Order room server messages by sender timestamp, not arrival-at-our-radio timestamp

2026-03-28 17:43:05 +01:00 · 2026-03-24 15:55:28 -07:00
36 changed files with 192 additions and 2725 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,16 +1,3 @@
-## [3.6.1] - 2026-03-26
-
-Feature: MeshCore Map integration
-Feature: Add warning screen about bots
-Feature: Favicon reflects unread message state
-Feature: Show hop map in larger modal
-Feature: Add prebuilt frontend install script
-Feature: Add clean service installer script
-Feature: Swipe in to show menu
-Bugfix: Invalid backend API path serves error, not fallback index
-Bugfix: Fix some spacing/page height issues
-Misc: Misc. bugfixes and performance and test improvements
-
 ## [3.6.0] - 2026-03-22

 Feature: Add incoming-packet analytics
--- a/LICENSES.md
+++ b/LICENSES.md
@@ -1592,39 +1592,6 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI

 </details>

-### react-swipeable (7.0.2) — MIT
-
-<details>
-<summary>Full license text</summary>
-
-```
-The MIT License (MIT)
-
-Copyright (C) 2014-2022 Josh Perez
-Copyright (C) 2014-2022 Brian Emil Hartz
-Copyright (C) 2022 Formidable Labs, Inc.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
-```
-
-</details>
-
 ### sonner (2.0.7) — MIT

 <details>
--- a/README.md
+++ b/README.md
@@ -41,6 +41,8 @@ If you plan to contribute, read [CONTRIBUTING.md](CONTRIBUTING.md).
 - [UV](https://astral.sh/uv) package manager: `curl -LsSf https://astral.sh/uv/install.sh | sh`
 - MeshCore radio connected via USB serial, TCP, or BLE

+If you are on a low-resource system and do not want to build the frontend locally, download the release zip named `remoteterm-prebuilt-frontend-vX.X.X-<short hash>.zip`. That bundle includes `frontend/prebuilt`, so you can run the app without doing a frontend build from source.
+
 <details>
 <summary>Finding your serial port</summary>

@@ -95,8 +97,6 @@ Access the app at http://localhost:8000.

 Source checkouts expect a normal frontend build in `frontend/dist`.

-On Linux, if you want this installed as a persistent `systemd` service that starts on boot and restarts automatically on failure, run `bash scripts/install_service.sh` from the repo root.
-
 ## Path 1.5: Use The Prebuilt Release Zip

 Release zips can be found as an asset within the [releases listed here](https://github.com/jkingsman/Remote-Terminal-for-MeshCore/releases). This can be beneficial on resource constrained systems that cannot cope with the RAM-hungry frontend build process.
@@ -111,8 +111,6 @@ uv run uvicorn app.main:app --host 0.0.0.0 --port 8000

 The release bundle includes `frontend/prebuilt`, so it does not require a local frontend build.

-Alternatively, if you have already cloned the repo, you can fetch just the prebuilt frontend into your working tree without downloading the full release zip via `python3 scripts/fetch_prebuilt_frontend.py`.
-
 ## Path 2: Docker

 > **Warning:** Docker has had reports intermittent issues with serial event subscriptions. The native method above is more reliable.
--- a/README_ADVANCED.md
+++ b/README_ADVANCED.md
@@ -46,37 +46,59 @@ Accept the browser warning, or use [mkcert](https://github.com/FiloSottile/mkcer

 ## Systemd Service

-Two paths are available depending on your comfort level with Linux system administration.
-
-### Simple install (recommended for most users)
-
-On Linux systems, this is the recommended installation method if you want RemoteTerm set up as a persistent systemd service that starts automatically on boot and restarts automatically if it crashes. Run the installer script from the repo root. It runs as your current user, installs from wherever you cloned the repo, and prints a quick-reference cheatsheet when done — no separate service account or path juggling required.
+Assumes you are running from `/opt/remoteterm`; adjust paths if you deploy elsewhere.

 ```bash
-bash scripts/install_service.sh
+# Create service user
+sudo useradd -r -m -s /bin/false remoteterm
+
+# Install to /opt/remoteterm
+sudo mkdir -p /opt/remoteterm
+sudo cp -r . /opt/remoteterm/
+sudo chown -R remoteterm:remoteterm /opt/remoteterm
+
+# Install dependencies
+cd /opt/remoteterm
+sudo -u remoteterm uv venv
+sudo -u remoteterm uv sync
+
+# If deploying from a source checkout, build the frontend first
+sudo -u remoteterm bash -lc 'cd /opt/remoteterm/frontend && npm install && npm run build'
+
+# If deploying from the release zip artifact, frontend/prebuilt is already present
 ```

-The script interactively asks which transport to use (serial auto-detect, serial with explicit port, TCP, or BLE), whether to build the frontend locally or download a prebuilt copy, whether to enable the bot system, and whether to set up HTTP Basic Auth. It handles dependency installation (`uv sync`), validates `node`/`npm` for local builds, adds your user to the `dialout` group if needed, writes the systemd unit file, and enables the service. After installation, normal operations work without any `sudo -u` gymnastics:
+Create `/etc/systemd/system/remoteterm.service` with:

-You can also rerun the script later to change transport, bot, or auth settings. If the service is already running, the installer stops it, rewrites the unit file, reloads systemd, and starts it again with the new configuration.
+```ini
+[Unit]
+Description=RemoteTerm for MeshCore
+After=network.target
+
+[Service]
+Type=simple
+User=remoteterm
+Group=remoteterm
+WorkingDirectory=/opt/remoteterm
+ExecStart=/opt/remoteterm/.venv/bin/uvicorn app.main:app --host 0.0.0.0 --port 8000
+Restart=always
+RestartSec=5
+Environment=MESHCORE_DATABASE_PATH=/opt/remoteterm/data/meshcore.db
+# Uncomment and set if auto-detection doesn't work:
+# Environment=MESHCORE_SERIAL_PORT=/dev/ttyUSB0
+SupplementaryGroups=dialout
+
+[Install]
+WantedBy=multi-user.target
+```
+
+Then install and start it:

 ```bash
-# Update to latest and restart
-cd /path/to/repo
-git pull
-uv sync
-cd frontend && npm install && npm run build && cd ..
-sudo systemctl restart remoteterm
-
-# Refresh prebuilt frontend only (skips local build)
-python3 scripts/fetch_prebuilt_frontend.py
-sudo systemctl restart remoteterm
-
-# View live logs
+sudo systemctl daemon-reload
+sudo systemctl enable --now remoteterm
+sudo systemctl status remoteterm
 sudo journalctl -u remoteterm -f
-
-# Service control
-sudo systemctl start|stop|restart|status remoteterm
 ```

 ## Debug Logging And Bug Reports
--- a/app/fanout/AGENTS_fanout.md
+++ b/app/fanout/AGENTS_fanout.md
@@ -89,19 +89,6 @@ Amazon SQS delivery. Config blob:
 - Publishes a JSON envelope of the form `{"event_type":"message"|"raw_packet","data":...}`
 - Supports both decoded messages and raw packets via normal scope selection

-### map_upload (map_upload.py)
-Uploads heard repeater and room-server advertisements to map.meshcore.dev. Config blob:
- `api_url` (optional, default `""`) — upload endpoint; empty falls back to the public map.meshcore.dev API
- `dry_run` (bool, default `true`) — when true, logs the payload at INFO level without sending
- `geofence_enabled` (bool, default `false`) — when true, only uploads nodes within `geofence_radius_km` of the radio's own configured lat/lon
- `geofence_radius_km` (float, default `0`) — filter radius in kilometres
-
-Geofence notes:
- The reference center is always the radio's own `adv_lat`/`adv_lon` from `radio_runtime.meshcore.self_info`, read **live at upload time** — no lat/lon is stored in the fanout config itself.
- If the radio's lat/lon is `(0, 0)` or the radio is not connected, the geofence check is silently skipped so uploads continue normally until coordinates are configured.
- Requires the radio to have `ENABLE_PRIVATE_KEY_EXPORT=1` firmware to sign uploads.
- Scope is always `{"messages": "none", "raw_packets": "all"}` — only raw RF packets are processed.
-
 ## Adding a New Integration Type

 ### Step-by-step checklist
@@ -304,7 +291,6 @@ Migrations:
 - `app/fanout/webhook.py` — Webhook fanout module
 - `app/fanout/apprise_mod.py` — Apprise fanout module
 - `app/fanout/sqs.py` — Amazon SQS fanout module
- `app/fanout/map_upload.py` — Map Upload fanout module
 - `app/repository/fanout.py` — Database CRUD
 - `app/routers/fanout.py` — REST API
 - `app/websocket.py` — `broadcast_event()` dispatches to fanout
--- a/app/fanout/community_mqtt.py
+++ b/app/fanout/community_mqtt.py
@@ -20,9 +20,9 @@ from datetime import datetime
 from typing import Any, Protocol

 import aiomqtt
+import nacl.bindings

 from app.fanout.mqtt_base import BaseMqttPublisher
-from app.keystore import ed25519_sign_expanded
 from app.path_utils import parse_packet_envelope, split_path_hex
 from app.version_info import get_app_build_info

@@ -40,6 +40,9 @@ _TOKEN_RENEWAL_THRESHOLD = _TOKEN_LIFETIME - 3600  # 23 hours
 _STATS_REFRESH_INTERVAL = 300  # 5 minutes
 _STATS_MIN_CACHE_SECS = 60  # Don't re-fetch stats within 60s

+# Ed25519 group order
+_L = 2**252 + 27742317777372353535851937790883648493
+
 # Route type mapping: bottom 2 bits of first byte
 _ROUTE_MAP = {0: "F", 1: "F", 2: "D", 3: "T"}

@@ -66,6 +69,28 @@ def _base64url_encode(data: bytes) -> str:
    return base64.urlsafe_b64encode(data).rstrip(b"=").decode("ascii")


+def _ed25519_sign_expanded(
+    message: bytes, scalar: bytes, prefix: bytes, public_key: bytes
+) -> bytes:
+    """Sign a message using MeshCore's expanded Ed25519 key format.
+
+    MeshCore stores 64-byte "orlp" format keys: scalar(32) || prefix(32).
+    Standard Ed25519 libraries expect seed format and would re-SHA-512 the key.
+    This performs the signing manually using the already-expanded key material.
+
+    Port of meshcore-packet-capture's ed25519_sign_with_expanded_key().
+    """
+    # r = SHA-512(prefix || message) mod L
+    r = int.from_bytes(hashlib.sha512(prefix + message).digest(), "little") % _L
+    # R = r * B (base point multiplication)
+    R = nacl.bindings.crypto_scalarmult_ed25519_base_noclamp(r.to_bytes(32, "little"))
+    # k = SHA-512(R || public_key || message) mod L
+    k = int.from_bytes(hashlib.sha512(R + public_key + message).digest(), "little") % _L
+    # s = (r + k * scalar) mod L
+    s = (r + k * int.from_bytes(scalar, "little")) % _L
+    return R + s.to_bytes(32, "little")
+
+
 def _generate_jwt_token(
    private_key: bytes,
    public_key: bytes,
@@ -102,7 +127,7 @@ def _generate_jwt_token(

    scalar = private_key[:32]
    prefix = private_key[32:]
-    signature = ed25519_sign_expanded(signing_input, scalar, prefix, public_key)
+    signature = _ed25519_sign_expanded(signing_input, scalar, prefix, public_key)

    return f"{header_b64}.{payload_b64}.{signature.hex()}"

