matrix: cover missing unit test vectors

matrix: fix tests
matrix: add docker env boilerplate
2026-05-07 05:44:50 +02:00 · 2026-01-06 18:05:23 +01:00 · 2026-01-06 17:56:20 +01:00 · 2026-01-06 17:54:50 +01:00
71 changed files with 1146 additions and 6843 deletions
@@ -1,44 +1,5 @@
 # CHANGELOG

-## v0.5.9
-
-* Matrix: listen for synapse on port 41448 by @l5yth in <https://github.com/l5yth/potato-mesh/pull/607>
-* Web: collapse federation map ledgend by @l5yth in <https://github.com/l5yth/potato-mesh/pull/604>
-* Web: fix stale node queries by @l5yth in <https://github.com/l5yth/potato-mesh/pull/603>
-* Matrix: move short name to display name by @l5yth in <https://github.com/l5yth/potato-mesh/pull/602>
-* Ci: update ruby to 4 by @l5yth in <https://github.com/l5yth/potato-mesh/pull/601>
-* Web: display traces of last 28 days if available by @l5yth in <https://github.com/l5yth/potato-mesh/pull/599>
-* Web: establish menu structure by @l5yth in <https://github.com/l5yth/potato-mesh/pull/597>
-* Matrix: fixed the text-message checkpoint regression by @l5yth in <https://github.com/l5yth/potato-mesh/pull/595>
-* Matrix: cache seen messages by rx_time not id by @l5yth in <https://github.com/l5yth/potato-mesh/pull/594>
-* Web: hide the default '0' tab when not active by @l5yth in <https://github.com/l5yth/potato-mesh/pull/593>
-* Matrix: fix empty bridge state json by @l5yth in <https://github.com/l5yth/potato-mesh/pull/592>
-* Web: allow certain charts to overflow upper bounds by @l5yth in <https://github.com/l5yth/potato-mesh/pull/585>
-* Ingestor: support ROUTING_APP messages by @l5yth in <https://github.com/l5yth/potato-mesh/pull/584>
-* Ci: run nix flake check on ci by @l5yth in <https://github.com/l5yth/potato-mesh/pull/583>
-* Web: hide legend by default by @l5yth in <https://github.com/l5yth/potato-mesh/pull/582>
-* Nix flake by @benjajaja in <https://github.com/l5yth/potato-mesh/pull/577>
-* Support BLE UUID format for macOS Bluetooth devices by @apo-mak in <https://github.com/l5yth/potato-mesh/pull/575>
-* Web: add mesh.qrp.ro as seed node by @l5yth in <https://github.com/l5yth/potato-mesh/pull/573>
-* Web: ensure unknown nodes for messages and traces by @l5yth in <https://github.com/l5yth/potato-mesh/pull/572>
-* Chore: bump version to 0.5.9 by @l5yth in <https://github.com/l5yth/potato-mesh/pull/569>
-
-## v0.5.8
-
-* Web: add secondary seed node jmrp.io by @l5yth in <https://github.com/l5yth/potato-mesh/pull/568>
-* Data: implement whitelist for ingestor by @l5yth in <https://github.com/l5yth/potato-mesh/pull/567>
-* Web: add ?since= parameter to all apis by @l5yth in <https://github.com/l5yth/potato-mesh/pull/566>
-* Matrix: fix docker build by @l5yth in <https://github.com/l5yth/potato-mesh/pull/565>
-* Matrix: fix docker build by @l5yth in <https://github.com/l5yth/potato-mesh/pull/564>
-* Web: fix federation signature validation and create fallback by @l5yth in <https://github.com/l5yth/potato-mesh/pull/563>
-* Chore: update readme by @l5yth in <https://github.com/l5yth/potato-mesh/pull/561>
-* Matrix: add docker file for bridge by @l5yth in <https://github.com/l5yth/potato-mesh/pull/556>
-* Matrix: add health checks to startup by @l5yth in <https://github.com/l5yth/potato-mesh/pull/555>
-* Matrix: omit the api part in base url by @l5yth in <https://github.com/l5yth/potato-mesh/pull/554>
-* App: add utility coverage tests for main.dart by @l5yth in <https://github.com/l5yth/potato-mesh/pull/552>
-* Data: add thorough daemon unit tests by @l5yth in <https://github.com/l5yth/potato-mesh/pull/553>
-* Chore: bump version to 0.5.8 by @l5yth in <https://github.com/l5yth/potato-mesh/pull/551>
-
 ## v0.5.7

 * Data: track ingestors heartbeat by @l5yth in <https://github.com/l5yth/potato-mesh/pull/549>
@@ -88,7 +88,6 @@ The web app can be configured with environment variables (defaults shown):
 | `CHANNEL` | `"#LongFast"` | Default channel name displayed in the UI. |
 | `FREQUENCY` | `"915MHz"` | Default frequency description displayed in the UI. |
 | `CONTACT_LINK` | `"#potatomesh:dod.ngo"` | Chat link or Matrix alias rendered in the footer and overlays. |
-| `ANNOUNCEMENT` | _unset_ | Optional announcement banner text rendered above the header on every page. |
 | `MAP_CENTER` | `38.761944,-27.090833` | Latitude and longitude that centre the map on load. |
 | `MAP_ZOOM` | _unset_ | Fixed Leaflet zoom applied on first load; disables auto-fit when provided. |
 | `MAX_DISTANCE` | `42` | Maximum distance (km) before node relationships are hidden on the map. |
@@ -271,8 +270,6 @@ A matrix bridge is currently being worked on. It requests messages from a config
 potato-mesh instance and forwards it to a specified matrix channel; see
 [matrix/README.md](./matrix/README.md).

-![matrix bridge](./scrot-0.6.png)
-
 ## Mobile App

 A mobile _reader_ app is currently being worked on. Stay tuned for releases and updates.
@@ -1,18 +1,3 @@
-/*
- * Copyright © 2025-26 l5yth & contributors
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
 plugins {
    id("com.android.application")
    id("kotlin-android")
@@ -1,16 +1,3 @@
-// Copyright © 2025-26 l5yth & contributors
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
 package net.potatomesh.reader

 import io.flutter.embedding.android.FlutterActivity
@@ -1,18 +1,3 @@
-/*
- * Copyright © 2025-26 l5yth & contributors
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
 allprojects {
    repositories {
        google()
@@ -1,18 +1,3 @@
-/*
- * Copyright © 2025-26 l5yth & contributors
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
 pluginManagement {
    val flutterSdkPath =
        run {
@@ -1,18 +1,5 @@
 #!/usr/bin/env bash

-# Copyright © 2025-26 l5yth & contributors
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
 export GIT_TAG="$(git describe --tags --abbrev=0)"
 export GIT_COMMITS="$(git rev-list --count ${GIT_TAG}..HEAD)"
 export GIT_SHA="$(git rev-parse --short=9 HEAD)"
@@ -25,3 +12,4 @@ flutter run \
  --dart-define=GIT_SHA="${GIT_SHA}" \
  --dart-define=GIT_DIRTY="${GIT_DIRTY}" \
  --device-id 38151FDJH00D4C
+
@@ -15,11 +15,11 @@
  <key>CFBundlePackageType</key>
  <string>FMWK</string>
  <key>CFBundleShortVersionString</key>
-  <string>0.5.10</string>
+  <string>0.5.9</string>
  <key>CFBundleSignature</key>
  <string>????</string>
  <key>CFBundleVersion</key>
-  <string>0.5.10</string>
+  <string>0.5.9</string>
  <key>MinimumOSVersion</key>
  <string>14.0</string>
 </dict>
@@ -1,16 +1,3 @@
-// Copyright © 2025-26 l5yth & contributors
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
 import Flutter
 import UIKit

@@ -1,14 +1 @@
-// Copyright © 2025-26 l5yth & contributors
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
 #import "GeneratedPluginRegistrant.h"
@@ -1,16 +1,3 @@
-// Copyright © 2025-26 l5yth & contributors
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
 import Flutter
 import UIKit
 import XCTest
@@ -1,7 +1,7 @@
 name: potato_mesh_reader
 description: Meshtastic Reader — read-only view for PotatoMesh messages.
 publish_to: "none"
-version: 0.5.10
+version: 0.5.9

 environment:
  sdk: ">=3.4.0 <4.0.0"
@@ -1,18 +1,5 @@
 #!/usr/bin/env bash

-# Copyright © 2025-26 l5yth & contributors
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
 set -euo pipefail

 export GIT_TAG="$(git describe --tags --abbrev=0)"
@@ -40,3 +27,4 @@ fi
 export APK_DIR="build/app/outputs/flutter-apk"
 mv -v "${APK_DIR}/app-release.apk" "${APK_DIR}/potatomesh-reader-android-${TAG_NAME}.apk"
 (cd "${APK_DIR}" && sha256sum "potatomesh-reader-android-${TAG_NAME}.apk" > "potatomesh-reader-android-${TAG_NAME}.apk.sha256sum")
+
@@ -1,16 +1,3 @@
-// Copyright © 2025-26 l5yth & contributors
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
 // This is a basic Flutter widget test.
 //
 // To perform an interaction with a widget in your test, use the WidgetTester
@@ -18,7 +18,7 @@ The ``data.mesh`` module exposes helpers for reading Meshtastic node and
 message information before forwarding it to the accompanying web application.
 """

-VERSION = "0.5.10"
+VERSION = "0.5.9"
 """Semantic version identifier shared with the dashboard and front-end."""

 __version__ = VERSION
@@ -1,86 +0,0 @@
-# Copyright © 2025-26 l5yth & contributors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-"""Decode Meshtastic protobuf payloads from stdin JSON."""
-
-from __future__ import annotations
-
-import base64
-import json
-import os
-import sys
-from typing import Any, Dict, Tuple
-
-SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
-if SCRIPT_DIR in sys.path:
-    sys.path.remove(SCRIPT_DIR)
-
-from google.protobuf.json_format import MessageToDict
-from meshtastic.protobuf import mesh_pb2, telemetry_pb2
-
-
-PORTNUM_MAP: Dict[int, Tuple[str, Any]] = {
-    3: ("POSITION_APP", mesh_pb2.Position),
-    4: ("NODEINFO_APP", mesh_pb2.NodeInfo),
-    5: ("ROUTING_APP", mesh_pb2.Routing),
-    67: ("TELEMETRY_APP", telemetry_pb2.Telemetry),
-    70: ("TRACEROUTE_APP", mesh_pb2.RouteDiscovery),
-    71: ("NEIGHBORINFO_APP", mesh_pb2.NeighborInfo),
-}
-
-
-def _decode_payload(portnum: int, payload_b64: str) -> dict[str, Any]:
-    if portnum not in PORTNUM_MAP:
-        return {"error": "unsupported-port", "portnum": portnum}
-    try:
-        payload_bytes = base64.b64decode(payload_b64, validate=True)
-    except Exception as exc:
-        return {"error": f"invalid-payload: {exc}"}
-
-    name, message_cls = PORTNUM_MAP[portnum]
-    msg = message_cls()
-    try:
-        msg.ParseFromString(payload_bytes)
-    except Exception as exc:
-        return {"error": f"decode-failed: {exc}", "portnum": portnum, "type": name}
-
-    decoded = MessageToDict(msg, preserving_proto_field_name=True)
-    return {"portnum": portnum, "type": name, "payload": decoded}
-
-
-def main() -> int:
-    raw = sys.stdin.read()
-    try:
-        request = json.loads(raw)
-    except json.JSONDecodeError as exc:
-        sys.stdout.write(json.dumps({"error": f"invalid-json: {exc}"}))
-        return 1
-
-    portnum = request.get("portnum")
-    payload_b64 = request.get("payload_b64")
-
-    if not isinstance(portnum, int):
-        sys.stdout.write(json.dumps({"error": "missing-portnum"}))
-        return 1
-    if not isinstance(payload_b64, str):
-        sys.stdout.write(json.dumps({"error": "missing-payload"}))
-        return 1
-
-    result = _decode_payload(portnum, payload_b64)
-    sys.stdout.write(json.dumps(result))
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -29,9 +29,7 @@ CREATE TABLE IF NOT EXISTS messages (
    modem_preset TEXT,
    channel_name TEXT,
    reply_id INTEGER,
-    emoji TEXT,
-    decrypted INTEGER NOT NULL DEFAULT 0,
-    decryption_confidence REAL
+    emoji TEXT
 );

 CREATE INDEX IF NOT EXISTS idx_messages_rx_time   ON messages(rx_time);
@@ -140,8 +140,6 @@ services:
      - potatomesh-network
    depends_on:
      - web-bridge
-    ports:
-      - "41448:41448"
    profiles:
      - bridge

@@ -77,84 +77,24 @@ dependencies = [
 "serde_json",
 ]

-[[package]]
-name = "async-trait"
-version = "0.1.89"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
 [[package]]
 name = "atomic-waker"
 version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"

-[[package]]
-name = "axum"
-version = "0.7.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edca88bc138befd0323b20752846e6587272d3b03b0343c8ea28a6f819e6e71f"
-dependencies = [
- "async-trait",
- "axum-core",
- "bytes",
- "futures-util",
- "http",
- "http-body",
- "http-body-util",
- "hyper",
- "hyper-util",
- "itoa",
- "matchit",
- "memchr",
- "mime",
- "percent-encoding",
- "pin-project-lite",
- "rustversion",
- "serde",
- "serde_json",
- "serde_path_to_error",
- "serde_urlencoded",
- "sync_wrapper",
- "tokio",
- "tower",
- "tower-layer",
- "tower-service",
- "tracing",
-]
-
-[[package]]
-name = "axum-core"
-version = "0.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09f2bd6146b97ae3359fa0cc6d6b376d9539582c7b4220f041a33ec24c226199"
-dependencies = [
- "async-trait",
- "bytes",
- "futures-util",
- "http",
- "http-body",
- "http-body-util",
- "mime",
- "pin-project-lite",
- "rustversion",
- "sync_wrapper",
- "tower-layer",
- "tower-service",
- "tracing",
-]
-
 [[package]]
 name = "base64"
 version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"

+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
 [[package]]
 name = "bitflags"
 version = "2.10.0"
@@ -163,9 +103,9 @@ checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"

 [[package]]
 name = "bumpalo"
-version = "3.19.1"
+version = "3.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5dd9dc738b7a8311c7ade152424974d8115f2cdad61e8dab8dac9f2362298510"
+checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43"

 [[package]]
 name = "bytes"
@@ -175,9 +115,9 @@ checksum = "b35204fbdc0b3f4446b89fc1ac2cf84a8a68971995d0bf2e925ec7cd960f9cb3"

 [[package]]
 name = "cc"
-version = "1.2.52"
+version = "1.2.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd4932aefd12402b36c60956a4fe0035421f544799057659ff86f923657aada3"
+checksum = "cd405d82c84ff7f35739f175f67d8b9fb7687a0e84ccdc78bd3568839827cf07"
 dependencies = [
 "find-msvc-tools",
 "shlex",
@@ -247,7 +187,7 @@ version = "3.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fde0e0ec90c9dfb3b4b1a0891a7dcd0e2bffde2f7efed5fe7c9bb00e5bfb915e"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.52.0",
 ]

 [[package]]
@@ -310,9 +250,9 @@ checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"

 [[package]]
 name = "find-msvc-tools"
-version = "0.1.7"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f449e6c6c08c865631d4890cfacf252b3d396c9bcc83adb6623cdb02a8336c41"
+checksum = "3a3076410a55c90011c298b04d0cfa770b00fa04e1e3c97d3f6c9de105a03844"

 [[package]]
 name = "fnv"
@@ -344,6 +284,21 @@ dependencies = [
 "percent-encoding",
 ]

+[[package]]
+name = "futures"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65bc07b1a8bc7c85c5f2e110c476c7389b4554ba72af57d8445ea63a576b0876"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
 [[package]]
 name = "futures-channel"
 version = "0.3.31"
@@ -351,6 +306,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10"
 dependencies = [
 "futures-core",
+ "futures-sink",
 ]

 [[package]]
@@ -370,6 +326,12 @@ dependencies = [
 "futures-util",
 ]

+[[package]]
+name = "futures-io"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6"
+
 [[package]]
 name = "futures-sink"
 version = "0.3.31"
@@ -388,8 +350,12 @@ version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
 dependencies = [
+ "futures-channel",
 "futures-core",
+ "futures-io",
+ "futures-sink",
 "futures-task",
+ "memchr",
 "pin-project-lite",
 "pin-utils",
 "slab",
@@ -424,9 +390,9 @@ dependencies = [

 [[package]]
 name = "h2"
-version = "0.4.13"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
+checksum = "f3c0b69cfcb4e1b9f1bf2f53f95f766e4661169728ec61cd3fe5a0166f2d1386"
 dependencies = [
 "atomic-waker",
 "bytes",
@@ -556,9 +522,9 @@ dependencies = [

 [[package]]
 name = "hyper-util"
-version = "0.1.19"
+version = "0.1.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "727805d60e7938b76b826a6ef209eb70eaa1812794f9424d4a4e2d740662df5f"
+checksum = "52e9a2a24dc5c6821e71a7030e1e14b7b632acac55c40e9d2e082c621261bb56"
 dependencies = [
 "base64",
 "bytes",
@@ -628,9 +594,9 @@ checksum = "7aedcccd01fc5fe81e6b489c15b247b8b0690feb23304303a9e560f37efc560a"

 [[package]]
 name = "icu_properties"
-version = "2.1.2"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "020bfc02fe870ec3a66d93e677ccca0562506e5872c650f893269e08615d74ec"
+checksum = "e93fcd3157766c0c8da2f8cff6ce651a31f0810eaa1c51ec363ef790bbb5fb99"
 dependencies = [
 "icu_collections",
 "icu_locale_core",
@@ -642,9 +608,9 @@ dependencies = [

 [[package]]
 name = "icu_properties_data"
-version = "2.1.2"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "616c294cf8d725c6afcd8f55abc17c56464ef6211f9ed59cccffe534129c77af"
+checksum = "02845b3647bb045f1100ecd6480ff52f34c35f82d9880e029d329c21d1054899"

 [[package]]
 name = "icu_provider"
@@ -684,9 +650,9 @@ dependencies = [

 [[package]]
 name = "indexmap"
-version = "2.13.0"
+version = "2.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7714e70437a7dc3ac8eb7e6f8df75fd8eb422675fc7678aff7364301092b1017"
+checksum = "0ad4bb2b565bca0645f4d68c5c9af97fba094e9791da685bf83cb5f3ce74acf2"
 dependencies = [
 "equivalent",
 "hashbrown",
@@ -700,9 +666,9 @@ checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130"

 [[package]]
 name = "iri-string"
-version = "0.7.10"
+version = "0.7.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c91338f0783edbd6195decb37bae672fd3b165faffb89bf7b9e6942f8b1a731a"
+checksum = "4f867b9d1d896b67beb18518eda36fdb77a32ea590de864f1325b294a6d14397"
 dependencies = [
 "memchr",
 "serde",
@@ -716,15 +682,15 @@ checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"

 [[package]]
 name = "itoa"
-version = "1.0.17"
+version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
+checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"

 [[package]]
 name = "js-sys"
-version = "0.3.83"
+version = "0.3.82"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "464a3709c7f55f1f721e5389aa6ea4e3bc6aba669353300af094b29ffbdde1d8"
+checksum = "b011eec8cc36da2aab2d5cff675ec18454fad408585853910a202391cf9f8e65"
 dependencies = [
 "once_cell",
 "wasm-bindgen",
@@ -738,9 +704,9 @@ checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"

 [[package]]
 name = "libc"
-version = "0.2.180"
+version = "0.2.177"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bcc35a38544a891a5f7c865aca548a982ccb3b8650a5b06d0fd33a10283c56fc"
+checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976"

 [[package]]
 name = "linux-raw-sys"
@@ -765,9 +731,9 @@ dependencies = [

 [[package]]
 name = "log"
-version = "0.4.29"
+version = "0.4.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+checksum = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432"

 [[package]]
 name = "lru-slab"
@@ -784,12 +750,6 @@ dependencies = [
 "regex-automata",
 ]

-[[package]]
-name = "matchit"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
-
 [[package]]
 name = "memchr"
 version = "2.7.6"
@@ -804,9 +764,9 @@ checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"

 [[package]]
 name = "mio"
-version = "1.1.1"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a69bcab0ad47271a0234d9422b131806bf3968021e5dc9328caf2d4cd58557fc"
+checksum = "69d83b0086dc8ecf3ce9ae2874b2d1290252e2a30720bea58a5c6639b0092873"
 dependencies = [
 "libc",
 "wasi",
@@ -815,21 +775,20 @@ dependencies = [

 [[package]]
 name = "mockito"
-version = "1.7.1"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e0603425789b4a70fcc4ac4f5a46a566c116ee3e2a6b768dc623f7719c611de"
+checksum = "7760e0e418d9b7e5777c0374009ca4c93861b9066f18cb334a20ce50ab63aa48"
 dependencies = [
 "assert-json-diff",
 "bytes",
 "colored",
- "futures-core",
+ "futures-util",
 "http",
 "http-body",
 "http-body-util",
 "hyper",
 "hyper-util",
 "log",
- "pin-project-lite",
 "rand",
 "regex",
 "serde_json",
@@ -882,7 +841,7 @@ version = "0.10.75"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08838db121398ad17ab8531ce9de97b244589089e290a384c900cb9ff7434328"
 dependencies = [
- "bitflags",
+ "bitflags 2.10.0",
 "cfg-if",
 "foreign-types",
 "libc",
@@ -969,10 +928,9 @@ checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"

 [[package]]
 name = "potatomesh-matrix-bridge"
-version = "0.5.10"
+version = "0.5.9"
 dependencies = [
 "anyhow",
- "axum",
 "clap",
 "mockito",
 "reqwest",
@@ -982,7 +940,6 @@ dependencies = [
 "tempfile",
 "tokio",
 "toml",
- "tower",
 "tracing",
 "tracing-subscriber",
 "urlencoding",
@@ -1008,9 +965,9 @@ dependencies = [

 [[package]]
 name = "proc-macro2"
-version = "1.0.105"
+version = "1.0.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "535d180e0ecab6268a3e718bb9fd44db66bbbc256257165fc699dadf70d16fe7"
+checksum = "5ee95bc4ef87b8d5ba32e8b7714ccc834865276eab0aed5c9958d00ec45f49e8"
 dependencies = [
 "unicode-ident",
 ]
@@ -1072,9 +1029,9 @@ dependencies = [

 [[package]]
 name = "quote"
-version = "1.0.43"
+version = "1.0.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc74d9a594b72ae6656596548f56f667211f8a97b3d4c3d467150794690dc40a"
+checksum = "a338cc41d27e6cc6dce6cefc13a0729dfbb81c262b1f519331575dd80ef3067f"
 dependencies = [
 "proc-macro2",
 ]
@@ -1120,7 +1077,7 @@ version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
- "bitflags",
+ "bitflags 2.10.0",
 ]

 [[package]]
@@ -1154,9 +1111,9 @@ checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58"

 [[package]]
 name = "reqwest"
-version = "0.12.28"
+version = "0.12.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+checksum = "9d0946410b9f7b082a427e4ef5c8ff541a88b357bc6c637c40db3a68ac70a36f"
 dependencies = [
 "base64",
 "bytes",
@@ -1218,11 +1175,11 @@ checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"

 [[package]]
 name = "rustix"
-version = "1.1.3"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "146c9e247ccc180c1f61615433868c99f3de3ae256a30a43b49f67c2d9171f34"
+checksum = "cd15f8a2c5551a84d56efdc1cd049089e409ac19a3072d5037a17fd70719ff3e"
 dependencies = [
- "bitflags",
+ "bitflags 2.10.0",
 "errno",
 "libc",
 "linux-raw-sys",
@@ -1231,9 +1188,9 @@ dependencies = [

 [[package]]
 name = "rustls"
-version = "0.23.36"
+version = "0.23.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c665f33d38cea657d9614f766881e4d510e0eda4239891eea56b4cadcf01801b"
+checksum = "533f54bc6a7d4f647e46ad909549eda97bf5afc1585190ef692b4286b198bd8f"
 dependencies = [
 "once_cell",
 "ring",
@@ -1245,9 +1202,9 @@ dependencies = [

 [[package]]
 name = "rustls-pki-types"
-version = "1.13.2"
+version = "1.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21e6f2ab2928ca4291b86736a8bd920a277a399bba1589409d72154ff87c1282"
+checksum = "94182ad936a0c91c324cd46c6511b9510ed16af436d7b5bab34beab0afd55f7a"
 dependencies = [
 "web-time",
 "zeroize",
@@ -1272,9 +1229,9 @@ checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"

 [[package]]
 name = "ryu"
-version = "1.0.22"
+version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a50f4cf475b65d88e057964e0e9bb1f0aa9bbb2036dc65c64596b42932536984"
+checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"

 [[package]]
 name = "scc"
@@ -1312,7 +1269,7 @@ version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
 dependencies = [
- "bitflags",
+ "bitflags 2.10.0",
 "core-foundation",
 "core-foundation-sys",
 "libc",
@@ -1361,33 +1318,22 @@ dependencies = [

 [[package]]
 name = "serde_json"
-version = "1.0.149"
+version = "1.0.145"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+checksum = "402a6f66d8c709116cf22f558eab210f5a50187f702eb4d7e5ef38d9a7f1c79c"
 dependencies = [
 "itoa",
 "memchr",
- "serde",
- "serde_core",
- "zmij",
-]
-
-[[package]]
-name = "serde_path_to_error"
-version = "0.1.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
-dependencies = [
- "itoa",
+ "ryu",
 "serde",
 "serde_core",
 ]

 [[package]]
 name = "serde_spanned"
-version = "1.0.4"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8bbf91e5a4d6315eee45e704372590b30e260ee83af6639d64557f51b067776"
+checksum = "e24345aa0fe688594e73770a5f6d1b216508b4f93484c0026d521acd30134392"
 dependencies = [
 "serde_core",
 ]
@@ -1406,12 +1352,11 @@ dependencies = [

 [[package]]
 name = "serial_test"
-version = "3.3.1"
+version = "3.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d0b343e184fc3b7bb44dff0705fffcf4b3756ba6aff420dddd8b24ca145e555"
+checksum = "1b258109f244e1d6891bf1053a55d63a5cd4f8f4c30cf9a1280989f80e7a1fa9"
 dependencies = [
- "futures-executor",
- "futures-util",
+ "futures",
 "log",
 "once_cell",
 "parking_lot",
@@ -1421,9 +1366,9 @@ dependencies = [

 [[package]]
 name = "serial_test_derive"
-version = "3.3.1"
+version = "3.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f50427f258fb77356e4cd4aa0e87e2bd2c66dbcee41dc405282cae2bfc26c83"
+checksum = "5d69265a08751de7844521fd15003ae0a888e035773ba05695c5c759a6f89eef"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -1493,9 +1438,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"

 [[package]]
 name = "syn"
-version = "2.0.114"
+version = "2.0.111"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4d107df263a3013ef9b1879b0df87d706ff80f65a86ea879bd9c31f9b307c2a"
+checksum = "390cc9a294ab71bdb1aa2e99d13be9c753cd2d7bd6560c77118597410c4d2e87"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -1524,20 +1469,20 @@ dependencies = [

 [[package]]
 name = "system-configuration"
-version = "0.6.1"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c879d448e9d986b661742763247d3693ed13609438cf3d006f51f5368a5ba6b"
+checksum = "ba3a3adc5c275d719af8cb4272ea1c4a6d668a777f37e115f6d11ddbc1c8e0e7"
 dependencies = [
- "bitflags",
+ "bitflags 1.3.2",
 "core-foundation",
 "system-configuration-sys",
 ]

 [[package]]
 name = "system-configuration-sys"
-version = "0.6.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
+checksum = "a75fb188eb626b924683e3b95e3a48e63551fcfb51949de2f06a9d91dbee93c9"
 dependencies = [
 "core-foundation-sys",
 "libc",
@@ -1545,9 +1490,9 @@ dependencies = [

 [[package]]
 name = "tempfile"
-version = "3.24.0"
+version = "3.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "655da9c7eb6305c55742045d5a8d2037996d61d8de95806335c7c86ce0f82e9c"
+checksum = "2d31c77bdf42a745371d260a26ca7163f1e0924b64afa0b688e61b5a9fa02f16"
 dependencies = [
 "fastrand",
 "getrandom 0.3.4",
@@ -1612,9 +1557,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"

 [[package]]
 name = "tokio"
-version = "1.49.0"
+version = "1.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72a2903cd7736441aac9df9d7688bd0ce48edccaadf181c3b90be801e81d3d86"
+checksum = "ff360e02eab121e0bc37a2d3b4d4dc622e6eda3a8e5253d5435ecf5bd4c68408"
 dependencies = [
 "bytes",
 "libc",
@@ -1659,9 +1604,9 @@ dependencies = [

