
+      *)
+        err "Usage: ./manage.sh restart [prod|staging|all]"
+        exit 1
+        ;;
+    esac
+  else
+    # Legacy mode
+    if docker ps --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
+      if ! check_port_match; then
+        warn "Port mappings have changed. Recreating container..."
+        recreate_container
+        log "Container recreated with correct ports."
+      else
+        docker restart "$CONTAINER_NAME"
+        log "Restarted."
+      fi
+    elif docker ps -a --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
+      if ! check_port_match; then
+        warn "Port mappings have changed. Recreating container..."
+        recreate_container
+        log "Container recreated with correct ports."
+      else
+        docker start "$CONTAINER_NAME"
+        log "Started."
+      fi
+    else
+      err "Not running. Use './manage.sh setup'."
       exit 1
-      ;;
-  esac
+    fi
+  fi
 }
 
 # ─── Status ───────────────────────────────────────────────────────────────
@@ -529,68 +695,143 @@ show_container_status() {
 
 cmd_status() {
   echo ""
-  echo "═══════════════════════════════════════"
-  echo "  CoreScope Status"
-  echo "═══════════════════════════════════════"
-  echo ""
 
-  # Production
-  show_container_status "corescope-prod" "Production"
-  echo ""
+  if $COMPOSE_MODE; then
+    echo "═══════════════════════════════════════"
+    echo "  CoreScope Status (Compose)"
+    echo "═══════════════════════════════════════"
+    echo ""
+
+    # Production
+    show_container_status "corescope-prod" "Production"
+    echo ""
+
+    # Staging
+    if container_running "corescope-staging"; then
+      show_container_status "corescope-staging" "Staging"
+    else
+      info "Staging (corescope-staging): Not running (use --with-staging to start both)"
+    fi
+    echo ""
+
+    # Disk usage
+    if [ -d "$PROD_DATA" ] && [ -f "$PROD_DATA/meshcore.db" ]; then
+      local db_size
+      db_size=$(du -h "$PROD_DATA/meshcore.db" 2>/dev/null | cut -f1)
+      info "Production DB: ${db_size}"
+    fi
+    if [ -d "$STAGING_DATA" ] && [ -f "$STAGING_DATA/meshcore.db" ]; then
+      local staging_db_size
+      staging_db_size=$(du -h "$STAGING_DATA/meshcore.db" 2>/dev/null | cut -f1)
+      info "Staging DB: ${staging_db_size}"
+    fi
 
-  # Staging
-  if container_running "corescope-staging"; then
-    show_container_status "corescope-staging" "Staging"
   else
-    info "Staging (corescope-staging): Not running (use --with-staging to start both)"
-  fi
-  echo ""
+    # Legacy single-container status
+    if docker ps --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
+      log "Container is running."
+      echo ""
+      docker ps --filter "name=${CONTAINER_NAME}" --format "   Status: {{.Status}}"
+      docker ps --filter "name=${CONTAINER_NAME}" --format "   Ports:  {{.Ports}}"
+      echo ""
 
-  # Disk usage
-  if [ -d "$PROD_DATA" ] && [ -f "$PROD_DATA/meshcore.db" ]; then
-    local db_size
-    db_size=$(du -h "$PROD_DATA/meshcore.db" 2>/dev/null | cut -f1)
-    info "Production DB: ${db_size}"
-  fi
-  if [ -d "$STAGING_DATA" ] && [ -f "$STAGING_DATA/meshcore.db" ]; then
-    local staging_db_size
-    staging_db_size=$(du -h "$STAGING_DATA/meshcore.db" 2>/dev/null | cut -f1)
-    info "Staging DB: ${staging_db_size}"
-  fi
+      info "Service health:"
+      # Server
+      if docker exec "$CONTAINER_NAME" wget -qO /dev/null http://localhost:3000/api/stats 2>/dev/null; then
+        STATS=$(docker exec "$CONTAINER_NAME" wget -qO- http://localhost:3000/api/stats 2>/dev/null)
+        PACKETS=$(echo "$STATS" | grep -oP '"totalPackets":\K[0-9]+' 2>/dev/null || echo "?")
+        NODES=$(echo "$STATS" | grep -oP '"totalNodes":\K[0-9]+' 2>/dev/null || echo "?")
+        log "  Server — ${PACKETS} packets, ${NODES} nodes"
+      else
+        err "  Server — not responding"
+      fi
 
+      # Mosquitto
+      if docker exec "$CONTAINER_NAME" pgrep mosquitto &>/dev/null; then
+        log "  Mosquitto — running"
+      else
+        err "  Mosquitto — not running"
+      fi
+
+      # Caddy
+      if docker exec "$CONTAINER_NAME" pgrep caddy &>/dev/null; then
+        log "  Caddy — running"
+      else
+        err "  Caddy — not running"
+      fi
+
+      # Check for MQTT errors in recent logs
+      MQTT_ERRORS=$(docker logs "$CONTAINER_NAME" --tail 50 2>&1 | grep -i 'mqtt.*error\|mqtt.*fail\|ECONNREFUSED.*1883' || true)
+      if [ -n "$MQTT_ERRORS" ]; then
+        echo ""
+        warn "MQTT errors in recent logs:"
+        echo "$MQTT_ERRORS" | head -3 | sed 's/^/   /'
+      fi
+
+      # Port mapping check
+      if ! check_port_match; then
+        echo ""
+        warn "Port mappings don't match Caddyfile. Run './manage.sh restart' to fix."
+      fi
+
+      # Disk usage
+      DB_SIZE=$(docker exec "$CONTAINER_NAME" du -h /app/data/meshcore.db 2>/dev/null | cut -f1)
+      if [ -n "$DB_SIZE" ]; then
+        echo ""
+        info "Database size: ${DB_SIZE}"
+      fi
+    else
+      err "Container is not running."
+      if docker ps -a --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
+        echo "   Start with: ./manage.sh start"
+      else
+        echo "   Set up with: ./manage.sh setup"
+      fi
+    fi
+  fi
   echo ""
 }
 
 # ─── Logs ─────────────────────────────────────────────────────────────────
 
 cmd_logs() {
-  local TARGET="${1:-prod}"
-  local LINES="${2:-100}"
-  case "$TARGET" in
-    prod)
-      info "Tailing production logs..."
-      docker compose logs -f --tail="$LINES" prod
-      ;;
-    staging)
-      if container_running "corescope-staging"; then
-        info "Tailing staging logs..."
-        docker compose logs -f --tail="$LINES" staging
-      else
-        err "Staging container is not running."
-        info "Start with: ./manage.sh start --with-staging"
+  if $COMPOSE_MODE; then
+    local TARGET="${1:-prod}"
+    local LINES="${2:-100}"
+    case "$TARGET" in
+      prod)
+        info "Tailing production logs..."
+        docker compose logs -f --tail="$LINES" prod
+        ;;
+      staging)
+        if container_running "corescope-staging"; then
+          info "Tailing staging logs..."
+          docker compose logs -f --tail="$LINES" staging
+        else
+          err "Staging container is not running."
+          info "Start with: ./manage.sh start --with-staging"
+          exit 1
+        fi
+        ;;
+      *)
+        err "Usage: ./manage.sh logs [prod|staging] [lines]"
         exit 1
-      fi
-      ;;
-    *)
-      err "Usage: ./manage.sh logs [prod|staging] [lines]"
-      exit 1
-      ;;
-  esac
+        ;;
+    esac
+  else
+    # Legacy mode
+    docker logs -f "$CONTAINER_NAME" --tail "${1:-100}"
+  fi
 }
 