--- a/app/fanout/manager.py
+++ b/app/fanout/manager.py
@@ -21,7 +21,6 @@ def _register_module_types() -> None:
        return
    from app.fanout.apprise_mod import AppriseModule
    from app.fanout.bot import BotModule
-    from app.fanout.map_upload import MapUploadModule
    from app.fanout.mqtt_community import MqttCommunityModule
    from app.fanout.mqtt_private import MqttPrivateModule
    from app.fanout.sqs import SqsModule
@@ -33,7 +32,6 @@ def _register_module_types() -> None:
    _MODULE_TYPES["webhook"] = WebhookModule
    _MODULE_TYPES["apprise"] = AppriseModule
    _MODULE_TYPES["sqs"] = SqsModule
-    _MODULE_TYPES["map_upload"] = MapUploadModule


 def _matches_filter(filter_value: Any, key: str) -> bool:
--- a/app/fanout/map_upload.py
+++ b/app/fanout/map_upload.py
@@ -1,320 +0,0 @@
-"""Fanout module for uploading heard advert packets to map.meshcore.dev.
-
-Mirrors the logic of the standalone map.meshcore.dev-uploader project:
- Listens on raw RF packets via on_raw
- Filters for ADVERT packets, only processes repeaters (role 2) and rooms (role 3)
- Skips nodes with no valid location (lat/lon None)
- Applies per-pubkey rate-limiting (1-hour window, matching the uploader)
- Signs the upload request with the radio's own Ed25519 private key
- POSTs to the map API (or logs in dry-run mode)
-
-Dry-run mode (default: True) logs the full would-be payload at INFO level
-without making any HTTP requests. Disable it only after verifying the log
-output looks correct — in particular the radio params (freq/bw/sf/cr) and
-the raw hex link.
-
-Config keys
-----------
-api_url : str, default ""
-    Upload endpoint. Empty string falls back to the public map.meshcore.dev API.
-dry_run : bool, default True
-    When True, log the payload at INFO level instead of sending it.
-geofence_enabled : bool, default False
-    When True, only upload nodes whose location falls within geofence_radius_km of
-    the radio's own configured latitude/longitude (read live from the radio at upload
-    time — no lat/lon is stored in this config).  When the radio's lat/lon is not set
-    (0, 0) or unavailable, the geofence check is silently skipped so uploads continue
-    normally until coordinates are configured.
-geofence_radius_km : float, default 0.0
-    Radius of the geofence in kilometres. Nodes further than this distance
-    from the radio's own position are skipped.
-"""
-
-from __future__ import annotations
-
-import hashlib
-import json
-import logging
-import math
-
-import httpx
-
-from app.decoder import parse_advertisement, parse_packet
-from app.fanout.base import FanoutModule
-from app.keystore import ed25519_sign_expanded, get_private_key, get_public_key
-from app.services.radio_runtime import radio_runtime
-
-logger = logging.getLogger(__name__)
-
-_DEFAULT_API_URL = "https://map.meshcore.dev/api/v1/uploader/node"
-
-# Re-upload guard: skip re-uploading a pubkey seen within this window (AU parity)
-_REUPLOAD_SECONDS = 3600
-
-# Only upload repeaters (2) and rooms (3). Any other role — including future
-# roles not yet defined — is rejected. An allowlist is used rather than a
-# blocklist so that new roles cannot accidentally start populating the map.
-_ALLOWED_DEVICE_ROLES = {2, 3}
-
-
-def _get_radio_params() -> dict:
-    """Read radio frequency parameters from the connected radio's self_info.
-
-    The Python meshcore library returns radio_freq in MHz (e.g. 910.525) and
-    radio_bw in kHz (e.g. 62.5). These are exactly the units the map API
-    expects, matching what the JS reference uploader produces after its own
-    /1000 division on raw integer values. No further scaling is applied here.
-    """
-    try:
-        mc = radio_runtime.meshcore
-        if not mc:
-            return {"freq": 0, "cr": 0, "sf": 0, "bw": 0}
-        info = mc.self_info
-        if not isinstance(info, dict):
-            return {"freq": 0, "cr": 0, "sf": 0, "bw": 0}
-        freq = info.get("radio_freq", 0) or 0
-        bw = info.get("radio_bw", 0) or 0
-        sf = info.get("radio_sf", 0) or 0
-        cr = info.get("radio_cr", 0) or 0
-        return {
-            "freq": freq,
-            "cr": cr,
-            "sf": sf,
-            "bw": bw,
-        }
-    except Exception as exc:
-        logger.debug("MapUpload: could not read radio params: %s", exc)
-    return {"freq": 0, "cr": 0, "sf": 0, "bw": 0}
-
-
-_ROLE_NAMES: dict[int, str] = {2: "repeater", 3: "room"}
-
-
-def _haversine_km(lat1: float, lon1: float, lat2: float, lon2: float) -> float:
-    """Return the great-circle distance in kilometres between two lat/lon points."""
-    r = 6371.0
-    phi1, phi2 = math.radians(lat1), math.radians(lat2)
-    dphi = math.radians(lat2 - lat1)
-    dlam = math.radians(lon2 - lon1)
-    a = math.sin(dphi / 2) ** 2 + math.cos(phi1) * math.cos(phi2) * math.sin(dlam / 2) ** 2
-    return 2 * r * math.asin(math.sqrt(a))
-
-
-class MapUploadModule(FanoutModule):
-    """Uploads heard ADVERT packets to the MeshCore community map."""
-
-    def __init__(self, config_id: str, config: dict, *, name: str = "") -> None:
-        super().__init__(config_id, config, name=name)
-        self._client: httpx.AsyncClient | None = None
-        self._last_error: str | None = None
-        # Per-pubkey rate limiting: pubkey_hex -> last_uploaded_advert_timestamp
-        self._seen: dict[str, int] = {}
-
-    async def start(self) -> None:
-        self._client = httpx.AsyncClient(timeout=httpx.Timeout(15.0))
-        self._last_error = None
-        self._seen.clear()
-
-    async def stop(self) -> None:
-        if self._client:
-            await self._client.aclose()
-            self._client = None
-        self._last_error = None
-
-    async def on_raw(self, data: dict) -> None:
-        if data.get("payload_type") != "ADVERT":
-            return
-
-        raw_hex = data.get("data", "")
-        if not raw_hex:
-            return
-
-        try:
-            raw_bytes = bytes.fromhex(raw_hex)
-        except ValueError:
-            return
-
-        packet_info = parse_packet(raw_bytes)
-        if packet_info is None:
-            return
-
-        advert = parse_advertisement(packet_info.payload, raw_packet=raw_bytes)
-        if advert is None:
-            return
-
-        # TODO: advert Ed25519 signature verification is skipped here.
-        # The radio has already validated the packet before passing it to RT,
-        # so re-verification is redundant in practice. If added, verify that
-        # nacl.bindings.crypto_sign_open(sig + (pubkey_bytes || timestamp_bytes),
-        # advert.public_key_bytes) succeeds before proceeding.
-
-        # Only process repeaters (2) and rooms (3) — any other role is rejected
-        if advert.device_role not in _ALLOWED_DEVICE_ROLES:
-            return
-
-        # Skip nodes with no valid location — the decoder already nulls out
-        # impossible values, so None means either no location flag or bad coords.
-        if advert.lat is None or advert.lon is None:
-            logger.debug(
-                "MapUpload: skipping %s — no valid location",
-                advert.public_key[:12],
-            )
-            return
-
-        pubkey = advert.public_key.lower()
-
-        # Rate-limit: skip if this pubkey's timestamp hasn't advanced enough
-        last_seen = self._seen.get(pubkey)
-        if last_seen is not None:
-            if last_seen >= advert.timestamp:
-                logger.debug(
-                    "MapUpload: skipping %s — possible replay (last=%d, advert=%d)",
-                    pubkey[:12],
-                    last_seen,
-                    advert.timestamp,
-                )
-                return
-            if advert.timestamp < last_seen + _REUPLOAD_SECONDS:
-                logger.debug(
-                    "MapUpload: skipping %s — within 1-hr rate-limit window (delta=%ds)",
-                    pubkey[:12],
-                    advert.timestamp - last_seen,
-                )
-                return
-
-        await self._upload(
-            pubkey, advert.timestamp, advert.device_role, raw_hex, advert.lat, advert.lon
-        )
-
-    async def _upload(
-        self,
-        pubkey: str,
-        advert_timestamp: int,
-        device_role: int,
-        raw_hex: str,
-        lat: float,
-        lon: float,
-    ) -> None:
-        # Geofence check: if enabled, skip nodes outside the configured radius.
-        # The reference center is the radio's own lat/lon read live from self_info —
-        # no coordinates are stored in the fanout config. If the radio lat/lon is
-        # (0, 0) or unavailable the check is skipped transparently so uploads
-        # continue normally until the operator sets coordinates in radio settings.
-        geofence_dist_km: float | None = None
-        if self.config.get("geofence_enabled"):
-            try:
-                mc = radio_runtime.meshcore
-                sinfo = mc.self_info if mc else None
-                fence_lat = float((sinfo or {}).get("adv_lat", 0) or 0)
-                fence_lon = float((sinfo or {}).get("adv_lon", 0) or 0)
-            except Exception as exc:
-                logger.debug("MapUpload: could not read radio lat/lon for geofence: %s", exc)
-                fence_lat = 0.0
-                fence_lon = 0.0
-
-            if fence_lat == 0.0 and fence_lon == 0.0:
-                logger.debug(
-                    "MapUpload: geofence skipped for %s — radio lat/lon not configured",
-                    pubkey[:12],
-                )
-            else:
-                fence_radius_km = float(self.config.get("geofence_radius_km", 0) or 0)
-                geofence_dist_km = _haversine_km(fence_lat, fence_lon, lat, lon)
-                if geofence_dist_km > fence_radius_km:
-                    logger.debug(
-                        "MapUpload: skipping %s — outside geofence (%.2f km > %.2f km)",
-                        pubkey[:12],
-                        geofence_dist_km,
-                        fence_radius_km,
-                    )
-                    return
-
-        private_key = get_private_key()
-        public_key = get_public_key()
-
-        if private_key is None or public_key is None:
-            logger.warning(
-                "MapUpload: private key not available — cannot sign upload for %s. "
-                "Ensure radio firmware has ENABLE_PRIVATE_KEY_EXPORT=1.",
-                pubkey[:12],
-            )
-            return
-
-        api_url = str(self.config.get("api_url", "") or _DEFAULT_API_URL).strip()
-        dry_run = bool(self.config.get("dry_run", True))
-        role_name = _ROLE_NAMES.get(device_role, f"role={device_role}")
-
-        params = _get_radio_params()
-        upload_data = {
-            "params": params,
-            "links": [f"meshcore://{raw_hex}"],
-        }
-
-        # Sign: SHA-256 the compact JSON, then Ed25519-sign the hash
-        json_str = json.dumps(upload_data, separators=(",", ":"))
-        data_hash = hashlib.sha256(json_str.encode()).digest()
-        scalar = private_key[:32]
-        prefix_bytes = private_key[32:]
-        signature = ed25519_sign_expanded(data_hash, scalar, prefix_bytes, public_key)
-
-        request_payload = {
-            "data": json_str,
-            "signature": signature.hex(),
-            "publicKey": public_key.hex(),
-        }
-
-        if dry_run:
-            geofence_note = (
-                f" | geofence: {geofence_dist_km:.2f} km from observer"
-                if geofence_dist_km is not None
-                else ""
-            )
-            logger.info(
-                "MapUpload [DRY RUN] %s (%s)%s → would POST to %s\n  payload: %s",
-                pubkey[:12],
-                role_name,
-                geofence_note,
-                api_url,
-                json.dumps(request_payload, separators=(",", ":")),
-            )
-            # Still update _seen so rate-limiting works during dry-run testing
-            self._seen[pubkey] = advert_timestamp
-            return
-
-        if not self._client:
-            return
-
-        try:
-            resp = await self._client.post(
-                api_url,
-                content=json.dumps(request_payload, separators=(",", ":")),
-                headers={"Content-Type": "application/json"},
-            )
-            resp.raise_for_status()
-            self._seen[pubkey] = advert_timestamp
-            self._last_error = None
-            logger.info(
-                "MapUpload: uploaded %s (%s) → HTTP %d",
-                pubkey[:12],
-                role_name,
-                resp.status_code,
-            )
-        except httpx.HTTPStatusError as exc:
-            self._last_error = f"HTTP {exc.response.status_code}"
-            logger.warning(
-                "MapUpload: server returned %d for %s: %s",
-                exc.response.status_code,
-                pubkey[:12],
-                exc.response.text[:200],
-            )
-        except httpx.RequestError as exc:
-            self._last_error = str(exc)
-            logger.warning("MapUpload: request error for %s: %s", pubkey[:12], exc)
-
-    @property
-    def status(self) -> str:
-        if self._client is None:
-            return "disconnected"
-        if self._last_error:
-            return "error"
-        return "connected"
--- a/app/fanout/mqtt_base.py
+++ b/app/fanout/mqtt_base.py
@@ -102,7 +102,7 @@ class BaseMqttPublisher(ABC):
        except Exception as e:
            logger.warning(
                "%s publish failed on %s. This is usually transient network noise; "
-                "if it self-resolves and reconnects, it is generally not a concern. Persistent errors may indicate a problem with your network connection or MQTT broker. Original error: %s",
+                "if it self-resolves and reconnects, it is generally not a concern: %s",
                self._integration_label(),
                topic,
                e,
@@ -239,7 +239,7 @@ class BaseMqttPublisher(ABC):
                logger.warning(
                    "%s connection error. This is usually transient network noise; "
                    "if it self-resolves, it is generally not a concern: %s "
-                    "(reconnecting in %ds). If this error persists, check your network connection and MQTT broker status.",
+                    "(reconnecting in %ds)",
                    self._integration_label(),
                    e,
                    backoff,
--- a/app/keystore.py
+++ b/app/keystore.py
@@ -1,18 +1,14 @@
 """
-Ephemeral keystore for storing sensitive keys in memory, plus the Ed25519
-signing primitive used by fanout modules that need to sign requests with the
-radio's own key.
+Ephemeral keystore for storing sensitive keys in memory.