 [[package]]
 name = "tokio-util"
-version = "0.7.18"
+version = "0.7.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+checksum = "2efa149fe76073d6e8fd97ef4f4eca7b67f599660115591483572e406e165594"
 dependencies = [
 "bytes",
 "futures-core",
@@ -1672,9 +1617,9 @@ dependencies = [

 [[package]]
 name = "toml"
-version = "0.9.11+spec-1.1.0"
+version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3afc9a848309fe1aaffaed6e1546a7a14de1f935dc9d89d32afd9a44bab7c46"
+checksum = "f0dc8b1fb61449e27716ec0e1bdf0f6b8f3e8f6b05391e8497b8b6d7804ea6d8"
 dependencies = [
 "indexmap",
 "serde_core",
@@ -1687,27 +1632,27 @@ dependencies = [

 [[package]]
 name = "toml_datetime"
-version = "0.7.5+spec-1.1.0"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
+checksum = "f2cdb639ebbc97961c51720f858597f7f24c4fc295327923af55b74c3c724533"
 dependencies = [
 "serde_core",
 ]

 [[package]]
 name = "toml_parser"
-version = "1.0.6+spec-1.1.0"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3198b4b0a8e11f09dd03e133c0280504d0801269e9afa46362ffde1cbeebf44"
+checksum = "c0cbe268d35bdb4bb5a56a2de88d0ad0eb70af5384a99d648cd4b3d04039800e"
 dependencies = [
 "winnow",
 ]

 [[package]]
 name = "toml_writer"
-version = "1.0.6+spec-1.1.0"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab16f14aed21ee8bfd8ec22513f7287cd4a91aa92e44edfe2c17ddd004e92607"
+checksum = "df8b2b54733674ad286d16267dcfc7a71ed5c776e4ac7aa3c3e2561f7c637bf2"

 [[package]]
 name = "tower"
@@ -1722,16 +1667,15 @@ dependencies = [
 "tokio",
 "tower-layer",
 "tower-service",
- "tracing",
 ]

 [[package]]
 name = "tower-http"
-version = "0.6.8"
+version = "0.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
+checksum = "9cf146f99d442e8e68e585f5d798ccd3cad9a7835b917e09728880a862706456"
 dependencies = [
- "bitflags",
+ "bitflags 2.10.0",
 "bytes",
 "futures-util",
 "http",
@@ -1757,11 +1701,10 @@ checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"

 [[package]]
 name = "tracing"
-version = "0.1.44"
+version = "0.1.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+checksum = "784e0ac535deb450455cbfa28a6f0df145ea1bb7ae51b821cf5e7927fdcfbdd0"
 dependencies = [
- "log",
 "pin-project-lite",
 "tracing-attributes",
 "tracing-core",
@@ -1780,9 +1723,9 @@ dependencies = [

 [[package]]
 name = "tracing-core"
-version = "0.1.36"
+version = "0.1.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+checksum = "7a04e24fab5c89c6a36eb8558c9656f30d81de51dfa4d3b45f26b21d61fa0a6c"
 dependencies = [
 "once_cell",
 "valuable",
@@ -1801,9 +1744,9 @@ dependencies = [

 [[package]]
 name = "tracing-subscriber"
-version = "0.3.22"
+version = "0.3.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f30143827ddab0d256fd843b7a66d164e9f271cfa0dde49142c5ca0ca291f1e"
+checksum = "2054a14f5307d601f88daf0553e1cbf472acc4f2c51afab632431cdcd72124d5"
 dependencies = [
 "matchers",
 "nu-ansi-term",
@@ -1837,9 +1780,9 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"

 [[package]]
 name = "url"
-version = "2.5.8"
+version = "2.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+checksum = "08bc136a29a3d1758e07a9cca267be308aeebf5cfd5a10f3f67ab2097683ef5b"
 dependencies = [
 "form_urlencoded",
 "idna",
@@ -1903,9 +1846,9 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen"
-version = "0.2.106"
+version = "0.2.105"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d759f433fa64a2d763d1340820e46e111a7a5ab75f993d1852d70b03dbb80fd"
+checksum = "da95793dfc411fbbd93f5be7715b0578ec61fe87cb1a42b12eb625caa5c5ea60"
 dependencies = [
 "cfg-if",
 "once_cell",
@@ -1916,9 +1859,9 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.56"
+version = "0.4.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "836d9622d604feee9e5de25ac10e3ea5f2d65b41eac0d9ce72eb5deae707ce7c"
+checksum = "551f88106c6d5e7ccc7cd9a16f312dd3b5d36ea8b4954304657d5dfba115d4a0"
 dependencies = [
 "cfg-if",
 "js-sys",
@@ -1929,9 +1872,9 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.106"
+version = "0.2.105"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48cb0d2638f8baedbc542ed444afc0644a29166f1595371af4fecf8ce1e7eeb3"
+checksum = "04264334509e04a7bf8690f2384ef5265f05143a4bff3889ab7a3269adab59c2"
 dependencies = [
 "quote",
 "wasm-bindgen-macro-support",
@@ -1939,9 +1882,9 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.106"
+version = "0.2.105"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cefb59d5cd5f92d9dcf80e4683949f15ca4b511f4ac0a6e14d4e1ac60c6ecd40"
+checksum = "420bc339d9f322e562942d52e115d57e950d12d88983a14c79b86859ee6c7ebc"
 dependencies = [
 "bumpalo",
 "proc-macro2",
@@ -1952,18 +1895,18 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.106"
+version = "0.2.105"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cbc538057e648b67f72a982e708d485b2efa771e1ac05fec311f9f63e5800db4"
+checksum = "76f218a38c84bcb33c25ec7059b07847d465ce0e0a76b995e134a45adcb6af76"
 dependencies = [
 "unicode-ident",
 ]

 [[package]]
 name = "web-sys"
-version = "0.3.83"
+version = "0.3.82"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b32828d774c412041098d182a8b38b16ea816958e07cf40eec2bc080ae137ac"
+checksum = "3a1f95c0d03a47f4ae1f7a64643a6bb97465d9b740f0fa8f90ea33915c99a9a1"
 dependencies = [
 "js-sys",
 "wasm-bindgen",
@@ -1981,9 +1924,9 @@ dependencies = [

 [[package]]
 name = "webpki-roots"
-version = "1.0.5"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12bed680863276c63889429bfd6cab3b99943659923822de1c8a39c49e4d722c"
+checksum = "b2878ef029c47c6e8cf779119f20fcf52bde7ad42a731b2a304bc221df17571e"
 dependencies = [
 "rustls-pki-types",
 ]
@@ -2032,15 +1975,6 @@ dependencies = [
 "windows-targets 0.52.6",
 ]

-[[package]]
-name = "windows-sys"
-version = "0.59.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
-dependencies = [
- "windows-targets 0.52.6",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.60.2"
@@ -2231,18 +2165,18 @@ dependencies = [

 [[package]]
 name = "zerocopy"
-version = "0.8.33"
+version = "0.8.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "668f5168d10b9ee831de31933dc111a459c97ec93225beb307aed970d1372dfd"
+checksum = "4ea879c944afe8a2b25fef16bb4ba234f47c694565e97383b36f3a878219065c"
 dependencies = [
 "zerocopy-derive",
 ]

 [[package]]
 name = "zerocopy-derive"
-version = "0.8.33"
+version = "0.8.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c7962b26b0a8685668b671ee4b54d007a67d4eaf05fda79ac0ecf41e32270f1"
+checksum = "cf955aa904d6040f70dc8e9384444cb1030aed272ba3cb09bbc4ab9e7c1f34f5"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -2308,9 +2242,3 @@ dependencies = [
 "quote",
 "syn",
 ]
-
-[[package]]
-name = "zmij"
-version = "1.0.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2fc5a66a20078bf1251bde995aa2fdcc4b800c70b5d92dd2c62abc5c60f679f8"
@@ -14,7 +14,7 @@

 [package]
 name = "potatomesh-matrix-bridge"
-version = "0.5.10"
+version = "0.5.9"
 edition = "2021"

 [dependencies]
@@ -27,11 +27,9 @@ anyhow = "1"
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["fmt", "env-filter"] }
 urlencoding = "2"
-axum = { version = "0.7", features = ["json"] }
 clap = { version = "4", features = ["derive"] }

 [dev-dependencies]
 tempfile = "3"
 mockito = "1"
 serial_test = "3"
-tower = "0.5"
@@ -9,8 +9,6 @@ poll_interval_secs = 60
 homeserver = "https://matrix.dod.ngo"
 # Appservice access token (from your registration.yaml)
 as_token = "INVALID_TOKEN_NOT_WORKING"
-# Homeserver token used to authenticate Synapse callbacks
-hs_token = "INVALID_TOKEN_NOT_WORKING"
 # Server name (domain) part of Matrix user IDs
 server_name = "dod.ngo"
 # Room ID to send into (must be joined by the appservice / puppets)
@@ -19,3 +17,4 @@ room_id = "!sXabOBXbVObAlZQEUs:c-base.org" # "#potato-bridge:c-base.org"
 [state]
 # Where to persist last seen message id (optional but recommended)
 state_file = "bridge_state.json"
+
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

-FROM rust:1.92-bookworm AS builder
+FROM rust:1.91-bookworm AS builder

 WORKDIR /app

@@ -37,8 +37,6 @@ COPY --from=builder /app/target/release/potatomesh-matrix-bridge /usr/local/bin/
 COPY matrix/Config.toml /app/Config.example.toml
 COPY matrix/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh

-EXPOSE 41448
-
 RUN chmod +x /usr/local/bin/docker-entrypoint.sh

 ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
@@ -2,8 +2,6 @@

 A small Rust daemon that bridges **PotatoMesh** LoRa messages into a **Matrix** room.

-![matrix bridge](../scrot-0.6.png)
-
 For each PotatoMesh node, the bridge creates (or uses) a **Matrix puppet user**:

 - Matrix localpart: `potato_` + the hex node id (without `!`), e.g. `!67fc83cb` → `@potato_67fc83cb:example.org`
@@ -56,17 +54,11 @@ This is **not** a full appservice framework; it just speaks the minimal HTTP nee

 ## Configuration

-Configuration can come from a TOML file, CLI flags, environment variables, or secret files. The bridge merges inputs in this order (highest to lowest):
+Configuration can come from TOML, CLI flags, and environment variables. The TOML
+file is optional as long as every required setting is supplied via CLI/env/secret
+overrides.

-1. CLI flags
-2. Environment variables
-3. Secret files (`*_FILE` paths or container defaults)
-4. TOML config file
-5. Container defaults (paths + poll interval)
-
-If no TOML file is provided, required values must be supplied via CLI/env/secret inputs.
-
-Example TOML:
+Example:

 ```toml
 [potatomesh]
@@ -80,8 +72,6 @@ poll_interval_secs = 10
 homeserver = "https://matrix.example.org"
 # Appservice access token (from your registration.yaml)
 as_token = "YOUR_APPSERVICE_AS_TOKEN"
-# Appservice homeserver token (must match registration hs_token)
-hs_token = "SECRET_HS_TOKEN"
 # Server name (domain) part of Matrix user IDs
 server_name = "example.org"
 # Room ID to send into (must be joined by the appservice / puppets)
@@ -92,59 +82,65 @@ room_id = "!yourroomid:example.org"
 state_file = "bridge_state.json"
 ````

-The `hs_token` is used to validate inbound appservice transactions. Keep it identical in `Config.toml` and your Matrix appservice registration file.
+### CLI Overrides

-### CLI Flags
+Run `potatomesh-matrix-bridge --help` for the full list. The most common flags:

-Run `potatomesh-matrix-bridge --help` for the full list. Common flags:
+- `--config` (or `--config-path`) to point at a TOML file
+- `--state-file`
+- `--potatomesh-base-url`
+- `--potatomesh-poll-interval-secs`
+- `--matrix-homeserver`
+- `--matrix-as-token`
+- `--matrix-server-name`
+- `--matrix-room-id`
+- `--container-defaults` / `--no-container-defaults`

-* `--config PATH`
-* `--state-file PATH`
-* `--potatomesh-base-url URL`
-* `--potatomesh-poll-interval-secs SECS`
-* `--matrix-homeserver URL`
-* `--matrix-as-token TOKEN`
-* `--matrix-as-token-file PATH`
-* `--matrix-hs-token TOKEN`
-* `--matrix-hs-token-file PATH`
-* `--matrix-server-name NAME`
-* `--matrix-room-id ROOM`
-* `--container` / `--no-container`
-* `--secrets-dir PATH`
+### Environment Overrides

-### Environment Variables
+Environment variables override CLI and TOML values:

-* `POTATOMESH_CONFIG`
-* `POTATOMESH_BASE_URL`
-* `POTATOMESH_POLL_INTERVAL_SECS`
-* `MATRIX_HOMESERVER`
-* `MATRIX_AS_TOKEN`
-* `MATRIX_AS_TOKEN_FILE`
-* `MATRIX_HS_TOKEN`
-* `MATRIX_HS_TOKEN_FILE`
-* `MATRIX_SERVER_NAME`
-* `MATRIX_ROOM_ID`
-* `STATE_FILE`
-* `POTATOMESH_CONTAINER`
-* `POTATOMESH_SECRETS_DIR`
+- `POTATOMESH_BASE_URL`
+- `POTATOMESH_POLL_INTERVAL_SECS`
+- `MATRIX_HOMESERVER`
+- `MATRIX_AS_TOKEN`
+- `MATRIX_SERVER_NAME`
+- `MATRIX_ROOM_ID`
+- `STATE_FILE`
+- `POTATOMESH_CONFIG_PATH` (optional TOML path)
+- `POTATOMESH_CONTAINER_DEFAULTS` (`1/0`, `true/false`)
+- `POTATOMESH_SECRETS_DIR` (default secrets directory)
+- `CONTAINER` (container detection hint)

-### Secret Files
+### Docker Secrets

-If you supply `*_FILE` values, the bridge reads the secret contents and trims whitespace. When running inside a container, the bridge also checks the default secrets directory (default: `/run/secrets`) for:
+Every env var above supports a `*_FILE` companion (for example, `MATRIX_AS_TOKEN_FILE`).
+When present, the bridge reads the file contents and uses them instead of the plain env var.
+If `POTATOMESH_SECRETS_DIR` is set (or container defaults are enabled), the bridge also
+checks for files named after the env vars (for example, `/run/secrets/MATRIX_AS_TOKEN`)
+even when the `*_FILE` variable is not set.

-* `matrix_as_token`
-* `matrix_hs_token`
+### Precedence
+
+From highest to lowest:
+
+1. `*_FILE` secret values (explicit or default secrets directory)
+2. Environment variables
+3. CLI flags
+4. TOML config
+5. Built-in defaults

 ### Container Defaults

-Container detection checks `POTATOMESH_CONTAINER`, `CONTAINER`, and `/proc/1/cgroup`. When detected (or forced with `--container`), defaults shift to:
+When container defaults are enabled (auto-detected or forced):

-* Config path: `/app/Config.toml`
-* State file: `/app/bridge_state.json`
-* Secrets dir: `/run/secrets`
-* Poll interval: 15 seconds (if not otherwise configured)
+- Default config path: `/app/Config.toml`
+- Default state file: `/app/bridge_state.json`
+- Default secrets directory: `/run/secrets`
+- Default poll interval: 120 seconds

-Set `POTATOMESH_CONTAINER=0` or `--no-container` to opt out of container defaults.
+Disable container defaults with `--no-container-defaults` or set
+`POTATOMESH_CONTAINER_DEFAULTS=0`.

 ### PotatoMesh API

@@ -200,7 +196,7 @@ A minimal example sketch (you **must** adjust URLs, secrets, namespaces):

 ```yaml
 id: potatomesh-bridge
-url: "http://your-bridge-host:41448"
+url: "http://your-bridge-host:8080"  # not used by this bridge if it only calls out
 as_token: "YOUR_APPSERVICE_AS_TOKEN"
 hs_token: "SECRET_HS_TOKEN"
 sender_localpart: "potatomesh-bridge"
@@ -211,12 +207,10 @@ namespaces:
      regex: "@potato_[0-9a-f]{8}:example.org"
 ```

-This bridge listens for Synapse appservice callbacks on port `41448` so it can log inbound transaction payloads. It still only forwards messages one way (PotatoMesh → Matrix), so inbound Matrix events are acknowledged but not bridged. The `as_token` and `namespaces.users` entries remain required for outbound calls, and the `url` should point at the listener.
+For this bridge, only the `as_token` and `namespaces.users` actually matter. The bridge does not accept inbound events; it only uses the `as_token` to call the homeserver.

 In Synapse’s `homeserver.yaml`, add the registration file under `app_service_config_files`, restart, and invite a puppet user to your target room (or use room ID directly).

-The bridge validates inbound appservice callbacks by comparing the `access_token` query param to `hs_token` in `Config.toml`, so keep those values in sync.
-
 ---

 ## Build
@@ -246,11 +240,10 @@ Build the container from the repo root with the included `matrix/Dockerfile`:
 docker build -f matrix/Dockerfile -t potatomesh-matrix-bridge .
 ```

-Provide your config at `/app/Config.toml` (or use CLI/env/secret overrides) and persist the bridge state file by mounting volumes. Minimal example:
+Provide your config at `/app/Config.toml` and persist the bridge state file by mounting volumes. Minimal example:

 ```bash
 docker run --rm \
-  -p 41448:41448 \
  -v bridge_state:/app \
  -v "$(pwd)/matrix/Config.toml:/app/Config.toml:ro" \
  potatomesh-matrix-bridge
@@ -260,13 +253,12 @@ If you prefer to isolate the state file from the config, mount it directly inste

 ```bash
 docker run --rm \
-  -p 41448:41448 \
  -v bridge_state:/app \
  -v "$(pwd)/matrix/Config.toml:/app/Config.toml:ro" \
  potatomesh-matrix-bridge
 ```

-The image ships `Config.example.toml` for reference. If `/app/Config.toml` is absent, set the required values via environment variables, CLI flags, or secrets instead.
+The image ships `Config.example.toml` for reference, but the bridge will exit if `/app/Config.toml` is not provided.

 ---

@@ -304,7 +296,7 @@ Delete `bridge_state.json` if you want it to replay all currently available mess