 # ─── Promote ──────────────────────────────────────────────────────────────
 
 cmd_promote() {
+  if ! $COMPOSE_MODE; then
+    err "Promotion requires Docker Compose setup (docker-compose.yml)."
+    exit 1
+  fi
+
   echo ""
   info "Promotion Flow: Staging → Production"
   echo ""
@@ -665,10 +906,10 @@ cmd_update() {
   git pull
 
   info "Rebuilding image..."
-  docker compose build prod
+  docker build --build-arg APP_VERSION=$(node -p "require('./package.json').version" 2>/dev/null || echo "unknown") --build-arg GIT_COMMIT=$(git rev-parse --short HEAD 2>/dev/null || echo "unknown") --build-arg BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ) -t "$IMAGE_NAME" .
 
   info "Restarting with new image..."
-  docker compose up -d --force-recreate prod
+  recreate_container
 
   log "Updated and restarted. Data preserved."
 }
@@ -683,13 +924,12 @@ cmd_backup() {
   info "Backing up to ${BACKUP_DIR}/"
 
   # Database
-  # Always use bind mount path (from .env or default)
-  DB_PATH="$PROD_DATA/meshcore.db"
+  DB_PATH=$(docker volume inspect "$DATA_VOLUME" --format '{{ .Mountpoint }}' 2>/dev/null)/meshcore.db
   if [ -f "$DB_PATH" ]; then
     cp "$DB_PATH" "$BACKUP_DIR/meshcore.db"
     log "Database ($(du -h "$BACKUP_DIR/meshcore.db" | cut -f1))"
-  elif container_running "corescope-prod"; then
-    docker cp corescope-prod:/app/data/meshcore.db "$BACKUP_DIR/meshcore.db" 2>/dev/null && \
+  elif docker ps --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
+    docker cp "${CONTAINER_NAME}:/app/data/meshcore.db" "$BACKUP_DIR/meshcore.db" 2>/dev/null && \
       log "Database (via docker cp)" || warn "Could not backup database"
   else
     warn "Database not found (container not running?)"
@@ -708,8 +948,7 @@ cmd_backup() {
   fi
 
   # Theme
-  # Always use bind mount path (from .env or default)
-  THEME_PATH="$PROD_DATA/theme.json"
+  THEME_PATH=$(docker volume inspect "$DATA_VOLUME" --format '{{ .Mountpoint }}' 2>/dev/null)/theme.json
   if [ -f "$THEME_PATH" ]; then
     cp "$THEME_PATH" "$BACKUP_DIR/theme.json"
     log "theme.json"
@@ -782,12 +1021,15 @@ cmd_restore() {
   info "Backing up current state..."
   cmd_backup "./backups/corescope-pre-restore-$(date +%Y%m%d-%H%M%S)"
 
-  docker compose stop prod 2>/dev/null || true
+  docker stop "$CONTAINER_NAME" 2>/dev/null || true
 
   # Restore database
-  mkdir -p "$PROD_DATA"
-  DEST_DB="$PROD_DATA/meshcore.db"
-  cp "$DB_FILE" "$DEST_DB"
+  DEST_DB=$(docker volume inspect "$DATA_VOLUME" --format '{{ .Mountpoint }}' 2>/dev/null)/meshcore.db
+  if [ -d "$(dirname "$DEST_DB")" ]; then
+    cp "$DB_FILE" "$DEST_DB"
+  else
+    docker cp "$DB_FILE" "${CONTAINER_NAME}:/app/data/meshcore.db"
+  fi
   log "Database restored"
 
   # Restore config if present
@@ -805,25 +1047,27 @@ cmd_restore() {
 
   # Restore theme if present
   if [ -n "$THEME_FILE" ] && [ -f "$THEME_FILE" ]; then
-    DEST_THEME="$PROD_DATA/theme.json"
-    cp "$THEME_FILE" "$DEST_THEME"
+    DEST_THEME=$(docker volume inspect "$DATA_VOLUME" --format '{{ .Mountpoint }}' 2>/dev/null)/theme.json
+    if [ -d "$(dirname "$DEST_THEME")" ]; then
+      cp "$THEME_FILE" "$DEST_THEME"
+    fi
     log "theme.json restored"
   fi
 
-  docker compose up -d prod
+  docker start "$CONTAINER_NAME"
   log "Restored and restarted."
 }
 
 # ─── MQTT Test ────────────────────────────────────────────────────────────
 
 cmd_mqtt_test() {
-  if ! container_running "corescope-prod"; then
+  if ! docker ps --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
     err "Container not running. Start with: ./manage.sh start"
     exit 1
   fi
 
   info "Listening for MQTT messages (10 second timeout)..."
-  MSG=$(docker exec corescope-prod mosquitto_sub -h localhost -t 'meshcore/#' -C 1 -W 10 2>/dev/null)
+  MSG=$(docker exec "$CONTAINER_NAME" mosquitto_sub -h localhost -t 'meshcore/#' -C 1 -W 10 2>/dev/null)
   if [ -n "$MSG" ]; then
     log "Received MQTT message:"
     echo "   $MSG" | head -c 200
@@ -840,19 +1084,21 @@ cmd_mqtt_test() {
 
 cmd_reset() {
   echo ""
-  warn "This will remove all containers, images, and setup state."
-  warn "Your config.json, Caddyfile, and data directory are NOT deleted."
+  warn "This will remove the container, image, and setup state."
+  warn "Your config.json, Caddyfile, and data volume are NOT deleted."
   echo ""
   if ! confirm "Continue?"; then
     echo "   Aborted."
     exit 0
   fi
 
-  docker compose --profile staging --profile staging-go down --rmi local 2>/dev/null || true
+  docker stop "$CONTAINER_NAME" 2>/dev/null || true
+  docker rm "$CONTAINER_NAME" 2>/dev/null || true
+  docker rmi "$IMAGE_NAME" 2>/dev/null || true
   rm -f "$STATE_FILE"
 
   log "Reset complete. Run './manage.sh setup' to start over."
-  echo "   Data directory: $PROD_DATA (not removed)"
+  echo "   Data volume preserved. To delete it: docker volume rm ${DATA_VOLUME}"
 }
 
 # ─── Help ─────────────────────────────────────────────────────────────────
@@ -882,7 +1128,11 @@ cmd_help() {
   echo "    restore <d>        Restore from backup dir or .db file"
   echo "    mqtt-test          Check if MQTT data is flowing"
   echo ""
-  echo "All commands use docker compose with docker-compose.yml."
+  if $COMPOSE_MODE; then
+    info "Docker Compose mode detected (docker-compose.yml present)."
+  else
+    warn "Legacy mode (no docker-compose.yml). Some commands unavailable."
+  fi
   echo ""
 }
 

public/index.html

@@ -22,9 +22,9 @@
   <meta name="twitter:title" content="CoreScope">
   <meta name="twitter:description" content="Real-time MeshCore LoRa mesh network analyzer — live packet visualization, node tracking, channel decryption, and route analysis.">
   <meta name="twitter:image" content="https://raw.githubusercontent.com/Kpa-clawbot/corescope/master/public/og-image.png">
-  <link rel="stylesheet" href="style.css?v=1774786038">
-  <link rel="stylesheet" href="home.css?v=1774786038">
-  <link rel="stylesheet" href="live.css?v=1774786038">
+  <link rel="stylesheet" href="style.css?v=1774731523">
+  <link rel="stylesheet" href="home.css?v=1774731523">
+  <link rel="stylesheet" href="live.css?v=1774731523">
   <link rel="stylesheet" href="https://unpkg.com/leaflet@1.9.4/dist/leaflet.css"
     integrity="sha256-p4NxAoJBhIIN+hmNHrzRCf9tD/miZyoHS5obTRR9BMY="
     crossorigin="anonymous">
@@ -81,29 +81,29 @@
   <main id="app" role="main"></main>
 