 The private key is stored in memory only and is never persisted to disk.
 It's exported from the radio on startup and reconnect, then used for
 server-side decryption of direct messages.
 """

-import hashlib
 import logging
 from typing import TYPE_CHECKING

-import nacl.bindings
 from meshcore import EventType

 from app.decoder import derive_public_key
@@ -29,30 +25,11 @@ NO_EVENT_RECEIVED_GUIDANCE = (
    "issue commands to the radio."
 )

-# Ed25519 group order (L) — used in the expanded signing primitive below
-_L = 2**252 + 27742317777372353535851937790883648493
-
 # In-memory storage for the private key and derived public key
 _private_key: bytes | None = None
 _public_key: bytes | None = None


-def ed25519_sign_expanded(message: bytes, scalar: bytes, prefix: bytes, public_key: bytes) -> bytes:
-    """Sign a message using MeshCore's expanded Ed25519 key format.
-
-    MeshCore stores 64-byte keys as scalar(32) || prefix(32).  Standard
-    Ed25519 libraries expect seed format and would re-SHA-512 the key, so we
-    perform the signing manually using the already-expanded key material.
-
-    Port of meshcore-packet-capture's ed25519_sign_with_expanded_key().
-    """
-    r = int.from_bytes(hashlib.sha512(prefix + message).digest(), "little") % _L
-    R = nacl.bindings.crypto_scalarmult_ed25519_base_noclamp(r.to_bytes(32, "little"))
-    k = int.from_bytes(hashlib.sha512(R + public_key + message).digest(), "little") % _L
-    s = (r + k * int.from_bytes(scalar, "little")) % _L
-    return R + s.to_bytes(32, "little")
-
-
 def clear_keys() -> None:
    """Clear any stored private/public key material from memory."""
    global _private_key, _public_key
--- a/app/routers/fanout.py
+++ b/app/routers/fanout.py
@@ -16,7 +16,7 @@ from app.repository.fanout import FanoutConfigRepository
 logger = logging.getLogger(__name__)
 router = APIRouter(prefix="/fanout", tags=["fanout"])

-_VALID_TYPES = {"mqtt_private", "mqtt_community", "bot", "webhook", "apprise", "sqs", "map_upload"}
+_VALID_TYPES = {"mqtt_private", "mqtt_community", "bot", "webhook", "apprise", "sqs"}

 _IATA_RE = re.compile(r"^[A-Z]{3}$")
 _DEFAULT_COMMUNITY_MQTT_TOPIC_TEMPLATE = "meshcore/{IATA}/{PUBLIC_KEY}/packets"
@@ -94,8 +94,6 @@ def _validate_and_normalize_config(config_type: str, config: dict) -> dict:
        _validate_apprise_config(normalized)
    elif config_type == "sqs":
        _validate_sqs_config(normalized)
-    elif config_type == "map_upload":
-        _validate_map_upload_config(normalized)

    return normalized

@@ -297,33 +295,10 @@ def _validate_sqs_config(config: dict) -> None:
        )


-def _validate_map_upload_config(config: dict) -> None:
-    """Validate and normalize map_upload config blob."""
-    api_url = str(config.get("api_url", "")).strip()
-    if api_url and not api_url.startswith(("http://", "https://")):
-        raise HTTPException(
-            status_code=400,
-            detail="api_url must start with http:// or https://",
-        )
-    # Persist the cleaned value (empty string means use the module default)
-    config["api_url"] = api_url
-    config["dry_run"] = bool(config.get("dry_run", True))
-    config["geofence_enabled"] = bool(config.get("geofence_enabled", False))
-    try:
-        radius = float(config.get("geofence_radius_km", 0) or 0)
-    except (TypeError, ValueError):
-        raise HTTPException(status_code=400, detail="geofence_radius_km must be a number") from None
-    if radius < 0:
-        raise HTTPException(status_code=400, detail="geofence_radius_km must be >= 0")
-    config["geofence_radius_km"] = radius
-
-
 def _enforce_scope(config_type: str, scope: dict) -> dict:
    """Enforce type-specific scope constraints. Returns normalized scope."""
    if config_type == "mqtt_community":
        return {"messages": "none", "raw_packets": "all"}
-    if config_type == "map_upload":
-        return {"messages": "none", "raw_packets": "all"}
    if config_type == "bot":
        return {"messages": "all", "raw_packets": "none"}
    if config_type in ("webhook", "apprise"):
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
  "name": "remoteterm-meshcore-frontend",
-  "version": "3.6.0",
+  "version": "2.7.9",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "remoteterm-meshcore-frontend",
-      "version": "3.6.0",
+      "version": "2.7.9",
      "dependencies": {
        "@codemirror/lang-python": "^6.2.1",
        "@codemirror/theme-one-dark": "^6.1.3",
@@ -29,7 +29,6 @@
        "react": "^18.3.1",
        "react-dom": "^18.3.1",
        "react-leaflet": "^4.2.1",
-        "react-swipeable": "^7.0.2",
        "sonner": "^2.0.7",
        "tailwind-merge": "^3.4.0",
        "tailwindcss-animate": "^1.0.7",
@@ -5696,15 +5695,6 @@
        }
      }
    },
-    "node_modules/react-swipeable": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/react-swipeable/-/react-swipeable-7.0.2.tgz",
-      "integrity": "sha512-v1Qx1l+aC2fdxKa9aKJiaU/ZxmJ5o98RMoFwUqAAzVWUcxgfHFXDDruCKXhw6zIYXm6V64JiHgP9f6mlME5l8w==",
-      "license": "MIT",
-      "peerDependencies": {
-        "react": "^16.8.3 || ^17 || ^18 || ^19.0.0 || ^19.0.0-rc"
-      }
-    },
    "node_modules/read-cache": {
      "version": "1.0.0",
      "resolved": "https://registry.npmjs.org/read-cache/-/read-cache-1.0.0.tgz",
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,7 +1,7 @@
 {
  "name": "remoteterm-meshcore-frontend",
  "private": true,
-  "version": "3.6.1",
+  "version": "3.6.0",
  "type": "module",
  "scripts": {
    "dev": "vite",
@@ -37,7 +37,6 @@
    "react": "^18.3.1",
    "react-dom": "^18.3.1",
    "react-leaflet": "^4.2.1",
-    "react-swipeable": "^7.0.2",
    "sonner": "^2.0.7",
    "tailwind-merge": "^3.4.0",
    "tailwindcss-animate": "^1.0.7",
--- a/frontend/src/App.tsx
+++ b/frontend/src/App.tsx
@@ -1,4 +1,4 @@
-import { useEffect, useCallback, useRef, useState } from 'react';
+import { useEffect, useCallback, useRef, useState, useMemo } from 'react';
 import { api } from './api';
 import { takePrefetchOrFetch } from './prefetch';
 import { useWebSocket } from './useWebSocket';
@@ -24,6 +24,7 @@ import { DistanceUnitProvider } from './contexts/DistanceUnitContext';
 import { messageContainsMention } from './utils/messageParser';
 import { getStateKey } from './utils/conversationState';
 import type { Conversation, Message, RawPacket } from './types';
+import { CONTACT_TYPE_ROOM } from './types';

 interface ChannelUnreadMarker {
  channelId: string;
@@ -251,6 +252,21 @@ export function App() {
  } = useConversationMessages(activeConversation, targetMessageId);
  removeConversationMessagesRef.current = removeConversationMessages;

+  // Room servers replay stored history as a burst of DMs, all arriving with similar received_at
+  // but spanning a wide range of sender_timestamps. Sort by sender_timestamp for room contacts
+  // so the display reflects the original send order rather than our radio's receipt order.
+  const activeContactIsRoom =
+    activeConversation?.type === 'contact' &&
+    contacts.find((c) => c.public_key === activeConversation.id)?.type === CONTACT_TYPE_ROOM;
+  const sortedMessages = useMemo(() => {
+    if (!activeContactIsRoom || messages.length === 0) return messages;
+    return [...messages].sort((a, b) => {
+      const aTs = a.sender_timestamp ?? a.received_at;
+      const bTs = b.sender_timestamp ?? b.received_at;
+      return aTs !== bTs ? aTs - bTs : a.id - b.id;
+    });
+  }, [activeContactIsRoom, messages]);
+
  const {
    unreadCounts,
    mentions,
@@ -427,7 +443,7 @@ export function App() {
    config,
    health,
    favorites,
-    messages,
+    messages: sortedMessages,
    messagesLoading,
    loadingOlder,
    hasOlderMessages,
--- a/frontend/src/components/AppShell.tsx
+++ b/frontend/src/components/AppShell.tsx
@@ -1,5 +1,4 @@
 import { lazy, Suspense, useRef, type ComponentProps } from 'react';
-import { useSwipeable } from 'react-swipeable';

 import { StatusBar } from './StatusBar';
 import { Sidebar } from './Sidebar';
@@ -90,24 +89,6 @@ export function AppShell({
  contactInfoPaneProps,
  channelInfoPaneProps,
 }: AppShellProps) {
-  const swipeHandlers = useSwipeable({
-    onSwipedRight: ({ initial }) => {
-      if (initial[0] < 30 && !sidebarOpen && window.innerWidth < 768) {
-        onSidebarOpenChange(true);
-      }
-    },
-    trackTouch: true,
-    trackMouse: false,
-    preventScrollOnSwipe: true,
-  });
-
-  const closeSwipeHandlers = useSwipeable({
-    onSwipedLeft: () => onSidebarOpenChange(false),
-    trackTouch: true,
-    trackMouse: false,
-    preventScrollOnSwipe: false,
-  });
-
  const searchMounted = useRef(false);
  if (conversationPaneProps.activeConversation?.type === 'search') {
    searchMounted.current = true;
@@ -172,7 +153,7 @@ export function AppShell({
  );

  return (
-    <div className="flex flex-col h-full" {...swipeHandlers}>
+    <div className="flex flex-col h-full">
      <a
        href="#main-content"
        className="sr-only focus:not-sr-only focus:absolute focus:z-50 focus:p-2 focus:bg-primary focus:text-primary-foreground"
@@ -215,9 +196,7 @@ export function AppShell({
              <SheetTitle>Navigation</SheetTitle>
              <SheetDescription>Sidebar navigation</SheetDescription>
            </SheetHeader>
-            <div className="flex-1 overflow-hidden" {...closeSwipeHandlers}>
-              {activeSidebarContent}
-            </div>
+            <div className="flex-1 overflow-hidden">{activeSidebarContent}</div>
          </SheetContent>
        </Sheet>

--- a/frontend/src/components/CrackerPanel.tsx
+++ b/frontend/src/components/CrackerPanel.tsx
@@ -505,7 +505,7 @@ export function CrackerPanel({
            ? 'GPU Not Available'
            : !wordlistLoaded
              ? 'Loading dictionary...'
-              : 'Find Channels'}
+              : 'Find Rooms'}
      </button>

      {/* Status */}
--- a/frontend/src/components/PathModal.tsx
+++ b/frontend/src/components/PathModal.tsx
@@ -51,7 +51,7 @@ export function PathModal({
  onAnalyzePacket,
 }: PathModalProps) {
  const { distanceUnit } = useDistanceUnit();
-  const [mapModalIndex, setMapModalIndex] = useState<number | null>(null);
+  const [expandedMaps, setExpandedMaps] = useState<Set<number>>(new Set());
  const hasResendActions = isOutgoingChan && messageId !== undefined && onResend;
  const hasPaths = paths.length > 0;
  const showAnalyzePacket = hasPaths && packetId != null && onAnalyzePacket;
@@ -68,7 +68,7 @@ export function PathModal({

  return (
    <Dialog open={open} onOpenChange={(isOpen) => !isOpen && onClose()}>
-      <DialogContent className="max-w-md max-h-[80dvh] flex flex-col">
+      <DialogContent className="max-w-md max-h-[80vh] flex flex-col">
        <DialogHeader>
          <DialogTitle>
            {hasPaths
@@ -141,68 +141,59 @@ export function PathModal({
                </div>
              )}

-            {resolvedPaths.map((pathData, index) => (
-              <div key={index}>
-                <div className="flex items-center justify-between mb-2 pb-1 border-b border-border">
-                  {!hasSinglePath ? (
-                    <div className="text-sm text-foreground/70 font-semibold">
-                      Path {index + 1}{' '}
-                      <span className="font-normal text-muted-foreground">
-                        — received {formatTime(pathData.received_at)}
-                      </span>
-                    </div>
-                  ) : (
-                    <div />
-                  )}
-                  <button
-                    onClick={() => setMapModalIndex(index)}
-                    className="text-xs text-primary hover:underline cursor-pointer shrink-0 ml-2"
-                  >
-                    Map route
-                  </button>
-                </div>
-                <PathVisualization
-                  resolved={pathData.resolved}
-                  senderInfo={senderInfo}
-                  distanceUnit={distanceUnit}
-                />
-              </div>
-            ))}
+            {resolvedPaths.map((pathData, index) => {
+              const mapExpanded = expandedMaps.has(index);
+              const toggleMap = () =>
+                setExpandedMaps((prev) => {
+                  const next = new Set(prev);
+                  if (next.has(index)) next.delete(index);
+                  else next.add(index);
+                  return next;
+                });