 ## Development

-Run tests:
+Run tests (currently mostly compile checks, no real tests yet):

 ```bash
 cargo test
@@ -15,12 +15,10 @@

 set -e

-# Default to container-aware configuration paths unless explicitly overridden.
-: "${POTATOMESH_CONTAINER:=1}"
-: "${POTATOMESH_SECRETS_DIR:=/run/secrets}"
-
-export POTATOMESH_CONTAINER
-export POTATOMESH_SECRETS_DIR
+# Surface container detection for the bridge and set default secret directory.
+export CONTAINER="${CONTAINER:-1}"
+export POTATOMESH_CONTAINER_DEFAULTS="${POTATOMESH_CONTAINER_DEFAULTS:-1}"
+export POTATOMESH_SECRETS_DIR="${POTATOMESH_SECRETS_DIR:-/run/secrets}"

 # Default state file path from Config.toml unless overridden.
 STATE_FILE="${STATE_FILE:-/app/bridge_state.json}"
@@ -12,94 +12,148 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

-use clap::{ArgAction, Parser};
+use clap::Parser;

-#[cfg(not(test))]
-use crate::config::{ConfigInputs, ConfigOverrides};
+use crate::config::{
+    BootstrapOverrides, ConfigOverrides, MatrixOverrides, PotatomeshOverrides, StateOverrides,
+};

-/// CLI arguments for the Matrix bridge.
+/// Command-line overrides for the Matrix bridge.
 #[derive(Debug, Parser)]
-#[command(
-    name = "potatomesh-matrix-bridge",
-    version,
-    about = "PotatoMesh Matrix bridge"
-)]
+#[command(name = "potatomesh-matrix-bridge", version)]
 pub struct Cli {
-    /// Path to the configuration TOML file.
-    #[arg(long, value_name = "PATH")]
-    pub config: Option<String>,
-    /// Path to the bridge state file.
-    #[arg(long, value_name = "PATH")]
+    /// TOML config path (optional, defaults to Config.toml or /app/Config.toml in containers).
+    #[arg(long = "config", alias = "config-path")]
+    pub config_path: Option<String>,
+
+    /// Override the state file path.
+    #[arg(long)]
    pub state_file: Option<String>,
-    /// PotatoMesh base URL.
-    #[arg(long, value_name = "URL")]
+
+    /// Override the PotatoMesh base URL.
+    #[arg(long)]
    pub potatomesh_base_url: Option<String>,
-    /// Poll interval in seconds.
-    #[arg(long, value_name = "SECS")]
+
+    /// Override the PotatoMesh poll interval in seconds.
+    #[arg(long)]
    pub potatomesh_poll_interval_secs: Option<u64>,
-    /// Matrix homeserver base URL.
-    #[arg(long, value_name = "URL")]
+
+    /// Override the Matrix homeserver URL.
+    #[arg(long)]
    pub matrix_homeserver: Option<String>,
-    /// Matrix appservice access token.
-    #[arg(long, value_name = "TOKEN")]
+
+    /// Override the Matrix appservice access token.
+    #[arg(long)]
    pub matrix_as_token: Option<String>,
-    /// Path to a secret file containing the Matrix appservice access token.
-    #[arg(long, value_name = "PATH")]
-    pub matrix_as_token_file: Option<String>,
-    /// Matrix homeserver token for inbound appservice requests.
-    #[arg(long, value_name = "TOKEN")]
-    pub matrix_hs_token: Option<String>,
-    /// Path to a secret file containing the Matrix homeserver token.
-    #[arg(long, value_name = "PATH")]
-    pub matrix_hs_token_file: Option<String>,
-    /// Matrix server name (domain).
-    #[arg(long, value_name = "NAME")]
+
+    /// Override the Matrix server name.
+    #[arg(long)]
    pub matrix_server_name: Option<String>,
-    /// Matrix room id to forward into.
-    #[arg(long, value_name = "ROOM")]
+
+    /// Override the Matrix room ID.
+    #[arg(long)]
    pub matrix_room_id: Option<String>,
-    /// Force container defaults (overrides detection).
-    #[arg(long, action = ArgAction::SetTrue)]
-    pub container: bool,
-    /// Disable container defaults (overrides detection).
-    #[arg(long, action = ArgAction::SetTrue)]
-    pub no_container: bool,
-    /// Directory to search for default secret files.
-    #[arg(long, value_name = "PATH")]
-    pub secrets_dir: Option<String>,
+
+    /// Force container defaults on even if container detection is false.
+    #[arg(long, conflicts_with = "no_container_defaults")]
+    pub container_defaults: bool,
+
+    /// Disable container defaults even if a container is detected.
+    #[arg(long, conflicts_with = "container_defaults")]
+    pub no_container_defaults: bool,
 }

 impl Cli {
-    /// Convert CLI args into configuration inputs.
-    #[cfg(not(test))]
-    pub fn to_inputs(&self) -> ConfigInputs {
-        ConfigInputs {
-            config_path: self.config.clone(),
-            secrets_dir: self.secrets_dir.clone(),
-            container_override: resolve_container_override(self.container, self.no_container),
-            container_hint: None,
-            overrides: ConfigOverrides {
-                potatomesh_base_url: self.potatomesh_base_url.clone(),
-                potatomesh_poll_interval_secs: self.potatomesh_poll_interval_secs,
-                matrix_homeserver: self.matrix_homeserver.clone(),
-                matrix_as_token: self.matrix_as_token.clone(),
-                matrix_as_token_file: self.matrix_as_token_file.clone(),
-                matrix_hs_token: self.matrix_hs_token.clone(),
-                matrix_hs_token_file: self.matrix_hs_token_file.clone(),
-                matrix_server_name: self.matrix_server_name.clone(),
-                matrix_room_id: self.matrix_room_id.clone(),
-                state_file: self.state_file.clone(),
+    /// Convert CLI flags to bootstrap overrides for config loading.
+    pub fn into_overrides(self) -> BootstrapOverrides {
+        let container_defaults = if self.container_defaults {
+            Some(true)
+        } else if self.no_container_defaults {
+            Some(false)
+        } else {
+            None
+        };
+
+        BootstrapOverrides {
+            config_path: self.config_path,
+            container_defaults,
+            values: ConfigOverrides {
+                potatomesh: PotatomeshOverrides {
+                    base_url: self.potatomesh_base_url,
+                    poll_interval_secs: self.potatomesh_poll_interval_secs,
+                },
+                matrix: MatrixOverrides {
+                    homeserver: self.matrix_homeserver,
+                    as_token: self.matrix_as_token,
+                    server_name: self.matrix_server_name,
+                    room_id: self.matrix_room_id,
+                },
+                state: StateOverrides {
+                    state_file: self.state_file,
+                },
            },
        }
    }
 }

-/// Resolve container override flags into an optional boolean.
-#[cfg(not(test))]
-fn resolve_container_override(container: bool, no_container: bool) -> Option<bool> {
-    match (container, no_container) {
-        (true, false) => Some(true),
-        (false, true) => Some(false),
-        _ => None,
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn cli_overrides_map_to_config() {
+        let cli = Cli::parse_from([
+            "bridge",
+            "--config",
+            "/tmp/Config.toml",
+            "--state-file",
+            "/tmp/state.json",
+            "--potatomesh-base-url",
+            "https://potato.example/",
+            "--potatomesh-poll-interval-secs",
+            "15",
+            "--matrix-homeserver",
+            "https://matrix.example.org",
+            "--matrix-as-token",
+            "token",
+            "--matrix-server-name",
+            "example.org",
+            "--matrix-room-id",
+            "!room:example.org",
+            "--container-defaults",
+        ]);
+
+        let overrides = cli.into_overrides();
+        assert_eq!(overrides.config_path.as_deref(), Some("/tmp/Config.toml"));
+        assert_eq!(overrides.container_defaults, Some(true));
+        assert_eq!(
+            overrides.values.potatomesh.base_url.as_deref(),
+            Some("https://potato.example/")
+        );
+        assert_eq!(overrides.values.potatomesh.poll_interval_secs, Some(15));
+        assert_eq!(
+            overrides.values.matrix.homeserver.as_deref(),
+            Some("https://matrix.example.org")
+        );
+        assert_eq!(overrides.values.matrix.as_token.as_deref(), Some("token"));
+        assert_eq!(
+            overrides.values.matrix.server_name.as_deref(),
+            Some("example.org")
+        );
+        assert_eq!(
+            overrides.values.matrix.room_id.as_deref(),
+            Some("!room:example.org")
+        );
+        assert_eq!(
+            overrides.values.state.state_file.as_deref(),
+            Some("/tmp/state.json")
+        );
+    }
+
+    #[test]
+    fn cli_can_disable_container_defaults() {
+        let cli = Cli::parse_from(["bridge", "--no-container-defaults"]);
+        let overrides = cli.into_overrides();
+        assert_eq!(overrides.container_defaults, Some(false));
    }
 }
@@ -15,26 +15,26 @@
 mod cli;
 mod config;
 mod matrix;
-mod matrix_server;
 mod potatomesh;

-use std::{fs, net::SocketAddr, path::Path};
+use std::{fs, path::Path};

 use anyhow::Result;
-#[cfg(not(test))]
 use clap::Parser;
-use tokio::time::Duration;
+use tokio::time::{sleep, Duration};
 use tracing::{error, info};

-#[cfg(not(test))]
 use crate::cli::Cli;
-#[cfg(not(test))]
 use crate::config::Config;
 use crate::matrix::MatrixAppserviceClient;
-use crate::matrix_server::run_synapse_listener;
 use crate::potatomesh::{FetchParams, PotatoClient, PotatoMessage, PotatoNode};
-#[cfg(not(test))]
-use tokio::time::sleep;
+
+fn format_runtime_context(context: &config::RuntimeContext) -> String {
+    format!(
+        "Runtime context: in_container={} container_defaults={} config_path={} secrets_dir={:?}",
+        context.in_container, context.container_defaults, context.config_path, context.secrets_dir
+    )
+}

 #[derive(Debug, serde::Serialize, serde::Deserialize, Default)]
 pub struct BridgeState {
@@ -124,31 +124,6 @@ fn build_fetch_params(state: &BridgeState) -> FetchParams {
    }
 }

-/// Persist the bridge state and log any write errors.
-fn persist_state(state: &BridgeState, state_path: &str) {
-    if let Err(e) = state.save(state_path) {
-        error!("Error saving state: {:?}", e);
-    }
-}
-
-/// Emit an info log for the latest bridge state snapshot.
-fn log_state_update(state: &BridgeState) {
-    info!("Updated state: {:?}", state);
-}
-
-/// Emit a sanitized config log without sensitive tokens.
-#[cfg(not(test))]
-fn log_config(cfg: &Config) {
-    info!(
-        potatomesh_base_url = cfg.potatomesh.base_url.as_str(),
-        matrix_homeserver = cfg.matrix.homeserver.as_str(),
-        matrix_server_name = cfg.matrix.server_name.as_str(),
-        matrix_room_id = cfg.matrix.room_id.as_str(),
-        state_file = cfg.state.state_file.as_str(),
-        "Loaded config"
-    );
-}
-
 async fn poll_once(
    potato: &PotatoClient,
    matrix: &MatrixAppserviceClient,
@@ -171,8 +146,9 @@ async fn poll_once(
                if let Some(port) = &msg.portnum {
                    if port != "TEXT_MESSAGE_APP" {
                        state.update_with(msg);
-                        log_state_update(state);
-                        persist_state(state, state_path);
+                        if let Err(e) = state.save(state_path) {
+                            error!("Error saving state: {:?}", e);
+                        }
                        continue;
                    }
                }
@@ -182,8 +158,11 @@ async fn poll_once(
                    continue;
                }

+                state.update_with(msg);
                // persist after each processed message
-                persist_state(state, state_path);
+                if let Err(e) = state.save(state_path) {
+                    error!("Error saving state: {:?}", e);
+                }
            }
        }
        Err(e) => {
@@ -192,15 +171,6 @@ async fn poll_once(
    }
 }

-fn spawn_synapse_listener(addr: SocketAddr, token: String) -> tokio::task::JoinHandle<()> {
-    tokio::spawn(async move {
-        if let Err(e) = run_synapse_listener(addr, token).await {
-            error!("Synapse listener failed: {:?}", e);
-        }
-    })
-}
-
-#[cfg(not(test))]
 #[tokio::main]
 async fn main() -> Result<()> {
    // Logging: RUST_LOG=info,bridge=debug,reqwest=warn ...
@@ -213,8 +183,11 @@ async fn main() -> Result<()> {
        .init();

    let cli = Cli::parse();
-    let cfg = config::load(cli.to_inputs())?;
-    log_config(&cfg);
+    let bootstrap = Config::load_with_overrides(cli.into_overrides())?;
+    info!("Loaded config: {:?}", bootstrap.config);
+    info!("{}", format_runtime_context(&bootstrap.context));
+
+    let cfg = bootstrap.config;

    let http = reqwest::Client::builder().build()?;
    let potato = PotatoClient::new(http.clone(), cfg.potatomesh.clone());
@@ -222,10 +195,6 @@ async fn main() -> Result<()> {
    let matrix = MatrixAppserviceClient::new(http.clone(), cfg.matrix.clone());
    matrix.health_check().await?;

-    let synapse_addr = SocketAddr::from(([0, 0, 0, 0], 41448));
-    let synapse_token = cfg.matrix.hs_token.clone();
-    let _synapse_handle = spawn_synapse_listener(synapse_addr, synapse_token);
-
    let state_path = &cfg.state.state_file;
    let mut state = BridgeState::load(state_path)?;
    info!("Loaded state: {:?}", state);
@@ -269,9 +238,7 @@ async fn handle_message(
        .send_formatted_message_as(&user_id, &body, &formatted_body)
        .await?;

-    info!("Bridged message: {:?}", msg);
    state.update_with(msg);
-    log_state_update(state);
    Ok(())
 }

@@ -585,57 +552,6 @@ mod tests {
        assert_eq!(params.since, None);
    }

-    #[test]
-    fn log_state_update_emits_info() {
-        let state = BridgeState::default();
-        log_state_update(&state);
-    }
-
-    #[test]
-    fn persist_state_writes_file() {
-        let tmp_dir = tempfile::tempdir().unwrap();
-        let file_path = tmp_dir.path().join("state.json");
-        let path_str = file_path.to_str().unwrap();
-
-        let state = BridgeState {
-            last_message_id: Some(42),
-            last_rx_time: Some(123),
-            last_rx_time_ids: vec![42],
-            last_checked_at: None,
-        };
-
-        persist_state(&state, path_str);
-
-        let loaded = BridgeState::load(path_str).unwrap();
-        assert_eq!(loaded.last_message_id, Some(42));
-    }
-
-    #[test]
-    fn persist_state_logs_on_error() {
-        let tmp_dir = tempfile::tempdir().unwrap();
-        let dir_path = tmp_dir.path().to_str().unwrap();
-        let state = BridgeState::default();
-
-        // Writing to a directory path should trigger the error branch.
-        persist_state(&state, dir_path);
-    }
-
-    #[tokio::test]
-    async fn spawn_synapse_listener_starts_task() {
-        let addr = SocketAddr::from(([127, 0, 0, 1], 0));
-        let handle = spawn_synapse_listener(addr, "HS_TOKEN".to_string());
-        tokio::time::sleep(Duration::from_millis(10)).await;
-        handle.abort();
-    }
-
-    #[tokio::test]
-    async fn spawn_synapse_listener_logs_error_on_bind_failure() {
-        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let addr = listener.local_addr().unwrap();
-        let handle = spawn_synapse_listener(addr, "HS_TOKEN".to_string());
-        let _ = handle.await;
-    }
-
    #[tokio::test]
    async fn poll_once_leaves_state_unchanged_without_messages() {
        let tmp_dir = tempfile::tempdir().unwrap();
@@ -659,7 +575,6 @@ mod tests {
        let matrix_cfg = MatrixConfig {
            homeserver: server.url(),
            as_token: "AS_TOKEN".to_string(),
-            hs_token: "HS_TOKEN".to_string(),
            server_name: "example.org".to_string(),
            room_id: "!roomid:example.org".to_string(),
        };
@@ -709,7 +624,6 @@ mod tests {
        let matrix_cfg = MatrixConfig {
            homeserver: server.url(),
            as_token: "AS_TOKEN".to_string(),
-            hs_token: "HS_TOKEN".to_string(),
            server_name: "example.org".to_string(),
            room_id: "!roomid:example.org".to_string(),
        };
@@ -739,7 +653,6 @@ mod tests {
        let matrix_cfg = MatrixConfig {
            homeserver: server.url(),
            as_token: "AS_TOKEN".to_string(),
-            hs_token: "HS_TOKEN".to_string(),
            server_name: "example.org".to_string(),
            room_id: "!roomid:example.org".to_string(),
        };
@@ -759,8 +672,7 @@ mod tests {

        let mock_register = server
            .mock("POST", "/_matrix/client/v3/register")
-            .match_query("kind=user")
-            .match_header("authorization", "Bearer AS_TOKEN")
+            .match_query("kind=user&access_token=AS_TOKEN")
            .with_status(200)
            .create();

@@ -769,8 +681,7 @@ mod tests {
                "POST",
                format!("/_matrix/client/v3/rooms/{}/join", encoded_room).as_str(),
            )
-            .match_query(format!("user_id={}", encoded_user).as_str())
-            .match_header("authorization", "Bearer AS_TOKEN")
+            .match_query(format!("user_id={}&access_token=AS_TOKEN", encoded_user).as_str())
            .with_status(200)
            .create();

@@ -779,8 +690,7 @@ mod tests {
                "PUT",
                format!("/_matrix/client/v3/profile/{}/displayname", encoded_user).as_str(),
            )
-            .match_query(format!("user_id={}", encoded_user).as_str())
-            .match_header("authorization", "Bearer AS_TOKEN")
+            .match_query(format!("user_id={}&access_token=AS_TOKEN", encoded_user).as_str())
            .match_body(mockito::Matcher::PartialJson(serde_json::json!({
                "displayname": "Test Node (TN)"
            })))
@@ -802,8 +712,7 @@ mod tests {
                )
                .as_str(),
            )
-            .match_query(format!("user_id={}", encoded_user).as_str())
-            .match_header("authorization", "Bearer AS_TOKEN")
+            .match_query(format!("user_id={}&access_token=AS_TOKEN", encoded_user).as_str())
            .match_body(mockito::Matcher::PartialJson(serde_json::json!({
                "msgtype": "m.text",
                "body": "`[868][MF][TEST]` Ping",
@@ -828,4 +737,20 @@ mod tests {

        assert_eq!(state.last_message_id, Some(100));
    }
+
+    #[test]
+    fn format_runtime_context_includes_flags() {
+        let context = config::RuntimeContext {
+            in_container: true,
+            container_defaults: false,
+            config_path: "/app/Config.toml".to_string(),
+            secrets_dir: Some(std::path::PathBuf::from("/run/secrets")),
+        };
+
+        let rendered = format_runtime_context(&context);
+        assert!(rendered.contains("in_container=true"));
+        assert!(rendered.contains("container_defaults=false"));
+        assert!(rendered.contains("/app/Config.toml"));
+        assert!(rendered.contains("/run/secrets"));
+    }
 }
@@ -66,6 +66,10 @@ impl MatrixAppserviceClient {
        format!("@{}:{}", localpart, self.cfg.server_name)
    }

+    fn auth_query(&self) -> String {
+        format!("access_token={}", urlencoding::encode(&self.cfg.as_token))
+    }
+
    /// Ensure the puppet user exists (register via appservice registration).
    pub async fn ensure_user_registered(&self, localpart: &str) -> anyhow::Result<()> {
        #[derive(Serialize)]
@@ -76,8 +80,9 @@ impl MatrixAppserviceClient {
        }

        let url = format!(
-            "{}/_matrix/client/v3/register?kind=user",
-            self.cfg.homeserver
+            "{}/_matrix/client/v3/register?kind=user&{}",
+            self.cfg.homeserver,
+            self.auth_query()
        );

        let body = RegisterReq {
@@ -85,13 +90,7 @@ impl MatrixAppserviceClient {
            username: localpart,
        };

-        let resp = self
-            .http
-            .post(&url)
-            .bearer_auth(&self.cfg.as_token)
-            .json(&body)
-            .send()
-            .await?;
+        let resp = self.http.post(&url).json(&body).send().await?;
        if resp.status().is_success() {
            Ok(())
        } else {
@@ -110,21 +109,18 @@ impl MatrixAppserviceClient {

        let encoded_user = urlencoding::encode(user_id);
        let url = format!(
-            "{}/_matrix/client/v3/profile/{}/displayname?user_id={}",
-            self.cfg.homeserver, encoded_user, encoded_user
+            "{}/_matrix/client/v3/profile/{}/displayname?user_id={}&{}",
+            self.cfg.homeserver,
+            encoded_user,
+            encoded_user,
+            self.auth_query()
        );

        let body = DisplayNameReq {
            displayname: display_name,
        };

-        let resp = self
-            .http
-            .put(&url)
-            .bearer_auth(&self.cfg.as_token)
-            .json(&body)
-            .send()
-            .await?;
+        let resp = self.http.put(&url).json(&body).send().await?;
        if resp.status().is_success() {
            Ok(())
        } else {
@@ -146,17 +142,14 @@ impl MatrixAppserviceClient {
        let encoded_room = urlencoding::encode(&self.cfg.room_id);
        let encoded_user = urlencoding::encode(user_id);
        let url = format!(
-            "{}/_matrix/client/v3/rooms/{}/join?user_id={}",
-            self.cfg.homeserver, encoded_room, encoded_user
+            "{}/_matrix/client/v3/rooms/{}/join?user_id={}&{}",
+            self.cfg.homeserver,
+            encoded_room,
+            encoded_user,
+            self.auth_query()
        );

-        let resp = self
-            .http
-            .post(&url)
-            .bearer_auth(&self.cfg.as_token)
-            .json(&JoinReq {})
-            .send()
-            .await?;
+        let resp = self.http.post(&url).json(&JoinReq {}).send().await?;
        if resp.status().is_success() {
            Ok(())
        } else {
@@ -192,8 +185,12 @@ impl MatrixAppserviceClient {
        let encoded_user = urlencoding::encode(user_id);

        let url = format!(
-            "{}/_matrix/client/v3/rooms/{}/send/m.room.message/{}?user_id={}",
-            self.cfg.homeserver, encoded_room, txn_id, encoded_user
+            "{}/_matrix/client/v3/rooms/{}/send/m.room.message/{}?user_id={}&{}",
+            self.cfg.homeserver,
+            encoded_room,
+            txn_id,
+            encoded_user,
+            self.auth_query()
        );

        let content = MsgContent {
@@ -203,13 +200,7 @@ impl MatrixAppserviceClient {
            formatted_body,
        };

-        let resp = self
-            .http
-            .put(&url)
-            .bearer_auth(&self.cfg.as_token)
-            .json(&content)
-            .send()
-            .await?;
+        let resp = self.http.put(&url).json(&content).send().await?;

        if !resp.status().is_success() {
            let status = resp.status();
@@ -241,7 +232,6 @@ mod tests {
        MatrixConfig {
            homeserver: "https://matrix.example.org".to_string(),
            as_token: "AS_TOKEN".to_string(),
-            hs_token: "HS_TOKEN".to_string(),
            server_name: "example.org".to_string(),
            room_id: "!roomid:example.org".to_string(),
        }
@@ -302,6 +292,16 @@ mod tests {
        assert!(result.is_err());
    }

+    #[test]
+    fn auth_query_contains_access_token() {
+        let http = reqwest::Client::builder().build().unwrap();
+        let client = MatrixAppserviceClient::new(http, dummy_cfg());
+
+        let q = client.auth_query();
+        assert!(q.starts_with("access_token="));
+        assert!(q.contains("AS_TOKEN"));
+    }
+
    #[test]
    fn test_new_matrix_client() {
        let http_client = reqwest::Client::new();
@@ -317,8 +317,7 @@ mod tests {
        let mut server = mockito::Server::new_async().await;
        let mock = server
            .mock("POST", "/_matrix/client/v3/register")
-            .match_query("kind=user")
-            .match_header("authorization", "Bearer AS_TOKEN")
+            .match_query("kind=user&access_token=AS_TOKEN")
            .with_status(200)
            .create();

@@ -336,8 +335,7 @@ mod tests {
        let mut server = mockito::Server::new_async().await;
        let mock = server
            .mock("POST", "/_matrix/client/v3/register")
-            .match_query("kind=user")
-            .match_header("authorization", "Bearer AS_TOKEN")
+            .match_query("kind=user&access_token=AS_TOKEN")
            .with_status(400) // M_USER_IN_USE
            .create();

@@ -355,13 +353,12 @@ mod tests {
        let mut server = mockito::Server::new_async().await;
        let user_id = "@test:example.org";
        let encoded_user = urlencoding::encode(user_id);
-        let query = format!("user_id={}", encoded_user);
+        let query = format!("user_id={}&access_token=AS_TOKEN", encoded_user);
        let path = format!("/_matrix/client/v3/profile/{}/displayname", encoded_user);

        let mock = server
            .mock("PUT", path.as_str())
            .match_query(query.as_str())
-            .match_header("authorization", "Bearer AS_TOKEN")
            .with_status(200)
            .create();

@@ -379,13 +376,12 @@ mod tests {
        let mut server = mockito::Server::new_async().await;
        let user_id = "@test:example.org";
        let encoded_user = urlencoding::encode(user_id);
-        let query = format!("user_id={}", encoded_user);
+        let query = format!("user_id={}&access_token=AS_TOKEN", encoded_user);
        let path = format!("/_matrix/client/v3/profile/{}/displayname", encoded_user);

        let mock = server
            .mock("PUT", path.as_str())
            .match_query(query.as_str())
-            .match_header("authorization", "Bearer AS_TOKEN")
            .with_status(500)
            .create();

@@ -405,13 +401,12 @@ mod tests {
        let room_id = "!roomid:example.org";
        let encoded_user = urlencoding::encode(user_id);
        let encoded_room = urlencoding::encode(room_id);
-        let query = format!("user_id={}", encoded_user);
+        let query = format!("user_id={}&access_token=AS_TOKEN", encoded_user);
        let path = format!("/_matrix/client/v3/rooms/{}/join", encoded_room);

        let mock = server
            .mock("POST", path.as_str())
            .match_query(query.as_str())
-            .match_header("authorization", "Bearer AS_TOKEN")
            .with_status(200)
            .create();

@@ -432,13 +427,12 @@ mod tests {
        let room_id = "!roomid:example.org";
        let encoded_user = urlencoding::encode(user_id);
        let encoded_room = urlencoding::encode(room_id);
-        let query = format!("user_id={}", encoded_user);
+        let query = format!("user_id={}&access_token=AS_TOKEN", encoded_user);
        let path = format!("/_matrix/client/v3/rooms/{}/join", encoded_room);

        let mock = server
            .mock("POST", path.as_str())
            .match_query(query.as_str())
-            .match_header("authorization", "Bearer AS_TOKEN")
            .with_status(403)
            .create();

@@ -467,7 +461,7 @@ mod tests {
            MatrixAppserviceClient::new(reqwest::Client::new(), cfg)
        };
        let txn_id = client.txn_counter.load(Ordering::SeqCst);
-        let query = format!("user_id={}", encoded_user);
+        let query = format!("user_id={}&access_token=AS_TOKEN", encoded_user);
        let path = format!(
            "/_matrix/client/v3/rooms/{}/send/m.room.message/{}",
            encoded_room, txn_id
@@ -476,7 +470,6 @@ mod tests {
        let mock = server
            .mock("PUT", path.as_str())
            .match_query(query.as_str())
-            .match_header("authorization", "Bearer AS_TOKEN")
            .match_body(mockito::Matcher::PartialJson(serde_json::json!({
                "msgtype": "m.text",
                "body": "`[meta]` hello",
@@ -1,289 +0,0 @@
-// Copyright © 2025-26 l5yth & contributors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use axum::{
-    extract::{Path, Query, State},
-    http::{header::AUTHORIZATION, HeaderMap, StatusCode},
-    response::IntoResponse,
-    routing::put,
-    Json, Router,
-};
-use serde_json::Value;
-use std::net::SocketAddr;
-use tracing::info;