   <script src="vendor/qrcode.js"></script>
-  <script src="roles.js?v=1774786038"></script>
-  <script src="customize.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="region-filter.js?v=1774786038"></script>
-  <script src="hop-resolver.js?v=1774786038"></script>
-  <script src="hop-display.js?v=1774786038"></script>
-  <script src="app.js?v=1774786038"></script>
-  <script src="home.js?v=1774786038"></script>
-  <script src="packet-filter.js?v=1774786038"></script>
-  <script src="packets.js?v=1774786038"></script>
-  <script src="map.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="channels.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="nodes.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="traces.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="analytics.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="audio.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="audio-v1-constellation.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="audio-v2-constellation.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="audio-lab.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="live.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="observers.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="observer-detail.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="compare.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="node-analytics.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="perf.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="roles.js?v=1774731523"></script>
+  <script src="customize.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="region-filter.js?v=1774731523"></script>
+  <script src="hop-resolver.js?v=1774731523"></script>
+  <script src="hop-display.js?v=1774731523"></script>
+  <script src="app.js?v=1774731523"></script>
+  <script src="home.js?v=1774731523"></script>
+  <script src="packet-filter.js?v=1774731523"></script>
+  <script src="packets.js?v=1774731523"></script>
+  <script src="map.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="channels.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="nodes.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="traces.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="analytics.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="audio.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="audio-v1-constellation.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="audio-v2-constellation.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="audio-lab.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="live.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="observers.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="observer-detail.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="compare.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="node-analytics.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="perf.js?v=1774731523" onerror="console.error('Failed to load:', this.src)"></script>
 </body>
 </html>

public/nodes.js

@@ -89,8 +89,7 @@
 
   function getStatusTooltip(role, status) {
     const isInfra = role === 'repeater' || role === 'room';
-    const threshMs = isInfra ? HEALTH_THRESHOLDS.infraSilentMs : HEALTH_THRESHOLDS.nodeSilentMs;
-    const threshold = threshMs >= 3600000 ? Math.round(threshMs / 3600000) + 'h' : Math.round(threshMs / 60000) + 'm';
+    const threshold = isInfra ? '72h' : '24h';
     if (status === 'active') {
       return 'Active \u2014 heard within the last ' + threshold + '.' + (isInfra ? ' Repeaters typically advertise every 12-24h.' : '');
     }

public/packets.js

@@ -1512,12 +1512,14 @@
       rows += fieldRow(off + 1, 'Sender', decoded.sender || '—', '');
       if (decoded.sender_timestamp) rows += fieldRow(off + 2, 'Sender Time', decoded.sender_timestamp, '');
     } else if (decoded.type === 'ACK') {
-      rows += fieldRow(off, 'Checksum (4B)', decoded.ackChecksum || '', '');
+      rows += fieldRow(off, 'Dest Hash (6B)', decoded.destHash || '', '');
+      rows += fieldRow(off + 6, 'Src Hash (6B)', decoded.srcHash || '', '');
+      rows += fieldRow(off + 12, 'Extra (6B)', decoded.extraHash || '', '');
     } else if (decoded.destHash !== undefined) {
-      rows += fieldRow(off, 'Dest Hash (1B)', decoded.destHash || '', '');
-      rows += fieldRow(off + 1, 'Src Hash (1B)', decoded.srcHash || '', '');
-      rows += fieldRow(off + 2, 'MAC (2B)', decoded.mac || '', '');
-      rows += fieldRow(off + 4, 'Encrypted Data', truncate(decoded.encryptedData || '', 30), '');
+      rows += fieldRow(off, 'Dest Hash (6B)', decoded.destHash || '', '');
+      rows += fieldRow(off + 6, 'Src Hash (6B)', decoded.srcHash || '', '');
+      rows += fieldRow(off + 12, 'MAC (4B)', decoded.mac || '', '');
+      rows += fieldRow(off + 16, 'Encrypted Data', truncate(decoded.encryptedData || '', 30), '');
     } else {
       rows += fieldRow(off, 'Raw', truncate(buf.slice(off * 2), 40), '');
     }

public/perf.js

@@ -40,12 +40,12 @@
           html += `<h3>🔧 Go Runtime</h3><div style="display:flex;gap:16px;flex-wrap:wrap;margin:8px 0;">
             <div class="perf-card"><div class="perf-num">${gr.goroutines}</div><div class="perf-label">Goroutines</div></div>
             <div class="perf-card"><div class="perf-num">${gr.numGC}</div><div class="perf-label">GC Collections</div></div>
-            <div class="perf-card"><div class="perf-num" style="color:${gcColor}">${(+gr.pauseTotalMs).toFixed(1)}ms</div><div class="perf-label">GC Pause Total</div></div>
-            <div class="perf-card"><div class="perf-num">${(+gr.lastPauseMs).toFixed(1)}ms</div><div class="perf-label">Last GC Pause</div></div>
-            <div class="perf-card"><div class="perf-num">${(+gr.heapAllocMB).toFixed(1)}MB</div><div class="perf-label">Heap Alloc</div></div>
-            <div class="perf-card"><div class="perf-num">${(+gr.heapSysMB).toFixed(1)}MB</div><div class="perf-label">Heap Sys</div></div>
-            <div class="perf-card"><div class="perf-num">${(+gr.heapInuseMB).toFixed(1)}MB</div><div class="perf-label">Heap Inuse</div></div>
-            <div class="perf-card"><div class="perf-num">${(+gr.heapIdleMB).toFixed(1)}MB</div><div class="perf-label">Heap Idle</div></div>
+            <div class="perf-card"><div class="perf-num" style="color:${gcColor}">${gr.pauseTotalMs}ms</div><div class="perf-label">GC Pause Total</div></div>
+            <div class="perf-card"><div class="perf-num">${gr.lastPauseMs}ms</div><div class="perf-label">Last GC Pause</div></div>
+            <div class="perf-card"><div class="perf-num">${gr.heapAllocMB}MB</div><div class="perf-label">Heap Alloc</div></div>
+            <div class="perf-card"><div class="perf-num">${gr.heapSysMB}MB</div><div class="perf-label">Heap Sys</div></div>
+            <div class="perf-card"><div class="perf-num">${gr.heapInuseMB}MB</div><div class="perf-label">Heap Inuse</div></div>
+            <div class="perf-card"><div class="perf-num">${gr.heapIdleMB}MB</div><div class="perf-label">Heap Idle</div></div>
             <div class="perf-card"><div class="perf-num">${gr.numCPU}</div><div class="perf-label">CPUs</div></div>
             <div class="perf-card"><div class="perf-num">${health.websocket.clients}</div><div class="perf-label">WS Clients</div></div>
           </div>`;

public/style.css

@@ -155,7 +155,7 @@ a:focus-visible, button:focus-visible, input:focus-visible, select:focus-visible
 /* === Nav Stats === */
 .nav-stats {
   display: flex; gap: 12px; align-items: center; font-size: 12px; color: var(--nav-text-muted);
-  font-family: var(--mono); margin-right: 4px; white-space: nowrap;
+  font-family: var(--mono); margin-right: 4px;
 }
 .nav-stats .stat-val { color: var(--nav-text); font-weight: 600; transition: color 0.3s ease; }
 .nav-stats .stat-val.updated { color: var(--accent); }

scripts/collect-frontend-coverage.js

@@ -18,16 +18,10 @@ async function collectCoverage() {
   page.setDefaultTimeout(10000);
   const BASE = process.env.BASE_URL || 'http://localhost:13581';
 