-            {/* Map modal — opens when a "Map route" button is clicked */}
-            <Dialog
-              open={mapModalIndex !== null}
-              onOpenChange={(open) => !open && setMapModalIndex(null)}
-            >
-              <DialogContent className="sm:max-w-2xl">
-                <DialogHeader>
-                  <DialogTitle>
-                    {mapModalIndex !== null && !hasSinglePath
-                      ? `Path ${mapModalIndex + 1} Route Map`
-                      : 'Route Map'}
-                  </DialogTitle>
-                  <DialogDescription>
-                    Map of known node locations along this message route.
-                  </DialogDescription>
-                </DialogHeader>
-                {mapModalIndex !== null && (
-                  <Suspense
-                    fallback={
-                      <div
-                        className="rounded border border-border bg-muted/30 animate-pulse"
-                        style={{ height: 400 }}
-                      />
-                    }
-                  >
-                    <PathRouteMap
-                      resolved={resolvedPaths[mapModalIndex].resolved}
-                      senderInfo={senderInfo}
-                      height={400}
-                    />
-                  </Suspense>
-                )}
-              </DialogContent>
-            </Dialog>
+              return (
+                <div key={index}>
+                  <div className="flex items-center justify-between mb-2 pb-1 border-b border-border">
+                    {!hasSinglePath ? (
+                      <div className="text-sm text-foreground/70 font-semibold">
+                        Path {index + 1}{' '}
+                        <span className="font-normal text-muted-foreground">
+                          — received {formatTime(pathData.received_at)}
+                        </span>
+                      </div>
+                    ) : (
+                      <div />
+                    )}
+                    <button
+                      onClick={toggleMap}
+                      aria-expanded={mapExpanded}
+                      className="text-xs text-primary hover:underline cursor-pointer shrink-0 ml-2"
+                    >
+                      {mapExpanded ? 'Hide map' : 'Map route'}
+                    </button>
+                  </div>
+                  {mapExpanded && (
+                    <div className="mb-2">
+                      <Suspense
+                        fallback={
+                          <div
+                            className="rounded border border-border bg-muted/30 animate-pulse"
+                            style={{ height: 220 }}
+                          />
+                        }
+                      >
+                        <PathRouteMap resolved={pathData.resolved} senderInfo={senderInfo} />
+                      </Suspense>
+                    </div>
+                  )}
+                  <PathVisualization
+                    resolved={pathData.resolved}
+                    senderInfo={senderInfo}
+                    distanceUnit={distanceUnit}
+                  />
+                </div>
+              );
+            })}
          </div>
        )}

--- a/frontend/src/components/PathRouteMap.tsx
+++ b/frontend/src/components/PathRouteMap.tsx
@@ -8,7 +8,6 @@ import type { ResolvedPath, SenderInfo } from '../utils/pathUtils';
 interface PathRouteMapProps {
  resolved: ResolvedPath;
  senderInfo: SenderInfo;
-  height?: number;
 }

 // Colors for hop markers (indexed by hop number - 1)
@@ -83,7 +82,7 @@ function RouteMapBounds({ points }: { points: [number, number][] }) {
  return null;
 }

-export function PathRouteMap({ resolved, senderInfo, height = 220 }: PathRouteMapProps) {
+export function PathRouteMap({ resolved, senderInfo }: PathRouteMapProps) {
  const points = collectPoints(resolved);
  const hasAnyGps = points.length > 0;

@@ -118,7 +117,7 @@ export function PathRouteMap({ resolved, senderInfo, height = 220 }: PathRouteMa
        className="rounded border border-border overflow-hidden"
        role="img"
        aria-label="Map showing message route between nodes"
-        style={{ height }}
+        style={{ height: 220 }}
      >
        <MapContainer
          center={center}
@@ -139,8 +138,6 @@ export function PathRouteMap({ resolved, senderInfo, height = 220 }: PathRouteMa
              icon={makeIcon('S', SENDER_COLOR)}
            >
              <Tooltip direction="top" offset={[0, -14]}>
-                <span className="font-mono">{resolved.sender.prefix}</span>
-                {' · '}
                {senderInfo.name || 'Sender'}
              </Tooltip>
            </Marker>
@@ -157,8 +154,6 @@ export function PathRouteMap({ resolved, senderInfo, height = 220 }: PathRouteMa
                  icon={makeIcon(String(hopIdx + 1), getHopColor(hopIdx))}
                >
                  <Tooltip direction="top" offset={[0, -14]}>
-                    <span className="font-mono">{hop.prefix}</span>
-                    {' · '}
                    {m.name || m.public_key.slice(0, 12)}
                  </Tooltip>
                </Marker>
@@ -172,8 +167,6 @@ export function PathRouteMap({ resolved, senderInfo, height = 220 }: PathRouteMa
              icon={makeIcon('R', RECEIVER_COLOR)}
            >
              <Tooltip direction="top" offset={[0, -14]}>
-                <span className="font-mono">{resolved.receiver.prefix}</span>
-                {' · '}
                {resolved.receiver.name || 'Receiver'}
              </Tooltip>
            </Marker>
--- a/frontend/src/components/RawPacketDetailModal.tsx
+++ b/frontend/src/components/RawPacketDetailModal.tsx
@@ -784,7 +784,7 @@ export function RawPacketInspectorDialog({

  return (
    <Dialog open={open} onOpenChange={onOpenChange}>
-      <DialogContent className="flex h-[92dvh] max-w-[min(96vw,82rem)] flex-col gap-0 overflow-hidden p-0">
+      <DialogContent className="flex h-[92vh] max-w-[min(96vw,82rem)] flex-col gap-0 overflow-hidden p-0">
        <DialogHeader className="border-b border-border px-5 py-3">
          <DialogTitle>{title}</DialogTitle>
          <DialogDescription className="sr-only">{description}</DialogDescription>
--- a/frontend/src/components/SecurityWarningModal.tsx
+++ b/frontend/src/components/SecurityWarningModal.tsx
@@ -69,7 +69,7 @@ export function SecurityWarningModal({ health }: SecurityWarningModalProps) {
    <Dialog open>
      <DialogContent
        hideCloseButton
-        className="w-[calc(100vw-1rem)] max-w-[42rem] gap-5 overflow-y-auto px-4 py-5 max-h-[calc(100dvh-2rem)] sm:w-full sm:max-h-[min(85dvh,48rem)] sm:px-6"
+        className="top-3 w-[calc(100vw-1rem)] max-w-[42rem] translate-y-0 gap-5 overflow-y-auto px-4 py-5 max-h-[calc(100vh-1.5rem)] sm:top-[50%] sm:w-full sm:max-h-[min(90vh,48rem)] sm:translate-y-[-50%] sm:px-6"
        onEscapeKeyDown={(event) => event.preventDefault()}
        onInteractOutside={(event) => event.preventDefault()}
      >
--- a/frontend/src/components/SettingsModal.tsx
+++ b/frontend/src/components/SettingsModal.tsx
@@ -147,8 +147,8 @@ export function SettingsModal(props: SettingsModalProps) {
    : 'mx-auto w-full max-w-[800px] space-y-4 border-t border-input p-4';

  const settingsContainerClass = externalDesktopSidebarMode
-    ? 'w-full h-full min-w-0 overflow-x-hidden overflow-y-auto [contain:layout_paint]'
-    : 'w-full h-full min-w-0 overflow-x-hidden overflow-y-auto space-y-3 [contain:layout_paint]';
+    ? 'w-full h-full overflow-y-auto'
+    : 'w-full h-full overflow-y-auto space-y-3';

  const sectionButtonClasses =
    'w-full flex items-center justify-between px-4 py-3 text-left hover:bg-muted/40 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-inset';
--- a/frontend/src/components/Sidebar.tsx
+++ b/frontend/src/components/Sidebar.tsx
@@ -844,7 +844,7 @@ export function Sidebar({
        <div className="relative min-w-0 flex-1">
          <Input
            type="text"
-            placeholder="Search channels/contacts..."
+            placeholder="Search rooms/contacts..."
            aria-label="Search conversations"
            value={searchQuery}
            onChange={(e) => setSearchQuery(e.target.value)}
--- a/frontend/src/components/settings/SettingsFanoutSection.tsx
+++ b/frontend/src/components/settings/SettingsFanoutSection.tsx
@@ -16,12 +16,11 @@ const BotCodeEditor = lazy(() =>

 const TYPE_LABELS: Record<string, string> = {
  mqtt_private: 'Private MQTT',
-  mqtt_community: 'Community Sharing',
+  mqtt_community: 'Community MQTT',
  bot: 'Python Bot',
  webhook: 'Webhook',
  apprise: 'Apprise',
  sqs: 'Amazon SQS',
-  map_upload: 'Map Upload',
 };

 const DEFAULT_COMMUNITY_PACKET_TOPIC_TEMPLATE = 'meshcore/{IATA}/{PUBLIC_KEY}/packets';
@@ -101,8 +100,7 @@ type DraftType =
  | 'webhook'
  | 'apprise'
  | 'sqs'
-  | 'bot'
-  | 'map_upload';
+  | 'bot';

 type CreateIntegrationDefinition = {
  value: DraftType;
@@ -145,7 +143,7 @@ const CREATE_INTEGRATION_DEFINITIONS: readonly CreateIntegrationDefinition[] = [
    value: 'mqtt_community',
    savedType: 'mqtt_community',
    label: 'Community MQTT/meshcoretomqtt',
-    section: 'Community Sharing',
+    section: 'Community MQTT',
    description:
      'MeshcoreToMQTT-compatible raw-packet feed publishing, compatible with community aggregators (in other words, make your companion radio also serve as an observer node). Superset of other Community MQTT presets.',
    defaultName: 'Community MQTT',
@@ -159,7 +157,7 @@ const CREATE_INTEGRATION_DEFINITIONS: readonly CreateIntegrationDefinition[] = [
    value: 'mqtt_community_meshrank',
    savedType: 'mqtt_community',
    label: 'MeshRank',
-    section: 'Community Sharing',
+    section: 'Community MQTT',
    description:
      'A community MQTT config preconfigured for MeshRank, requiring only the provided topic from your MeshRank configuration. A subset of the primary Community MQTT/meshcoretomqtt configuration; you are free to edit all configuration after creation.',
    defaultName: 'MeshRank',
@@ -182,7 +180,7 @@ const CREATE_INTEGRATION_DEFINITIONS: readonly CreateIntegrationDefinition[] = [
    value: 'mqtt_community_letsmesh_us',
    savedType: 'mqtt_community',
    label: 'LetsMesh (US)',
-    section: 'Community Sharing',
+    section: 'Community MQTT',
    description:
      'A community MQTT config preconfigured for the LetsMesh US-ingest endpoint, requiring only your email and IATA region code. Good to use with an additional EU configuration for redundancy. A subset of the primary Community MQTT/meshcoretomqtt configuration; you are free to edit all configuration after creation.',
    defaultName: 'LetsMesh (US)',
@@ -199,7 +197,7 @@ const CREATE_INTEGRATION_DEFINITIONS: readonly CreateIntegrationDefinition[] = [
    value: 'mqtt_community_letsmesh_eu',
    savedType: 'mqtt_community',
    label: 'LetsMesh (EU)',
-    section: 'Community Sharing',
+    section: 'Community MQTT',
    description:
      'A community MQTT config preconfigured for the LetsMesh EU-ingest endpoint, requiring only your email and IATA region code. Good to use with an additional US configuration for redundancy. A subset of the primary Community MQTT/meshcoretomqtt configuration; you are free to edit all configuration after creation.',
    defaultName: 'LetsMesh (EU)',
@@ -286,23 +284,6 @@ const CREATE_INTEGRATION_DEFINITIONS: readonly CreateIntegrationDefinition[] = [
      scope: { messages: 'all', raw_packets: 'none' },
    },
  },
-  {
-    value: 'map_upload',
-    savedType: 'map_upload',
-    label: 'Map Upload',
-    section: 'Community Sharing',
-    description:
-      'Upload repeaters and room servers to map.meshcore.dev or a compatible map API endpoint.',
-    defaultName: 'Map Upload',
-    nameMode: 'counted',
-    defaults: {
-      config: {
-        api_url: '',
-        dry_run: true,
-      },
-      scope: { messages: 'none', raw_packets: 'all' },
-    },
-  },
 ];

 const CREATE_INTEGRATION_DEFINITIONS_BY_VALUE = Object.fromEntries(
@@ -585,9 +566,7 @@ function getDefaultIntegrationName(type: string, configs: FanoutConfig[]) {

 function getStatusLabel(status: string | undefined, type?: string) {
  if (status === 'connected')
-    return type === 'bot' || type === 'webhook' || type === 'apprise' || type === 'map_upload'
-      ? 'Active'
-      : 'Connected';
+    return type === 'bot' || type === 'webhook' || type === 'apprise' ? 'Active' : 'Connected';
  if (status === 'error') return 'Error';
  if (status === 'disconnected') return 'Disconnected';
  return 'Inactive';
@@ -1080,152 +1059,6 @@ function BotConfigEditor({
  );
 }