-
-#[derive(Clone)]
-struct SynapseState {
-    hs_token: String,
-}
-
-#[derive(serde::Deserialize)]
-struct AuthQuery {
-    access_token: Option<String>,
-}
-
-/// Pull access tokens from supported auth headers.
-fn extract_access_token(headers: &HeaderMap) -> Option<String> {
-    if let Some(value) = headers.get(AUTHORIZATION) {
-        if let Ok(raw) = value.to_str() {
-            if let Some(token) = raw.strip_prefix("Bearer ") {
-                return Some(token.trim().to_string());
-            }
-            if let Some(token) = raw.strip_prefix("bearer ") {
-                return Some(token.trim().to_string());
-            }
-        }
-    }
-    if let Some(value) = headers.get("x-access-token") {
-        if let Ok(raw) = value.to_str() {
-            return Some(raw.trim().to_string());
-        }
-    }
-    None
-}
-
-/// Compare tokens in constant time to avoid timing leakage.
-fn constant_time_eq(a: &str, b: &str) -> bool {
-    let a_bytes = a.as_bytes();
-    let b_bytes = b.as_bytes();
-    let max_len = std::cmp::max(a_bytes.len(), b_bytes.len());
-    let mut diff = (a_bytes.len() ^ b_bytes.len()) as u8;
-
-    for idx in 0..max_len {
-        let left = *a_bytes.get(idx).unwrap_or(&0);
-        let right = *b_bytes.get(idx).unwrap_or(&0);
-        diff |= left ^ right;
-    }
-
-    diff == 0
-}
-
-/// Captures inbound Synapse transaction payloads for logging.
-#[derive(Debug)]
-struct SynapseResponse {
-    txn_id: String,
-    payload: Value,
-}
-
-/// Build the router that handles Synapse appservice transactions.
-fn build_router(state: SynapseState) -> Router {
-    Router::new()
-        .route(
-            "/_matrix/appservice/v1/transactions/:txn_id",
-            put(handle_transaction),
-        )
-        .with_state(state)
-}
-
-/// Handle inbound transaction callbacks from Synapse.
-async fn handle_transaction(
-    Path(txn_id): Path<String>,
-    State(state): State<SynapseState>,
-    Query(auth): Query<AuthQuery>,
-    headers: HeaderMap,
-    Json(payload): Json<Value>,
-) -> impl IntoResponse {
-    let header_token = extract_access_token(&headers);
-    let token_matches = if let Some(token) = header_token.as_deref() {
-        constant_time_eq(token, &state.hs_token)
-    } else {
-        auth.access_token
-            .as_deref()
-            .is_some_and(|token| constant_time_eq(token, &state.hs_token))
-    };
-    if !token_matches {
-        return (StatusCode::UNAUTHORIZED, Json(serde_json::json!({})));
-    }
-    let response = SynapseResponse { txn_id, payload };
-    info!(
-        "Status response: SynapseResponse {{ txn_id: {}, payload: {:?} }}",
-        response.txn_id, response.payload
-    );
-    (StatusCode::OK, Json(serde_json::json!({})))
-}
-
-/// Listen for Synapse callbacks on the configured address.
-pub async fn run_synapse_listener(addr: SocketAddr, hs_token: String) -> anyhow::Result<()> {
-    let app = build_router(SynapseState { hs_token });
-    let listener = tokio::net::TcpListener::bind(addr).await?;
-    info!("Synapse listener bound on {}", addr);
-    axum::serve(listener, app).await?;
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use axum::body::Body;
-    use axum::http::Request;
-    use tokio::time::{sleep, Duration};
-    use tower::ServiceExt;
-
-    #[tokio::test]
-    async fn transactions_endpoint_accepts_payloads() {
-        let app = build_router(SynapseState {
-            hs_token: "HS_TOKEN".to_string(),
-        });
-        let payload = serde_json::json!({
-            "events": [],
-            "txn_id": "123"
-        });
-
-        let response = app
-            .oneshot(
-                Request::builder()
-                    .method("PUT")
-                    .uri("/_matrix/appservice/v1/transactions/123")
-                    .header("authorization", "Bearer HS_TOKEN")
-                    .header("content-type", "application/json")
-                    .body(Body::from(payload.to_string()))
-                    .unwrap(),
-            )
-            .await
-            .unwrap();
-
-        assert_eq!(response.status(), StatusCode::OK);
-        let body = axum::body::to_bytes(response.into_body(), usize::MAX)
-            .await
-            .unwrap();
-        assert_eq!(body.as_ref(), b"{}");
-    }
-
-    #[tokio::test]
-    async fn transactions_endpoint_rejects_missing_token() {
-        let app = build_router(SynapseState {
-            hs_token: "HS_TOKEN".to_string(),
-        });
-        let payload = serde_json::json!({
-            "events": [],
-            "txn_id": "123"
-        });
-
-        let response = app
-            .oneshot(
-                Request::builder()
-                    .method("PUT")
-                    .uri("/_matrix/appservice/v1/transactions/123")
-                    .header("content-type", "application/json")
-                    .body(Body::from(payload.to_string()))
-                    .unwrap(),
-            )
-            .await
-            .unwrap();
-
-        assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
-        let body = axum::body::to_bytes(response.into_body(), usize::MAX)
-            .await
-            .unwrap();
-        assert_eq!(body.as_ref(), b"{}");
-    }
-
-    #[tokio::test]
-    async fn transactions_endpoint_rejects_wrong_token() {
-        let app = build_router(SynapseState {
-            hs_token: "HS_TOKEN".to_string(),
-        });
-        let payload = serde_json::json!({
-            "events": [],
-            "txn_id": "123"
-        });
-
-        let response = app
-            .oneshot(
-                Request::builder()
-                    .method("PUT")
-                    .uri("/_matrix/appservice/v1/transactions/123")
-                    .header("authorization", "Bearer NOPE")
-                    .header("content-type", "application/json")
-                    .body(Body::from(payload.to_string()))
-                    .unwrap(),
-            )
-            .await
-            .unwrap();
-
-        assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
-        let body = axum::body::to_bytes(response.into_body(), usize::MAX)
-            .await
-            .unwrap();
-        assert_eq!(body.as_ref(), b"{}");
-    }
-
-    #[tokio::test]
-    async fn transactions_endpoint_accepts_legacy_query_token() {
-        let app = build_router(SynapseState {
-            hs_token: "HS_TOKEN".to_string(),
-        });
-        let payload = serde_json::json!({
-            "events": [],
-            "txn_id": "125"
-        });
-
-        let response = app
-            .oneshot(
-                Request::builder()
-                    .method("PUT")
-                    .uri("/_matrix/appservice/v1/transactions/125?access_token=HS_TOKEN")
-                    .header("content-type", "application/json")
-                    .body(Body::from(payload.to_string()))
-                    .unwrap(),
-            )
-            .await
-            .unwrap();
-
-        assert_eq!(response.status(), StatusCode::OK);
-    }
-
-    #[tokio::test]
-    async fn transactions_endpoint_accepts_x_access_token_header() {
-        let app = build_router(SynapseState {
-            hs_token: "HS_TOKEN".to_string(),
-        });
-        let payload = serde_json::json!({
-            "events": [],
-            "txn_id": "126"
-        });
-
-        let response = app
-            .oneshot(
-                Request::builder()
-                    .method("PUT")
-                    .uri("/_matrix/appservice/v1/transactions/126")
-                    .header("x-access-token", "HS_TOKEN")
-                    .header("content-type", "application/json")
-                    .body(Body::from(payload.to_string()))
-                    .unwrap(),
-            )
-            .await
-            .unwrap();
-
-        assert_eq!(response.status(), StatusCode::OK);
-    }
-
-    #[tokio::test]
-    async fn run_synapse_listener_starts_and_can_abort() {
-        let addr = SocketAddr::from(([127, 0, 0, 1], 0));
-        let handle =
-            tokio::spawn(async move { run_synapse_listener(addr, "HS_TOKEN".to_string()).await });
-        sleep(Duration::from_millis(10)).await;
-        handle.abort();
-    }
-
-    #[tokio::test]
-    async fn run_synapse_listener_returns_error_on_bind_failure() {
-        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let addr = listener.local_addr().unwrap();
-        let result = run_synapse_listener(addr, "HS_TOKEN".to_string()).await;
-        assert!(result.is_err());
-    }
-}
@@ -1,71 +0,0 @@
-# Copyright © 2025-26 l5yth & contributors
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-require "base64"
-require "meshtastic"
-require "openssl"
-
-channel_name = "BerlinMesh"
-
-# === Inputs from your packet ===
-cipher_b64 = "Q1R7tgI5yXzMXu/3"
-psk_b64 = "Nmh7EooP2Tsc+7pvPwXLcEDDuYhk+fBo2GLnbA1Y1sg="
-packet_id = 3_915_687_257
-from_id = "!9e95cf60"
-channel = 35
-
-# === Decode key and ciphertext ===
-key = Base64.decode64(psk_b64)       # 32 bytes -> AES-256
-ciphertext = Base64.decode64(cipher_b64)
-
-# === Derive numeric node id from Meshtastic-style string ===
-hex_str = from_id.sub(/^!/, "")          # "9e95cf60"
-from_node = hex_str.to_i(16)               # 0x9e95cf60
-
-# === Build nonce exactly like Meshtastic CryptoEngine ===
-# Little-endian 64-bit packet ID + little-endian 32-bit node ID + 4 zero bytes
-nonce = [packet_id].pack("Q<")            # uint64, little-endian
-nonce += [from_node].pack("L<")            # uint32, little-endian
-nonce += "\x00" * 4                        # extraNonce == 0 for PSK channel msgs
-
-raise "Nonce must be 16 bytes" unless nonce.bytesize == 16
-raise "Key must be 32 bytes" unless key.bytesize == 32
-
-# === AES-256-CTR decrypt ===
-cipher = OpenSSL::Cipher.new("aes-256-ctr")
-cipher.decrypt
-cipher.key = key
-cipher.iv = nonce
-
-plaintext = cipher.update(ciphertext) + cipher.final
-
-# At this point `plaintext` is the raw Meshtastic protobuf payload
-plaintext = plaintext.bytes.pack("C*")
-data = Meshtastic::Data.decode(plaintext)
-msg = data.payload.dup.force_encoding("UTF-8")
-puts msg
-
-# Gets channel number from name and psk
-def channel_hash(name, psk_b64)
-  name_bytes = name.b          # UTF-8 bytes
-  psk_bytes = Base64.decode64(psk_b64)
-
-  hn = name_bytes.bytes.reduce(0) { |acc, b| acc ^ b }   # XOR over name
-  hp = psk_bytes.bytes.reduce(0) { |acc, b| acc ^ b }    # XOR over PSK
-
-  (hn ^ hp) & 0xFF
-end
-
-channel_h = channel_hash(channel_name, psk_b64)
-puts channel_h
-puts channel == channel_h
@@ -1,491 +0,0 @@
-hash,name
-0,Mesh1
-1,DEMO
-1,Downlink1
-1,NightNet
-1,Sideband1
-2,CommsNet
-2,Mesh3
-2,PulseNet
-3,LightNet
-3,Mesh2
-3,WestStar
-3,WolfMesh
-4,Mesh5
-4,OPERATIONS
-4,Rescue1
-4,SignalFire
-5,Base2
-5,DeltaNet
-5,Mesh4
-5,MeshMunich
-6,Base1
-7,MeshTest
-7,Rescue2
-7,ZuluMesh
-8,CourierNet
-8,Fire2
-8,Grid2
-8,LongFast
-8,RescueTeam
-9,AlphaNet
-9,MeshGrid
-10,TestBerlin
-10,WaWi
-11,Fire1
-11,Grid1
-12,FoxNet
-12,MeshRuhr
-12,RadioNet
-13,Signal1
-13,Zone1
-14,BetaBerlin
-14,Signal2
-14,TangoNet
-14,Zone2
-15,BerlinMesh
-15,LongSlow
-15,MeshBerlin
-15,Zone3
-16,CQ
-16,EchoMesh
-16,Freq2
-16,KiloMesh
-16,Node2
-16,PhoenixNet
-16,Repeater2
-17,FoxtrotNet
-17,Node3
-18,LoRa
-19,Freq1
-19,HarmonyNet
-19,Node1
-19,RavenNet
-19,Repeater1
-20,NomadNet
-20,SENSOR
-20,TEST
-20,test
-21,BravoNet
-21,EastStar
-21,MeshCollective
-21,SunNet
-22,Node4
-22,Uplink1
-23,EagleNet
-23,MeshHessen
-23,Node5
-24,MediumSlow
-24,Router1
-25,Checkpoint1
-25,HAMNet
-26,Checkpoint2
-26,GhostNet
-27,HQ
-27,Router2
-31,DemoBerlin
-31,FieldNet
-31,MediumFast
-32,Clinic
-32,Convoy
-32,Daylight
-32,Town
-33,Callisto
-33,CQ1
-33,Daybreak
-33,Demo
-33,East
-33,LoRaMesh
-33,Mist
-34,CQ2
-34,Freq
-34,Gold
-34,Link
-34,Repeater
-35,Aquila
-35,Doctor
-35,Echo
-35,Kilo
-35,Public
-35,Wyvern
-36,District
-36,Hessen
-36,Io
-36,LoRaTest
-36,Operations
-36,Shadow
-36,Unit
-37,Campfire
-37,City
-37,Outsider
-37,Sync
-38,Beacon
-38,Collective
-38,Harbor
-38,Lion
-38,Meteor
-39,Firebird
-39,Fireteam
-39,Quasar
-39,Snow
-39,Universe
-39,Uplink
-40,Checkpoint
-40,Galaxy
-40,Jaguar
-40,Sunset
-40,Zeta
-41,Hinterland
-41,HQ2
-41,Main
-41,Meshtastic
-41,Router
-41,Valley
-41,Wander
-41,Wolfpack
-42,HQ1
-42,Lizard
-42,Packet
-42,Sahara
-42,Tunnel
-43,Anaconda
-43,Basalt
-43,Blackout
-43,Crow
-43,Dusk
-43,Falcon
-43,Lima
-43,Müggelberg
-44,Arctic
-44,Backup
-44,Bronze
-44,Corvus
-44,Cosmos
-44,LoRaBerlin
-44,Neukölln
-44,Safari
-45,Breeze
-45,Burrow
-45,Gale
-45,Saturn
-46,Border
-46,Nest
-47,Borealis
-47,Mars
-47,Path
-47,Ranger
-48,Beat
-48,Berg
-48,Beta
-48,Downlink
-48,Hive
-48,Rhythm
-48,Saxony
-48,Sideband
-48,Wolf
-49,Asteroid
-49,Carbon
-49,Mesh
-50,Blizzard
-50,Runner
-51,Callsign
-51,Carpet
-51,Desert
-51,Dragon
-51,Friedrichshain
-51,Help
-51,Nebula
-51,Safe
-52,Amazon
-52,Fireline
-52,Haze
-52,LoRaHessen
-52,Platinum
-52,Sensor
-52,Test
-52,Zulu
-53,Nord
-53,Rescue
-53,Secure
-53,Silver
-54,Bear
-54,Hospital
-54,Munich
-54,Python
-54,Rain
-54,Wind
-54,Wolves
-55,Base
-55,Bolt
-55,Hawk
-55,Mirage
-55,Nightwatch
-55,Obsidian
-55,Rock
-55,Victor
-55,West
-56,Aurora
-56,Dune
-56,Iron
-56,Lava
-56,Nomads
-57,Copper
-57,Core
-57,Spectrum
-57,Summit
-58,Colony
-58,Fire
-58,Ganymede
-58,Grid
-58,Kraken
-58,Road
-58,Solstice
-58,Tundra
-59,911
-59,Forest
-59,Pack
-60,Berlin
-60,Chat
-60,Sierra
-60,Signal
-60,Wald
-60,Zone
-61,Alpine
-61,Bridge
-61,Camp
-61,Dortmund
-61,Frontier
-61,Jungle
-61,Peak
-62,Burner
-62,Dawn
-62,Europa
-62,Midnight
-62,Nightshift
-62,Prenzlauer
-62,Safety
-62,Sector
-62,Wanderer
-63,Distress
-63,Kiez
-63,Ruhr
-63,Team
-64,Epsilon
-64,Field
-64,Granite
-64,Orbit
-64,Trail
-64,Whisper
-65,Central
-65,Cologne
-65,Layer
-65,Relay
-65,Runners
-65,Stone
-65,Tempo
-66,Polar
-66,Woods
-67,Highway
-67,Kreuzberg
-67,Leopard
-67,Metro
-67,Omega
-67,Phantom
-68,Hamburg
-68,Hydra
-68,Medic
-68,Titan
-69,Command
-69,Control
-69,Gamma
-69,Ghost
-69,Mercury
-69,Oasis
-70,Diamond
-70,Ham
-70,HAM
-70,Leipzig
-70,Paramedic
-70,Savanna
-71,Frankfurt
-71,Gecko
-71,Jupiter
-71,Sensors
-71,SENSORS
-71,Sunrise
-72,Chameleon
-72,Eagle
-72,Hilltop
-72,Teufelsberg
-73,Firefly
-73,Steel
-74,Bravo
-74,Caravan
-74,Ost
-74,Süd
-75,Emergency
-75,EMERGENCY
-75,Nomad
-75,Watch
-76,Alert
-76,Bavaria
-76,Fog
-76,Harmony
-76,Raven
-77,Admin
-77,ADMIN
-77,Den
-77,Ice
-77,LoRaNet
-77,North
-77,SOS
-77,Sos
-77,Wanderers
-78,Foxtrot
-78,Med
-78,Ops
-79,Flock
-79,Phoenix
-79,PRIVATE
-79,Private
-79,Signals
-79,Tiger
-80,Commune
-80,Freedom
-80,Pluto
-80,Snake
-80,Squad
-80,Stuttgart
-81,Grassland
-81,Tango
-81,Union
-82,Comet
-82,Flash
-82,Lightning
-83,Cloud
-83,Equinox
-83,Firewatch
-83,Fox
-83,Radio
-83,Shelter
-84,Cheetah
-84,General
-84,Outpost
-84,Volcano
-85,Glacier
-85,Storm
-86,Alpha
-86,Owl
-86,Panther
-86,Prairie
-86,Thunder
-87,Courier
-87,Nexus
-87,South
-88,Ash
-88,River
-88,Syndicate
-89,Amateur
-89,Astro
-89,Avalanche
-89,Bonfire
-89,Draco
-89,Griffin
-89,Nightfall
-89,Shade
-89,Venus
-90,Charlie
-90,Delta
-90,Stratum
-90,Viper
-91,Bison
-91,Tal
-92,Network
-92,Scout
-93,Comms
-93,Fluss
-93,Group
-93,Hub
-93,Pulse
-93,Smoke
-94,Frost
-94,Rover
-94,Village
-95,Cobra
-95,Liberty
-95,Ridge
-97,DarkNet
-97,NightshiftNet
-97,Radio2
-97,Shelter2
-98,CampNet
-98,Radio1
-98,Shelter1
-98,TangoMesh
-99,BaseAlpha
-99,BerlinNet
-99,SouthStar
-100,CourierMesh
-100,Storm1
-101,Courier2
-101,GridNet
-101,OpsCenter
-102,Courier1
-103,Storm2
-104,HawkNet
-105,BearNet
-105,StarNet
-107,emergency
-107,ZuluNet
-108,Comms1
-108,DragonNet
-108,Hub1
-109,admin
-109,NightMesh
-110,MeshNet
-111,BaseCharlie
-111,Comms2
-111,GridSouth
-111,Hub2
-111,MeshNetwork
-111,WolfNet
-112,Layer1
-112,Relay1
-112,ShortFast
-113,OpsRoom
-114,Layer3
-114,MeshCologne
-115,Layer2
-115,Relay2
-115,SOSBerlin
-116,Command1
-116,Control1
-116,CrowNet
-116,MeshFrankfurt
-117,EmergencyBerlin
-117,GridNorth
-117,MeshLeipzig
-117,PacketNet
-119,Command2
-119,Control2
-119,MeshHamburg
-120,NomadMesh
-121,NorthStar
-121,Watch2
-122,CommandRoom
-122,ControlRoom
-122,SyncNet
-122,Watch1
-123,PacketRadio
-123,ShadowNet
-124,EchoNet
-124,KiloNet
-124,Med2
-124,Ops2
-125,FoxtrotMesh
-125,RepeaterHub
-126,MoonNet
-127,BaseBravo
-127,Med1
-127,Ops1
-127,WolfDen
@@ -1,736 +0,0 @@
-{
-  "59": [
-    "911",
-    "Forest",
-    "Pack"
-  ],
-  "77": [
-    "Admin",
-    "ADMIN",
-    "Den",
-    "Ice",
-    "LoRaNet",
-    "North",
-    "SOS",
-    "Sos",
-    "Wanderers"
-  ],
-  "109": [
-    "admin",
-    "NightMesh"
-  ],
-  "76": [
-    "Alert",
-    "Bavaria",
-    "Fog",
-    "Harmony",
-    "Raven"
-  ],
-  "86": [
-    "Alpha",
-    "Owl",
-    "Panther",
-    "Prairie",
-    "Thunder"
-  ],
-  "9": [
-    "AlphaNet",
-    "MeshGrid"
-  ],
-  "61": [
-    "Alpine",
-    "Bridge",
-    "Camp",
-    "Dortmund",
-    "Frontier",
-    "Jungle",
-    "Peak"
-  ],
-  "89": [
-    "Amateur",
-    "Astro",
-    "Avalanche",
-    "Bonfire",
-    "Draco",
-    "Griffin",
-    "Nightfall",
-    "Shade",
-    "Venus"
-  ],
-  "52": [
-    "Amazon",
-    "Fireline",
-    "Haze",
-    "LoRaHessen",
-    "Platinum",
-    "Sensor",
-    "Test",
-    "Zulu"
-  ],
-  "43": [
-    "Anaconda",
-    "Basalt",
-    "Blackout",
-    "Crow",
-    "Dusk",
-    "Falcon",
-    "Lima",
-    "Müggelberg"
-  ],
-  "35": [
-    "Aquila",
-    "Doctor",
-    "Echo",
-    "Kilo",
-    "Public",
-    "Wyvern"
-  ],
-  "44": [
-    "Arctic",
-    "Backup",
-    "Bronze",
-    "Corvus",
-    "Cosmos",
-    "LoRaBerlin",
-    "Neukölln",
-    "Safari"
-  ],
-  "88": [
-    "Ash",
-    "River",
-    "Syndicate"
-  ],
-  "49": [
-    "Asteroid",
-    "Carbon",
-    "Mesh"
-  ],
-  "56": [
-    "Aurora",
-    "Dune",
-    "Iron",
-    "Lava",
-    "Nomads"
-  ],
-  "55": [
-    "Base",
-    "Bolt",
-    "Hawk",
-    "Mirage",
-    "Nightwatch",
-    "Obsidian",
-    "Rock",
-    "Victor",
-    "West"
-  ],
-  "6": [
-    "Base1"
-  ],
-  "5": [
-    "Base2",
-    "DeltaNet",
-    "Mesh4",
-    "MeshMunich"
-  ],
-  "99": [
-    "BaseAlpha",
-    "BerlinNet",
-    "SouthStar"
-  ],
-  "127": [
-    "BaseBravo",
-    "Med1",
-    "Ops1",
-    "WolfDen"
-  ],
-  "111": [
-    "BaseCharlie",
-    "Comms2",
-    "GridSouth",
-    "Hub2",
-    "MeshNetwork",
-    "WolfNet"
-  ],
-  "38": [
-    "Beacon",
-    "Collective",
-    "Harbor",
-    "Lion",
-    "Meteor"
-  ],
-  "54": [
-    "Bear",
-    "Hospital",
-    "Munich",
-    "Python",
-    "Rain",
-    "Wind",
-    "Wolves"
-  ],
-  "105": [
-    "BearNet",
-    "StarNet"
-  ],
-  "48": [
-    "Beat",
-    "Berg",
-    "Beta",
-    "Downlink",
-    "Hive",
-    "Rhythm",
-    "Saxony",
-    "Sideband",
-    "Wolf"
-  ],
-  "60": [
-    "Berlin",
-    "Chat",
-    "Sierra",
-    "Signal",
-    "Wald",
-    "Zone"
-  ],
-  "15": [
-    "BerlinMesh",
-    "LongSlow",
-    "MeshBerlin",
-    "Zone3"
-  ],
-  "14": [
-    "BetaBerlin",
-    "Signal2",
-    "TangoNet",
-    "Zone2"
-  ],
-  "91": [
-    "Bison",
-    "Tal"
-  ],
-  "50": [
-    "Blizzard",
-    "Runner"
-  ],
-  "46": [
-    "Border",
-    "Nest"
-  ],
-  "47": [
-    "Borealis",
-    "Mars",
-    "Path",
-    "Ranger"
-  ],
-  "74": [
-    "Bravo",
-    "Caravan",
-    "Ost",
-    "Süd"
-  ],
-  "21": [
-    "BravoNet",
-    "EastStar",
-    "MeshCollective",
-    "SunNet"
-  ],
-  "45": [
-    "Breeze",
-    "Burrow",
-    "Gale",
-    "Saturn"
-  ],
-  "62": [
-    "Burner",
-    "Dawn",
-    "Europa",
-    "Midnight",
-    "Nightshift",
-    "Prenzlauer",
-    "Safety",
-    "Sector",
-    "Wanderer"
-  ],
-  "33": [
-    "Callisto",
-    "CQ1",
-    "Daybreak",
-    "Demo",
-    "East",
-    "LoRaMesh",
-    "Mist"
-  ],
-  "51": [
-    "Callsign",
-    "Carpet",
-    "Desert",
-    "Dragon",
-    "Friedrichshain",
-    "Help",
-    "Nebula",
-    "Safe"
-  ],
-  "37": [
-    "Campfire",
-    "City",
-    "Outsider",
-    "Sync"
-  ],
-  "98": [
-    "CampNet",
-    "Radio1",
-    "Shelter1",
-    "TangoMesh"
-  ],
-  "65": [
-    "Central",
-    "Cologne",
-    "Layer",
-    "Relay",
-    "Runners",
-    "Stone",
-    "Tempo"
-  ],
-  "72": [
-    "Chameleon",
-    "Eagle",
-    "Hilltop",
-    "Teufelsberg"
-  ],
-  "90": [
-    "Charlie",
-    "Delta",
-    "Stratum",
-    "Viper"
-  ],
-  "40": [
-    "Checkpoint",
-    "Galaxy",
-    "Jaguar",
-    "Sunset",
-    "Zeta"
-  ],
-  "25": [
-    "Checkpoint1",
-    "HAMNet"
-  ],
-  "26": [
-    "Checkpoint2",
-    "GhostNet"
-  ],
-  "84": [
-    "Cheetah",
-    "General",
-    "Outpost",
-    "Volcano"
-  ],
-  "32": [
-    "Clinic",
-    "Convoy",
-    "Daylight",
-    "Town"
-  ],
-  "83": [
-    "Cloud",
-    "Equinox",
-    "Firewatch",
-    "Fox",
-    "Radio",
-    "Shelter"
-  ],
-  "95": [
-    "Cobra",
-    "Liberty",
-    "Ridge"
-  ],
-  "58": [
-    "Colony",
-    "Fire",
-    "Ganymede",
-    "Grid",
-    "Kraken",
-    "Road",
-    "Solstice",
-    "Tundra"
-  ],
-  "82": [
-    "Comet",
-    "Flash",
-    "Lightning"
-  ],
-  "69": [
-    "Command",
-    "Control",
-    "Gamma",
-    "Ghost",
-    "Mercury",
-    "Oasis"
-  ],
-  "116": [
-    "Command1",
-    "Control1",
-    "CrowNet",
-    "MeshFrankfurt"
-  ],
-  "119": [
-    "Command2",
-    "Control2",
-    "MeshHamburg"
-  ],
-  "122": [
-    "CommandRoom",
-    "ControlRoom",
-    "SyncNet",
-    "Watch1"
-  ],
-  "93": [
-    "Comms",
-    "Fluss",
-    "Group",
-    "Hub",
-    "Pulse",
-    "Smoke"
-  ],
-  "108": [
-    "Comms1",
-    "DragonNet",
-    "Hub1"
-  ],
-  "2": [
-    "CommsNet",
-    "Mesh3",
-    "PulseNet"
-  ],
-  "80": [
-    "Commune",
-    "Freedom",
-    "Pluto",
-    "Snake",
-    "Squad",
-    "Stuttgart"
-  ],
-  "57": [
-    "Copper",
-    "Core",
-    "Spectrum",
-    "Summit"
-  ],
-  "87": [
-    "Courier",
-    "Nexus",
-    "South"
-  ],
-  "102": [
-    "Courier1"
-  ],
-  "101": [
-    "Courier2",
-    "GridNet",
-    "OpsCenter"
-  ],
-  "100": [
-    "CourierMesh",
-    "Storm1"
-  ],
-  "8": [
-    "CourierNet",
-    "Fire2",
-    "Grid2",
-    "LongFast",
-    "RescueTeam"
-  ],
-  "16": [
-    "CQ",
-    "EchoMesh",
-    "Freq2",
-    "KiloMesh",
-    "Node2",
-    "PhoenixNet",
-    "Repeater2"
-  ],
-  "34": [
-    "CQ2",
-    "Freq",
-    "Gold",
-    "Link",
-    "Repeater"
-  ],
-  "97": [
-    "DarkNet",
-    "NightshiftNet",
-    "Radio2",
-    "Shelter2"
-  ],
-  "1": [
-    "DEMO",
-    "Downlink1",
-    "NightNet",
-    "Sideband1"
-  ],
-  "31": [
-    "DemoBerlin",
-    "FieldNet",
-    "MediumFast"
-  ],
-  "70": [
-    "Diamond",
-    "Ham",
-    "HAM",
-    "Leipzig",
-    "Paramedic",
-    "Savanna"
-  ],
-  "63": [
-    "Distress",
-    "Kiez",
-    "Ruhr",
-    "Team"
-  ],
-  "36": [
-    "District",
-    "Hessen",
-    "Io",
-    "LoRaTest",
-    "Operations",
-    "Shadow",
-    "Unit"
-  ],
-  "23": [
-    "EagleNet",
-    "MeshHessen",
-    "Node5"
-  ],
-  "124": [
-    "EchoNet",
-    "KiloNet",
-    "Med2",
-    "Ops2"
-  ],
-  "75": [
-    "Emergency",
-    "EMERGENCY",
-    "Nomad",
-    "Watch"
-  ],
-  "107": [
-    "emergency",
-    "ZuluNet"
-  ],
-  "117": [
-    "EmergencyBerlin",
-    "GridNorth",
-    "MeshLeipzig",
-    "PacketNet"
-  ],
-  "64": [
-    "Epsilon",
-    "Field",
-    "Granite",
-    "Orbit",
-    "Trail",
-    "Whisper"
-  ],
-  "11": [
-    "Fire1",
-    "Grid1"
-  ],
-  "39": [
-    "Firebird",
-    "Fireteam",
-    "Quasar",
-    "Snow",
-    "Universe",
-    "Uplink"
-  ],
-  "73": [
-    "Firefly",
-    "Steel"
-  ],
-  "79": [
-    "Flock",
-    "Phoenix",
-    "PRIVATE",
-    "Private",
-    "Signals",
-    "Tiger"
-  ],
-  "12": [
-    "FoxNet",
-    "MeshRuhr",
-    "RadioNet"
-  ],
-  "78": [
-    "Foxtrot",
-    "Med",
-    "Ops"
-  ],
-  "125": [
-    "FoxtrotMesh",
-    "RepeaterHub"
-  ],
-  "17": [
-    "FoxtrotNet",
-    "Node3"
-  ],
-  "71": [
-    "Frankfurt",
-    "Gecko",
-    "Jupiter",
-    "Sensors",
-    "SENSORS",
-    "Sunrise"
-  ],
-  "19": [
-    "Freq1",
-    "HarmonyNet",
-    "Node1",
-    "RavenNet",
-    "Repeater1"
-  ],
-  "94": [
-    "Frost",
-    "Rover",
-    "Village"
-  ],
-  "85": [
-    "Glacier",
-    "Storm"
-  ],
-  "81": [
-    "Grassland",
-    "Tango",
-    "Union"
-  ],
-  "68": [
-    "Hamburg",
-    "Hydra",
-    "Medic",
-    "Titan"
-  ],
-  "104": [
-    "HawkNet"
-  ],
-  "67": [
-    "Highway",
-    "Kreuzberg",
-    "Leopard",
-    "Metro",
-    "Omega",
-    "Phantom"
-  ],
-  "41": [
-    "Hinterland",
-    "HQ2",
-    "Main",
-    "Meshtastic",
-    "Router",
-    "Valley",
-    "Wander",
-    "Wolfpack"
-  ],
-  "27": [
-    "HQ",
-    "Router2"
-  ],
-  "42": [
-    "HQ1",
-    "Lizard",
-    "Packet",
-    "Sahara",
-    "Tunnel"
-  ],
-  "112": [
-    "Layer1",
-    "Relay1",
-    "ShortFast"
-  ],
-  "115": [
-    "Layer2",
-    "Relay2",
-    "SOSBerlin"
-  ],
-  "114": [
-    "Layer3",
-    "MeshCologne"
-  ],
-  "3": [
-    "LightNet",
-    "Mesh2",
-    "WestStar",
-    "WolfMesh"
-  ],
-  "18": [
-    "LoRa"
-  ],
-  "24": [
-    "MediumSlow",
-    "Router1"
-  ],
-  "0": [
-    "Mesh1"
-  ],
-  "4": [
-    "Mesh5",
-    "OPERATIONS",
-    "Rescue1",
-    "SignalFire"
-  ],
-  "110": [
-    "MeshNet"
-  ],
-  "7": [
-    "MeshTest",
-    "Rescue2",
-    "ZuluMesh"
-  ],
-  "126": [
-    "MoonNet"
-  ],
-  "92": [
-    "Network",
-    "Scout"
-  ],
-  "22": [
-    "Node4",
-    "Uplink1"
-  ],
-  "120": [
-    "NomadMesh"
-  ],
-  "20": [
-    "NomadNet",
-    "SENSOR",
-    "TEST",
-    "test"
-  ],
-  "53": [
-    "Nord",
-    "Rescue",
-    "Secure",
-    "Silver"
-  ],
-  "121": [
-    "NorthStar",
-    "Watch2"
-  ],
-  "113": [
-    "OpsRoom"
-  ],
-  "123": [
-    "PacketRadio",
-    "ShadowNet"
-  ],
-  "66": [
-    "Polar",
-    "Woods"
-  ],
-  "13": [
-    "Signal1",
-    "Zone1"
-  ],
-  "103": [
-    "Storm2"
-  ],
-  "10": [
-    "TestBerlin",
-    "WaWi"
-  ]
-}
@@ -1,134 +0,0 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-# Copyright © 2025-26 l5yth & contributors
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-require "base64"
-require "json"
-require "csv"
-
-# --- CONFIG --------------------------------------------------------
-
-# The PSK you want. Here: public mesh, "AQ==" (0x01).
-PSK_B64 = ENV.fetch("PSK_B64", "AQ==")
-
-# 1000 potential channel candidate names for rainbow indices.
-CANDIDATE_NAMES = %w[