-  // Helper: navigate via hash (SPA — no full page reload needed after initial load)
-  async function navHash(hash, wait = 150) {
-    await page.evaluate((h) => { location.hash = h; }, hash);
-    await new Promise(r => setTimeout(r, wait));
-  }
-
-  // Helper: safe click — 500ms timeout (elements exist immediately or not at all)
+  // Helper: safe click
   async function safeClick(selector, timeout) {
     try {
-      await page.click(selector, { timeout: timeout || 500 });
+      await page.click(selector, { timeout: timeout || 3000 });
     } catch {}
   }
 
@@ -70,9 +64,9 @@ async function collectCoverage() {
   // ══════════════════════════════════════════════
   console.log('  [coverage] Home page — chooser...');
   // Clear localStorage to get chooser
-  await page.goto(BASE, { waitUntil: 'domcontentloaded', timeout: 10000 }).catch(() => {});
+  await page.goto(BASE, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
   await page.evaluate(() => localStorage.clear()).catch(() => {});
-  await page.goto(`${BASE}/#/home`, { waitUntil: 'domcontentloaded', timeout: 10000 }).catch(() => {});
+  await page.goto(`${BASE}/#/home`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
 
   // Click "I'm new"
   await safeClick('#chooseNew');
@@ -111,7 +105,7 @@ async function collectCoverage() {
 
   // Switch to experienced mode
   await page.evaluate(() => localStorage.clear()).catch(() => {});
-  await page.goto(`${BASE}/#/home`, { waitUntil: 'domcontentloaded', timeout: 10000 }).catch(() => {});
+  await page.goto(`${BASE}/#/home`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
   await safeClick('#chooseExp');
 
   // Interact with experienced home page
@@ -126,7 +120,7 @@ async function collectCoverage() {
   // NODES PAGE
   // ══════════════════════════════════════════════
   console.log('  [coverage] Nodes page...');
-  await navHash('#/nodes');
+  await page.goto(`${BASE}/#/nodes`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
 
   // Sort by EVERY column
   for (const col of ['name', 'public_key', 'role', 'last_seen', 'advert_count']) {
@@ -162,7 +156,7 @@ async function collectCoverage() {
   }
 
   // In side pane — click detail/analytics links
-  await safeClick('a[href*="/nodes/"]');
+  await safeClick('a[href*="/nodes/"]', 2000);
   // Click fav star
   await clickAll('.fav-star', 2);
 
@@ -174,7 +168,7 @@ async function collectCoverage() {
   try {
     const firstNodeKey = await page.$eval('#nodesBody tr td:nth-child(2)', el => el.textContent.trim());
     if (firstNodeKey) {
-      await navHash('#/nodes/' + firstNodeKey);
+      await page.goto(`${BASE}/#/nodes/${firstNodeKey}`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
 
       // Click tabs on detail page
       await clickAll('.tab-btn, [data-tab]', 10);
@@ -197,7 +191,7 @@ async function collectCoverage() {
   try {
     const firstKey = await page.$eval('#nodesBody tr td:nth-child(2)', el => el.textContent.trim()).catch(() => null);
     if (firstKey) {
-      await navHash('#/nodes/' + firstKey + '?scroll=paths');
+      await page.goto(`${BASE}/#/nodes/${firstKey}?scroll=paths`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
     }
   } catch {}
 
@@ -205,7 +199,7 @@ async function collectCoverage() {
   // PACKETS PAGE
   // ══════════════════════════════════════════════
   console.log('  [coverage] Packets page...');
-  await navHash('#/packets');
+  await page.goto(`${BASE}/#/packets`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
 
   // Open filter bar
   await safeClick('#filterToggleBtn');
@@ -291,13 +285,13 @@ async function collectCoverage() {
   } catch {}
 
   // Navigate to specific packet by hash
-  await navHash('#/packets/deadbeef');
+  await page.goto(`${BASE}/#/packets/deadbeef`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
 
   // ══════════════════════════════════════════════
   // MAP PAGE
   // ══════════════════════════════════════════════
   console.log('  [coverage] Map page...');
-  await navHash('#/map');
+  await page.goto(`${BASE}/#/map`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
 
   // Toggle controls panel
   await safeClick('#mapControlsToggle');
@@ -351,7 +345,7 @@ async function collectCoverage() {
   // ANALYTICS PAGE
   // ══════════════════════════════════════════════
   console.log('  [coverage] Analytics page...');
-  await navHash('#/analytics');
+  await page.goto(`${BASE}/#/analytics`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
 
   // Click EVERY analytics tab
   const analyticsTabs = ['overview', 'rf', 'topology', 'channels', 'hashsizes', 'collisions', 'subpaths', 'nodes', 'distance'];
@@ -387,12 +381,9 @@ async function collectCoverage() {
     await clickAll('.analytics-table th', 8);
   } catch {}
 
-  // Deep-link to each analytics tab via hash (avoid full page.goto)
+  // Deep-link to each analytics tab via URL
   for (const tab of analyticsTabs) {
-    try {
-      await page.evaluate((t) => { location.hash = '#/analytics?tab=' + t; }, tab);
-      await new Promise(r => setTimeout(r, 100));
-    } catch {}
+    await page.goto(`${BASE}/#/analytics?tab=${tab}`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
   }
 
   // Region filter on analytics
@@ -405,7 +396,7 @@ async function collectCoverage() {
   // CUSTOMIZE
   // ══════════════════════════════════════════════
   console.log('  [coverage] Customizer...');
-  await navHash('#/home');
+  await page.goto(BASE, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
   await safeClick('#customizeToggle');
 
   // Click EVERY customizer tab
@@ -512,7 +503,7 @@ async function collectCoverage() {
   // CHANNELS PAGE
   // ══════════════════════════════════════════════
   console.log('  [coverage] Channels page...');
-  await navHash('#/channels');
+  await page.goto(`${BASE}/#/channels`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
   // Click channel rows/items
   await clickAll('.channel-item, .channel-row, .channel-card', 3);
   await clickAll('table tbody tr', 3);
@@ -521,7 +512,7 @@ async function collectCoverage() {
   try {
     const channelHash = await page.$eval('table tbody tr td:first-child', el => el.textContent.trim()).catch(() => null);
     if (channelHash) {
-      await navHash('#/channels/' + channelHash);
+      await page.goto(`${BASE}/#/channels/${channelHash}`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
     }
   } catch {}
 
@@ -529,7 +520,7 @@ async function collectCoverage() {
   // LIVE PAGE
   // ══════════════════════════════════════════════
   console.log('  [coverage] Live page...');
-  await navHash('#/live');
+  await page.goto(`${BASE}/#/live`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
 