-function MapUploadConfigEditor({
-  config,
-  onChange,
-}: {
-  config: Record<string, unknown>;
-  onChange: (config: Record<string, unknown>) => void;
-}) {
-  const isDryRun = config.dry_run !== false;
-  const [radioLat, setRadioLat] = useState<number | null>(null);
-  const [radioLon, setRadioLon] = useState<number | null>(null);
-
-  useEffect(() => {
-    api
-      .getRadioConfig()
-      .then((rc) => {
-        setRadioLat(rc.lat ?? 0);
-        setRadioLon(rc.lon ?? 0);
-      })
-      .catch(() => {
-        setRadioLat(0);
-        setRadioLon(0);
-      });
-  }, []);
-
-  const radioLatLonConfigured =
-    radioLat !== null && radioLon !== null && !(radioLat === 0 && radioLon === 0);
-
-  return (
-    <div className="space-y-3">
-      <p className="text-xs text-muted-foreground">
-        Automatically upload heard repeater and room server advertisements to{' '}
-        <a
-          href="https://map.meshcore.dev"
-          target="_blank"
-          rel="noopener noreferrer"
-          className="underline hover:text-foreground"
-        >
-          map.meshcore.dev
-        </a>
-        . Requires the radio&apos;s private key to be available (firmware must have{' '}
-        <code>ENABLE_PRIVATE_KEY_EXPORT=1</code>). Only raw RF packets are shared &mdash; never
-        decrypted messages.
-      </p>
-
-      <div className="rounded-md border border-warning/50 bg-warning/10 px-3 py-2 text-xs text-warning">
-        <strong>Dry Run is {isDryRun ? 'ON' : 'OFF'}.</strong>{' '}
-        {isDryRun
-          ? 'No uploads will be sent. Check the backend logs to verify the payload looks correct before enabling live sends.'
-          : 'Live uploads are enabled. Each advert is rate-limited to once per hour per node.'}
-      </div>
-
-      <label className="flex items-center gap-3 cursor-pointer">
-        <input
-          type="checkbox"
-          checked={isDryRun}
-          onChange={(e) => onChange({ ...config, dry_run: e.target.checked })}
-          className="h-4 w-4 rounded border-border"
-        />
-        <div>
-          <span className="text-sm font-medium">Dry Run (log only, no uploads)</span>
-          <p className="text-xs text-muted-foreground">
-            When enabled, upload payloads are logged at INFO level but not sent. Disable once you
-            have confirmed the logged output looks correct.
-          </p>
-        </div>
-      </label>
-
-      <Separator />
-
-      <div className="space-y-2">
-        <Label htmlFor="fanout-map-api-url">API URL (optional)</Label>
-        <Input
-          id="fanout-map-api-url"
-          type="url"
-          placeholder="https://map.meshcore.dev/api/v1/uploader/node"
-          value={(config.api_url as string) || ''}
-          onChange={(e) => onChange({ ...config, api_url: e.target.value })}
-        />
-        <p className="text-xs text-muted-foreground">
-          Leave blank to use the default <code>map.meshcore.dev</code> endpoint.
-        </p>
-      </div>
-
-      <Separator />
-
-      <label className="flex items-center gap-3 cursor-pointer">
-        <input
-          type="checkbox"
-          checked={!!config.geofence_enabled}
-          onChange={(e) => onChange({ ...config, geofence_enabled: e.target.checked })}
-          className="h-4 w-4 rounded border-border"
-        />
-        <div>
-          <span className="text-sm font-medium">Enable Geofence</span>
-          <p className="text-xs text-muted-foreground">
-            Only upload nodes whose location falls within the configured radius of your radio&apos;s
-            own position. Helps exclude nodes with false or spoofed coordinates. Uses the
-            latitude/longitude set in Radio Settings.
-          </p>
-        </div>
-      </label>
-
-      {!!config.geofence_enabled && (
-        <div className="space-y-3 pl-7">
-          {!radioLatLonConfigured && (
-            <div className="rounded-md border border-warning/50 bg-warning/10 px-3 py-2 text-xs text-warning">
-              Your radio does not currently have a latitude/longitude configured. Geofencing will be
-              silently skipped until coordinates are set in{' '}
-              <strong>Settings &rarr; Radio &rarr; Location</strong>.
-            </div>
-          )}
-          {radioLatLonConfigured && (
-            <p className="text-xs text-muted-foreground">
-              Using radio position{' '}
-              <code>
-                {radioLat?.toFixed(5)}, {radioLon?.toFixed(5)}
-              </code>{' '}
-              as the geofence center. Update coordinates in Radio Settings to move the center.
-            </p>
-          )}
-          <div className="space-y-2">
-            <Label htmlFor="fanout-map-geofence-radius">Radius (km)</Label>
-            <Input
-              id="fanout-map-geofence-radius"
-              type="number"
-              min="0"
-              step="any"
-              placeholder="e.g. 100"
-              value={(config.geofence_radius_km as number | undefined) ?? ''}
-              onChange={(e) =>
-                onChange({
-                  ...config,
-                  geofence_radius_km: e.target.value === '' ? 0 : parseFloat(e.target.value),
-                })
-              }
-            />
-            <p className="text-xs text-muted-foreground">
-              Nodes further than this distance from your radio&apos;s position will not be uploaded.
-            </p>
-          </div>
-        </div>
-      )}
-    </div>
-  );
-}
-
 type ScopeMode = 'all' | 'none' | 'only' | 'except';

 function getScopeMode(value: unknown): ScopeMode {
@@ -2142,10 +1975,6 @@ export function SettingsFanoutSection({
          />
        )}

-        {detailType === 'map_upload' && (
-          <MapUploadConfigEditor config={editConfig} onChange={setEditConfig} />
-        )}
-
        <Separator />

        <div className="flex gap-2">
--- a/frontend/src/hooks/useBrowserNotifications.ts
+++ b/frontend/src/hooks/useBrowserNotifications.ts
@@ -9,17 +9,6 @@ const NOTIFICATION_ICON_PATH = '/favicon-256x256.png';
 type NotificationPermissionState = NotificationPermission | 'unsupported';
 type ConversationNotificationMap = Record<string, boolean>;

-interface NotificationEnableToastInfo {
-  level: 'success' | 'warning';
-  title: string;
-  description?: string;
-}
-
-interface NotificationEnvironment {
-  protocol: string;
-  isSecureContext: boolean;
-}
-
 function getConversationNotificationKey(type: 'channel' | 'contact', id: string): string {
  return getStateKey(type, id);
 }
@@ -103,40 +92,6 @@ function buildMessageNotificationHash(message: Message): string | null {
  return null;
 }

-export function getNotificationEnableToastInfo(
-  environment?: Partial<NotificationEnvironment>
-): NotificationEnableToastInfo {
-  if (typeof window === 'undefined') {
-    return { level: 'success', title: 'Notifications enabled' };
-  }
-
-  const protocol = environment?.protocol ?? window.location.protocol;
-  const isSecureContext = environment?.isSecureContext ?? window.isSecureContext;
-
-  if (protocol === 'http:') {
-    return {
-      level: 'warning',
-      title: 'Notifications enabled with warning',
-      description:
-        'Desktop notifications are on for this conversation, but you are using HTTP instead of HTTPS. Notifications will likely not work reliably.',
-    };
-  }
-
-  // Best-effort heuristic only. Browsers do not expose certificate trust details
-  // directly to page JS, so an HTTPS page that is not a secure context is the
-  // closest signal we have for an untrusted/self-signed setup.
-  if (protocol === 'https:' && !isSecureContext) {
-    return {
-      level: 'warning',
-      title: 'Notifications enabled with warning',
-      description:
-        'Desktop notifications are on for this conversation, but your HTTPS connection is untrusted, such as a self-signed certificate. Notification delivery may be inconsistent depending on your browser.',
-    };
-  }
-
-  return { level: 'success', title: 'Notifications enabled' };
-}
-
 export function useBrowserNotifications() {
  const [permission, setPermission] = useState<NotificationPermissionState>(getInitialPermission);
  const [enabledByConversation, setEnabledByConversation] =
@@ -155,6 +110,8 @@ export function useBrowserNotifications() {

  const toggleConversationNotifications = useCallback(
    async (type: 'channel' | 'contact', id: string, label: string) => {
+      const blockedDescription =
+        'Allow notifications in your browser settings, then try again. Some browsers may refuse notifications on non-HTTPS or self-signed HTTPS origins. Check your browser documentation for how to trust an insecure origin and the associated risks before doing so.';
      const conversationKey = getConversationNotificationKey(type, id);
      if (enabledByConversation[conversationKey]) {
        setEnabledByConversation((prev) => {
@@ -163,23 +120,20 @@ export function useBrowserNotifications() {
          writeStoredEnabledMap(next);
          return next;
        });
-        toast.success('Notifications disabled', {
-          description: `Desktop notifications are off for ${label}.`,
-        });
+        toast.success(`${label} notifications disabled`);
        return;
      }

      if (permission === 'unsupported') {
-        toast.error('Notifications unavailable', {
+        toast.error('Browser notifications unavailable', {
          description: 'This browser does not support desktop notifications.',
        });
        return;
      }

      if (permission === 'denied') {
-        toast.error('Notifications blocked', {
-          description:
-            'Desktop notifications are blocked by your browser. Allow notifications in browser settings, then try again. Non-HTTPS or untrusted HTTPS origins may also prevent notifications from working reliably.',
+        toast.error('Browser notifications blocked', {
+          description: blockedDescription,
        });
        return;
      }
@@ -201,24 +155,13 @@ export function useBrowserNotifications() {
          icon: NOTIFICATION_ICON_PATH,
          tag: `meshcore-notification-preview-${conversationKey}`,
        });
-        const toastInfo = getNotificationEnableToastInfo();
-        if (toastInfo.level === 'warning') {
-          toast.warning(toastInfo.title, {
-            description: toastInfo.description,
-          });
-        } else {
-          toast.success(toastInfo.title, {
-            description: `Desktop notifications are on for ${label}.`,
-          });
-        }
+        toast.success(`${label} notifications enabled`);
        return;
      }

-      toast.error('Notifications not enabled', {
+      toast.error('Browser notifications not enabled', {
        description:
-          nextPermission === 'denied'
-            ? 'Desktop notifications were denied by your browser. Allow notifications in browser settings, then try again.'
-            : 'The browser permission request was dismissed.',
+          nextPermission === 'denied' ? blockedDescription : 'Permission request was dismissed.',
      });
    },
    [enabledByConversation, permission]
--- a/frontend/src/test/fanoutSection.test.tsx
+++ b/frontend/src/test/fanoutSection.test.tsx
@@ -12,7 +12,6 @@ vi.mock('../api', () => ({
    deleteFanoutConfig: vi.fn(),
    getChannels: vi.fn(),
    getContacts: vi.fn(),
-    getRadioConfig: vi.fn(),
  },
 }));

@@ -97,17 +96,6 @@ beforeEach(() => {
  mockedApi.getFanoutConfigs.mockResolvedValue([]);
  mockedApi.getChannels.mockResolvedValue([]);
  mockedApi.getContacts.mockResolvedValue([]);
-  mockedApi.getRadioConfig.mockResolvedValue({
-    public_key: 'aa'.repeat(32),
-    name: 'TestNode',
-    lat: 0,
-    lon: 0,
-    tx_power: 17,
-    max_tx_power: 22,
-    radio: { freq: 910.525, bw: 62.5, sf: 7, cr: 5 },
-    path_hash_mode: 0,
-    path_hash_mode_supported: false,
-  });
 });

 describe('SettingsFanoutSection', () => {
@@ -118,7 +106,7 @@ describe('SettingsFanoutSection', () => {
    const optionButtons = within(dialog)
      .getAllByRole('button')
      .filter((button) => button.hasAttribute('aria-pressed'));
-    expect(optionButtons).toHaveLength(10);
+    expect(optionButtons).toHaveLength(9);
    expect(within(dialog).getByRole('button', { name: 'Close' })).toBeInTheDocument();
    expect(within(dialog).getByRole('button', { name: 'Create' })).toBeInTheDocument();
    expect(
@@ -150,9 +138,6 @@ describe('SettingsFanoutSection', () => {
    expect(
      within(dialog).getByRole('button', { name: startsWithAccessibleName('Python Bot') })
    ).toBeInTheDocument();
-    expect(
-      within(dialog).getByRole('button', { name: startsWithAccessibleName('Map Upload') })
-    ).toBeInTheDocument();
    expect(within(dialog).getByRole('heading', { level: 3 })).toBeInTheDocument();

    const genericCommunityIndex = optionButtons.findIndex((button) =>
@@ -931,7 +916,7 @@ describe('SettingsFanoutSection', () => {

    await waitFor(() => expect(screen.getByText('← Back to list')).toBeInTheDocument());