-  911 Admin ADMIN admin Alert Alpha AlphaNet Alpine Amateur Amazon Anaconda Aquila Arctic Ash Asteroid Astro Aurora Avalanche Backup Basalt Base Base1 Base2 BaseAlpha BaseBravo BaseCharlie Bavaria Beacon Bear BearNet Beat Berg Berlin BerlinMesh BerlinNet Beta BetaBerlin Bison Blackout Blizzard Bolt Bonfire Border Borealis Bravo BravoNet Breeze Bridge Bronze Burner Burrow Callisto Callsign Camp Campfire CampNet Caravan Carbon Carpet Central Chameleon Charlie Chat Checkpoint Checkpoint1 Checkpoint2 Cheetah City Clinic Cloud Cobra Collective Cologne Colony Comet Command Command1 Command2 CommandRoom Comms Comms1 Comms2 CommsNet Commune Control Control1 Control2 ControlRoom Convoy Copper Core Corvus Cosmos Courier Courier1 Courier2 CourierMesh CourierNet CQ CQ1 CQ2 Crow CrowNet DarkNet Dawn Daybreak Daylight Delta DeltaNet Demo DEMO DemoBerlin Den Desert Diamond Distress District Doctor Dortmund Downlink Downlink1 Draco Dragon DragonNet Dune Dusk Eagle EagleNet East EastStar Echo EchoMesh EchoNet Emergency emergency EMERGENCY EmergencyBerlin Epsilon Equinox Europa Falcon Field FieldNet Fire Fire1 Fire2 Firebird Firefly Fireline Fireteam Firewatch Flash Flock Fluss Fog Forest Fox FoxNet Foxtrot FoxtrotMesh FoxtrotNet Frankfurt Freedom Freq Freq1 Freq2 Friedrichshain Frontier Frost Galaxy Gale Gamma Ganymede Gecko General Ghost GhostNet Glacier Gold Granite Grassland Grid Grid1 Grid2 GridNet GridNorth GridSouth Griffin Group Ham HAM Hamburg HAMNet Harbor Harmony HarmonyNet Hawk HawkNet Haze Help Hessen Highway Hilltop Hinterland Hive Hospital HQ HQ1 HQ2 Hub Hub1 Hub2 Hydra Ice Io Iron Jaguar Jungle Jupiter Kiez Kilo KiloMesh KiloNet Kraken Kreuzberg Lava Layer Layer1 Layer2 Layer3 Leipzig Leopard Liberty LightNet Lightning Lima Link Lion Lizard LongFast LongSlow LoRa LoRaBerlin LoRaHessen LoRaMesh LoRaNet LoRaTest Main Mars Med Med1 Med2 Medic MediumFast MediumSlow Mercury Mesh Mesh1 Mesh2 Mesh3 Mesh4 Mesh5 MeshBerlin MeshCollective MeshCologne MeshFrankfurt MeshGrid MeshHamburg MeshHessen MeshLeipzig MeshMunich MeshNet MeshNetwork MeshRuhr Meshtastic MeshTest Meteor Metro Midnight Mirage Mist MoonNet Munich Müggelberg Nebula Nest Network Neukölln Nexus Nightfall NightMesh NightNet Nightshift NightshiftNet Nightwatch Node1 Node2 Node3 Node4 Node5 Nomad NomadMesh NomadNet Nomads Nord North NorthStar Oasis Obsidian Omega Operations OPERATIONS Ops Ops1 Ops2 OpsCenter OpsRoom Orbit Ost Outpost Outsider Owl Pack Packet PacketNet PacketRadio Panther Paramedic Path Peak Phantom Phoenix PhoenixNet Platinum Pluto Polar Prairie Prenzlauer PRIVATE Private Public Pulse PulseNet Python Quasar Radio Radio1 Radio2 RadioNet Rain Ranger Raven RavenNet Relay Relay1 Relay2 Repeater Repeater1 Repeater2 RepeaterHub Rescue Rescue1 Rescue2 RescueTeam Rhythm Ridge River Road Rock Router Router1 Router2 Rover Ruhr Runner Runners Safari Safe Safety Sahara Saturn Savanna Saxony Scout Sector Secure Sensor SENSOR Sensors SENSORS Shade Shadow ShadowNet Shelter Shelter1 Shelter2 ShortFast Sideband Sideband1 Sierra Signal Signal1 Signal2 SignalFire Signals Silver Smoke Snake Snow Solstice SOS Sos SOSBerlin South SouthStar Spectrum Squad StarNet Steel Stone Storm Storm1 Storm2 Stratum Stuttgart Summit SunNet Sunrise Sunset Sync SyncNet Syndicate Süd Tal Tango TangoMesh TangoNet Team Tempo Test TEST test TestBerlin Teufelsberg Thunder Tiger Titan Town Trail Tundra Tunnel Union Unit Universe Uplink Uplink1 Valley Venus Victor Village Viper Volcano Wald Wander Wanderer Wanderers Watch Watch1 Watch2 WaWi West WestStar Whisper Wind Wolf WolfDen WolfMesh WolfNet Wolfpack Wolves Woods Wyvern Zeta Zone Zone1 Zone2 Zone3 Zulu ZuluMesh ZuluNet
-]
-
-# Output filenames
-CSV_OUT = ENV.fetch("CSV_OUT", "rainbow.csv")
-JSON_OUT = ENV.fetch("JSON_OUT", "rainbow.json")
-
-# --- HASH FUNCTION -------------------------------------------------
-
-def xor_bytes(str_or_bytes)
-  bytes = str_or_bytes.is_a?(String) ? str_or_bytes.bytes : str_or_bytes
-  bytes.reduce(0) { |acc, b| (acc ^ b) & 0xFF }
-end
-
-def expanded_key(psk_b64)
-  raw = Base64.decode64(psk_b64 || "")
-
-  case raw.bytesize
-  when 0
-    # no encryption: length 0, xor = 0
-    "".b
-  when 1
-    alias_index = raw.bytes.first
-    alias_keys = {
-      1 => [
-        0xD4, 0xF1, 0xBB, 0x3A, 0x20, 0x29, 0x07, 0x59,
-        0xF0, 0xBC, 0xFF, 0xAB, 0xCF, 0x4E, 0x69, 0x01,
-      ].pack("C*"),
-      2 => [
-        0x38, 0x4B, 0xBC, 0xC0, 0x1D, 0xC0, 0x22, 0xD1,
-        0x81, 0xBF, 0x36, 0xB8, 0x61, 0x21, 0xE1, 0xFB,
-        0x96, 0xB7, 0x2E, 0x55, 0xBF, 0x74, 0x22, 0x7E,
-        0x9D, 0x6A, 0xFB, 0x48, 0xD6, 0x4C, 0xB1, 0xA1,
-      ].pack("C*"),
-    }
-    alias_keys.fetch(alias_index) { raise "Unknown PSK alias #{alias_index}" }
-  when 2..15
-    # pad to 16 (AES128)
-    (raw.bytes + [0] * (16 - raw.bytesize)).pack("C*")
-  when 16
-    raw
-  when 17..31
-    # pad to 32 (AES256)
-    (raw.bytes + [0] * (32 - raw.bytesize)).pack("C*")
-  when 32
-    raw
-  else
-    raise "PSK too long (#{raw.bytesize} bytes)"
-  end
-end
-
-def channel_hash(name, psk_b64)
-  effective_name = name.b
-  key = expanded_key(psk_b64)
-
-  h_name = xor_bytes(effective_name)
-  h_key = xor_bytes(key)
-
-  (h_name ^ h_key) & 0xFF
-end
-
-# --- BUILD RAINBOW TABLE -------------------------------------------
-
-psk_b64 = PSK_B64
-puts "Using PSK_B64=#{psk_b64.inspect}"
-
-hash_to_names = Hash.new { |h, k| h[k] = [] }
-
-CANDIDATE_NAMES.each do |name|
-  h = channel_hash(name, psk_b64)
-  hash_to_names[h] << name
-end
-
-# --- WRITE CSV (hash,name) -----------------------------------------
-
-CSV.open(CSV_OUT, "w") do |csv|
-  csv << %w[hash name]
-  hash_to_names.keys.sort.each do |h|
-    hash_to_names[h].each do |name|
-      csv << [h, name]
-    end
-  end
-end
-
-puts "Wrote CSV rainbow table to #{CSV_OUT}"
-
-# --- WRITE JSON ({hash: [names...]}) -------------------------------
-
-json_hash = hash_to_names.transform_keys(&:to_s)
-File.write(JSON_OUT, JSON.pretty_generate(json_hash))
-
-puts "Wrote JSON rainbow table to #{JSON_OUT}"
-
-# --- OPTIONAL: interactive query -----------------------------------
-
-if ARGV.first == "query"
-  target = Integer(ARGV[1] || raise("Usage: #{File.basename($0)} query <hash>"))
-  names = hash_to_names[target]
-  if names.empty?
-    puts "No names for hash #{target}"
-  else
-    puts "Names for hash #{target}:"
-    names.each { |n| puts "  - #{n}" }
-  end
-else
-  puts "Run again with: #{File.basename($0)} query <hash>  # to inspect a specific hash"
-end
@@ -1,183 +0,0 @@
-# Copyright © 2025-26 l5yth & contributors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-from __future__ import annotations
-
-import base64
-import io
-import json
-import sys
-
-from meshtastic.protobuf import mesh_pb2
-from meshtastic.protobuf import telemetry_pb2
-
-from data.mesh_ingestor import decode_payload
-
-
-def run_main_with_input(payload: dict) -> tuple[int, dict]:
-    stdin = io.StringIO(json.dumps(payload))
-    stdout = io.StringIO()
-    original_stdin = sys.stdin
-    original_stdout = sys.stdout
-    try:
-        sys.stdin = stdin
-        sys.stdout = stdout
-        status = decode_payload.main()
-    finally:
-        sys.stdin = original_stdin
-        sys.stdout = original_stdout
-
-    output = json.loads(stdout.getvalue() or "{}")
-    return status, output
-
-
-def test_decode_payload_position_success():
-    position = mesh_pb2.Position()
-    position.latitude_i = 525598720
-    position.longitude_i = 136577024
-    position.altitude = 11
-    position.precision_bits = 13
-    payload_b64 = base64.b64encode(position.SerializeToString()).decode("ascii")
-
-    result = decode_payload._decode_payload(3, payload_b64)
-
-    assert result["type"] == "POSITION_APP"
-    assert result["payload"]["latitude_i"] == 525598720
-    assert result["payload"]["longitude_i"] == 136577024
-    assert result["payload"]["altitude"] == 11
-
-
-def test_decode_payload_rejects_invalid_payload():
-    result = decode_payload._decode_payload(3, "not-base64")
-
-    assert result["error"].startswith("invalid-payload")
-    assert "invalid-payload" in result["error"]
-
-
-def test_decode_payload_rejects_unsupported_port():
-    result = decode_payload._decode_payload(
-        999, base64.b64encode(b"ok").decode("ascii")
-    )
-
-    assert result["error"] == "unsupported-port"
-    assert result["portnum"] == 999
-
-
-def test_main_handles_invalid_json():
-    stdin = io.StringIO("nope")
-    stdout = io.StringIO()
-    original_stdin = sys.stdin
-    original_stdout = sys.stdout
-    try:
-        sys.stdin = stdin
-        sys.stdout = stdout
-        status = decode_payload.main()
-    finally:
-        sys.stdin = original_stdin
-        sys.stdout = original_stdout
-
-    result = json.loads(stdout.getvalue())
-    assert status == 1
-    assert result["error"].startswith("invalid-json")
-
-
-def test_main_requires_portnum():
-    status, result = run_main_with_input(
-        {"payload_b64": base64.b64encode(b"ok").decode("ascii")}
-    )
-
-    assert status == 1
-    assert result["error"] == "missing-portnum"
-
-
-def test_main_requires_integer_portnum():
-    status, result = run_main_with_input(
-        {"portnum": "3", "payload_b64": base64.b64encode(b"ok").decode("ascii")}
-    )
-
-    assert status == 1
-    assert result["error"] == "missing-portnum"
-
-
-def test_main_requires_payload():
-    status, result = run_main_with_input({"portnum": 3})
-
-    assert status == 1
-    assert result["error"] == "missing-payload"
-
-
-def test_main_requires_string_payload():
-    status, result = run_main_with_input({"portnum": 3, "payload_b64": 123})
-
-    assert status == 1
-    assert result["error"] == "missing-payload"
-
-
-def test_main_success_position_payload():
-    position = mesh_pb2.Position()
-    position.latitude_i = 525598720
-    position.longitude_i = 136577024
-    payload_b64 = base64.b64encode(position.SerializeToString()).decode("ascii")
-
-    status, result = run_main_with_input({"portnum": 3, "payload_b64": payload_b64})
-
-    assert status == 0
-    assert result["type"] == "POSITION_APP"
-    assert result["payload"]["latitude_i"] == 525598720
-
-
-def test_decode_payload_handles_parse_failure():
-    class BrokenMessage:
-        def ParseFromString(self, _payload):
-            raise ValueError("boom")
-
-    decode_payload.PORTNUM_MAP[99] = ("BROKEN", BrokenMessage)
-    payload_b64 = base64.b64encode(b"\x00").decode("ascii")
-
-    result = decode_payload._decode_payload(99, payload_b64)
-
-    assert result["error"].startswith("decode-failed")
-    assert result["type"] == "BROKEN"
-    decode_payload.PORTNUM_MAP.pop(99, None)
-
-
-def test_main_entrypoint_executes():
-    import runpy
-
-    payload = {"portnum": 3, "payload_b64": base64.b64encode(b"").decode("ascii")}
-    stdin = io.StringIO(json.dumps(payload))
-    stdout = io.StringIO()
-    original_stdin = sys.stdin
-    original_stdout = sys.stdout
-    try:
-        sys.stdin = stdin
-        sys.stdout = stdout
-        try:
-            runpy.run_module("data.mesh_ingestor.decode_payload", run_name="__main__")
-        except SystemExit as exc:
-            assert exc.code == 0
-    finally:
-        sys.stdin = original_stdin
-        sys.stdout = original_stdout
-
-
-def test_decode_payload_telemetry_success():
-    telemetry = telemetry_pb2.Telemetry()
-    telemetry.time = 123
-    payload_b64 = base64.b64encode(telemetry.SerializeToString()).decode("ascii")
-
-    result = decode_payload._decode_payload(67, payload_b64)
-
-    assert result["type"] == "TELEMETRY_APP"
-    assert result["payload"]["time"] == 123
@@ -23,9 +23,6 @@ ENV BUNDLE_FORCE_RUBY_PLATFORM=true
 # Install build dependencies and SQLite3
 RUN apk add --no-cache \
    build-base \
-    python3 \
-    py3-pip \
-    py3-virtualenv \
    sqlite-dev \
    linux-headers \
    pkgconfig
@@ -41,16 +38,11 @@ RUN bundle config set --local force_ruby_platform true && \
    bundle config set --local without 'development test' && \
    bundle install --jobs=4 --retry=3

-# Install Meshtastic decoder dependencies in a dedicated venv
-RUN python3 -m venv /opt/meshtastic-venv && \
-    /opt/meshtastic-venv/bin/pip install --no-cache-dir meshtastic protobuf
-
 # Production stage
 FROM ruby:3.3-alpine AS production

 # Install runtime dependencies
 RUN apk add --no-cache \
-    python3 \
    sqlite \
    tzdata \
    curl
@@ -64,7 +56,6 @@ WORKDIR /app

 # Copy installed gems from builder stage
 COPY --from=builder /usr/local/bundle /usr/local/bundle
-COPY --from=builder /opt/meshtastic-venv /opt/meshtastic-venv

 # Copy application code (excluding the Dockerfile which is not required at runtime)
 COPY --chown=potatomesh:potatomesh web/app.rb ./
@@ -79,7 +70,6 @@ COPY --chown=potatomesh:potatomesh web/scripts ./scripts

 # Copy SQL schema files from data directory
 COPY --chown=potatomesh:potatomesh data/*.sql /data/
-COPY --chown=potatomesh:potatomesh data/mesh_ingestor/decode_payload.py /app/data/mesh_ingestor/decode_payload.py

 # Create data and configuration directories with correct ownership
 RUN mkdir -p /app/.local/share/potato-mesh \
@@ -95,7 +85,6 @@ EXPOSE 41447
 # Default environment variables (can be overridden by host)
 ENV RACK_ENV=production \
    APP_ENV=production \
-    MESHTASTIC_PYTHON=/opt/meshtastic-venv/bin/python \
    XDG_DATA_HOME=/app/.local/share \
    XDG_CONFIG_HOME=/app/.config \
    SITE_NAME="PotatoMesh Demo" \
@@ -49,12 +49,6 @@ require_relative "application/worker_pool"
 require_relative "application/federation"
 require_relative "application/prometheus"
 require_relative "application/queries"
-require_relative "application/meshtastic/channel_names"
-require_relative "application/meshtastic/channel_hash"
-require_relative "application/meshtastic/protobuf"
-require_relative "application/meshtastic/rainbow_table"
-require_relative "application/meshtastic/cipher"
-require_relative "application/meshtastic/payload_decoder"
 require_relative "application/data_processing"
 require_relative "application/filesystem"
 require_relative "application/instances"
@@ -160,15 +160,7 @@ module PotatoMesh
        inserted
      end

-      def touch_node_last_seen(
-        db,
-        node_ref,
-        fallback_num = nil,
-        rx_time: nil,
-        source: nil,
-        lora_freq: nil,
-        modem_preset: nil
-      )
+      def touch_node_last_seen(db, node_ref, fallback_num = nil, rx_time: nil, source: nil)
        timestamp = coerce_integer(rx_time)
        return unless timestamp

@@ -193,19 +185,15 @@ module PotatoMesh
        return if broadcast_node_ref?(node_id, fallback_num)
        return unless node_id

-        lora_freq = coerce_integer(lora_freq)
-        modem_preset = string_or_nil(modem_preset)
        updated = false
        with_busy_retry do
-          db.execute <<~SQL, [timestamp, timestamp, timestamp, lora_freq, modem_preset, node_id]
+          db.execute <<~SQL, [timestamp, timestamp, timestamp, node_id]
                       UPDATE nodes
                          SET last_heard = CASE
                            WHEN COALESCE(last_heard, 0) >= ? THEN last_heard
                            ELSE ?
                          END,
-                              first_heard = COALESCE(first_heard, ?),
-                              lora_freq = COALESCE(?, lora_freq),
-                              modem_preset = COALESCE(?, modem_preset)
+                              first_heard = COALESCE(first_heard, ?)
                        WHERE node_id = ?
                     SQL
          updated ||= db.changes.positive?
@@ -218,8 +206,6 @@ module PotatoMesh
            node_id: node_id,
            timestamp: timestamp,
            source: source || :unknown,
-            lora_freq: lora_freq,
-            modem_preset: modem_preset,
          )
        end

@@ -504,37 +490,20 @@ module PotatoMesh
        rx_iso ||= Time.at(rx_time).utc.iso8601

        raw_node_id = payload["node_id"] || payload["from_id"] || payload["from"]
+        node_id = string_or_nil(raw_node_id)
+        node_id = "!#{node_id.delete_prefix("!").downcase}" if node_id&.start_with?("!")
        raw_node_num = coerce_integer(payload["node_num"]) || coerce_integer(payload["num"])
+        node_id ||= format("!%08x", raw_node_num & 0xFFFFFFFF) if node_id.nil? && raw_node_num

-        canonical_parts = canonical_node_parts(raw_node_id, raw_node_num)
-        if canonical_parts
-          node_id, node_num, = canonical_parts
-        else
-          node_id = string_or_nil(raw_node_id)
-          node_id = "!#{node_id.delete_prefix("!").downcase}" if node_id&.start_with?("!")
-          node_id ||= format("!%08x", raw_node_num & 0xFFFFFFFF) if node_id.nil? && raw_node_num
-
-          payload_for_num = payload.is_a?(Hash) ? payload.dup : {}
-          payload_for_num["num"] ||= raw_node_num if raw_node_num
-          node_num = resolve_node_num(node_id, payload_for_num)
-          node_num ||= raw_node_num
-          canonical = normalize_node_id(db, node_id || node_num)
-          node_id = canonical if canonical
-        end
-
-        lora_freq = coerce_integer(payload["lora_freq"] || payload["loraFrequency"])
-        modem_preset = string_or_nil(payload["modem_preset"] || payload["modemPreset"])
+        payload_for_num = payload.is_a?(Hash) ? payload.dup : {}
+        payload_for_num["num"] ||= raw_node_num if raw_node_num
+        node_num = resolve_node_num(node_id, payload_for_num)
+        node_num ||= raw_node_num
+        canonical = normalize_node_id(db, node_id || node_num)
+        node_id = canonical if canonical

        ensure_unknown_node(db, node_id || node_num, node_num, heard_time: rx_time)
-        touch_node_last_seen(
-          db,
-          node_id || node_num,
-          node_num,
-          rx_time: rx_time,
-          source: :position,
-          lora_freq: lora_freq,
-          modem_preset: modem_preset,
-        )
+        touch_node_last_seen(db, node_id || node_num, node_num, rx_time: rx_time, source: :position)

        to_id = string_or_nil(payload["to_id"] || payload["to"])

@@ -778,15 +747,7 @@ module PotatoMesh
        end
      end

-      def update_node_from_telemetry(
-        db,
-        node_id,
-        node_num,
-        rx_time,
-        metrics = {},
-        lora_freq: nil,
-        modem_preset: nil
-      )
+      def update_node_from_telemetry(db, node_id, node_num, rx_time, metrics = {})
        num = coerce_integer(node_num)
        id = string_or_nil(node_id)
        if id&.start_with?("!")
@@ -796,15 +757,7 @@ module PotatoMesh
        return unless id

        ensure_unknown_node(db, id, num, heard_time: rx_time)
-        touch_node_last_seen(
-          db,
-          id,
-          num,
-          rx_time: rx_time,
-          source: :telemetry,
-          lora_freq: lora_freq,
-          modem_preset: modem_preset,
-        )
+        touch_node_last_seen(db, id, num, rx_time: rx_time, source: :telemetry)

        battery = coerce_float(metrics[:battery_level] || metrics["battery_level"])
        voltage = coerce_float(metrics[:voltage] || metrics["voltage"])
@@ -948,23 +901,17 @@ module PotatoMesh
        rx_iso ||= Time.at(rx_time).utc.iso8601

        raw_node_id = payload["node_id"] || payload["from_id"] || payload["from"]
+        node_id = string_or_nil(raw_node_id)
+        node_id = "!#{node_id.delete_prefix("!").downcase}" if node_id&.start_with?("!")
        raw_node_num = coerce_integer(payload["node_num"]) || coerce_integer(payload["num"])

-        canonical_parts = canonical_node_parts(raw_node_id, raw_node_num)
-        if canonical_parts
-          node_id, node_num, = canonical_parts
-        else
-          node_id = string_or_nil(raw_node_id)
-          node_id = "!#{node_id.delete_prefix("!").downcase}" if node_id&.start_with?("!")
+        payload_for_num = payload.dup
+        payload_for_num["num"] ||= raw_node_num if raw_node_num
+        node_num = resolve_node_num(node_id, payload_for_num)
+        node_num ||= raw_node_num

-          payload_for_num = payload.dup
-          payload_for_num["num"] ||= raw_node_num if raw_node_num
-          node_num = resolve_node_num(node_id, payload_for_num)
-          node_num ||= raw_node_num
-
-          canonical = normalize_node_id(db, node_id || node_num)
-          node_id = canonical if canonical
-        end
+        canonical = normalize_node_id(db, node_id || node_num)
+        node_id = canonical if canonical

        from_id = string_or_nil(payload["from_id"]) || node_id
        to_id = string_or_nil(payload["to_id"] || payload["to"])
@@ -979,8 +926,6 @@ module PotatoMesh
        rssi = coerce_integer(payload["rssi"])
        bitfield = coerce_integer(payload["bitfield"])
        payload_b64 = string_or_nil(payload["payload_b64"] || payload["payload"])
-        lora_freq = coerce_integer(payload["lora_freq"] || payload["loraFrequency"])
-        modem_preset = string_or_nil(payload["modem_preset"] || payload["modemPreset"])

        telemetry_section = normalize_json_object(payload["telemetry"])
        device_metrics = normalize_json_object(payload["device_metrics"] || payload["deviceMetrics"])
@@ -1363,21 +1308,13 @@ module PotatoMesh
                     SQL
        end

-        update_node_from_telemetry(
-          db,
-          node_id,
-          node_num,
-          rx_time,
-          {
-            battery_level: battery_level,
-            voltage: voltage,
-            channel_utilization: channel_utilization,
-            air_util_tx: air_util_tx,
-            uptime_seconds: uptime_seconds,
-          },
-          lora_freq: lora_freq,
-          modem_preset: modem_preset,
-        )
+        update_node_from_telemetry(db, node_id, node_num, rx_time, {
+          battery_level: battery_level,
+          voltage: voltage,
+          channel_utilization: channel_utilization,
+          air_util_tx: air_util_tx,
+          uptime_seconds: uptime_seconds,
+        })
      end

      # Persist a traceroute observation and its hop path.
@@ -1448,59 +1385,6 @@ module PotatoMesh
        end
      end

-      # Attempt to decrypt an encrypted Meshtastic message payload.
-      #
-      # @param message [Hash] message payload supplied by the ingestor.
-      # @param packet_id [Integer] message packet identifier.
-      # @param from_id [String, nil] canonical node identifier when available.
-      # @param from_num [Integer, nil] numeric node identifier when available.
-      # @param channel_index [Integer, nil] channel hash index.
-      # @return [Hash, nil] decrypted payload metadata when parsing succeeds.
-      def decrypt_meshtastic_message(message, packet_id, from_id, from_num, channel_index)
-        return nil unless message.is_a?(Hash)
-
-        cipher_b64 = string_or_nil(message["encrypted"])
-        return nil unless cipher_b64
-        if (ENV["RACK_ENV"] == "test" || ENV["APP_ENV"] == "test" || defined?(RSpec)) &&
-           ENV["MESHTASTIC_PSK_B64"].nil?
-          return nil
-        end
-
-        node_num = coerce_integer(from_num)
-        if node_num.nil?
-          parts = canonical_node_parts(from_id)
-          node_num = parts[1] if parts
-        end
-        return nil unless node_num
-
-        psk_b64 = PotatoMesh::Config.meshtastic_psk_b64
-        data = PotatoMesh::App::Meshtastic::Cipher.decrypt_data(
-          cipher_b64: cipher_b64,
-          packet_id: packet_id,
-          from_id: from_id,
-          from_num: node_num,
-          psk_b64: psk_b64,
-        )
-        return nil unless data
-
-        channel_name = nil
-        if channel_index.is_a?(Integer)
-          candidates = PotatoMesh::App::Meshtastic::RainbowTable.channel_names_for(
-            channel_index,
-            psk_b64: psk_b64,
-          )
-          channel_name = candidates.first if candidates.any?
-        end
-
-        {
-          text: data[:text],
-          portnum: data[:portnum],
-          payload: data[:payload],
-          channel_name: channel_name,
-          decryption_confidence: data[:decryption_confidence],
-        }
-      end
-
      def insert_message(db, message)
        return unless message.is_a?(Hash)

@@ -1531,14 +1415,6 @@ module PotatoMesh
            from_id = canonical_from_id
          end
        end
-        if from_id && !from_id.start_with?("^")
-          canonical_parts = canonical_node_parts(from_id, message["from_num"])
-          if canonical_parts && !from_id.start_with?("!")
-            from_id = canonical_parts[0]
-            message["from_num"] ||= canonical_parts[1]
-          end
-        end
-        sender_present = !from_id.nil? || !coerce_integer(message["from_num"]).nil? || !trimmed_from_id.nil?

        raw_to_id = message["to_id"]
        raw_to_id = message["to"] if raw_to_id.nil? || raw_to_id.to_s.strip.empty?
@@ -1552,59 +1428,27 @@ module PotatoMesh
            to_id = canonical_to_id
          end
        end
-        if to_id && !to_id.start_with?("^")
-          canonical_parts = canonical_node_parts(to_id, message["to_num"])
-          if canonical_parts && !to_id.start_with?("!")
-            to_id = canonical_parts[0]
-            message["to_num"] ||= canonical_parts[1]
-          end
-        end

        encrypted = string_or_nil(message["encrypted"])
-        text = message["text"]
-        portnum = message["portnum"]
-        clear_encrypted = false
-        channel_index = coerce_integer(message["channel"] || message["channel_index"] || message["channelIndex"])

-        decrypted_payload = nil
-        decrypted_text = nil
-        decrypted_portnum = nil
-        decrypted_flag = false
-        decryption_confidence = nil
+        ensure_unknown_node(db, from_id || raw_from_id, message["from_num"], heard_time: rx_time)
+        touch_node_last_seen(
+          db,
+          from_id || raw_from_id || message["from_num"],
+          message["from_num"],
+          rx_time: rx_time,
+          source: :message,
+        )

-        if encrypted && (text.nil? || text.to_s.strip.empty?)
-          decrypted_data = decrypt_meshtastic_message(
-            message,
-            msg_id,
-            from_id,
-            message["from_num"],
-            channel_index,
+        ensure_unknown_node(db, to_id || raw_to_id, message["to_num"], heard_time: rx_time) if to_id || raw_to_id
+        if to_id || raw_to_id || message.key?("to_num")
+          touch_node_last_seen(
+            db,
+            to_id || raw_to_id || message["to_num"],
+            message["to_num"],
+            rx_time: rx_time,
+            source: :message,
          )
-
-          if decrypted_data
-            decrypted_payload = decrypted_data
-            decrypted_portnum = decrypted_data[:portnum]
-
-            if decrypted_data[:text]
-              text = decrypted_data[:text]
-              decrypted_text = text
-              clear_encrypted = true
-              encrypted = nil
-              message["text"] = text
-              message["channel_name"] ||= decrypted_data[:channel_name]
-              decrypted_flag = true
-              decryption_confidence = decrypted_data[:decryption_confidence] || 0.0
-              if portnum.nil? && decrypted_portnum
-                portnum = decrypted_portnum
-                message["portnum"] = portnum
-              end
-            end
-          end
-        end
-
-        if encrypted && (text.nil? || text.to_s.strip.empty?)
-          portnum = nil
-          message.delete("portnum")
        end

        lora_freq = coerce_integer(message["lora_freq"] || message["loraFrequency"])
@@ -1620,8 +1464,8 @@ module PotatoMesh
          from_id,
          to_id,
          message["channel"],
-          portnum,
-          text,
+          message["portnum"],
+          message["text"],
          encrypted,
          message["snr"],
          message["rssi"],
@@ -1631,28 +1475,19 @@ module PotatoMesh
          channel_name,
          reply_id,
          emoji,
-          decrypted_flag ? 1 : 0,
-          decryption_confidence,
        ]

        with_busy_retry do
          existing = db.get_first_row(
-            "SELECT from_id, to_id, text, encrypted, lora_freq, modem_preset, channel_name, reply_id, emoji, portnum, decrypted, decryption_confidence FROM messages WHERE id = ?",
+            "SELECT from_id, to_id, encrypted, lora_freq, modem_preset, channel_name, reply_id, emoji FROM messages WHERE id = ?",
            [msg_id],
          )
          if existing
            updates = {}
-            existing_text = existing.is_a?(Hash) ? existing["text"] : existing[2]
-            existing_text_str = existing_text&.to_s
-            existing_has_text = existing_text_str && !existing_text_str.strip.empty?
-            existing_from = existing.is_a?(Hash) ? existing["from_id"] : existing[0]
-            existing_from_str = existing_from&.to_s
-            return if !sender_present && (existing_from_str.nil? || existing_from_str.strip.empty?)
-            existing_encrypted = existing.is_a?(Hash) ? existing["encrypted"] : existing[3]
-            existing_encrypted_str = existing_encrypted&.to_s
-            decrypted_precedence = text && (clear_encrypted || (existing_encrypted_str && !existing_encrypted_str.strip.empty?))

            if from_id
+              existing_from = existing.is_a?(Hash) ? existing["from_id"] : existing[0]
+              existing_from_str = existing_from&.to_s
              should_update = existing_from_str.nil? || existing_from_str.strip.empty?
              should_update ||= existing_from != from_id
              updates["from_id"] = from_id if should_update
@@ -1666,53 +1501,21 @@ module PotatoMesh
              updates["to_id"] = to_id if should_update
            end