   // VCR controls
   await safeClick('#vcrPauseBtn');
@@ -612,14 +603,14 @@ async function collectCoverage() {
   // TRACES PAGE
   // ══════════════════════════════════════════════
   console.log('  [coverage] Traces page...');
-  await navHash('#/traces');
+  await page.goto(`${BASE}/#/traces`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
   await clickAll('table tbody tr', 3);
 
   // ══════════════════════════════════════════════
   // OBSERVERS PAGE
   // ══════════════════════════════════════════════
   console.log('  [coverage] Observers page...');
-  await navHash('#/observers');
+  await page.goto(`${BASE}/#/observers`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
   // Click observer rows
   const obsRows = await page.$$('table tbody tr, .observer-card, .observer-row');
   for (let i = 0; i < Math.min(obsRows.length, 3); i++) {
@@ -640,7 +631,7 @@ async function collectCoverage() {
   // PERF PAGE
   // ══════════════════════════════════════════════
   console.log('  [coverage] Perf page...');
-  await navHash('#/perf');
+  await page.goto(`${BASE}/#/perf`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
   await safeClick('#perfRefresh');
   await safeClick('#perfReset');
 
@@ -650,14 +641,14 @@ async function collectCoverage() {
   console.log('  [coverage] App.js — router + global...');
 
   // Navigate to bad route to trigger error/404
-  await navHash('#/nonexistent-route');
+  await page.goto(`${BASE}/#/nonexistent-route`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
 
-  // Navigate to every route via hash (50ms is enough for SPA hash routing)
+  // Navigate to every route via hash
   const allRoutes = ['home', 'nodes', 'packets', 'map', 'live', 'channels', 'traces', 'observers', 'analytics', 'perf'];
   for (const route of allRoutes) {
     try {
       await page.evaluate((r) => { location.hash = '#/' + r; }, route);
-      await new Promise(r => setTimeout(r, 50));
+      await page.waitForLoadState('networkidle').catch(() => {});
     } catch {}
   }
 
@@ -723,11 +714,10 @@ async function collectCoverage() {
     await page.evaluate(() => { if (window.apiPerf) window.apiPerf(); });
   } catch {}
 
-  // Exercise utility functions + packet filter parser in one evaluate call
-  console.log('  [coverage] Utility functions + packet filter...');
+  // Exercise utility functions
   try {
     await page.evaluate(() => {
-      // Utility functions
+      // timeAgo with various inputs
       if (typeof timeAgo === 'function') {
         timeAgo(null);
         timeAgo(new Date().toISOString());
@@ -735,11 +725,13 @@ async function collectCoverage() {
         timeAgo(new Date(Date.now() - 3600000).toISOString());
         timeAgo(new Date(Date.now() - 86400000 * 2).toISOString());
       }
+      // truncate
       if (typeof truncate === 'function') {
         truncate('hello world', 5);
         truncate(null, 5);
         truncate('hi', 10);
       }
+      // routeTypeName, payloadTypeName, payloadTypeColor
       if (typeof routeTypeName === 'function') {
         for (let i = 0; i <= 4; i++) routeTypeName(i);
       }
@@ -749,14 +741,23 @@ async function collectCoverage() {
       if (typeof payloadTypeColor === 'function') {
         for (let i = 0; i <= 15; i++) payloadTypeColor(i);
       }
+      // invalidateApiCache
       if (typeof invalidateApiCache === 'function') {
         invalidateApiCache();
         invalidateApiCache('/test');
       }
+    });
+  } catch {}
 
-      // Packet filter parser
+  // ══════════════════════════════════════════════
+  // PACKET FILTER — exercise the filter parser
+  // ══════════════════════════════════════════════
+  console.log('  [coverage] Packet filter parser...');
+  try {
+    await page.evaluate(() => {
       if (window.PacketFilter && window.PacketFilter.compile) {
         const PF = window.PacketFilter;
+        // Valid expressions
         const exprs = [
           'type == ADVERT', 'type == GRP_TXT', 'type != ACK',
           'snr > 0', 'snr < -5', 'snr >= 10', 'snr <= 3',
@@ -772,6 +773,7 @@ async function collectCoverage() {
         for (const e of exprs) {
           try { PF.compile(e); } catch {}
         }
+        // Bad expressions
         const bad = ['@@@', '== ==', '(((', 'type ==', ''];
         for (const e of bad) {
           try { PF.compile(e); } catch {}
@@ -785,24 +787,29 @@ async function collectCoverage() {
   // ══════════════════════════════════════════════
   console.log('  [coverage] Region filter...');
   try {
-    // Open region filter on nodes page (use hash nav, already visited)
-    await page.evaluate(() => { location.hash = '#/nodes'; });
-    await new Promise(r => setTimeout(r, 100));
+    // Open region filter on nodes page
+    await page.goto(`${BASE}/#/nodes`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
     await safeClick('#nodesRegionFilter');
     await clickAll('#nodesRegionFilter input[type="checkbox"]', 3);
   } catch {}
 
   // Region filter on packets
   try {
-    await page.evaluate(() => { location.hash = '#/packets'; });
-    await new Promise(r => setTimeout(r, 100));
+    await page.goto(`${BASE}/#/packets`, { waitUntil: 'networkidle', timeout: 15000 }).catch(() => {});
     await safeClick('#packetsRegionFilter');
     await clickAll('#packetsRegionFilter input[type="checkbox"]', 3);
   } catch {}
 
   // ══════════════════════════════════════════════
-  // FINAL — extract coverage (all routes already visited above)
+  // FINAL — navigate through all routes once more
   // ══════════════════════════════════════════════
+  console.log('  [coverage] Final route sweep...');
+  for (const route of allRoutes) {
+    try {
+      await page.evaluate((r) => { location.hash = '#/' + r; }, route);
+      await page.waitForLoadState('networkidle').catch(() => {});
+    } catch {}
+  }
 
   // Extract coverage
   const coverage = await page.evaluate(() => window.__coverage__);

server-helpers.js

@@ -36,19 +36,18 @@ function loadThemeFile(themePaths) {
 function buildHealthConfig(config) {
   const _ht = (config && config.healthThresholds) || {};
   return {
-    infraDegraded: _ht.infraDegradedHours || 24,
-    infraSilent:   _ht.infraSilentHours   || 72,
-    nodeDegraded:  _ht.nodeDegradedHours  || 1,
-    nodeSilent:    _ht.nodeSilentHours    || 24
+    infraDegradedMs: _ht.infraDegradedMs || 86400000,
+    infraSilentMs:   _ht.infraSilentMs   || 259200000,
+    nodeDegradedMs:  _ht.nodeDegradedMs  || 3600000,
+    nodeSilentMs:    _ht.nodeSilentMs    || 86400000
   };
 }
 
 function getHealthMs(role, HEALTH) {
-  const H = 3600000;
   const isInfra = role === 'repeater' || role === 'room';
   return {
-    degradedMs: (isInfra ? HEALTH.infraDegraded : HEALTH.nodeDegraded) * H,
-    silentMs:   (isInfra ? HEALTH.infraSilent   : HEALTH.nodeSilent)   * H
+    degradedMs: isInfra ? HEALTH.infraDegradedMs : HEALTH.nodeDegradedMs,
+    silentMs:   isInfra ? HEALTH.infraSilentMs   : HEALTH.nodeSilentMs
   };
 }
 