-    expect(screen.getByLabelText('Name')).toHaveValue('Community Sharing #1');
+    expect(screen.getByLabelText('Name')).toHaveValue('Community MQTT #1');
    expect(screen.getByLabelText('Broker Host')).toBeInTheDocument();
    expect(screen.getByLabelText('Authentication')).toBeInTheDocument();
    expect(screen.getByLabelText('Packet Topic Template')).toBeInTheDocument();
--- a/frontend/src/test/useBrowserNotifications.test.ts
+++ b/frontend/src/test/useBrowserNotifications.test.ts
@@ -1,16 +1,12 @@
 import { act, renderHook } from '@testing-library/react';
 import { beforeEach, describe, expect, it, vi } from 'vitest';

-import {
-  getNotificationEnableToastInfo,
-  useBrowserNotifications,
-} from '../hooks/useBrowserNotifications';
+import { useBrowserNotifications } from '../hooks/useBrowserNotifications';
 import type { Message } from '../types';

 const mocks = vi.hoisted(() => ({
  toast: {
    success: vi.fn(),
-    warning: vi.fn(),
    error: vi.fn(),
  },
 }));
@@ -61,10 +57,6 @@ describe('useBrowserNotifications', () => {
      configurable: true,
      value: NotificationMock,
    });
-    Object.defineProperty(window, 'isSecureContext', {
-      configurable: true,
-      value: true,
-    });
  });

  it('stores notification opt-in per conversation', async () => {
@@ -92,10 +84,6 @@ describe('useBrowserNotifications', () => {
      icon: '/favicon-256x256.png',
      tag: `meshcore-notification-preview-channel-${incomingChannelMessage.conversation_key}`,
    });
-    expect(mocks.toast.warning).toHaveBeenCalledWith('Notifications enabled with warning', {
-      description:
-        'Desktop notifications are on for this conversation, but you are using HTTP instead of HTTPS. Notifications will likely not work reliably.',
-    });
  });

  it('only sends desktop notifications for opted-in conversations', async () => {
@@ -176,65 +164,9 @@ describe('useBrowserNotifications', () => {
      );
    });