-            if clear_encrypted || (decrypted_precedence && existing_encrypted_str && !existing_encrypted_str.strip.empty?)
-              updates["encrypted"] = nil if existing_encrypted
-            elsif encrypted && !existing_has_text
+            if encrypted
+              existing_encrypted = existing.is_a?(Hash) ? existing["encrypted"] : existing[2]
+              existing_encrypted_str = existing_encrypted&.to_s
              should_update = existing_encrypted_str.nil? || existing_encrypted_str.strip.empty?
              should_update ||= existing_encrypted != encrypted
              updates["encrypted"] = encrypted if should_update
            end

-            if text
-              should_update = existing_text_str.nil? || existing_text_str.strip.empty?
-              should_update ||= existing_text != text
-              updates["text"] = text if should_update
-            end
-
-            if decrypted_precedence
-              updates["channel"] = message["channel"] if message.key?("channel")
-              updates["snr"] = message["snr"] if message.key?("snr")
-              updates["rssi"] = message["rssi"] if message.key?("rssi")
-              updates["hop_limit"] = message["hop_limit"] if message.key?("hop_limit")
-              updates["lora_freq"] = lora_freq unless lora_freq.nil?
-              updates["modem_preset"] = modem_preset if modem_preset
-              updates["channel_name"] = channel_name if channel_name
-              updates["rx_time"] = rx_time if rx_time
-              updates["rx_iso"] = rx_iso if rx_iso
-            end
-
-            if clear_encrypted
-              updates["decrypted"] = 1
-              updates["decryption_confidence"] = decryption_confidence
-            end
-
-            if portnum
-              existing_portnum = existing.is_a?(Hash) ? existing["portnum"] : existing[9]
-              existing_portnum_str = existing_portnum&.to_s
-              should_update = existing_portnum_str.nil? || existing_portnum_str.strip.empty?
-              should_update ||= existing_portnum != portnum
-              should_update ||= decrypted_precedence
-              updates["portnum"] = portnum if should_update
-            end
-
            unless lora_freq.nil?
-              existing_lora = existing.is_a?(Hash) ? existing["lora_freq"] : existing[4]
+              existing_lora = existing.is_a?(Hash) ? existing["lora_freq"] : existing[3]
              updates["lora_freq"] = lora_freq if existing_lora != lora_freq
            end

            if modem_preset
-              existing_preset = existing.is_a?(Hash) ? existing["modem_preset"] : existing[5]
+              existing_preset = existing.is_a?(Hash) ? existing["modem_preset"] : existing[4]
              existing_preset_str = existing_preset&.to_s
              should_update = existing_preset_str.nil? || existing_preset_str.strip.empty?
              should_update ||= existing_preset != modem_preset
@@ -1720,7 +1523,7 @@ module PotatoMesh
            end

            if channel_name
-              existing_channel = existing.is_a?(Hash) ? existing["channel_name"] : existing[6]
+              existing_channel = existing.is_a?(Hash) ? existing["channel_name"] : existing[5]
              existing_channel_str = existing_channel&.to_s
              should_update = existing_channel_str.nil? || existing_channel_str.strip.empty?
              should_update ||= existing_channel != channel_name
@@ -1728,12 +1531,12 @@ module PotatoMesh
            end

            unless reply_id.nil?
-              existing_reply = existing.is_a?(Hash) ? existing["reply_id"] : existing[7]
+              existing_reply = existing.is_a?(Hash) ? existing["reply_id"] : existing[6]
              updates["reply_id"] = reply_id if existing_reply != reply_id
            end

            if emoji
-              existing_emoji = existing.is_a?(Hash) ? existing["emoji"] : existing[8]
+              existing_emoji = existing.is_a?(Hash) ? existing["emoji"] : existing[7]
              existing_emoji_str = existing_emoji&.to_s
              should_update = existing_emoji_str.nil? || existing_emoji_str.strip.empty?
              should_update ||= existing_emoji != emoji
@@ -1749,48 +1552,17 @@ module PotatoMesh

            begin
              db.execute <<~SQL, row
-                           INSERT INTO messages(id,rx_time,rx_iso,from_id,to_id,channel,portnum,text,encrypted,snr,rssi,hop_limit,lora_freq,modem_preset,channel_name,reply_id,emoji,decrypted,decryption_confidence)
-                           VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
+                           INSERT INTO messages(id,rx_time,rx_iso,from_id,to_id,channel,portnum,text,encrypted,snr,rssi,hop_limit,lora_freq,modem_preset,channel_name,reply_id,emoji)
+                           VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
                         SQL
            rescue SQLite3::ConstraintException
-              existing_row = db.get_first_row(
-                "SELECT text, encrypted FROM messages WHERE id = ?",
-                [msg_id],
-              )
-              existing_text = existing_row.is_a?(Hash) ? existing_row["text"] : existing_row&.[](0)
-              existing_text_str = existing_text&.to_s
-              allow_encrypted_update = existing_text_str.nil? || existing_text_str.strip.empty?
-              existing_encrypted = existing_row.is_a?(Hash) ? existing_row["encrypted"] : existing_row&.[](1)
-              existing_encrypted_str = existing_encrypted&.to_s
-              decrypted_precedence = text && (clear_encrypted || (existing_encrypted_str && !existing_encrypted_str.strip.empty?))
-
              fallback_updates = {}
              fallback_updates["from_id"] = from_id if from_id
              fallback_updates["to_id"] = to_id if to_id
-              fallback_updates["text"] = text if text
-              fallback_updates["encrypted"] = encrypted if encrypted && allow_encrypted_update
-              fallback_updates["encrypted"] = nil if clear_encrypted
-              fallback_updates["portnum"] = portnum if portnum
-              if clear_encrypted
-                fallback_updates["decrypted"] = 1
-                fallback_updates["decryption_confidence"] = decryption_confidence
-              end
-              if decrypted_precedence
-                fallback_updates["channel"] = message["channel"] if message.key?("channel")
-                fallback_updates["snr"] = message["snr"] if message.key?("snr")
-                fallback_updates["rssi"] = message["rssi"] if message.key?("rssi")
-                fallback_updates["hop_limit"] = message["hop_limit"] if message.key?("hop_limit")
-                fallback_updates["portnum"] = portnum if portnum
-                fallback_updates["lora_freq"] = lora_freq unless lora_freq.nil?
-                fallback_updates["modem_preset"] = modem_preset if modem_preset
-                fallback_updates["channel_name"] = channel_name if channel_name
-                fallback_updates["rx_time"] = rx_time if rx_time
-                fallback_updates["rx_iso"] = rx_iso if rx_iso
-              else
-                fallback_updates["lora_freq"] = lora_freq unless lora_freq.nil?
-                fallback_updates["modem_preset"] = modem_preset if modem_preset
-                fallback_updates["channel_name"] = channel_name if channel_name
-              end
+              fallback_updates["encrypted"] = encrypted if encrypted
+              fallback_updates["lora_freq"] = lora_freq unless lora_freq.nil?
+              fallback_updates["modem_preset"] = modem_preset if modem_preset
+              fallback_updates["channel_name"] = channel_name if channel_name
              fallback_updates["reply_id"] = reply_id unless reply_id.nil?
              fallback_updates["emoji"] = emoji if emoji
              unless fallback_updates.empty?
@@ -1800,213 +1572,6 @@ module PotatoMesh
            end
          end
        end
-
-        if clear_encrypted && decrypted_text
-          debug_log(
-            "Stored decrypted text message",
-            context: "data_processing.insert_message",
-            message_id: msg_id,
-            channel: message["channel"],
-            channel_name: message["channel_name"],
-            portnum: portnum,
-          )
-        end
-
-        stored_decrypted = nil
-        if decrypted_payload
-          stored_decrypted = store_decrypted_payload(
-            db,
-            message,
-            msg_id,
-            decrypted_payload,
-            rx_time: rx_time,
-            rx_iso: rx_iso,
-            from_id: from_id,
-            to_id: to_id,
-            channel: message["channel"],
-            portnum: portnum || decrypted_portnum,
-            hop_limit: message["hop_limit"],
-            snr: message["snr"],
-            rssi: message["rssi"],
-          )
-        end
-
-        if stored_decrypted && encrypted
-          with_busy_retry do
-            db.execute("UPDATE messages SET encrypted = NULL WHERE id = ?", [msg_id])
-          end
-          debug_log(
-            "Cleared encrypted payload after decoding",
-            context: "data_processing.insert_message",
-            message_id: msg_id,
-            portnum: portnum || decrypted_portnum,
-          )
-        end
-
-        should_touch_message = !stored_decrypted || decrypted_text
-        if should_touch_message
-          ensure_unknown_node(db, from_id || raw_from_id, message["from_num"], heard_time: rx_time)
-          touch_node_last_seen(
-            db,
-            from_id || raw_from_id || message["from_num"],
-            message["from_num"],
-            rx_time: rx_time,
-            source: :message,
-            lora_freq: lora_freq,
-            modem_preset: modem_preset,
-          )
-
-          ensure_unknown_node(db, to_id || raw_to_id, message["to_num"], heard_time: rx_time) if to_id || raw_to_id
-          if to_id || raw_to_id || message.key?("to_num")
-            touch_node_last_seen(
-              db,
-              to_id || raw_to_id || message["to_num"],
-              message["to_num"],
-              rx_time: rx_time,
-              source: :message,
-              lora_freq: lora_freq,
-              modem_preset: modem_preset,
-            )
-          end
-        end
-      end
-
-      # Decode and store decrypted payloads in domain-specific tables.
-      #
-      # @param db [SQLite3::Database] open database handle.
-      # @param message [Hash] original message payload.
-      # @param packet_id [Integer] packet identifier for the message.
-      # @param decrypted [Hash] decrypted payload metadata.
-      # @param rx_time [Integer] receive time.
-      # @param rx_iso [String] ISO 8601 receive timestamp.
-      # @param from_id [String, nil] canonical sender identifier.
-      # @param to_id [String, nil] destination identifier.
-      # @param channel [Integer, nil] channel index.
-      # @param portnum [Object, nil] port number identifier.
-      # @param hop_limit [Integer, nil] hop limit value.
-      # @param snr [Numeric, nil] signal-to-noise ratio.
-      # @param rssi [Integer, nil] RSSI value.
-      # @return [void]
-      def store_decrypted_payload(
-        db,
-        message,
-        packet_id,
-        decrypted,
-        rx_time:,
-        rx_iso:,
-        from_id:,
-        to_id:,
-        channel:,
-        portnum:,
-        hop_limit:,
-        snr:,
-        rssi:
-      )
-        payload_bytes = decrypted[:payload]
-        return false unless payload_bytes
-
-        portnum_value = coerce_integer(portnum || decrypted[:portnum])
-        return false unless portnum_value
-
-        payload_b64 = Base64.strict_encode64(payload_bytes)
-        supported_ports = [3, 67, 70, 71]
-        return false unless supported_ports.include?(portnum_value)
-
-        decoded = PotatoMesh::App::Meshtastic::PayloadDecoder.decode(
-          portnum: portnum_value,
-          payload_b64: payload_b64,
-        )
-        return false unless decoded.is_a?(Hash)
-        return false unless decoded["payload"].is_a?(Hash)
-
-        common_payload = {
-          "id" => packet_id,
-          "packet_id" => packet_id,
-          "rx_time" => rx_time,
-          "rx_iso" => rx_iso,
-          "from_id" => from_id,
-          "to_id" => to_id,
-          "channel" => channel,
-          "portnum" => portnum_value.to_s,
-          "hop_limit" => hop_limit,
-          "snr" => snr,
-          "rssi" => rssi,
-          "lora_freq" => coerce_integer(message["lora_freq"] || message["loraFrequency"]),
-          "modem_preset" => string_or_nil(message["modem_preset"] || message["modemPreset"]),
-          "payload_b64" => payload_b64,
-        }
-
-        case decoded["type"]
-        when "POSITION_APP"
-          payload = common_payload.merge("position" => decoded["payload"])
-          insert_position(db, payload)
-          debug_log(
-            "Stored decrypted position payload",
-            context: "data_processing.store_decrypted_payload",
-            message_id: packet_id,
-            portnum: portnum_value,
-          )
-          true
-        when "TELEMETRY_APP"
-          payload = common_payload.merge("telemetry" => decoded["payload"])
-          insert_telemetry(db, payload)
-          debug_log(
-            "Stored decrypted telemetry payload",
-            context: "data_processing.store_decrypted_payload",
-            message_id: packet_id,
-            portnum: portnum_value,
-          )
-          true
-        when "NEIGHBORINFO_APP"
-          neighbor_payload = decoded["payload"]
-          neighbors = neighbor_payload["neighbors"]
-          neighbors = [] unless neighbors.is_a?(Array)
-          normalized_neighbors = neighbors.map do |neighbor|
-            next unless neighbor.is_a?(Hash)
-            {
-              "neighbor_id" => neighbor["node_id"] || neighbor["nodeId"] || neighbor["id"],
-              "snr" => neighbor["snr"],
-              "rx_time" => neighbor["last_rx_time"],
-            }.compact
-          end.compact
-          return false if normalized_neighbors.empty?
-
-          payload = common_payload.merge(
-            "node_id" => neighbor_payload["node_id"] || from_id,
-            "neighbors" => normalized_neighbors,
-            "node_broadcast_interval_secs" => neighbor_payload["node_broadcast_interval_secs"],
-            "last_sent_by_id" => neighbor_payload["last_sent_by_id"],
-          )
-          insert_neighbors(db, payload)
-          debug_log(
-            "Stored decrypted neighbor payload",
-            context: "data_processing.store_decrypted_payload",
-            message_id: packet_id,
-            portnum: portnum_value,
-          )
-          true
-        when "TRACEROUTE_APP"
-          route = decoded["payload"]["route"]
-          route_back = decoded["payload"]["route_back"]
-          hops = route.is_a?(Array) ? route : route_back.is_a?(Array) ? route_back : []
-          dest = hops.last if hops.is_a?(Array) && !hops.empty?
-          src_num = coerce_integer(message["from_num"]) || resolve_node_num(from_id, message)
-          payload = common_payload.merge(
-            "src" => src_num,
-            "dest" => dest,
-            "hops" => hops,
-          )
-          insert_trace(db, payload)
-          debug_log(
-            "Stored decrypted traceroute payload",
-            context: "data_processing.store_decrypted_payload",
-            message_id: packet_id,
-            portnum: portnum_value,
-          )
-          true
-        else
-          false
-        end
      end

      def normalize_node_id(db, node_ref)
@@ -150,16 +150,6 @@ module PotatoMesh
          message_columns << "emoji"
        end

-        unless message_columns.include?("decrypted")
-          db.execute("ALTER TABLE messages ADD COLUMN decrypted INTEGER NOT NULL DEFAULT 0")
-          message_columns << "decrypted"
-        end
-
-        unless message_columns.include?("decryption_confidence")
-          db.execute("ALTER TABLE messages ADD COLUMN decryption_confidence REAL")
-          message_columns << "decryption_confidence"
-        end
-
        reply_index_exists =
          db.get_first_value(
            "SELECT COUNT(*) FROM sqlite_master WHERE type='index' AND name='idx_messages_reply_id'",
@@ -177,7 +177,6 @@ module PotatoMesh
        pool = PotatoMesh::App::WorkerPool.new(
          size: PotatoMesh::Config.federation_worker_pool_size,
          max_queue: PotatoMesh::Config.federation_worker_queue_capacity,
-          task_timeout: PotatoMesh::Config.federation_task_timeout_seconds,
          name: "potato-mesh-fed",
        )

@@ -443,8 +442,6 @@ module PotatoMesh
          end
        end
        thread.name = "potato-mesh-federation" if thread.respond_to?(:name=)
-        # Allow shutdown even if the announcement loop is still sleeping.
-        thread.daemon = true if thread.respond_to?(:daemon=)
        set(:federation_thread, thread)
        thread
      end
@@ -477,8 +474,6 @@ module PotatoMesh
        end
        thread.name = "potato-mesh-federation-initial" if thread.respond_to?(:name=)
        thread.report_on_exception = false if thread.respond_to?(:report_on_exception=)
-        # Avoid blocking process shutdown during delayed startup announcements.
-        thread.daemon = true if thread.respond_to?(:daemon=)
        set(:initial_federation_thread, thread)
        thread
      end
@@ -20,8 +20,6 @@ module PotatoMesh
    # its intended consumers to ensure consistent behaviour across the Sinatra
    # application.
    module Helpers
-      ANNOUNCEMENT_URL_PATTERN = %r{\bhttps?://[^\s<]+}i.freeze
-
      # Fetch an application level constant exposed by {PotatoMesh::Application}.
      #
      # @param name [Symbol] constant identifier to retrieve.
@@ -94,47 +92,6 @@ module PotatoMesh
        PotatoMesh::Sanitizer.sanitized_site_name
      end

-      # Retrieve the configured announcement banner copy.
-      #
-      # @return [String, nil] sanitised announcement or nil when unset.
-      def sanitized_announcement
-        PotatoMesh::Sanitizer.sanitized_announcement
-      end
-
-      # Render the announcement copy with safe outbound links.
-      #
-      # @return [String, nil] escaped HTML snippet or nil when unset.
-      def announcement_html
-        announcement = sanitized_announcement
-        return nil unless announcement
-
-        fragments = []
-        last_index = 0
-
-        announcement.to_enum(:scan, ANNOUNCEMENT_URL_PATTERN).each do
-          match = Regexp.last_match
-          next unless match
-
-          start_index = match.begin(0)
-          end_index = match.end(0)
-
-          if start_index > last_index
-            fragments << Rack::Utils.escape_html(announcement[last_index...start_index])
-          end
-
-          url = match[0]
-          escaped_url = Rack::Utils.escape_html(url)
-          fragments << %(<a href="#{escaped_url}" target="_blank" rel="noopener noreferrer">#{escaped_url}</a>)
-          last_index = end_index
-        end
-
-        if last_index < announcement.length
-          fragments << Rack::Utils.escape_html(announcement[last_index..])
-        end
-
-        fragments.join
-      end
-
      # Retrieve the configured channel.
      #
      # @return [String] sanitised channel identifier.
@@ -1,102 +0,0 @@
-# Copyright © 2025-26 l5yth & contributors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# frozen_string_literal: true
-
-require "base64"
-
-module PotatoMesh
-  module App
-    module Meshtastic
-      # Compute Meshtastic channel hashes from a name and pre-shared key.
-      module ChannelHash
-        module_function
-
-        DEFAULT_PSK_ALIAS_KEYS = {
-          1 => [
-            0xD4, 0xF1, 0xBB, 0x3A, 0x20, 0x29, 0x07, 0x59,
-            0xF0, 0xBC, 0xFF, 0xAB, 0xCF, 0x4E, 0x69, 0x01,
-          ].pack("C*"),
-          2 => [
-            0x38, 0x4B, 0xBC, 0xC0, 0x1D, 0xC0, 0x22, 0xD1,
-            0x81, 0xBF, 0x36, 0xB8, 0x61, 0x21, 0xE1, 0xFB,
-            0x96, 0xB7, 0x2E, 0x55, 0xBF, 0x74, 0x22, 0x7E,
-            0x9D, 0x6A, 0xFB, 0x48, 0xD6, 0x4C, 0xB1, 0xA1,
-          ].pack("C*"),
-        }.freeze
-
-        # Calculate the Meshtastic channel hash for the given name and PSK.
-        #
-        # @param name [String] channel name candidate.
-        # @param psk_b64 [String, nil] base64-encoded PSK or PSK alias.
-        # @return [Integer, nil] channel hash byte or nil when inputs are invalid.
-        def channel_hash(name, psk_b64)
-          return nil unless name
-
-          key = expanded_key(psk_b64)
-          return nil unless key
-
-          h_name = xor_bytes(name.b)
-          h_key = xor_bytes(key)
-
-          (h_name ^ h_key) & 0xFF
-        end
-
-        # Expand the provided PSK into a valid AES key length.
-        #
-        # @param psk_b64 [String, nil] base64 PSK value.
-        # @return [String, nil] expanded key bytes or nil when invalid.
-        def expanded_key(psk_b64)
-          raw = Base64.decode64(psk_b64.to_s)
-
-          case raw.bytesize
-          when 0
-            "".b
-          when 1
-            default_key_for_alias(raw.bytes.first)
-          when 2..15
-            (raw.bytes + [0] * (16 - raw.bytesize)).pack("C*")
-          when 16
-            raw
-          when 17..31
-            (raw.bytes + [0] * (32 - raw.bytesize)).pack("C*")
-          when 32
-            raw
-          else
-            nil
-          end
-        end
-
-        # Map PSK alias bytes to their default key material.
-        #
-        # @param alias_index [Integer, nil] alias identifier for the PSK.
-        # @return [String, nil] key bytes or nil when unknown.
-        def default_key_for_alias(alias_index)
-          return nil unless alias_index
-
-          DEFAULT_PSK_ALIAS_KEYS[alias_index]&.dup
-        end
-
-        # XOR all bytes in the given string or byte array.
-        #
-        # @param value [String, Array<Integer>] input byte sequence.
-        # @return [Integer] XOR of all bytes.
-        def xor_bytes(value)
-          bytes = value.is_a?(String) ? value.bytes : value
-          bytes.reduce(0) { |acc, byte| (acc ^ byte) & 0xFF }
-        end
-      end
-    end
-  end
-end
@@ -1,28 +0,0 @@
-# Copyright © 2025-26 l5yth & contributors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# frozen_string_literal: true
-
-module PotatoMesh
-  module App
-    module Meshtastic
-      # Canonical list of candidate channel names used to build rainbow tables.
-      module ChannelNames
-        CHANNEL_NAME_CANDIDATES = %w[
-          911 Admin ADMIN admin Alert Alpha AlphaNet Alpine Amateur Amazon Anaconda Aquila Arctic Ash Asteroid Astro Aurora Avalanche Backup Basalt Base Base1 Base2 BaseAlpha BaseBravo BaseCharlie Bavaria Beacon Bear BearNet Beat Berg Berlin BerlinMesh BerlinNet Beta BetaBerlin Bison Blackout Blizzard Bolt Bonfire Border Borealis Bravo BravoNet Breeze Bridge Bronze Burner Burrow Callisto Callsign Camp Campfire CampNet Caravan Carbon Carpet Central Chameleon Charlie Chat Checkpoint Checkpoint1 Checkpoint2 Cheetah City Clinic Cloud Cobra Collective Cologne Colony Comet Command Command1 Command2 CommandRoom Comms Comms1 Comms2 CommsNet Commune Control Control1 Control2 ControlRoom Convoy Copper Core Corvus Cosmos Courier Courier1 Courier2 CourierMesh CourierNet CQ CQ1 CQ2 Crow CrowNet DarkNet Dawn Daybreak Daylight Delta DeltaNet Demo DEMO DemoBerlin Den Desert Diamond Distress District Doctor Dortmund Downlink Downlink1 Draco Dragon DragonNet Dune Dusk Eagle EagleNet East EastStar Echo EchoMesh EchoNet Emergency emergency EMERGENCY EmergencyBerlin Epsilon Equinox Europa Falcon Field FieldNet Fire Fire1 Fire2 Firebird Firefly Fireline Fireteam Firewatch Flash Flock Fluss Fog Forest Fox FoxNet Foxtrot FoxtrotMesh FoxtrotNet Frankfurt Freedom Freq Freq1 Freq2 Friedrichshain Frontier Frost Galaxy Gale Gamma Ganymede Gecko General Ghost GhostNet Glacier Gold Granite Grassland Grid Grid1 Grid2 GridNet GridNorth GridSouth Griffin Group Ham HAM Hamburg HAMNet Harbor Harmony HarmonyNet Hawk HawkNet Haze Help Hessen Highway Hilltop Hinterland Hive Hospital HQ HQ1 HQ2 Hub Hub1 Hub2 Hydra Ice Io Iron Jaguar Jungle Jupiter Kiez Kilo KiloMesh KiloNet Kraken Kreuzberg Lava Layer Layer1 Layer2 Layer3 Leipzig Leopard Liberty LightNet Lightning Lima Link Lion Lizard LongFast LongSlow LoRa LoRaBerlin LoRaHessen LoRaMesh LoRaNet LoRaTest Main Mars Med Med1 Med2 Medic MediumFast MediumSlow Mercury Mesh Mesh1 Mesh2 Mesh3 Mesh4 Mesh5 MeshBerlin MeshCollective MeshCologne MeshFrankfurt MeshGrid MeshHamburg MeshHessen MeshLeipzig MeshMunich MeshNet MeshNetwork MeshRuhr Meshtastic MeshTest Meteor Metro Midnight Mirage Mist MoonNet Munich Müggelberg Nebula Nest Network Neukölln Nexus Nightfall NightMesh NightNet Nightshift NightshiftNet Nightwatch Node1 Node2 Node3 Node4 Node5 Nomad NomadMesh NomadNet Nomads Nord North NorthStar Oasis Obsidian Omega Operations OPERATIONS Ops Ops1 Ops2 OpsCenter OpsRoom Orbit Ost Outpost Outsider Owl Pack Packet PacketNet PacketRadio Panther Paramedic Path Peak Phantom Phoenix PhoenixNet Platinum Pluto Polar Prairie Prenzlauer PRIVATE Private Public PUBLIC Pulse PulseNet Python Quasar Radio Radio1 Radio2 RadioNet Rain Ranger Raven RavenNet Relay Relay1 Relay2 Repeater Repeater1 Repeater2 RepeaterHub Rescue Rescue1 Rescue2 RescueTeam Rhythm Ridge River Road Rock Router Router1 Router2 Rover Ruhr Runner Runners Safari Safe Safety Sahara Saturn Savanna Saxony Scout Sector Secure Sensor SENSOR Sensors SENSORS Shade Shadow ShadowNet Shelter Shelter1 Shelter2 ShortFast Sideband Sideband1 Sierra Signal Signal1 Signal2 SignalFire Signals Silver Smoke Snake Snow Solstice SOS Sos SOSBerlin South SouthStar Spectrum Squad StarNet Steel Stone Storm Storm1 Storm2 Stratum Stuttgart Summit SunNet Sunrise Sunset Sync SyncNet Syndicate Süd Tal Tango TangoMesh TangoNet Team Tempo Test TEST test TestBerlin Teufelsberg Thunder Tiger Titan Town Trail Tundra Tunnel Union Unit Universe Uplink Uplink1 Valley Venus Victor Village Viper Volcano Wald Wander Wanderer Wanderers Watch Watch1 Watch2 WaWi West WestStar Whisper Wind Wolf WolfDen WolfMesh WolfNet Wolfpack Wolves Woods Wyvern Zeta Zone Zone1 Zone2 Zone3 Zulu ZuluMesh ZuluNet
-        ].freeze
-      end
-    end
-  end
-end
@@ -1,213 +0,0 @@
-# Copyright © 2025-26 l5yth & contributors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# frozen_string_literal: true
-
-require "base64"
-require "openssl"
-
-require_relative "channel_hash"
-require_relative "protobuf"
-
-module PotatoMesh
-  module App
-    module Meshtastic
-      # Decrypt Meshtastic payloads with AES-CTR using Meshtastic nonce rules.
-      module Cipher
-        module_function
-
-        DEFAULT_PSK_B64 = "AQ=="
-        TEXT_MESSAGE_PORTNUM = 1
-        # Number of characters required for full confidence scoring.
-        CONFIDENCE_LENGTH_TARGET = 8.0
-
-        # Decrypt an encrypted Meshtastic payload into UTF-8 text.
-        #
-        # @param cipher_b64 [String] base64-encoded encrypted payload.
-        # @param packet_id [Integer] packet identifier used for the nonce.
-        # @param from_id [String, nil] Meshtastic node identifier (e.g. "!9e95cf60").
-        # @param from_num [Integer, nil] numeric node identifier override.
-        # @param psk_b64 [String, nil] base64 PSK or alias.
-        # @return [String, nil] decrypted text or nil when decryption fails.
-        def decrypt_text(cipher_b64:, packet_id:, from_id: nil, from_num: nil, psk_b64: DEFAULT_PSK_B64)
-          data = decrypt_data(
-            cipher_b64: cipher_b64,
-            packet_id: packet_id,
-            from_id: from_id,
-            from_num: from_num,
-            psk_b64: psk_b64,
-          )
-
-          data && data[:text]
-        end
-
-        # Decrypt the Meshtastic data protobuf payload.
-        #
-        # @param cipher_b64 [String] base64-encoded encrypted payload.
-        # @param packet_id [Integer] packet identifier used for the nonce.