server.js

@@ -207,13 +207,6 @@ class TTLCache {
       if (key.startsWith(prefix)) this.store.delete(key);
     }
   }
-  debouncedInvalidateBulkHealth() {
-    if (this._bulkHealthTimer) return;
-    this._bulkHealthTimer = setTimeout(() => {
-      this._bulkHealthTimer = null;
-      this.invalidate('bulk-health');
-    }, 30000);
-  }
   debouncedInvalidateAll() {
     if (this._debounceTimer) return;
     this._debounceTimer = setTimeout(() => {
@@ -307,12 +300,7 @@ app.get('/api/config/cache', (req, res) => {
 app.get('/api/config/client', (req, res) => {
   res.json({
     roles: config.roles || null,
-    healthThresholds: {
-      infraDegradedMs: HEALTH.infraDegraded * 3600000,
-      infraSilentMs:   HEALTH.infraSilent   * 3600000,
-      nodeDegradedMs:  HEALTH.nodeDegraded  * 3600000,
-      nodeSilentMs:    HEALTH.nodeSilent    * 3600000
-    },
+    healthThresholds: config.healthThresholds || null,
     tiles: config.tiles || null,
     snrThresholds: config.snrThresholds || null,
     distThresholds: config.distThresholds || null,
@@ -422,7 +410,7 @@ app.get('/api/perf', (req, res) => {
     avgMs: perfStats.requests ? Math.round(perfStats.totalMs / perfStats.requests * 10) / 10 : 0,
     endpoints: Object.fromEntries(sorted),
     slowQueries: perfStats.slowQueries.slice(-20),
-    cache: { size: cache.size, hits: cache.hits, misses: cache.misses, staleHits: cache.staleHits, recomputes: cache.recomputes, hitRate: cache.hits + cache.staleHits + cache.misses > 0 ? Math.round((cache.hits + cache.staleHits) / (cache.hits + cache.staleHits + cache.misses) * 1000) / 10 : 0 },
+    cache: { size: cache.size, hits: cache.hits, misses: cache.misses, staleHits: cache.staleHits, recomputes: cache.recomputes, hitRate: cache.hits + cache.misses > 0 ? Math.round(cache.hits / (cache.hits + cache.misses) * 1000) / 10 : 0 },
     packetStore: pktStore.getStats(),
     sqlite: (() => {
       try {
@@ -531,7 +519,7 @@ app.get('/api/health', (req, res) => {
       misses: cache.misses,
       staleHits: cache.staleHits,
       recomputes: cache.recomputes,
-      hitRate: cache.hits + cache.staleHits + cache.misses > 0 ? Math.round((cache.hits + cache.staleHits) / (cache.hits + cache.staleHits + cache.misses) * 1000) / 10 : 0,
+      hitRate: cache.hits + cache.misses > 0 ? Math.round(cache.hits / (cache.hits + cache.misses) * 1000) / 10 : 0,
     },
     websocket: {
       clients: wsClients,
@@ -735,7 +723,7 @@ for (const source of mqttSources) {
             // Invalidate this node's caches on advert
             cache.invalidate('node:' + p.pubKey);
             cache.invalidate('health:' + p.pubKey);
-            cache.debouncedInvalidateBulkHealth();
+            cache.invalidate('bulk-health');
 
             // Cross-reference: if this node's pubkey matches an existing observer, backfill observer name
             if (p.name && p.pubKey) {

test-decoder-spec.js

@@ -122,14 +122,13 @@ console.log('── Spec Tests: Transport Codes ──');
 
 {
   // Route type 0 (TRANSPORT_FLOOD) and 3 (TRANSPORT_DIRECT) should have 4-byte transport codes
-  // Route type 0: header=0x14 = payloadType 5 (GRP_TXT), routeType 0 (TRANSPORT_FLOOD)
-  // Format: header(1) + transportCodes(4) + pathByte(1) + payload
-  const hex = '14' + 'AABB' + 'CCDD' + '00' + '1A' + '00'.repeat(10); // transport codes + pathByte + GRP_TXT payload
+  // Route type 0: header byte = 0bPPPPPP00, e.g. 0x14 = payloadType 5 (GRP_TXT), routeType 0
+  const hex = '1400' + 'AABB' + 'CCDD' + '1A' + '00'.repeat(10); // transport codes + GRP_TXT payload
   const p = decodePacket(hex);
   assertEq(p.header.routeType, 0, 'transport: routeType=0 (TRANSPORT_FLOOD)');
   assert(p.transportCodes !== null, 'transport: transportCodes present for TRANSPORT_FLOOD');
-  assertEq(p.transportCodes.code1, 'AABB', 'transport: code1');
-  assertEq(p.transportCodes.code2, 'CCDD', 'transport: code2');
+  assertEq(p.transportCodes.nextHop, 'AABB', 'transport: nextHop');
+  assertEq(p.transportCodes.lastHop, 'CCDD', 'transport: lastHop');
 }
 
 {
@@ -258,13 +257,13 @@ console.log('── Spec Tests: Advert Payload ──');
 
 console.log('── Spec Tests: Encrypted Payload Format ──');
 
-// Spec says v1 encrypted payloads: dest(1)+src(1)+MAC(2)+cipher — decoder matches this.
+// NOTE: Spec says v1 encrypted payloads have dest(1) + src(1) + MAC(2) + ciphertext
+// But decoder reads dest(6) + src(6) + MAC(4) + ciphertext
+// This is a known discrepancy — the decoder matches production behavior, not the spec.
+// The spec may describe the firmware's internal addressing while the OTA format differs,
+// or the decoder may be parsing the fields differently. Production data validates the decoder.
 {
-  const hex = '0100' + 'AA' + 'BB' + 'CCDD' + '00'.repeat(10);
-  const p = decodePacket(hex);
-  assertEq(p.payload.destHash, 'aa', 'encrypted payload: dest is 1 byte');
-  assertEq(p.payload.srcHash, 'bb', 'encrypted payload: src is 1 byte');
-  assertEq(p.payload.mac, 'ccdd', 'encrypted payload: MAC is 2 bytes');
+  note('Spec says v1 encrypted payloads: dest(1)+src(1)+MAC(2)+cipher, but decoder reads dest(6)+src(6)+MAC(4)+cipher — decoder matches prod data');
 }
 
 console.log('── Spec Tests: validateAdvert ──');

test-decoder.js

@@ -28,22 +28,22 @@ test('FLOOD + ADVERT = 0x11', () => {
 });
 
 test('TRANSPORT_FLOOD = routeType 0', () => {
-  // header=0x00 (TRANSPORT_FLOOD + REQ), transportCodes=AABB+CCDD, pathByte=0x00, payload
-  const hex = '00' + 'AABB' + 'CCDD' + '00' + '00'.repeat(16);
+  // 0x00 = TRANSPORT_FLOOD + REQ(0), needs transport codes + 16 byte payload
+  const hex = '0000' + 'AABB' + 'CCDD' + '00'.repeat(16);
   const p = decodePacket(hex);
   assert.strictEqual(p.header.routeType, 0);
   assert.strictEqual(p.header.routeTypeName, 'TRANSPORT_FLOOD');
   assert.notStrictEqual(p.transportCodes, null);
-  assert.strictEqual(p.transportCodes.code1, 'AABB');
-  assert.strictEqual(p.transportCodes.code2, 'CCDD');
+  assert.strictEqual(p.transportCodes.nextHop, 'AABB');
+  assert.strictEqual(p.transportCodes.lastHop, 'CCDD');
 });
 