-    expect(mocks.toast.error).toHaveBeenCalledWith('Notifications blocked', {
+    expect(mocks.toast.error).toHaveBeenCalledWith('Browser notifications blocked', {
      description:
-        'Desktop notifications are blocked by your browser. Allow notifications in browser settings, then try again. Non-HTTPS or untrusted HTTPS origins may also prevent notifications from working reliably.',
-    });
-  });
-
-  it('shows a warning toast when notifications are enabled on HTTP', async () => {
-    const { result } = renderHook(() => useBrowserNotifications());
-
-    await act(async () => {
-      await result.current.toggleConversationNotifications(
-        'channel',
-        incomingChannelMessage.conversation_key,
-        '#flightless'
-      );
-    });
-
-    expect(mocks.toast.warning).toHaveBeenCalledWith('Notifications enabled with warning', {
-      description:
-        'Desktop notifications are on for this conversation, but you are using HTTP instead of HTTPS. Notifications will likely not work reliably.',
-    });
-    expect(mocks.toast.success).not.toHaveBeenCalledWith('Notifications enabled');
-  });
-
-  it('best-effort detects insecure HTTPS for the enable-warning copy', () => {
-    expect(
-      getNotificationEnableToastInfo({
-        protocol: 'https:',
-        isSecureContext: false,
-      })
-    ).toEqual({
-      level: 'warning',
-      title: 'Notifications enabled with warning',
-      description:
-        'Desktop notifications are on for this conversation, but your HTTPS connection is untrusted, such as a self-signed certificate. Notification delivery may be inconsistent depending on your browser.',
-    });
-  });
-
-  it('shows a descriptive success toast when notifications are disabled', async () => {
-    const { result } = renderHook(() => useBrowserNotifications());
-
-    await act(async () => {
-      await result.current.toggleConversationNotifications(
-        'channel',
-        incomingChannelMessage.conversation_key,
-        '#flightless'
-      );
-    });
-
-    await act(async () => {
-      await result.current.toggleConversationNotifications(
-        'channel',
-        incomingChannelMessage.conversation_key,
-        '#flightless'
-      );
-    });
-
-    expect(mocks.toast.success).toHaveBeenCalledWith('Notifications disabled', {
-      description: 'Desktop notifications are off for #flightless.',
+        'Allow notifications in your browser settings, then try again. Some browsers may refuse notifications on non-HTTPS or self-signed HTTPS origins. Check your browser documentation for how to trust an insecure origin and the associated risks before doing so.',
    });
  });
 });
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "remoteterm-meshcore"
-version = "3.6.1"
+version = "3.6.0"
 description = "RemoteTerm - Web interface for MeshCore radio mesh networks"
 readme = "README.md"
 requires-python = ">=3.10"
--- a/scripts/fetch_prebuilt_frontend.py
+++ b/scripts/fetch_prebuilt_frontend.py
@@ -1,106 +0,0 @@
-#!/usr/bin/env python3
-"""
-fetch_prebuilt_frontend.py
-
-Downloads the latest prebuilt frontend artifact from the GitHub releases page
-and installs it into frontend/prebuilt/ so the backend can serve it directly.
-
-No GitHub CLI or authentication required — uses only the public releases API
-and browser_download_url. Requires only the Python standard library.
-"""
-
-import json
-import shutil
-import sys
-import urllib.request
-import zipfile
-from pathlib import Path
-
-REPO = "jkingsman/Remote-Terminal-for-MeshCore"
-API_URL = f"https://api.github.com/repos/{REPO}/releases/latest"
-PREBUILT_PREFIX = "Remote-Terminal-for-MeshCore/frontend/prebuilt/"
-
-SCRIPT_DIR = Path(__file__).resolve().parent
-PREBUILT_DIR = SCRIPT_DIR.parent / "frontend" / "prebuilt"
-
-
-def fetch_json(url: str) -> dict:
-    req = urllib.request.Request(url, headers={"Accept": "application/vnd.github+json"})
-    with urllib.request.urlopen(req) as resp:
-        return json.loads(resp.read())
-
-
-def find_prebuilt_asset(release: dict) -> tuple[str, str, str]:
-    """Return (tag_name, asset_name, download_url) for the prebuilt zip."""
-    tag = release.get("tag_name", "")
-    for asset in release.get("assets", []):
-        name = asset.get("name", "")
-        if name.startswith("remoteterm-prebuilt-frontend-") and name.endswith(".zip"):
-            return tag, name, asset["browser_download_url"]
-    raise SystemExit(
-        f"No prebuilt frontend artifact found in the latest release.\n"
-        f"Check https://github.com/{REPO}/releases for available assets."
-    )
-
-
-def download(url: str, dest: Path) -> None:
-    with urllib.request.urlopen(url) as resp, open(dest, "wb") as f:
-        shutil.copyfileobj(resp, f)
-
-
-def extract_prebuilt(zip_path: Path, dest: Path) -> int:
-    with zipfile.ZipFile(zip_path) as zf:
-        members = [m for m in zf.namelist() if m.startswith(PREBUILT_PREFIX)]
-        if not members:
-            raise SystemExit(f"'{PREBUILT_PREFIX}' not found inside zip.")
-
-        if dest.exists():
-            shutil.rmtree(dest)
-        dest.mkdir(parents=True)
-
-        for member in members:
-            rel = member[len(PREBUILT_PREFIX):]
-            if not rel:
-                continue
-            target = dest / rel
-            if member.endswith("/"):
-                target.mkdir(parents=True, exist_ok=True)
-            else:
-                target.parent.mkdir(parents=True, exist_ok=True)
-                with zf.open(member) as src, open(target, "wb") as dst:
-                    shutil.copyfileobj(src, dst)
-
-    return len(members)
-
-
-def main() -> None:
-    print("Fetching latest release info...")
-    release = fetch_json(API_URL)
-    tag, asset_name, download_url = find_prebuilt_asset(release)
-    print(f"  Release : {tag}")
-    print(f"  Asset   : {asset_name}")
-    print()
-
-    zip_path = PREBUILT_DIR.parent / asset_name
-    try:
-        print(f"Downloading {asset_name}...")
-        download(download_url, zip_path)
-
-        print("Extracting prebuilt frontend...")
-        count = extract_prebuilt(zip_path, PREBUILT_DIR)
-        print(f"Extracted {count} entries.")
-    finally:
-        zip_path.unlink(missing_ok=True)
-
-    print()
-    print(f"Done! Prebuilt frontend ({tag}) installed to frontend/prebuilt/")
-    print("Start the server with:")
-    print("  uv run uvicorn app.main:app --host 0.0.0.0 --port 8000")
-
-
-if __name__ == "__main__":
-    try:
-        main()
-    except KeyboardInterrupt:
-        print("\nAborted.", file=sys.stderr)
-        sys.exit(1)
--- a/scripts/install_service.sh
+++ b/scripts/install_service.sh
@@ -1,413 +0,0 @@
-#!/usr/bin/env bash
-# install_service.sh
-#
-# Sets up RemoteTerm for MeshCore as a persistent systemd service running as
-# the current user from the current repo directory. No separate service account
-# is needed. After installation, git pull and rebuilds work without any sudo -u
-# gymnastics.
-#
-# Run from anywhere inside the repo:
-#   bash scripts/install_service.sh
-
-set -e
-
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-CYAN='\033[0;36m'
-BOLD='\033[1m'
-NC='\033[0m'
-
-SERVICE_NAME="remoteterm"
-REPO_DIR="$(cd "$(dirname "$0")/.." && pwd)"
-CURRENT_USER="$(id -un)"
-SERVICE_FILE="/etc/systemd/system/${SERVICE_NAME}.service"
-FRONTEND_MODE="build"
-
-echo -e "${BOLD}=== RemoteTerm for MeshCore — Service Installer ===${NC}"
-echo
-
-# ── sanity checks ──────────────────────────────────────────────────────────────
-
-if [ "$(uname -s)" != "Linux" ]; then
-    echo -e "${RED}Error: this script is for Linux (systemd) only.${NC}"
-    exit 1
-fi
-
-if ! command -v systemctl &>/dev/null; then
-    echo -e "${RED}Error: systemd not found. This script requires a systemd-based Linux system.${NC}"
-    exit 1
-fi
-
-if ! command -v uv &>/dev/null; then
-    echo -e "${RED}Error: 'uv' not found. Install it first:${NC}"
-    echo    "  curl -LsSf https://astral.sh/uv/install.sh | sh"
-    exit 1
-fi
-
-if ! command -v python3 &>/dev/null; then
-    echo -e "${RED}Error: python3 is required but was not found.${NC}"
-    exit 1
-fi
-
-UV_BIN="$(command -v uv)"
-UVICORN_BIN="$REPO_DIR/.venv/bin/uvicorn"
-
-echo -e "  Installing as user : ${CYAN}${CURRENT_USER}${NC}"
-echo -e "  Repo directory     : ${CYAN}${REPO_DIR}${NC}"
-echo -e "  Service name       : ${CYAN}${SERVICE_NAME}${NC}"
-echo -e "  uv                 : ${CYAN}${UV_BIN}${NC}"
-echo
-
-version_major() {
-    local version="$1"
-    version="${version#v}"
-    printf '%s' "${version%%.*}"
-}
-
-require_minimum_version() {
-    local tool_name="$1"
-    local detected_version="$2"
-    local minimum_major="$3"
-    local major
-    major="$(version_major "$detected_version")"
-    if ! [[ "$major" =~ ^[0-9]+$ ]] || [ "$major" -lt "$minimum_major" ]; then
-        echo -e "${RED}Error: ${tool_name} ${minimum_major}+ is required for a local frontend build, but found ${detected_version}.${NC}"
-        exit 1
-    fi
-}
-
-# ── transport selection ────────────────────────────────────────────────────────
-
-echo -e "${BOLD}─── Transport ───────────────────────────────────────────────────────${NC}"
-echo "How is your MeshCore radio connected?"
-echo "  1) Serial — auto-detect port (default)"
-echo "  2) Serial — specify port manually"
-echo "  3) TCP (network connection)"
-echo "  4) BLE (Bluetooth)"
-echo
-read -rp "Select transport [1-4] (default: 1): " TRANSPORT_CHOICE
-TRANSPORT_CHOICE="${TRANSPORT_CHOICE:-1}"
-echo
-
-NEED_DIALOUT=false
-SERIAL_PORT=""
-TCP_HOST=""
-TCP_PORT=""
-BLE_ADDRESS=""
-BLE_PIN=""
-
-case "$TRANSPORT_CHOICE" in
-    1)
-        echo -e "${GREEN}Serial auto-detect selected.${NC}"
-        NEED_DIALOUT=true
-        ;;
-    2)
-        read -rp "Serial port path (default: /dev/ttyUSB0): " SERIAL_PORT
-        SERIAL_PORT="${SERIAL_PORT:-/dev/ttyUSB0}"
-        echo -e "${GREEN}Serial port: ${SERIAL_PORT}${NC}"
-        NEED_DIALOUT=true
-        ;;
-    3)
-        read -rp "TCP host (IP address or hostname): " TCP_HOST
-        while [ -z "$TCP_HOST" ]; do
-            echo -e "${RED}TCP host is required.${NC}"
-            read -rp "TCP host: " TCP_HOST
-        done
-        read -rp "TCP port (default: 4000): " TCP_PORT
-        TCP_PORT="${TCP_PORT:-4000}"
-        echo -e "${GREEN}TCP: ${TCP_HOST}:${TCP_PORT}${NC}"
-        ;;
-    4)
-        read -rp "BLE device address (e.g. AA:BB:CC:DD:EE:FF): " BLE_ADDRESS
-        while [ -z "$BLE_ADDRESS" ]; do
-            echo -e "${RED}BLE address is required.${NC}"
-            read -rp "BLE device address: " BLE_ADDRESS
-        done
-        read -rsp "BLE PIN: " BLE_PIN
-        echo
-        while [ -z "$BLE_PIN" ]; do
-            echo -e "${RED}BLE PIN is required.${NC}"
-            read -rsp "BLE PIN: " BLE_PIN
-            echo
-        done
-        echo -e "${GREEN}BLE: ${BLE_ADDRESS}${NC}"
-        ;;
-    *)
-        echo -e "${YELLOW}Invalid selection — defaulting to serial auto-detect.${NC}"
-        TRANSPORT_CHOICE=1
-        NEED_DIALOUT=true
-        ;;
-esac
-echo
-
-# ── frontend install mode ──────────────────────────────────────────────────────
-
-echo -e "${BOLD}─── Frontend Assets ─────────────────────────────────────────────────${NC}"
-echo "How should the frontend be installed?"
-echo "  1) Build locally with npm (default, latest code, requires node/npm)"
-echo "  2) Download prebuilt frontend (fastest)"
-echo
-read -rp "Select frontend mode [1-2] (default: 1): " FRONTEND_CHOICE
-FRONTEND_CHOICE="${FRONTEND_CHOICE:-1}"
-echo
-
-case "$FRONTEND_CHOICE" in
-    1)
-        FRONTEND_MODE="build"
-        echo -e "${GREEN}Using local frontend build.${NC}"
-        ;;
-    2)
-        FRONTEND_MODE="prebuilt"
-        echo -e "${GREEN}Using prebuilt frontend download.${NC}"
-        ;;
-    *)
-        FRONTEND_MODE="build"
-        echo -e "${YELLOW}Invalid selection — defaulting to local frontend build.${NC}"
-        ;;
-esac
-echo
-
-# ── bots ──────────────────────────────────────────────────────────────────────
-
-echo -e "${BOLD}─── Bot System ──────────────────────────────────────────────────────${NC}"
-echo -e "${YELLOW}Warning:${NC} The bot system executes arbitrary Python code on the server."
-echo    "It is not recommended on untrusted networks. You can always enable"
-echo    "it later by editing the service file."
-echo
-read -rp "Enable bots? [y/N]: " ENABLE_BOTS
-ENABLE_BOTS="${ENABLE_BOTS:-N}"
-echo
-
-ENABLE_AUTH="N"
-AUTH_USERNAME=""
-AUTH_PASSWORD=""
-
-if [[ "$ENABLE_BOTS" =~ ^[Yy] ]]; then
-    echo -e "${GREEN}Bots enabled.${NC}"
-    echo
-
-    echo -e "${BOLD}─── HTTP Basic Auth ─────────────────────────────────────────────────${NC}"
-    echo "With bots enabled, HTTP Basic Auth is strongly recommended if this"
-    echo "service will be accessible beyond your local machine."
-    echo
-    read -rp "Set up HTTP Basic Auth? [Y/n]: " ENABLE_AUTH
-    ENABLE_AUTH="${ENABLE_AUTH:-Y}"
-    echo
-
-    if [[ "$ENABLE_AUTH" =~ ^[Yy] ]]; then
-        read -rp "Username: " AUTH_USERNAME
-        while [ -z "$AUTH_USERNAME" ]; do
-            echo -e "${RED}Username cannot be empty.${NC}"
-            read -rp "Username: " AUTH_USERNAME
-        done
-        read -rsp "Password: " AUTH_PASSWORD
-        echo
-        while [ -z "$AUTH_PASSWORD" ]; do
-            echo -e "${RED}Password cannot be empty.${NC}"
-            read -rsp "Password: " AUTH_PASSWORD
-            echo
-        done
-        echo -e "${GREEN}Basic Auth configured for user '${AUTH_USERNAME}'.${NC}"
-        echo -e "${YELLOW}Note:${NC} Basic Auth credentials are not safe over plain HTTP."
-        echo    "See README_ADVANCED.md for HTTPS setup."
-    fi
-else
-    echo -e "${GREEN}Bots disabled.${NC}"
-fi
-echo
-
-# ── python dependencies ────────────────────────────────────────────────────────
-
-echo -e "${YELLOW}Installing Python dependencies (uv sync)...${NC}"
-cd "$REPO_DIR"
-uv sync
-echo -e "${GREEN}Dependencies ready.${NC}"
-echo
-
-# ── frontend assets ────────────────────────────────────────────────────────────
-
-if [ "$FRONTEND_MODE" = "build" ]; then
-    if ! command -v node &>/dev/null; then
-        echo -e "${RED}Error: node is required for a local frontend build but was not found.${NC}"
-        echo -e "${YELLOW}Tip:${NC} Re-run the installer and choose the prebuilt frontend option, or install Node.js 18+ and npm 9+."
-        exit 1
-    fi
-    if ! command -v npm &>/dev/null; then
-        echo -e "${RED}Error: npm is required for a local frontend build but was not found.${NC}"
-        echo -e "${YELLOW}Tip:${NC} Re-run the installer and choose the prebuilt frontend option, or install Node.js 18+ and npm 9+."
-        exit 1
-    fi
-
-    NODE_VERSION="$(node -v)"
-    NPM_VERSION="$(npm -v)"
-    require_minimum_version "Node.js" "$NODE_VERSION" 18
-    require_minimum_version "npm" "$NPM_VERSION" 9
-
-    echo -e "${YELLOW}Building frontend locally with Node ${NODE_VERSION} and npm ${NPM_VERSION}...${NC}"
-    (
-        cd "$REPO_DIR/frontend"
-        npm install
-        npm run build
-    )
-else
-    echo -e "${YELLOW}Fetching prebuilt frontend...${NC}"
-    python3 "$REPO_DIR/scripts/fetch_prebuilt_frontend.py"
-fi
-echo
-
-# ── data directory ─────────────────────────────────────────────────────────────
-
-mkdir -p "$REPO_DIR/data"
-
-# ── serial port access ─────────────────────────────────────────────────────────
-
-if [ "$NEED_DIALOUT" = true ]; then
-    if ! id -nG "$CURRENT_USER" | grep -qw dialout; then
-        echo -e "${YELLOW}Adding ${CURRENT_USER} to the 'dialout' group for serial port access...${NC}"
-        sudo usermod -aG dialout "$CURRENT_USER"
-        echo -e "${GREEN}Done. You may need to log out and back in for this to take effect for${NC}"
-        echo -e "${GREEN}manual runs; the service itself handles it via SupplementaryGroups.${NC}"
-        echo
-    else
-        echo -e "${GREEN}User ${CURRENT_USER} is already in the 'dialout' group.${NC}"
-        echo
-    fi
-fi
-
-# ── systemd service file ───────────────────────────────────────────────────────
-
-if sudo systemctl is-active --quiet "$SERVICE_NAME"; then
-    echo -e "${YELLOW}${SERVICE_NAME} is currently running; stopping it before applying changes...${NC}"
-    sudo systemctl stop "$SERVICE_NAME"
-    echo
-fi
-
-echo -e "${YELLOW}Writing systemd service file to ${SERVICE_FILE}...${NC}"
-
-generate_service_file() {
-    echo "[Unit]"
-    echo "Description=RemoteTerm for MeshCore"
-    echo "After=network.target"
-    echo ""
-    echo "[Service]"
-    echo "Type=simple"
-    echo "User=${CURRENT_USER}"
-    echo "WorkingDirectory=${REPO_DIR}"
-    echo "ExecStart=${UVICORN_BIN} app.main:app --host 0.0.0.0 --port 8000"
-    echo "Restart=always"
-    echo "RestartSec=5"
-    echo "Environment=MESHCORE_DATABASE_PATH=${REPO_DIR}/data/meshcore.db"
-
-    # Transport
-    case "$TRANSPORT_CHOICE" in
-        2) echo "Environment=MESHCORE_SERIAL_PORT=${SERIAL_PORT}" ;;
-        3)
-            echo "Environment=MESHCORE_TCP_HOST=${TCP_HOST}"
-            echo "Environment=MESHCORE_TCP_PORT=${TCP_PORT}"
-            ;;
-        4)
-            echo "Environment=MESHCORE_BLE_ADDRESS=${BLE_ADDRESS}"
-            echo "Environment=MESHCORE_BLE_PIN=${BLE_PIN}"
-            ;;
-    esac
-
-    # Bots
-    if [[ ! "$ENABLE_BOTS" =~ ^[Yy] ]]; then
-        echo "Environment=MESHCORE_DISABLE_BOTS=true"
-    fi
-
-    # Basic auth
-    if [[ "$ENABLE_BOTS" =~ ^[Yy] ]] && [[ "$ENABLE_AUTH" =~ ^[Yy] ]]; then
-        echo "Environment=MESHCORE_BASIC_AUTH_USERNAME=${AUTH_USERNAME}"
-        echo "Environment=MESHCORE_BASIC_AUTH_PASSWORD=${AUTH_PASSWORD}"
-    fi
-
-    # Serial group access
-    if [ "$NEED_DIALOUT" = true ]; then
-        echo "SupplementaryGroups=dialout"
-    fi
-
-    echo ""
-    echo "[Install]"
-    echo "WantedBy=multi-user.target"
-}
-
-generate_service_file | sudo tee "$SERVICE_FILE" > /dev/null
-
-echo -e "${GREEN}Service file written.${NC}"
-echo
-
-# ── enable and start ───────────────────────────────────────────────────────────
-
-echo -e "${YELLOW}Reloading systemd and applying ${SERVICE_NAME}...${NC}"
-sudo systemctl daemon-reload
-sudo systemctl enable "$SERVICE_NAME"
-sudo systemctl start "$SERVICE_NAME"
-echo
-
-# ── status check ───────────────────────────────────────────────────────────────
-
-echo -e "${YELLOW}Service status:${NC}"
-sudo systemctl status "$SERVICE_NAME" --no-pager -l || true
-echo
-
-# ── summary ────────────────────────────────────────────────────────────────────
-
-echo -e "${GREEN}${BOLD}=== Installation complete! ===${NC}"
-echo
-echo -e "RemoteTerm is running at ${CYAN}http://$(hostname -I | awk '{print $1}'):8000${NC}"
-echo
-
-case "$TRANSPORT_CHOICE" in
-    1) echo -e "  Transport : ${CYAN}Serial (auto-detect)${NC}" ;;
-    2) echo -e "  Transport : ${CYAN}Serial (${SERIAL_PORT})${NC}" ;;
-    3) echo -e "  Transport : ${CYAN}TCP (${TCP_HOST}:${TCP_PORT})${NC}" ;;
-    4) echo -e "  Transport : ${CYAN}BLE (${BLE_ADDRESS})${NC}" ;;
-esac
-if [ "$FRONTEND_MODE" = "build" ]; then
-    echo -e "  Frontend  : ${GREEN}Built locally${NC}"
-else
-    echo -e "  Frontend  : ${YELLOW}Prebuilt download${NC}"
-fi
-
-if [[ "$ENABLE_BOTS" =~ ^[Yy] ]]; then
-    echo -e "  Bots      : ${YELLOW}Enabled${NC}"
-    if [[ "$ENABLE_AUTH" =~ ^[Yy] ]]; then
-        echo -e "  Basic Auth: ${GREEN}Enabled (user: ${AUTH_USERNAME})${NC}"
-    else
-        echo -e "  Basic Auth: ${YELLOW}Not configured${NC}"
-    fi
-else
-    echo -e "  Bots      : ${GREEN}Disabled${NC} (edit ${SERVICE_FILE} to enable)"
-fi
-echo
-
-if [ "$FRONTEND_MODE" = "prebuilt" ]; then
-    echo -e "${YELLOW}Note:${NC} A prebuilt frontend has been fetched and installed. It may lag"
-    echo    "behind the latest code. To build the frontend from source for the most"
-    echo    "up-to-date features later, run:"
-    echo
-    echo -e "  ${CYAN}cd ${REPO_DIR}/frontend && npm install && npm run build${NC}"
-    echo
-fi
-
-echo -e "${BOLD}─── Quick Reference ─────────────────────────────────────────────────${NC}"
-echo
-echo -e "${YELLOW}Update to latest and restart:${NC}"
-echo -e "  cd ${REPO_DIR}"
-echo -e "  git pull"
-echo -e "  uv sync"
-echo -e "  cd frontend && npm install && npm run build && cd .."
-echo -e "  sudo systemctl restart ${SERVICE_NAME}"
-echo
-echo -e "${YELLOW}Refresh prebuilt frontend only (skips local build):${NC}"
-echo -e "  python3 ${REPO_DIR}/scripts/fetch_prebuilt_frontend.py"
-echo -e "  sudo systemctl restart ${SERVICE_NAME}"
-echo
-echo -e "${YELLOW}View live logs (useful for troubleshooting):${NC}"
-echo -e "  sudo journalctl -u ${SERVICE_NAME} -f"
-echo
-echo -e "${YELLOW}Service control:${NC}"
-echo -e "  sudo systemctl start|stop|restart|status ${SERVICE_NAME}"
-echo -e "${BOLD}─────────────────────────────────────────────────────────────────────${NC}"
--- a/tests/e2e/playwright.config.ts
+++ b/tests/e2e/playwright.config.ts
@@ -25,16 +25,6 @@ export default defineConfig({
    baseURL: 'http://localhost:8001',
    trace: 'on-first-retry',
    screenshot: 'only-on-failure',
-    // Dismiss the security warning modal that blocks interaction on fresh browser contexts
-    storageState: {
-      cookies: [],
-      origins: [
-        {
-          origin: 'http://localhost:8001',
-          localStorage: [{ name: 'meshcore_security_warning_acknowledged', value: 'true' }],
-        },
-      ],
-    },
  },