-        # @param from_id [String, nil] Meshtastic node identifier.
-        # @param from_num [Integer, nil] numeric node identifier override.
-        # @param psk_b64 [String, nil] base64 PSK or alias.
-        # @return [Hash, nil] decrypted data payload details or nil when decryption fails.
-        def decrypt_data(cipher_b64:, packet_id:, from_id: nil, from_num: nil, psk_b64: DEFAULT_PSK_B64)
-          ciphertext = Base64.strict_decode64(cipher_b64)
-          key = ChannelHash.expanded_key(psk_b64)
-          return nil unless key
-          return nil unless [16, 32].include?(key.bytesize)
-
-          packet_value = normalize_packet_id(packet_id)
-          return nil unless packet_value
-
-          from_value = normalize_node_num(from_id, from_num)
-          return nil unless from_value
-
-          nonce = build_nonce(packet_value, from_value)
-          plaintext = decrypt_aes_ctr(ciphertext, key, nonce)
-          return nil unless plaintext
-
-          data = Protobuf.parse_data(plaintext)
-          return nil unless data
-
-          text = nil
-          decryption_confidence = nil
-          if data[:portnum] == TEXT_MESSAGE_PORTNUM
-            candidate = data[:payload].dup.force_encoding("UTF-8")
-            if candidate.valid_encoding? && !candidate.empty?
-              text = candidate
-              decryption_confidence = text_confidence(text)
-            end
-          end
-
-          {
-            portnum: data[:portnum],
-            payload: data[:payload],
-            text: text,
-            decryption_confidence: decryption_confidence,
-          }
-        rescue ArgumentError, OpenSSL::Cipher::CipherError
-          nil
-        end
-
-        # Decrypt the Meshtastic data protobuf payload bytes.
-        #
-        # @param cipher_b64 [String] base64-encoded encrypted payload.
-        # @param packet_id [Integer] packet identifier used for the nonce.
-        # @param from_id [String, nil] Meshtastic node identifier.
-        # @param from_num [Integer, nil] numeric node identifier override.
-        # @param psk_b64 [String, nil] base64 PSK or alias.
-        # @return [String, nil] payload bytes or nil when decryption fails.
-        def decrypt_payload_bytes(cipher_b64:, packet_id:, from_id: nil, from_num: nil, psk_b64: DEFAULT_PSK_B64)
-          data = decrypt_data(
-            cipher_b64: cipher_b64,
-            packet_id: packet_id,
-            from_id: from_id,
-            from_num: from_num,
-            psk_b64: psk_b64,
-          )
-
-          data && data[:payload]
-        end
-
-        # Build the Meshtastic AES nonce from packet and node identifiers.
-        #
-        # @param packet_id [Integer] packet identifier.
-        # @param from_num [Integer] numeric node identifier.
-        # @return [String] 16-byte nonce.
-        def build_nonce(packet_id, from_num)
-          [packet_id].pack("Q<") + [from_num].pack("L<") + ("\x00" * 4)
-        end
-
-        # Decrypt data using AES-CTR with the derived nonce.
-        #
-        # @param ciphertext [String] encrypted payload bytes.
-        # @param key [String] expanded AES key bytes.
-        # @param nonce [String] 16-byte nonce.
-        # @return [String] decrypted plaintext bytes.
-        def decrypt_aes_ctr(ciphertext, key, nonce)
-          cipher_name = key.bytesize == 16 ? "aes-128-ctr" : "aes-256-ctr"
-          cipher = OpenSSL::Cipher.new(cipher_name)
-          cipher.decrypt
-          cipher.key = key
-          cipher.iv = nonce
-          cipher.update(ciphertext) + cipher.final
-        end
-
-        # Normalise the packet identifier into an integer.
-        #
-        # @param packet_id [Integer, nil] packet identifier.
-        # @return [Integer, nil] validated packet id or nil when invalid.
-        def normalize_packet_id(packet_id)
-          return packet_id if packet_id.is_a?(Integer) && packet_id >= 0
-          return nil if packet_id.nil?
-
-          if packet_id.is_a?(Numeric)
-            return nil if packet_id.negative?
-            return packet_id.to_i
-          end
-
-          return nil unless packet_id.respond_to?(:to_s)
-
-          trimmed = packet_id.to_s.strip
-          return nil if trimmed.empty?
-          return trimmed.to_i(10) if trimmed.match?(/\A\d+\z/)
-
-          nil
-        end
-
-        # Score the plausibility of decrypted text content.
-        #
-        # @param text [String] decrypted text candidate.
-        # @return [Float] confidence score between 0.0 and 1.0.
-        def text_confidence(text)
-          return 0.0 unless text.is_a?(String)
-          return 0.0 if text.empty?
-
-          total = text.length.to_f
-          length_score = [total / CONFIDENCE_LENGTH_TARGET, 1.0].min
-          control_count = text.scan(/[\p{Cc}\p{Cs}]/).length
-          control_ratio = control_count / total
-          acceptable_count = text.scan(/[\p{L}\p{N}\p{P}\p{S}\p{Zs}\t\n\r]/).length
-          acceptable_ratio = acceptable_count / total
-
-          score = length_score * acceptable_ratio * (1.0 - control_ratio)
-          score.clamp(0.0, 1.0)
-        end
-
-        # Resolve the node number from any of the supported identifiers.
-        #
-        # @param from_id [String, nil] Meshtastic node identifier.
-        # @param from_num [Integer, nil] numeric node identifier override.
-        # @return [Integer, nil] node number or nil when invalid.
-        def normalize_node_num(from_id, from_num)
-          if from_num.is_a?(Integer)
-            return from_num & 0xFFFFFFFF
-          elsif from_num.is_a?(Numeric)
-            return from_num.to_i & 0xFFFFFFFF
-          end
-
-          return nil unless from_id
-
-          trimmed = from_id.to_s.strip
-          return nil if trimmed.empty?
-
-          hex = trimmed.delete_prefix("!")
-          hex = hex[2..] if hex.start_with?("0x", "0X")
-          return nil unless hex.match?(/\A[0-9A-Fa-f]+\z/)
-
-          hex.to_i(16) & 0xFFFFFFFF
-        end
-      end
-    end
-  end
-end
@@ -1,120 +0,0 @@
-# Copyright © 2025-26 l5yth & contributors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# frozen_string_literal: true
-
-require "json"
-require "open3"
-
-module PotatoMesh
-  module App
-    module Meshtastic
-      # Decode Meshtastic protobuf payloads via the Python helper script.
-      module PayloadDecoder
-        module_function
-
-        PYTHON_ENV_KEY = "MESHTASTIC_PYTHON"
-        DEFAULT_PYTHON_RELATIVE = File.join("data", ".venv", "bin", "python")
-        DEFAULT_DECODER_RELATIVE = File.join("data", "mesh_ingestor", "decode_payload.py")
-        FALLBACK_PYTHON_NAMES = ["python3", "python"].freeze
-
-        # Decode a protobuf payload using the Meshtastic helper.
-        #
-        # @param portnum [Integer] Meshtastic port number.
-        # @param payload_b64 [String] base64-encoded payload bytes.
-        # @return [Hash, nil] decoded payload hash or nil when decoding fails.
-        def decode(portnum:, payload_b64:)
-          return nil unless portnum && payload_b64
-
-          decoder_path = decoder_script_path
-          python_path = python_executable_path
-          return nil unless decoder_path && python_path
-
-          input = JSON.generate({ portnum: portnum, payload_b64: payload_b64 })
-          stdout, stderr, status = Open3.capture3(python_path, decoder_path, stdin_data: input)
-          return nil unless status.success?
-
-          parsed = JSON.parse(stdout)
-          return nil unless parsed.is_a?(Hash)
-          return nil if parsed["error"]
-
-          parsed
-        rescue JSON::ParserError
-          nil
-        rescue Errno::ENOENT
-          nil
-        rescue ArgumentError
-          nil
-        end
-
-        # Resolve the configured Python executable for Meshtastic decoding.
-        #
-        # @return [String, nil] python path or nil when missing.
-        def python_executable_path
-          configured = ENV[PYTHON_ENV_KEY]
-          return configured if configured && !configured.strip.empty?
-
-          candidate = File.expand_path(DEFAULT_PYTHON_RELATIVE, repo_root)
-          return candidate if File.exist?(candidate)
-
-          FALLBACK_PYTHON_NAMES.each do |name|
-            found = find_executable(name)
-            return found if found
-          end
-
-          nil
-        end
-
-        # Resolve the Meshtastic payload decoder script path.
-        #
-        # @return [String, nil] script path or nil when missing.
-        def decoder_script_path
-          repo_candidate = File.expand_path(DEFAULT_DECODER_RELATIVE, repo_root)
-          return repo_candidate if File.exist?(repo_candidate)
-
-          web_candidate = File.expand_path(DEFAULT_DECODER_RELATIVE, web_root)
-          return web_candidate if File.exist?(web_candidate)
-
-          nil
-        end
-
-        # Resolve the repository root directory from the application config.
-        #
-        # @return [String] absolute path to the repository root.
-        def repo_root
-          PotatoMesh::Config.repo_root
-        end
-
-        def web_root
-          PotatoMesh::Config.web_root
-        end
-
-        def find_executable(name)
-          # Locate an executable in PATH without invoking a subshell.
-          #
-          # @param name [String] executable name to resolve.
-          # @return [String, nil] full path when found.
-          ENV.fetch("PATH", "").split(File::PATH_SEPARATOR).each do |path|
-            candidate = File.join(path, name)
-            return candidate if File.file?(candidate) && File.executable?(candidate)
-          end
-
-          nil
-        end
-
-        private_class_method :find_executable
-      end
-    end
-  end
-end
@@ -1,140 +0,0 @@
-# Copyright © 2025-26 l5yth & contributors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# frozen_string_literal: true
-
-module PotatoMesh
-  module App
-    module Meshtastic
-      # Minimal protobuf helpers for extracting payload bytes from Meshtastic data.
-      module Protobuf
-        module_function
-
-        WIRE_TYPE_VARINT = 0
-        WIRE_TYPE_64BIT = 1
-        WIRE_TYPE_LENGTH_DELIMITED = 2
-        WIRE_TYPE_32BIT = 5
-        DATA_PORTNUM_FIELD = 1
-        DATA_PAYLOAD_FIELD = 2
-
-        # Extract a length-delimited field from a protobuf message.
-        #
-        # @param payload [String] raw protobuf-encoded bytes.
-        # @param field_number [Integer] field to extract.
-        # @return [String, nil] field bytes or nil when absent/invalid.
-        def extract_field_bytes(payload, field_number)
-          return nil unless payload && field_number
-
-          bytes = payload.bytes
-          index = 0
-
-          while index < bytes.length
-            tag, index = read_varint(bytes, index)
-            return nil unless tag
-
-            field = tag >> 3
-            wire = tag & 0x7
-
-            case wire
-            when WIRE_TYPE_VARINT
-              _, index = read_varint(bytes, index)
-              return nil unless index
-            when WIRE_TYPE_64BIT
-              index += 8
-            when WIRE_TYPE_LENGTH_DELIMITED
-              length, index = read_varint(bytes, index)
-              return nil unless length
-              return nil if index + length > bytes.length
-              value = bytes[index, length].pack("C*")
-              index += length
-              return value if field == field_number
-            when WIRE_TYPE_32BIT
-              index += 4
-            else
-              return nil
-            end
-          end
-
-          nil
-        end
-
-        # Parse a Meshtastic Data message for the port number and payload.
-        #
-        # @param payload [String] raw protobuf-encoded bytes.
-        # @return [Hash, nil] parsed port number and payload bytes.
-        def parse_data(payload)
-          return nil unless payload
-
-          bytes = payload.bytes
-          index = 0
-          portnum = nil
-          data_payload = nil
-
-          while index < bytes.length
-            tag, index = read_varint(bytes, index)
-            return nil unless tag
-
-            field = tag >> 3
-            wire = tag & 0x7
-
-            case wire
-            when WIRE_TYPE_VARINT
-              value, index = read_varint(bytes, index)
-              return nil unless value
-              portnum = value if field == DATA_PORTNUM_FIELD
-            when WIRE_TYPE_64BIT
-              index += 8
-            when WIRE_TYPE_LENGTH_DELIMITED
-              length, index = read_varint(bytes, index)
-              return nil unless length
-              return nil if index + length > bytes.length
-              value = bytes[index, length].pack("C*")
-              index += length
-              data_payload = value if field == DATA_PAYLOAD_FIELD
-            when WIRE_TYPE_32BIT
-              index += 4
-            else
-              return nil
-            end
-          end
-
-          return nil unless portnum && data_payload
-
-          { portnum: portnum, payload: data_payload }
-        end
-
-        # Read a protobuf varint from a byte array.
-        #
-        # @param bytes [Array<Integer>] byte stream.
-        # @param index [Integer] read offset.
-        # @return [Array(Integer, Integer), nil] value and new index or nil when invalid.
-        def read_varint(bytes, index)
-          shift = 0
-          value = 0
-
-          while index < bytes.length
-            byte = bytes[index]
-            index += 1
-            value |= (byte & 0x7F) << shift
-            return [value, index] if (byte & 0x80).zero?
-            shift += 7
-            return nil if shift > 63
-          end
-
-          nil
-        end
-      end
-    end
-  end
-end
@@ -1,68 +0,0 @@
-# Copyright © 2025-26 l5yth & contributors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# frozen_string_literal: true
-
-require_relative "channel_hash"
-require_relative "channel_names"
-
-module PotatoMesh
-  module App
-    module Meshtastic
-      # Resolve candidate channel names for a hashed channel index.
-      module RainbowTable
-        module_function
-
-        @tables = {}
-
-        # Lookup candidate channel names for a hashed channel index.
-        #
-        # @param index [Integer, nil] channel hash byte.
-        # @param psk_b64 [String, nil] base64 PSK or alias.
-        # @return [Array<String>] list of candidate names.
-        def channel_names_for(index, psk_b64:)
-          return [] unless index.is_a?(Integer)
-
-          table_for(psk_b64)[index] || []
-        end
-
-        # Build or retrieve the cached rainbow table for the given PSK.
-        #
-        # @param psk_b64 [String, nil] base64 PSK or alias.
-        # @return [Hash{Integer=>Array<String>}] mapping of hash bytes to names.
-        def table_for(psk_b64)
-          key = psk_b64.to_s
-          @tables[key] ||= build_table(psk_b64)
-        end
-
-        # Build a hash-to-name mapping for the provided PSK.
-        #
-        # @param psk_b64 [String, nil] base64 PSK or alias.
-        # @return [Hash{Integer=>Array<String>}] mapping of hash bytes to names.
-        def build_table(psk_b64)
-          mapping = Hash.new { |hash, key| hash[key] = [] }
-
-          ChannelNames::CHANNEL_NAME_CANDIDATES.each do |name|
-            hash = ChannelHash.channel_hash(name, psk_b64)
-            next unless hash
-
-            mapping[hash] << name
-          end
-
-          mapping
-        end
-      end
-    end
-  end
-end
@@ -357,7 +357,7 @@ module PotatoMesh
          SELECT m.id, m.rx_time, m.rx_iso, m.from_id, m.to_id, m.channel,
                 m.portnum, m.text, m.encrypted, m.rssi, m.hop_limit,
                 m.lora_freq, m.modem_preset, m.channel_name, m.snr,
-                 m.reply_id, m.emoji, m.decrypted, m.decryption_confidence
+                 m.reply_id, m.emoji
          FROM messages m
        SQL
        sql += "    WHERE #{where_clauses.join(" AND ")}\n"
@@ -371,30 +371,6 @@ module PotatoMesh
          r.delete_if { |key, _| key.is_a?(Integer) }
          r["reply_id"] = coerce_integer(r["reply_id"]) if r.key?("reply_id")
          r["emoji"] = string_or_nil(r["emoji"]) if r.key?("emoji")
-          if string_or_nil(r["encrypted"])
-            r.delete("portnum")
-          end
-
-          if r.key?("decrypted")
-            decrypted_raw = r["decrypted"]
-            decrypted = case decrypted_raw
-              when true, false
-                decrypted_raw
-              when Integer
-                !decrypted_raw.zero?
-              when String
-                trimmed = decrypted_raw.strip
-                !trimmed.empty? && trimmed != "0" && trimmed.casecmp("false") != 0
-              else
-                !!decrypted_raw
-              end
-            r["decrypted"] = decrypted
-            r.delete("decryption_confidence") unless decrypted
-          end
-
-          if r.key?("decryption_confidence") && !r["decryption_confidence"].nil?
-            r["decryption_confidence"] = r["decryption_confidence"].to_f
-          end
          if PotatoMesh::Config.debug? && (r["from_id"].nil? || r["from_id"].to_s.strip.empty?)
            raw = db.execute("SELECT * FROM messages WHERE id = ?", [r["id"]]).first
            debug_log(
@@ -14,8 +14,6 @@

 # frozen_string_literal: true

-require "timeout"
-
 module PotatoMesh
  module App
    # WorkerPool executes submitted blocks using a bounded set of Ruby threads.
@@ -126,9 +124,8 @@ module PotatoMesh
      #
      # @param size [Integer] number of worker threads to spawn.
      # @param max_queue [Integer, nil] optional upper bound on queued jobs.
-      # @param task_timeout [Numeric, nil] optional per-task execution timeout.
      # @param name [String] prefix assigned to worker thread names.
-      def initialize(size:, max_queue: nil, task_timeout: nil, name: "worker-pool")
+      def initialize(size:, max_queue: nil, name: "worker-pool")
        raise ArgumentError, "size must be positive" unless size.is_a?(Integer) && size.positive?

        @name = name
@@ -136,7 +133,6 @@ module PotatoMesh
        @threads = []
        @stopped = false
        @mutex = Mutex.new
-        @task_timeout = normalize_task_timeout(task_timeout)
        spawn_workers(size)
      end

@@ -196,45 +192,23 @@ module PotatoMesh
          worker = Thread.new do
            Thread.current.name = "#{@name}-#{index}" if Thread.current.respond_to?(:name=)
            Thread.current.report_on_exception = false if Thread.current.respond_to?(:report_on_exception=)
-            # Daemon threads allow the process to exit even if a job is stuck.
-            Thread.current.daemon = true if Thread.current.respond_to?(:daemon=)

            loop do
              task, block = @queue.pop
              break if task.equal?(STOP_SIGNAL)

              begin
-                result = if @task_timeout
-                    Timeout.timeout(@task_timeout, TaskTimeoutError, "task exceeded timeout") do
-                      block.call
-                    end
-                  else
-                    block.call
-                  end
+                result = block.call
                task.fulfill(result)
              rescue StandardError => e
                task.reject(e)
              end
            end
          end
+
          @threads << worker
        end
      end
-
-      # Normalize the per-task timeout into a positive float value.
-      #
-      # @param task_timeout [Numeric, nil] candidate timeout value.
-      # @return [Float, nil] positive timeout in seconds or nil when disabled.
-      def normalize_task_timeout(task_timeout)
-        return nil if task_timeout.nil?
-
-        value = Float(task_timeout)
-        return nil unless value.positive?
-
-        value
-      rescue ArgumentError, TypeError
-        nil
-      end
    end
  end
 end
@@ -32,7 +32,6 @@ module PotatoMesh
    DEFAULT_MAP_CENTER = "#{DEFAULT_MAP_CENTER_LAT},#{DEFAULT_MAP_CENTER_LON}"
    DEFAULT_CHANNEL = "#LongFast"
    DEFAULT_FREQUENCY = "915MHz"
-    DEFAULT_MESHTASTIC_PSK_B64 = "AQ=="
    DEFAULT_CONTACT_LINK = "#potatomesh:dod.ngo"
    DEFAULT_MAX_DISTANCE_KM = 42.0
    DEFAULT_REMOTE_INSTANCE_CONNECT_TIMEOUT = 15
@@ -184,7 +183,7 @@ module PotatoMesh
    #
    # @return [String] semantic version identifier.
    def version_fallback
-      "0.5.10"
+      "0.5.9"
    end

    # Default refresh interval for frontend polling routines.
@@ -445,13 +444,6 @@ module PotatoMesh
      fetch_string("SITE_NAME", "PotatoMesh Demo")
    end

-    # Retrieve the configured announcement banner copy.
-    #
-    # @return [String, nil] announcement string when configured.
-    def announcement
-      fetch_string("ANNOUNCEMENT", nil)
-    end
-
    # Retrieve the default radio channel label.
    #
    # @return [String] channel name from configuration.
@@ -466,13 +458,6 @@ module PotatoMesh
      fetch_string("FREQUENCY", DEFAULT_FREQUENCY)
    end

-    # Retrieve the Meshtastic PSK used for decrypting channel messages.
-    #
-    # @return [String] base64-encoded PSK or alias.
-    def meshtastic_psk_b64
-      fetch_string("MESHTASTIC_PSK_B64", DEFAULT_MESHTASTIC_PSK_B64)
-    end
-
    # Parse the configured map centre coordinates.
    #
    # @return [Hash{Symbol=>Float}] latitude and longitude in decimal degrees.
@@ -199,14 +199,6 @@ module PotatoMesh
      sanitized_string(Config.site_name)
    end

-    # Retrieve the configured announcement banner copy and normalise blank values to nil.
-    #
-    # @return [String, nil] announcement copy or +nil+ when blank.
-    def sanitized_announcement
-      value = sanitized_string(Config.announcement)
-      value.empty? ? nil : value
-    end
-
    # Retrieve the configured channel as a cleaned string.
    #
    # @return [String] trimmed configuration value.
@@ -1,12 +1,12 @@
 {
  "name": "potato-mesh",
-  "version": "0.5.10",
+  "version": "0.5.9",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "potato-mesh",
-      "version": "0.5.10",
+      "version": "0.5.9",
      "devDependencies": {
        "istanbul-lib-coverage": "^3.2.2",
        "istanbul-lib-report": "^3.0.1",
@@ -1,6 +1,6 @@
 {
  "name": "potato-mesh",
-  "version": "0.5.10",
+  "version": "0.5.9",
  "type": "module",
  "private": true,
  "scripts": {
@@ -172,13 +172,14 @@ test('buildChatTabModel includes telemetry, position, and neighbor events', () =
    windowSeconds: WINDOW
  });

-  const types = model.logEntries.map(entry => entry.type);
-  assert.equal(types[0], CHAT_LOG_ENTRY_TYPES.NODE_NEW);
-  assert.ok(types.includes(CHAT_LOG_ENTRY_TYPES.NODE_INFO));
-  assert.ok(types.includes(CHAT_LOG_ENTRY_TYPES.TELEMETRY));
-  assert.ok(types.includes(CHAT_LOG_ENTRY_TYPES.POSITION));
-  assert.ok(types.includes(CHAT_LOG_ENTRY_TYPES.NEIGHBOR));
-  assert.ok(types.includes(CHAT_LOG_ENTRY_TYPES.TRACE));
+  assert.deepEqual(model.logEntries.map(entry => entry.type), [
+    CHAT_LOG_ENTRY_TYPES.NODE_NEW,
+    CHAT_LOG_ENTRY_TYPES.NODE_INFO,
+    CHAT_LOG_ENTRY_TYPES.TELEMETRY,
+    CHAT_LOG_ENTRY_TYPES.POSITION,
+    CHAT_LOG_ENTRY_TYPES.NEIGHBOR,
+    CHAT_LOG_ENTRY_TYPES.TRACE
+  ]);
  assert.equal(model.logEntries[0].nodeId, nodeId);
  const neighborEntry = model.logEntries.find(entry => entry.type === CHAT_LOG_ENTRY_TYPES.NEIGHBOR);
  assert.ok(neighborEntry);
@@ -27,9 +27,6 @@ test('federation map centers on configured coordinates and follows theme filters

  const mapEl = createElement('div', 'map');
  registerElement('map', mapEl);
-  const mapPanel = createElement('div', 'mapPanel');
-  mapPanel.dataset.legendCollapsed = 'true';
-  registerElement('mapPanel', mapPanel);
  const statusEl = createElement('div', 'status');
  registerElement('status', statusEl);
  const tableEl = createElement('table', 'instances');
@@ -411,192 +408,15 @@ test('federation table sorting, contact rendering, and legend creation', async (
    assert.deepEqual(mapSetViewCalls[0], [[0, 0], 3]);
    assert.equal(mapFitBoundsCalls[0][0].length, 3);

-    assert.equal(legendContainers.length, 2);
-    const legend = legendContainers.find(container => container.className.includes('legend--instances'));
-    assert.ok(legend);
-    assert.ok(legend.className.includes('legend-hidden'));
+    assert.equal(legendContainers.length, 1);
+    const legend = legendContainers[0];
+    assert.ok(legend.className.includes('legend'));
    const legendHeader = legend.children.find(child => child.className === 'legend-header');
    const legendTitle = legendHeader && Array.isArray(legendHeader.children)
      ? legendHeader.children.find(child => child.className === 'legend-title')
      : null;
    assert.ok(legendTitle);
    assert.equal(legendTitle.textContent, 'Active nodes');
-    const legendToggle = legendContainers.find(container => container.className.includes('legend-toggle'));
-    assert.ok(legendToggle);
-  } finally {
-    cleanup();
-  }
-});
-
-test('federation legend toggle respects media query changes', async () => {
-  const env = createDomEnvironment({ includeBody: true, bodyHasDarkClass: false });
-  const { document, createElement, registerElement, cleanup } = env;
-
-  const mapEl = createElement('div', 'map');
-  registerElement('map', mapEl);
-  const mapPanel = createElement('div', 'mapPanel');
-  mapPanel.setAttribute('data-legend-collapsed', 'false');
-  registerElement('mapPanel', mapPanel);
-  const statusEl = createElement('div', 'status');
-  registerElement('status', statusEl);
-
-  const tableEl = createElement('table', 'instances');
-  const tbodyEl = createElement('tbody');
-  registerElement('instances', tableEl);
-  tableEl.appendChild(tbodyEl);
-
-  const configPayload = {
-    mapCenter: { lat: 0, lon: 0 },
-    mapZoom: 3,
-    tileFilters: { light: 'none', dark: 'invert(1)' }
-  };
-  const configEl = createElement('div');
-  configEl.setAttribute('data-app-config', JSON.stringify(configPayload));
-
-  document.querySelector = selector => {
-    if (selector === '[data-app-config]') return configEl;
-    if (selector === '#instances tbody') return tbodyEl;
-    return null;
-  };
-
-  let mediaQueryHandler = null;
-  window.matchMedia = () => ({
-    matches: false,
-    addListener(handler) {
-      mediaQueryHandler = handler;
-    }
-  });
-
-  const legendContainers = [];
-  const legendButtons = [];
-
-  const DomUtil = {
-    create(tag, className, parent) {
-      const classSet = new Set(className ? className.split(/\s+/).filter(Boolean) : []);
-      const el = {
-        tagName: tag,
-        className,
-        classList: {
-          toggle(name, force) {
-            const shouldAdd = typeof force === 'boolean' ? force : !classSet.has(name);
-            if (shouldAdd) {
-              classSet.add(name);
-            } else {
-              classSet.delete(name);
-            }
-            el.className = Array.from(classSet).join(' ');
-          }
-        },
-        children: [],
-        style: {},
-        textContent: '',
-        attributes: new Map(),
-        setAttribute(name, value) {
-          this.attributes.set(name, String(value));
-        },
-        appendChild(child) {
-          this.children.push(child);
-          return child;
-        },
-        addEventListener(event, handler) {
-          if (event === 'click') {
-            this._clickHandler = handler;
-          }
-        },
-        querySelector() {
-          return null;
-        }
-      };
-      if (parent && parent.appendChild) parent.appendChild(el);
-      if (className && className.includes('legend-toggle-button')) {
-        legendButtons.push(el);
-      }
-      return el;
-    }
-  };
-
-  const controlStub = () => {
-    const ctrl = {
-      onAdd: null,
-      container: null,
-      addTo(map) {
-        this.container = this.onAdd ? this.onAdd(map) : null;
-        legendContainers.push(this.container);
-        return this;
-      },
-      getContainer() {
-        return this.container;
-      }
-    };
-    return ctrl;
-  };
-