 test('TRANSPORT_DIRECT = routeType 3', () => {
-  const hex = '03' + '1122' + '3344' + '00' + '00'.repeat(16);
+  const hex = '0300' + '1122' + '3344' + '00'.repeat(16);
   const p = decodePacket(hex);
   assert.strictEqual(p.header.routeType, 3);
   assert.strictEqual(p.header.routeTypeName, 'TRANSPORT_DIRECT');
-  assert.strictEqual(p.transportCodes.code1, '1122');
+  assert.strictEqual(p.transportCodes.nextHop, '1122');
 });
 
 test('DIRECT = routeType 2, no transport codes', () => {
@@ -358,7 +358,9 @@ test('ACK decode', () => {
   const hex = '0D00' + '00'.repeat(18);
   const p = decodePacket(hex);
   assert.strictEqual(p.payload.type, 'ACK');
-  assert(p.payload.ackChecksum);
+  assert(p.payload.destHash);
+  assert(p.payload.srcHash);
+  assert(p.payload.extraHash);
 });
 
 test('ACK too short', () => {
@@ -422,9 +424,9 @@ test('TRACE decode', () => {
   const hex = '2500' + '00'.repeat(12);
   const p = decodePacket(hex);
   assert.strictEqual(p.payload.type, 'TRACE');
-  assert(p.payload.tag !== undefined);
-  assert(p.payload.authCode !== undefined);
   assert.strictEqual(p.payload.flags, 0);
+  assert(p.payload.tag !== undefined);
+  assert(p.payload.destHash);
 });
 
 test('TRACE too short', () => {
@@ -458,18 +460,16 @@ test('Transport route too short throws', () => {
   assert.throws(() => decodePacket('0000'), /too short for transport/);
 });
 
-test('Corrupt packet #183 — TRANSPORT_DIRECT with correct field order', () => {
+test('Corrupt packet #183 — path overflow capped to buffer', () => {
   const hex = 'BBAD6797EC8751D500BF95A1A776EF580E665BCBF6A0BBE03B5E730707C53489B8C728FD3FB902397197E1263CEC21E52465362243685DBBAD6797EC8751C90A75D9FD8213155D';
   const p = decodePacket(hex);
   assert.strictEqual(p.header.routeType, 3, 'routeType should be TRANSPORT_DIRECT');
   assert.strictEqual(p.header.payloadTypeName, 'UNKNOWN');
-  // transport codes are bytes 1-4, pathByte=0x87 at byte 5
-  assert.strictEqual(p.transportCodes.code1, 'AD67');
-  assert.strictEqual(p.transportCodes.code2, '97EC');
-  // pathByte 0x87: hashSize=3, hashCount=7
+  // pathByte 0xAD claims 45 hops × 3 bytes = 135, but only 65 bytes available
   assert.strictEqual(p.path.hashSize, 3);
-  assert.strictEqual(p.path.hashCount, 7);
-  assert.strictEqual(p.path.hops.length, 7);
+  assert.strictEqual(p.path.hashCount, 21, 'hashCount capped to fit buffer');
+  assert.strictEqual(p.path.hops.length, 21);
+  assert.strictEqual(p.path.truncated, true);
   // No empty strings in hops
   assert(p.path.hops.every(h => h.length > 0), 'no empty hops');
 });

test-e2e-playwright.js

@@ -354,17 +354,10 @@ async function run() {
   await test('Packets clicking row shows detail pane', async () => {
     // Fresh navigation to avoid stale row references from previous test
     await page.goto(`${BASE}/#/packets`, { waitUntil: 'domcontentloaded' });
-    // Wait for table rows AND initial API data to settle
     await page.waitForSelector('table tbody tr[data-action]', { timeout: 15000 });
-    await page.waitForLoadState('networkidle');
     const firstRow = await page.$('table tbody tr[data-action]');
     assert(firstRow, 'No clickable packet rows found');
-    // Click the row and wait for the /packets/{hash} API response
-    const [response] = await Promise.all([
-      page.waitForResponse(resp => resp.url().includes('/packets/') && resp.status() === 200, { timeout: 15000 }),
-      firstRow.click(),
-    ]);
-    assert(response, 'API response for packet detail not received');
+    await firstRow.click();
     await page.waitForFunction(() => {
       const panel = document.getElementById('pktRight');
       return panel && !panel.classList.contains('empty');
@@ -382,16 +375,12 @@ async function run() {
     if (!pktRight) {
       await page.goto(`${BASE}/#/packets`, { waitUntil: 'domcontentloaded' });
       await page.waitForSelector('table tbody tr[data-action]', { timeout: 15000 });
-      await page.waitForLoadState('networkidle');
     }
     const panelOpen = await page.$eval('#pktRight', el => !el.classList.contains('empty'));
     if (!panelOpen) {
       const firstRow = await page.$('table tbody tr[data-action]');
       if (!firstRow) { console.log('    ⏭️  Skipped (no clickable rows)'); return; }
-      await Promise.all([
-        page.waitForResponse(resp => resp.url().includes('/packets/') && resp.status() === 200, { timeout: 15000 }),
-        firstRow.click(),
-      ]);
+      await firstRow.click();
       await page.waitForFunction(() => {
         const panel = document.getElementById('pktRight');
         return panel && !panel.classList.contains('empty');
@@ -840,7 +829,17 @@ async function run() {
     assert(content.length > 10, 'Perf content should still be present after refresh');
   });
 
-
+  // Test: Node.js perf page shows Event Loop metrics (not Go Runtime)
+  await test('Perf page shows Event Loop on Node server', async () => {
+    const perfText = await page.$eval('#perfContent', el => el.textContent);
+    // Node.js server should show Event Loop metrics
+    const hasEventLoop = perfText.includes('Event Loop') || perfText.includes('event loop');
+    const hasMemory = perfText.includes('Memory') || perfText.includes('RSS');
+    assert(hasEventLoop || hasMemory, 'Node perf page should show Event Loop or Memory metrics');
+    // Should NOT show Go Runtime section on Node.js server
+    const hasGoRuntime = perfText.includes('Go Runtime');
+    assert(!hasGoRuntime, 'Node perf page should NOT show Go Runtime section');
+  });
 
   // Test: Go perf page shows Go Runtime section (goroutines, GC)
   // NOTE: This test requires GO_BASE_URL pointing to Go staging (port 82)
@@ -910,19 +909,6 @@ async function run() {
     assert(hexDump, 'Hex dump should be visible after selecting a packet');
   });
 
-  // Extract frontend coverage if instrumented server is running
-  try {
-    const coverage = await page.evaluate(() => window.__coverage__);
-    if (coverage) {
-      const fs = require('fs');
-      const path = require('path');
-      const outDir = path.join(__dirname, '.nyc_output');
-      if (!fs.existsSync(outDir)) fs.mkdirSync(outDir, { recursive: true });
-      fs.writeFileSync(path.join(outDir, 'e2e-coverage.json'), JSON.stringify(coverage));
-      console.log(`Frontend coverage from E2E: ${Object.keys(coverage).length} files`);
-    }
-  } catch {}
-
   await browser.close();
 