  projects: [
--- a/tests/e2e/specs/bot.spec.ts
+++ b/tests/e2e/specs/bot.spec.ts
@@ -40,7 +40,7 @@ test.describe('Bot functionality', () => {

    await page.locator('#fanout-edit-name').fill('E2E Test Bot');

-    const codeEditor = page.locator('[aria-label="Bot code editor"] [contenteditable]');
+    const codeEditor = page.getByLabel('Bot code editor');
    await codeEditor.click();
    await codeEditor.press(process.platform === 'darwin' ? 'Meta+A' : 'Control+A');
    await codeEditor.fill(BOT_CODE);
--- a/tests/test_community_mqtt.py
+++ b/tests/test_community_mqtt.py
@@ -19,6 +19,7 @@ from app.fanout.community_mqtt import (
    _build_status_topic,
    _calculate_packet_hash,
    _decode_packet_fields,
+    _ed25519_sign_expanded,
    _format_raw_packet,
    _generate_jwt_token,
    _get_client_version,
@@ -28,7 +29,6 @@ from app.fanout.mqtt_community import (
    _publish_community_packet,
    _render_packet_topic,
 )
-from app.keystore import ed25519_sign_expanded


 def _make_test_keys() -> tuple[bytes, bytes]:
@@ -173,13 +173,13 @@ class TestEddsaSignExpanded:
    def test_produces_64_byte_signature(self):
        private_key, public_key = _make_test_keys()
        message = b"test message"
-        sig = ed25519_sign_expanded(message, private_key[:32], private_key[32:], public_key)
+        sig = _ed25519_sign_expanded(message, private_key[:32], private_key[32:], public_key)
        assert len(sig) == 64

    def test_signature_verifies_with_nacl(self):
        private_key, public_key = _make_test_keys()
        message = b"hello world"
-        sig = ed25519_sign_expanded(message, private_key[:32], private_key[32:], public_key)
+        sig = _ed25519_sign_expanded(message, private_key[:32], private_key[32:], public_key)

        signed_message = sig + message
        verified = nacl.bindings.crypto_sign_open(signed_message, public_key)
@@ -187,8 +187,8 @@ class TestEddsaSignExpanded:

    def test_different_messages_produce_different_signatures(self):
        private_key, public_key = _make_test_keys()
-        sig1 = ed25519_sign_expanded(b"msg1", private_key[:32], private_key[32:], public_key)
-        sig2 = ed25519_sign_expanded(b"msg2", private_key[:32], private_key[32:], public_key)
+        sig1 = _ed25519_sign_expanded(b"msg1", private_key[:32], private_key[32:], public_key)
+        sig2 = _ed25519_sign_expanded(b"msg2", private_key[:32], private_key[32:], public_key)
        assert sig1 != sig2


--- a/tests/test_fanout.py
+++ b/tests/test_fanout.py
@@ -707,98 +707,6 @@ class TestSqsValidation:
            {"queue_url": "https://sqs.us-east-1.amazonaws.com/123456789012/mesh-events"}
        )

-
-class TestMapUploadValidation:
-    def test_rejects_bad_api_url_scheme(self):
-        from fastapi import HTTPException
-
-        from app.routers.fanout import _validate_map_upload_config
-
-        with pytest.raises(HTTPException) as exc_info:
-            _validate_map_upload_config({"api_url": "ftp://example.com"})
-        assert exc_info.value.status_code == 400
-        assert "api_url" in exc_info.value.detail
-
-    def test_accepts_empty_api_url(self):
-        from app.routers.fanout import _validate_map_upload_config
-
-        config = {"api_url": ""}
-        _validate_map_upload_config(config)
-        assert config["api_url"] == ""
-
-    def test_accepts_valid_api_url(self):
-        from app.routers.fanout import _validate_map_upload_config
-
-        config = {"api_url": "https://custom.example.com/upload"}
-        _validate_map_upload_config(config)
-        assert config["api_url"] == "https://custom.example.com/upload"
-
-    def test_normalizes_dry_run_to_bool(self):
-        from app.routers.fanout import _validate_map_upload_config
-
-        config = {"dry_run": 1}
-        _validate_map_upload_config(config)
-        assert config["dry_run"] is True
-
-    def test_normalizes_geofence_enabled_to_bool(self):
-        from app.routers.fanout import _validate_map_upload_config
-
-        config = {"geofence_enabled": 1}
-        _validate_map_upload_config(config)
-        assert config["geofence_enabled"] is True
-
-    def test_normalizes_geofence_radius_to_float(self):
-        from app.routers.fanout import _validate_map_upload_config
-
-        config = {"geofence_radius_km": 100}
-        _validate_map_upload_config(config)
-        assert config["geofence_radius_km"] == 100.0
-        assert isinstance(config["geofence_radius_km"], float)
-
-    def test_rejects_negative_geofence_radius(self):
-        from fastapi import HTTPException
-
-        from app.routers.fanout import _validate_map_upload_config
-
-        with pytest.raises(HTTPException) as exc_info:
-            _validate_map_upload_config({"geofence_radius_km": -1})
-        assert exc_info.value.status_code == 400
-        assert "geofence_radius_km" in exc_info.value.detail
-
-    def test_rejects_non_numeric_geofence_radius(self):
-        from fastapi import HTTPException
-
-        from app.routers.fanout import _validate_map_upload_config
-
-        with pytest.raises(HTTPException) as exc_info:
-            _validate_map_upload_config({"geofence_radius_km": "bad"})
-        assert exc_info.value.status_code == 400
-        assert "geofence_radius_km" in exc_info.value.detail
-
-    def test_accepts_zero_geofence_radius(self):
-        from app.routers.fanout import _validate_map_upload_config
-
-        config = {"geofence_radius_km": 0}
-        _validate_map_upload_config(config)
-        assert config["geofence_radius_km"] == 0.0
-
-    def test_defaults_applied_when_keys_absent(self):
-        from app.routers.fanout import _validate_map_upload_config
-
-        config = {}
-        _validate_map_upload_config(config)
-        assert config["api_url"] == ""
-        assert config["dry_run"] is True
-        assert config["geofence_enabled"] is False
-        assert config["geofence_radius_km"] == 0.0
-
-    def test_enforce_scope_map_upload_forces_raw_only(self):
-        """map_upload scope is always fixed regardless of what the caller passes."""
-        from app.routers.fanout import _enforce_scope
-
-        scope = _enforce_scope("map_upload", {"messages": "all", "raw_packets": "none"})
-        assert scope == {"messages": "none", "raw_packets": "all"}
-
    def test_enforce_scope_sqs_preserves_raw_packets_setting(self):
        from app.routers.fanout import _enforce_scope

--- a/tests/test_fanout_integration.py
+++ b/tests/test_fanout_integration.py
@@ -1790,100 +1790,3 @@ class TestManagerRestartFailure:

        assert len(healthy.messages_received) == 1
        assert len(dead.messages_received) == 0
-
-
-# ---------------------------------------------------------------------------
-# MapUploadModule integration tests
-# ---------------------------------------------------------------------------
-
-
-class TestMapUploadIntegration:
-    """Integration tests: FanoutManager loads and dispatches to MapUploadModule."""
-
-    @pytest.mark.asyncio
-    async def test_map_upload_module_loaded_and_receives_raw(self, integration_db):
-        """Enabled map_upload config is loaded by the manager and its on_raw is called."""
-        from unittest.mock import AsyncMock, patch
-
-        cfg = await FanoutConfigRepository.create(
-            config_type="map_upload",
-            name="Map",
-            config={"dry_run": True, "api_url": ""},
-            scope={"messages": "none", "raw_packets": "all"},
-            enabled=True,
-        )
-
-        manager = FanoutManager()
-        await manager.load_from_db()
-
-        assert cfg["id"] in manager._modules
-        module, scope = manager._modules[cfg["id"]]
-        assert scope == {"messages": "none", "raw_packets": "all"}
-
-        # Raw ADVERT event should be dispatched to on_raw
-        advert_data = {
-            "payload_type": "ADVERT",
-            "data": "aabbccdd",
-            "timestamp": 1000,
-            "id": 1,
-            "observation_id": 1,
-        }
-
-        with patch.object(module, "_upload", new_callable=AsyncMock):
-            # Provide a parseable but minimal packet so on_raw gets past hex decode;
-            # parse_packet/parse_advertisement returning None is fine — on_raw silently exits
-            await manager.broadcast_raw(advert_data)
-            # Give the asyncio task a chance to run
-            import asyncio
-
-            await asyncio.sleep(0.05)
-            # _upload may or may not be called depending on parse result, but no exception
-
-        await manager.stop_all()
-
-    @pytest.mark.asyncio
-    async def test_map_upload_disabled_not_loaded(self, integration_db):
-        """Disabled map_upload config is not loaded by the manager."""
-        await FanoutConfigRepository.create(
-            config_type="map_upload",
-            name="Map Disabled",
-            config={"dry_run": True, "api_url": ""},
-            scope={"messages": "none", "raw_packets": "all"},
-            enabled=False,
-        )
-
-        manager = FanoutManager()
-        await manager.load_from_db()
-
-        assert len(manager._modules) == 0
-        await manager.stop_all()
-
-    @pytest.mark.asyncio
-    async def test_map_upload_does_not_receive_messages(self, integration_db):
-        """map_upload scope forces raw_packets only — message events must not reach it."""
-        from unittest.mock import AsyncMock, patch
-
-        cfg = await FanoutConfigRepository.create(
-            config_type="map_upload",
-            name="Map",
-            config={"dry_run": True, "api_url": ""},
-            scope={"messages": "none", "raw_packets": "all"},
-            enabled=True,
-        )
-
-        manager = FanoutManager()
-        await manager.load_from_db()
-
-        assert cfg["id"] in manager._modules
-        module, _ = manager._modules[cfg["id"]]
-
-        with patch.object(module, "on_message", new_callable=AsyncMock) as mock_msg:
-            await manager.broadcast_message(
-                {"type": "CHAN", "conversation_key": "k1", "text": "hi"}
-            )
-            import asyncio
-
-            await asyncio.sleep(0.05)
-            mock_msg.assert_not_called()
-
-        await manager.stop_all()
--- a/tests/test_map_upload.py
+++ b/tests/test_map_upload.py
--- a/uv.lock
+++ b/uv.lock
@@ -1098,7 +1098,7 @@ wheels = [

 [[package]]
 name = "remoteterm-meshcore"
-version = "3.6.1"
+version = "3.6.0"
 source = { virtual = "." }
 dependencies = [
    { name = "aiomqtt" },