* Fix map node freshness consistency
* Harden output, ingest, caches, and WebSocket limits
* Enforce public visibility across derived data
* Harden proxy and operator deployment boundary
* Make owner grants authoritative and reconcile ACLs safely
* Bound path, spam, and statistics analysis
* Make link and coverage jobs crash-safe
* Implement strategic security remediation
* Fix production cutover configuration
* Fix disabled viewshed worker health signal
* Serve stale stats during background refresh
* Retain stale stats through refresh windows
* Bound analytics work to protect ingestion
* Prioritize summary warmup over chart scans
* Throttle path history rebuilds
* Bound path history result memory
* Stream path history aggregation
* Give bounded path rebuild one CPU
* Serve stale charts during bounded refresh
* Prioritize startup stats before chart scans
* Bound path history segment cardinality
* Pin path rebuild context to privacy generation
* Self-host original frontend fonts
* Allow bounded path rebuild to complete
* Improve live map UI and low-latency group feed
- Dock node details on the right with selection highlight and collapsible layers
- Add node legend, 24h activity sparkline, copy-link, and layout/overlap fixes
- Keep all repeaters visible during Live Path focus
- Send GroupText feed packets immediately over WebSocket (no batch delay)
- Cache expensive stats/observer activity more aggressively to protect ingest
- Remove stale local planning/audit markdown from the tree
* fix(ci): supply OPERATOR_SITE_TOKEN for compose validation
Workers/Compose CI failed because docker-compose requires
OPERATOR_SITE_TOKEN. Add CI placeholders for that and MQTT_PASSWORD.
Consolidates the stacked backend, privacy, network-intelligence, frontend, operations, mobile, and owner-cache changes after resolving main conflicts and passing the full CI suite.
www.ukmesh.com (website-ukmesh container, port 3004):
- UKLayout, UKHomePage, UKInstallPage, UKMqttPage components
- VITE_SITE=ukmesh build arg routes to UK pages in main.tsx
- Stats fetched via relative /api path (proxied by Nginx)
app.ukmesh.com (app-ukmesh container, port 3003):
- Same dashboard build with VITE_APP_HOSTNAME=app.ukmesh.com
- VITE_NETWORK=ukmesh for future API filtering
MQTT:
- node-ukmesh Mosquitto user for ukmesh observer nodes
- ACL updated: backend reads meshcore/# and ukmesh/#
- ukmesh nodes publish to ukmesh/{IATA}/{PUBKEY}/packets
Cloudflare routes to add in Zero Trust:
www.ukmesh.com -> http://website-ukmesh:80
app.ukmesh.com -> http://app-ukmesh:80
mqtt.ukmesh.com -> http://mosquitto:9001
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
gadgethd