   // Summary

test-frontend-helpers.js

@@ -1322,7 +1322,7 @@ console.log('\n=== app.js: formatVersionBadge ===');
     assert.ok(result.includes('>v2.6.0</a>'), 'version text has v prefix');
     assert.ok(result.includes(`href="${GH}/commit/abc1234def5678"`), 'commit links to full hash');
     assert.ok(result.includes('>abc1234</a>'), 'commit display is truncated to 7');
-    assert.ok(result.includes('engine-badge'), 'should show engine badge'); assert.ok(result.includes('>node<'), 'should show engine name');
+    assert.ok(result.includes('[node]'), 'should show engine');
   });
   test('prod port 80: shows version', () => {
     const { formatVersionBadge } = makeBadgeSandbox('80');
@@ -1348,7 +1348,7 @@ console.log('\n=== app.js: formatVersionBadge ===');
     assert.ok(!result.includes('v2.6.0'), 'staging should NOT show version');
     assert.ok(result.includes('>abc1234</a>'), 'should show commit hash');
     assert.ok(result.includes(`href="${GH}/commit/abc1234def5678"`), 'commit is linked');
-    assert.ok(result.includes('engine-badge'), 'should show engine badge'); assert.ok(result.includes('>go<'), 'should show engine name');
+    assert.ok(result.includes('[go]'), 'should show engine');
   });
   test('staging port 81: hides version', () => {
     const { formatVersionBadge } = makeBadgeSandbox('81');
@@ -1369,18 +1369,18 @@ console.log('\n=== app.js: formatVersionBadge ===');
     const result = formatVersionBadge('2.6.0', 'unknown', 'node');
     assert.ok(result.includes('>v2.6.0</a>'), 'should show version');
     assert.ok(!result.includes('unknown'), 'should not show unknown commit');
-    assert.ok(result.includes('engine-badge'), 'should show engine badge'); assert.ok(result.includes('>node<'), 'should show engine name');
+    assert.ok(result.includes('[node]'), 'should show engine');
   });
   test('skips commit when missing', () => {
     const { formatVersionBadge } = makeBadgeSandbox('');
     const result = formatVersionBadge('2.6.0', null, 'go');
     assert.ok(result.includes('>v2.6.0</a>'), 'should show version');
-    assert.ok(result.includes('engine-badge'), 'should show engine badge'); assert.ok(result.includes('>go<'), 'should show engine name');
+    assert.ok(result.includes('[go]'), 'should show engine');
   });
   test('shows only engine when version/commit missing', () => {
     const { formatVersionBadge } = makeBadgeSandbox('3000');
     const result = formatVersionBadge(null, null, 'go');
-    assert.ok(result.includes('engine-badge'), 'should show engine badge'); assert.ok(result.includes('>go<'), 'should show engine name');
+    assert.ok(result.includes('[go]'), 'should show engine');
     assert.ok(result.includes('version-badge'), 'should use version-badge class');
   });
   test('short commit not truncated in display', () => {
@@ -1398,7 +1398,7 @@ console.log('\n=== app.js: formatVersionBadge ===');
     const { formatVersionBadge } = makeBadgeSandbox('8080');
     const result = formatVersionBadge('2.6.0', null, 'go');
     assert.ok(!result.includes('2.6.0'), 'no version on staging');
-    assert.ok(result.includes('engine-badge'), 'engine badge shown'); assert.ok(result.includes('>go<'), 'engine name shown');
+    assert.ok(result.includes('[go]'), 'engine shown');
   });
 }
 

test-server-helpers.js

@@ -59,17 +59,17 @@ console.log('\nloadThemeFile:');
 console.log('\nbuildHealthConfig:');
 {
   const h = helpers.buildHealthConfig({});
-  assert(h.infraDegraded === 24, 'default infraDegraded');
-  assert(h.infraSilent === 72, 'default infraSilent');
-  assert(h.nodeDegraded === 1, 'default nodeDegraded');
-  assert(h.nodeSilent === 24, 'default nodeSilent');
+  assert(h.infraDegradedMs === 86400000, 'default infraDegradedMs');
+  assert(h.infraSilentMs === 259200000, 'default infraSilentMs');
+  assert(h.nodeDegradedMs === 3600000, 'default nodeDegradedMs');
+  assert(h.nodeSilentMs === 86400000, 'default nodeSilentMs');
 
-  const h2 = helpers.buildHealthConfig({ healthThresholds: { infraDegradedHours: 2 } });
-  assert(h2.infraDegraded === 2, 'custom infraDegraded');
-  assert(h2.nodeDegraded === 1, 'other defaults preserved');
+  const h2 = helpers.buildHealthConfig({ healthThresholds: { infraDegradedMs: 1000 } });
+  assert(h2.infraDegradedMs === 1000, 'custom infraDegradedMs');
+  assert(h2.nodeDegradedMs === 3600000, 'other defaults preserved');
 
   const h3 = helpers.buildHealthConfig(null);
-  assert(h3.infraDegraded === 24, 'handles null config');
+  assert(h3.infraDegradedMs === 86400000, 'handles null config');
 }
 
 // --- getHealthMs ---
@@ -78,21 +78,21 @@ console.log('\ngetHealthMs:');
   const HEALTH = helpers.buildHealthConfig({});
 
   const rep = helpers.getHealthMs('repeater', HEALTH);
-  assert(rep.degradedMs === 24 * 3600000, 'repeater uses infra degraded');
-  assert(rep.silentMs === 72 * 3600000, 'repeater uses infra silent');
+  assert(rep.degradedMs === 86400000, 'repeater uses infra degraded');
+  assert(rep.silentMs === 259200000, 'repeater uses infra silent');
 
   const room = helpers.getHealthMs('room', HEALTH);
-  assert(room.degradedMs === 24 * 3600000, 'room uses infra degraded');
+  assert(room.degradedMs === 86400000, 'room uses infra degraded');
 
   const comp = helpers.getHealthMs('companion', HEALTH);
-  assert(comp.degradedMs === 1 * 3600000, 'companion uses node degraded');
-  assert(comp.silentMs === 24 * 3600000, 'companion uses node silent');
+  assert(comp.degradedMs === 3600000, 'companion uses node degraded');
+  assert(comp.silentMs === 86400000, 'companion uses node silent');
 
   const sensor = helpers.getHealthMs('sensor', HEALTH);
-  assert(sensor.degradedMs === 1 * 3600000, 'sensor uses node degraded');
+  assert(sensor.degradedMs === 3600000, 'sensor uses node degraded');
 
   const undef = helpers.getHealthMs(undefined, HEALTH);
-  assert(undef.degradedMs === 1 * 3600000, 'undefined role uses node degraded');
+  assert(undef.degradedMs === 3600000, 'undefined role uses node degraded');
 }
 
 // --- isHashSizeFlipFlop ---

test-server-routes.js

@@ -1254,24 +1254,6 @@ seedTestData();
     lastPathSeenMap.delete(liveNode);
   });
 
-  // ── Cache hit rate includes stale hits ──
-  await t('Cache hitRate includes staleHits in formula', async () => {
-    cache.clear();
-    cache.hits = 0;
-    cache.misses = 0;
-    cache.staleHits = 0;
-    // Simulate: 3 hits, 2 stale hits, 5 misses => rate = (3+2)/(3+2+5) = 50%
-    cache.hits = 3;
-    cache.staleHits = 2;
-    cache.misses = 5;
-    const r = await request(app).get('/api/health').expect(200);
-    assert(r.body.cache.hitRate === 50, 'hitRate should be (hits+staleHits)/(hits+staleHits+misses) = 50%, got ' + r.body.cache.hitRate);
-    // Reset
-    cache.hits = 0;
-    cache.misses = 0;
-    cache.staleHits = 0;
-  });
-
   // ── Summary ──
   console.log(`\n═══ Server Route Tests: ${passed} passed, ${failed} failed ═══`);
   if (failed > 0) process.exit(1);