-  const markersLayer = {
-    addLayer() {
-      return null;
-    },
-    addTo() {
-      return this;
-    }
-  };
-
-  const leafletStub = {
-    map() {
-      return {
-        setView() {},
-        on() {},
-        fitBounds() {}
-      };
-    },
-    tileLayer() {
-      return {
-        addTo() {
-          return this;
-        },
-        getContainer() {
-          return null;
-        },
-        on() {}
-      };
-    },
-    layerGroup() {
-      return markersLayer;
-    },
-    circleMarker() {
-      return {
-        bindPopup() {
-          return this;
-        }
-      };
-    },
-    control: controlStub,
-    DomUtil,
-    DomEvent: {
-      disableClickPropagation() {},
-      disableScrollPropagation() {}
-    }
-  };
-
-  const fetchImpl = async () => ({
-    ok: true,
-    json: async () => []
-  });
-
-  try {
-    await initializeFederationPage({ config: configPayload, fetchImpl, leaflet: leafletStub });
-
-    const legend = legendContainers.find(container => container.className.includes('legend--instances'));
-    assert.ok(legend);
-    assert.ok(!legend.className.includes('legend-hidden'));
-
-    assert.equal(legendButtons.length, 1);
-    legendButtons[0]._clickHandler?.({ preventDefault() {}, stopPropagation() {} });
-    assert.ok(legend.className.includes('legend-hidden'));
-
-    if (mediaQueryHandler) {
-      mediaQueryHandler({ matches: false });
-      assert.ok(!legend.className.includes('legend-hidden'));
-    }
  } finally {
    cleanup();
  }
@@ -20,7 +20,7 @@ import { createDomEnvironment } from './dom-environment.js';

 import { buildInstanceUrl, initializeInstanceSelector, __test__ } from '../instance-selector.js';

-const { resolveInstanceLabel, updateFederationNavCount } = __test__;
+const { resolveInstanceLabel } = __test__;

 function setupSelectElement(document) {
  const select = document.createElement('select');
@@ -191,65 +191,3 @@ test('initializeInstanceSelector navigates to the chosen instance domain', async
    env.cleanup();
  }
 });
-
-test('initializeInstanceSelector updates federation navigation labels with instance count', async () => {
-  const env = createDomEnvironment();
-  const select = setupSelectElement(env.document);
-  const navLink = env.document.createElement('a');
-  navLink.classList.add('js-federation-nav');
-  navLink.textContent = 'Federation';
-  env.document.body.appendChild(navLink);
-
-  const fetchImpl = async () => ({
-    ok: true,
-    async json() {
-      return [{ domain: 'alpha.mesh' }, { domain: 'beta.mesh' }];
-    }
-  });
-
-  try {
-    await initializeInstanceSelector({
-      selectElement: select,
-      fetchImpl,
-      windowObject: env.window,
-      documentObject: env.document
-    });
-
-    assert.equal(navLink.textContent, 'Federation (2)');
-  } finally {
-    env.cleanup();
-  }
-});
-
-test('updateFederationNavCount prefers stored labels and normalizes counts', () => {
-  const env = createDomEnvironment();
-  const navLink = env.document.createElement('a');
-  navLink.classList.add('js-federation-nav');
-  navLink.textContent = 'Federation';
-  navLink.dataset.federationLabel = 'Community';
-  env.document.body.appendChild(navLink);
-
-  try {
-    updateFederationNavCount({ documentObject: env.document, count: -3 });
-
-    assert.equal(navLink.textContent, 'Community (0)');
-  } finally {
-    env.cleanup();
-  }
-});
-
-test('updateFederationNavCount falls back to existing link text when no dataset label', () => {
-  const env = createDomEnvironment();
-  const navLink = env.document.createElement('a');
-  navLink.classList.add('js-federation-nav');
-  navLink.textContent = 'Federation (9)';
-  env.document.body.appendChild(navLink);
-
-  try {
-    updateFederationNavCount({ documentObject: env.document, count: 4 });
-
-    assert.equal(navLink.textContent, 'Federation (4)');
-  } finally {
-    env.cleanup();
-  }
-});
@@ -103,29 +103,11 @@ export function buildChatTabModel({
  const logEntries = [];
  const channelBuckets = new Map();
  const primaryChannelEnvLabel = normalisePrimaryChannelEnvLabel(primaryChannelFallbackLabel);
-  const nodeById = new Map();
-  const nodeByNum = new Map();
-  const nodeInfoKeys = new Set();
-
-  const buildNodeInfoKey = (nodeId, nodeNum, ts) => `${nodeId ?? ''}:${nodeNum ?? ''}:${ts ?? ''}`;
-  const recordNodeInfoEntry = (ts, nodeId, nodeNum) => {
-    if (ts == null) return;
-    const key = buildNodeInfoKey(nodeId, nodeNum, ts);
-    if (nodeInfoKeys.has(key)) return;
-    const node = nodeId && nodeById.has(nodeId)
-      ? nodeById.get(nodeId)
-      : (nodeNum != null && nodeByNum.has(nodeNum) ? nodeByNum.get(nodeNum) : null);
-    if (!node) return;
-    nodeInfoKeys.add(key);
-    logEntries.push({ ts, type: CHAT_LOG_ENTRY_TYPES.NODE_INFO, node, nodeId, nodeNum });
-  };

  for (const node of nodes || []) {
    if (!node) continue;
    const nodeId = normaliseNodeId(node);
    const nodeNum = normaliseNodeNum(node);
-    if (nodeId) nodeById.set(nodeId, node);
-    if (nodeNum != null) nodeByNum.set(nodeNum, node);
    const firstTs = resolveTimestampSeconds(node.first_heard ?? node.firstHeard, node.first_heard_iso ?? node.firstHeardIso);
    if (firstTs != null && firstTs >= cutoff) {
      logEntries.push({ ts: firstTs, type: CHAT_LOG_ENTRY_TYPES.NODE_NEW, node, nodeId, nodeNum });
@@ -133,7 +115,6 @@ export function buildChatTabModel({
    const lastTs = resolveTimestampSeconds(node.last_heard ?? node.lastHeard, node.last_seen_iso ?? node.lastSeenIso);
    if (lastTs != null && lastTs >= cutoff) {
      logEntries.push({ ts: lastTs, type: CHAT_LOG_ENTRY_TYPES.NODE_INFO, node, nodeId, nodeNum });
-      nodeInfoKeys.add(buildNodeInfoKey(nodeId, nodeNum, lastTs));
    }
  }

@@ -149,7 +130,6 @@ export function buildChatTabModel({
      const nodeId = normaliseNodeId(snapshot);
      const nodeNum = normaliseNodeNum(snapshot);
      logEntries.push({ ts, type: CHAT_LOG_ENTRY_TYPES.TELEMETRY, telemetry: snapshot, nodeId, nodeNum });
-      recordNodeInfoEntry(ts, nodeId, nodeNum);
    }
  }

@@ -165,7 +145,6 @@ export function buildChatTabModel({
      const nodeId = normaliseNodeId(snapshot);
      const nodeNum = normaliseNodeNum(snapshot);
      logEntries.push({ ts, type: CHAT_LOG_ENTRY_TYPES.POSITION, position: snapshot, nodeId, nodeNum });
-      recordNodeInfoEntry(ts, nodeId, nodeNum);
    }
  }

@@ -179,7 +158,6 @@ export function buildChatTabModel({
      const nodeNum = normaliseNodeNum(snapshot);
      const neighborId = normaliseNeighborId(snapshot);
      logEntries.push({ ts, type: CHAT_LOG_ENTRY_TYPES.NEIGHBOR, neighbor: snapshot, nodeId, nodeNum, neighborId });
-      recordNodeInfoEntry(ts, nodeId, nodeNum);
    }
  }

@@ -209,7 +187,6 @@ export function buildChatTabModel({
      nodeId: firstHop.id ?? null,
      nodeNum: firstHop.num ?? null
    });
-    recordNodeInfoEntry(ts, firstHop.id ?? null, firstHop.num ?? null);
  }

  const encryptedLogEntries = [];
@@ -15,7 +15,6 @@
 */

 import { readAppConfig } from './config.js';
-import { resolveLegendVisibility } from './map-legend-visibility.js';
 import { mergeConfig } from './settings.js';
 import { roleColors } from './role-helpers.js';

@@ -205,31 +204,6 @@ function hasNumberValue(value) {
  return toFiniteNumber(value) != null;
 }

-/**
- * Toggle the legend hidden class on a container element.
- *
- * @param {HTMLElement|{ classList?: { toggle?: Function }, className?: string }} container Legend container.
- * @param {boolean} hidden Whether the legend should be hidden.
- * @returns {void}
- */
-function toggleLegendHiddenClass(container, hidden) {
-  if (!container) return;
-  if (container.classList && typeof container.classList.toggle === 'function') {
-    container.classList.toggle('legend-hidden', hidden);
-    return;
-  }
-  if (typeof container.className === 'string') {
-    const classes = container.className.split(/\s+/).filter(Boolean);
-    const hasHidden = classes.includes('legend-hidden');
-    if (hidden && !hasHidden) {
-      classes.push('legend-hidden');
-    } else if (!hidden && hasHidden) {
-      classes.splice(classes.indexOf('legend-hidden'), 1);
-    }
-    container.className = classes.join(' ');
-  }
-}
-
 const TILE_LAYER_URL = 'https://{s}.tile.openstreetmap.fr/hot/{z}/{x}/{y}.png';

 /**
@@ -249,7 +223,6 @@ export async function initializeFederationPage(options = {}) {
  const fetchImpl = options.fetchImpl || fetch;
  const leaflet = options.leaflet || (typeof window !== 'undefined' ? window.L : null);
  const mapContainer = document.getElementById('map');
-  const mapPanel = document.getElementById('mapPanel');
  const tableEl = document.getElementById('instances');
  const tableBody = document.querySelector('#instances tbody');
  const statusEl = document.getElementById('status');
@@ -266,13 +239,6 @@ export async function initializeFederationPage(options = {}) {
  let map = null;
  let markersLayer = null;
  let tileLayer = null;
-  let legendContainer = null;
-  let legendToggleButton = null;
-  let legendVisible = true;
-  const legendCollapsedValue = mapPanel ? mapPanel.getAttribute('data-legend-collapsed') : null;
-  const legendDefaultCollapsed = legendCollapsedValue == null
-    ? true
-    : legendCollapsedValue.trim() !== 'false';
  const tableSorters = {
    name: { getValue: inst => inst.name ?? '', compare: compareString, hasValue: hasStringValue, defaultDirection: 'asc' },
    domain: { getValue: inst => inst.domain ?? '', compare: compareString, hasValue: hasStringValue, defaultDirection: 'asc' },
@@ -391,37 +357,6 @@ export async function initializeFederationPage(options = {}) {
    syncSortIndicators();
  };

-  /**
-   * Update the pressed state of the legend visibility toggle button.
-   *
-   * @returns {void}
-   */
-  const updateLegendToggleState = () => {
-    if (!legendToggleButton) return;
-    const baseLabel = legendVisible ? 'Hide map legend' : 'Show map legend';
-    const baseText = legendVisible ? 'Hide legend' : 'Show legend';
-    legendToggleButton.setAttribute('aria-pressed', legendVisible ? 'true' : 'false');
-    legendToggleButton.setAttribute('aria-label', baseLabel);
-    legendToggleButton.textContent = baseText;
-  };
-
-  /**
-   * Show or hide the map legend component.
-   *
-   * @param {boolean} visible Whether the legend should be displayed.
-   * @returns {void}
-   */
-  const setLegendVisibility = visible => {
-    legendVisible = Boolean(visible);
-    if (legendContainer) {
-      toggleLegendHiddenClass(legendContainer, !legendVisible);
-      if (typeof legendContainer.setAttribute === 'function') {
-        legendContainer.setAttribute('aria-hidden', legendVisible ? 'false' : 'true');
-      }
-    }
-    updateLegendToggleState();
-  };
-
  /**
   * Wire up click and keyboard handlers for sortable headers.
   *
@@ -548,15 +483,6 @@ export async function initializeFederationPage(options = {}) {
    const canRenderLegend =
      typeof leaflet.control === 'function' && leaflet.DomUtil && typeof leaflet.DomUtil.create === 'function';
    if (canRenderLegend) {
-      const legendMediaQuery = typeof window !== 'undefined' && window.matchMedia
-        ? window.matchMedia('(max-width: 1024px)')
-        : null;
-      const initialLegendVisible = resolveLegendVisibility({
-        defaultCollapsed: legendDefaultCollapsed,
-        mediaQueryMatches: legendMediaQuery ? legendMediaQuery.matches : false
-      });
-      legendVisible = initialLegendVisible;
-
      const legendStops = NODE_COUNT_COLOR_STOPS.map((stop, index) => {
        const lower = index === 0 ? 0 : NODE_COUNT_COLOR_STOPS[index - 1].limit;
        const upper = stop.limit - 1;
@@ -569,11 +495,7 @@ export async function initializeFederationPage(options = {}) {
      const legend = leaflet.control({ position: 'bottomright' });
      legend.onAdd = function onAdd() {
        const container = leaflet.DomUtil.create('div', 'legend legend--instances');
-        container.id = 'federationLegend';
        container.setAttribute('aria-label', 'Active nodes legend');
-        container.setAttribute('role', 'region');
-        container.setAttribute('aria-hidden', initialLegendVisible ? 'false' : 'true');
-        toggleLegendHiddenClass(container, !initialLegendVisible);
        const header = leaflet.DomUtil.create('div', 'legend-header', container);
        const title = leaflet.DomUtil.create('span', 'legend-title', header);
        title.textContent = 'Active nodes';
@@ -586,46 +508,9 @@ export async function initializeFederationPage(options = {}) {
          const label = leaflet.DomUtil.create('span', 'legend-label', item);
          label.textContent = stop.label;
        });
-        legendContainer = container;
        return container;
      };
      legend.addTo(map);
-
-      const legendToggleControl = leaflet.control({ position: 'bottomright' });
-      legendToggleControl.onAdd = function onAdd() {
-        const container = leaflet.DomUtil.create('div', 'leaflet-control legend-toggle');
-        const button = leaflet.DomUtil.create('button', 'legend-toggle-button', container);
-        button.type = 'button';
-        button.setAttribute('aria-controls', 'federationLegend');
-        button.addEventListener?.('click', event => {
-          event.preventDefault();
-          event.stopPropagation();
-          setLegendVisibility(!legendVisible);
-        });
-        legendToggleButton = button;
-        updateLegendToggleState();
-        if (leaflet.DomEvent && typeof leaflet.DomEvent.disableClickPropagation === 'function') {
-          leaflet.DomEvent.disableClickPropagation(container);
-        }
-        if (leaflet.DomEvent && typeof leaflet.DomEvent.disableScrollPropagation === 'function') {
-          leaflet.DomEvent.disableScrollPropagation(container);
-        }
-        return container;
-      };
-      legendToggleControl.addTo(map);
-
-      setLegendVisibility(initialLegendVisible);
-      if (legendMediaQuery) {
-        const changeHandler = event => {
-          if (legendDefaultCollapsed) return;
-          setLegendVisibility(!event.matches);
-        };
-        if (typeof legendMediaQuery.addEventListener === 'function') {
-          legendMediaQuery.addEventListener('change', changeHandler);
-        } else if (typeof legendMediaQuery.addListener === 'function') {
-          legendMediaQuery.addListener(changeHandler);
-        }
-      }
    }

    for (const instance of instances) {
@@ -34,50 +34,6 @@ function resolveInstanceLabel(entry) {
  return domain;
 }

-/**
- * Update federation navigation labels with the instance count.
- *
- * @param {{
- *   documentObject?: Document | null,
- *   count: number
- * }} options Configuration for updating the navigation labels.
- * @returns {void}
- */
-function updateFederationNavCount(options) {
-  const { documentObject, count } = options;
-
-  if (!documentObject || typeof count !== 'number' || !Number.isFinite(count)) {
-    return;
-  }
-
-  const normalizedCount = Math.max(0, Math.floor(count));
-  const root = typeof documentObject.querySelectorAll === 'function'
-    ? documentObject
-    : documentObject.body;
-
-  if (!root || typeof root.querySelectorAll !== 'function') {
-    return;
-  }
-
-  const links = Array.from(root.querySelectorAll('.js-federation-nav'));
-
-  links.forEach(link => {
-    if (!link || typeof link !== 'object') {
-      return;
-    }
-
-    const dataset = link.dataset || {};
-    const storedLabel = typeof dataset.federationLabel === 'string' ? dataset.federationLabel.trim() : '';
-    const fallbackLabel = typeof link.textContent === 'string'
-      ? link.textContent.split('(')[0].trim()
-      : 'Federation';
-    const label = storedLabel || fallbackLabel || 'Federation';
-
-    dataset.federationLabel = label;
-    link.textContent = `${label} (${normalizedCount})`;
-  });
-}
-
 /**
  * Construct a navigable URL for the provided instance domain.
  *
@@ -210,8 +166,6 @@ export async function initializeInstanceSelector(options) {
    return;
  }

-  updateFederationNavCount({ documentObject: doc, count: payload.length });
-
  const sanitizedDomain = typeof instanceDomain === 'string' ? instanceDomain.trim().toLowerCase() : null;

  const sortedEntries = payload
@@ -284,4 +238,4 @@ export async function initializeInstanceSelector(options) {
  });
 }

-export const __test__ = { resolveInstanceLabel, updateFederationNavCount };
+export const __test__ = { resolveInstanceLabel };
@@ -30,9 +30,6 @@
  --input-border: rgba(12, 15, 18, 0.18);
  --input-placeholder: rgba(12, 15, 18, 0.45);
  --control-accent: var(--accent);
-  --announcement-bg: #fff4d6;
-  --announcement-fg: #7a3f00;
-  --announcement-border: #f0c05b;
  --pad: 16px;
  --map-tile-filter-light: grayscale(1) saturate(0) brightness(0.92) contrast(1.05);
  --map-tile-filter-dark: grayscale(1) invert(1) brightness(0.9) contrast(1.08);
@@ -62,9 +59,6 @@ body.dark {
  --input-border: rgba(230, 235, 240, 0.24);
  --input-placeholder: rgba(230, 235, 240, 0.55);
  --control-accent: var(--accent);
-  --announcement-bg: #3b2500;
-  --announcement-fg: #ffd184;
-  --announcement-border: #a56a00;
 }

 html,
@@ -246,29 +240,6 @@ h1 {
  margin-left: auto;
 }

-.announcement-banner {
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  height: 1.6em;
-  padding: 0 var(--pad);
-  border-radius: 999px;
-  background: var(--announcement-bg);
-  color: var(--announcement-fg);
-  border: 1px solid var(--announcement-border);
-  box-sizing: border-box;
-  overflow: hidden;
-}
-
-.announcement-banner__content {
-  margin: 0;
-  line-height: 1.6;
-  text-align: center;
-  white-space: nowrap;
-  overflow: hidden;
-  text-overflow: ellipsis;
-}
-
 .site-title {
  display: inline-flex;
  align-items: center;
@@ -15,7 +15,6 @@
 # frozen_string_literal: true

 require "spec_helper"
-require "base64"
 require "sqlite3"
 require "json"
 require "time"
@@ -729,34 +728,6 @@ RSpec.describe "Potato Mesh Sinatra app" do
        expect(sanitized_contact_link).to be_nil
      end

-      it "returns nil when the announcement is unset" do
-        allow(PotatoMesh::Config).to receive(:announcement).and_return(nil)
-        expect(announcement_html).to be_nil
-      end
-
-      it "renders announcement links with safe targets" do
-        allow(PotatoMesh::Config).to receive(:announcement).and_return("Visit https://example.org now.")
-
-        expect(announcement_html).to include(
-          '<a href="https://example.org" target="_blank" rel="noopener noreferrer">https://example.org</a>',
-        )
-      end
-
-      it "escapes announcement text while preserving links" do
-        allow(PotatoMesh::Config).to receive(:announcement).and_return("<b>Hi</b> https://example.org")
-
-        expect(announcement_html).to include("&lt;b&gt;Hi&lt;/b&gt;")
-        expect(announcement_html).to include(
-          '<a href="https://example.org" target="_blank" rel="noopener noreferrer">https://example.org</a>',
-        )
-      end
-
-      it "returns escaped announcement text when no links are present" do
-        allow(PotatoMesh::Config).to receive(:announcement).and_return("<hi>")
-
-        expect(announcement_html).to eq("&lt;hi&gt;")
-      end
-
      it "coerces string_or_nil inputs" do
        expect(string_or_nil("  hello \n")).to eq("hello")
        expect(string_or_nil("   ")).to be_nil
@@ -3983,869 +3954,6 @@ RSpec.describe "Potato Mesh Sinatra app" do
      expect(node_entry["to_id"]).to eq(receiver_id)
    end

-    it "decrypts encrypted messages when the PSK is configured" do
-      psk_b64 = "Nmh7EooP2Tsc+7pvPwXLcEDDuYhk+fBo2GLnbA1Y1sg="
-      previous_psk = ENV["MESHTASTIC_PSK_B64"]
-      ENV["MESHTASTIC_PSK_B64"] = psk_b64
-
-      begin
-        payload = {
-          "packet_id" => 3_915_687_257,
-          "rx_time" => reference_time.to_i,
-          "rx_iso" => reference_time.utc.iso8601,
-          "from_id" => "!9e95cf60",
-          "channel" => 35,
-          "portnum" => "TEXT_MESSAGE_APP",
-          "encrypted" => "Q1R7tgI5yXzMXu/3",
-        }
-
-        post "/api/messages", payload.to_json, auth_headers
-
-        expect(last_response).to be_ok
-        expect(JSON.parse(last_response.body)).to eq("status" => "ok")
-
-        with_db(readonly: true) do |db|
-          db.results_as_hash = true
-          row = db.get_first_row(
-            "SELECT text, encrypted, channel_name, decrypted, decryption_confidence FROM messages WHERE id = ?",
-            [payload["packet_id"]],
-          )
-
-          expect(row["text"]).to eq("Nabend")
-          expect(row["encrypted"]).to be_nil
-          expect(row["channel_name"]).to eq("BerlinMesh")
-          expect(row["decrypted"]).to eq(1)
-          expect(row["decryption_confidence"]).to be > 0.0
-          expect(row["decryption_confidence"]).to be <= 1.0
-        end
-      ensure
-        if previous_psk.nil?
-          ENV.delete("MESHTASTIC_PSK_B64")
-        else
-          ENV["MESHTASTIC_PSK_B64"] = previous_psk
-        end
-      end
-    end
-
-    it "keeps encrypted payloads when the decrypted portnum is not text" do
-      psk_b64 = "Nmh7EooP2Tsc+7pvPwXLcEDDuYhk+fBo2GLnbA1Y1sg="
-      previous_psk = ENV["MESHTASTIC_PSK_B64"]
-      ENV["MESHTASTIC_PSK_B64"] = psk_b64
-
-      begin
-        encode_varint = lambda do |value|
-          bytes = []
-          remaining = value
-          loop do
-            byte = remaining & 0x7f
-            remaining >>= 7
-            if remaining.zero?
-              bytes << byte
-              break
-            end
-            bytes << (byte | 0x80)
-          end
-          bytes.pack("C*")
-        end
-
-        build_data_message = lambda do |portnum, payload|
-          tag_portnum = (1 << 3) | 0
-          tag_payload = (2 << 3) | 2
-          [
-            tag_portnum,
-          ].pack("C") + encode_varint.call(portnum) +
-            [tag_payload].pack("C") + encode_varint.call(payload.bytesize) + payload
-        end
-
-        encrypt_message = lambda do |plaintext, packet_id, from_id|
-          key = PotatoMesh::App::Meshtastic::ChannelHash.expanded_key(psk_b64)
-          from_num = PotatoMesh::App::Meshtastic::Cipher.normalize_node_num(from_id, nil)
-          nonce = PotatoMesh::App::Meshtastic::Cipher.build_nonce(packet_id, from_num)
-          cipher_name = key.bytesize == 16 ? "aes-128-ctr" : "aes-256-ctr"
-          cipher = OpenSSL::Cipher.new(cipher_name)
-          cipher.encrypt
-          cipher.key = key
-          cipher.iv = nonce
-          Base64.strict_encode64(cipher.update(plaintext) + cipher.final)
-        end
-
-        payload_bytes = "OK".b
-        plaintext = build_data_message.call(3, payload_bytes)
-        encrypted_payload = encrypt_message.call(plaintext, 3_915_687_260, "!9e95cf60")
-
-        payload = {
-          "packet_id" => 3_915_687_260,
-          "rx_time" => reference_time.to_i,
-          "rx_iso" => reference_time.utc.iso8601,
-          "from_id" => "!9e95cf60",
-          "channel" => 35,
-          "encrypted" => encrypted_payload,
-        }
-
-        post "/api/messages", payload.to_json, auth_headers
-
-        expect(last_response).to be_ok
-        expect(JSON.parse(last_response.body)).to eq("status" => "ok")
-
-        with_db(readonly: true) do |db|
-          db.results_as_hash = true
-          row = db.get_first_row(
-            "SELECT text, encrypted, portnum, decrypted, decryption_confidence FROM messages WHERE id = ?",
-            [payload["packet_id"]],
-          )
-
-          expect(row["text"]).to be_nil
-          expect(row["encrypted"]).to eq(encrypted_payload)
-          expect(row["portnum"]).to be_nil
-          expect(row["decrypted"]).to eq(0)
-          expect(row["decryption_confidence"]).to be_nil
-        end
-      ensure
-        if previous_psk.nil?
-          ENV.delete("MESHTASTIC_PSK_B64")
-        else
-          ENV["MESHTASTIC_PSK_B64"] = previous_psk
-        end
-      end
-    end
-
-    it "skips decryption in test mode unless PSK is set" do
-      previous_psk = ENV["MESHTASTIC_PSK_B64"]
-      previous_rack = ENV["RACK_ENV"]
-      ENV.delete("MESHTASTIC_PSK_B64")
-      ENV["RACK_ENV"] = "test"
-
-      message = {
-        "encrypted" => "otu3OyMrTIUlcaisLVDyAnLW",
-      }
-
-      result = PotatoMesh::Application.decrypt_meshtastic_message(
-        message,
-        3_189_171_433,
-        "!7c5b0920",
-        nil,
-        3,
-      )
-
-      expect(result).to be_nil
-    ensure
-      if previous_psk.nil?
-        ENV.delete("MESHTASTIC_PSK_B64")
-      else
-        ENV["MESHTASTIC_PSK_B64"] = previous_psk
-      end
-      if previous_rack.nil?
-        ENV.delete("RACK_ENV")
-      else
-        ENV["RACK_ENV"] = previous_rack
-      end
-    end
-
-    it "touches node last seen when encrypted payloads cannot be decrypted" do
-      encoded_payload = Base64.strict_encode64("cipher".b)
-      allow(PotatoMesh::Application).to receive(:decrypt_meshtastic_message).and_return(nil)
-      allow(PotatoMesh::Application).to receive(:touch_node_last_seen).and_call_original
-
-      with_db do |db|
-        PotatoMesh::Application.insert_message(
-          db,
-          {
-            "packet_id" => 910_010,
-            "rx_time" => reference_time.to_i,
-            "rx_iso" => reference_time.utc.iso8601,
-            "from_id" => "!7c5b0920",
-            "encrypted" => encoded_payload,
-          },
-        )
-      end
-
-      expect(PotatoMesh::Application).to have_received(:touch_node_last_seen).with(
-        anything,
-        anything,
-        anything,
-        hash_including(source: :message),
-      )
-    end
-
-    it "stores modem metadata when touching nodes via messages" do
-      payload = {
-        "packet_id" => 910_011,
-        "rx_time" => reference_time.to_i,
-        "rx_iso" => reference_time.utc.iso8601,
-        "from_id" => "!7c5b0920",
-        "text" => "modem metadata",
-        "lora_freq" => 868,
-        "modem_preset" => "MediumFast",
-      }
-
-      post "/api/messages", payload.to_json, auth_headers
-
-      expect(last_response).to be_ok
-      expect(JSON.parse(last_response.body)).to eq("status" => "ok")
-
-      with_db(readonly: true) do |db|
-        db.results_as_hash = true
-        row = db.get_first_row(
-          "SELECT lora_freq, modem_preset FROM nodes WHERE node_id = ?",
-          ["!7c5b0920"],
-        )
-
-        expect(row["lora_freq"]).to eq(868)
-        expect(row["modem_preset"]).to eq("MediumFast")
-      end
-    end
-
-    it "stores decoded telemetry when decrypting non-text payloads" do
-      payload_bytes = "telemetry".b
-      encoded_payload = Base64.strict_encode64(payload_bytes)
-      telemetry_payload = {
-        "time" => reference_time.to_i,
-        "deviceMetrics" => { "batteryLevel" => 77.5 },
-      }
-
-      allow(PotatoMesh::Application).to receive(:decrypt_meshtastic_message).and_return(
-        {
-          portnum: 67,
-          payload: payload_bytes,
-          text: nil,
-          channel_name: nil,
-        },
-      )
-      allow(PotatoMesh::App::Meshtastic::PayloadDecoder).to receive(:decode).and_return(
-        {
-          "type" => "TELEMETRY_APP",
-          "payload" => telemetry_payload,
-        },
-      )
-
-      with_db do |db|
-        PotatoMesh::Application.insert_message(
-          db,
-          {
-            "packet_id" => 900_001,
-            "rx_time" => reference_time.to_i,
-            "rx_iso" => reference_time.utc.iso8601,
-            "from_id" => "!7c5b0920",
-            "lora_freq" => 868,
-            "modem_preset" => "MediumFast",
-            "encrypted" => encoded_payload,
-          },
-        )
-      end
-
-      with_db(readonly: true) do |db|
-        db.results_as_hash = true
-        row = db.get_first_row(
-          "SELECT id, payload_b64, battery_level FROM telemetry WHERE id = ?",
-          [900_001],
-        )
-
-        expect(row["payload_b64"]).to eq(encoded_payload)
-        expect(row["battery_level"]).to eq(77.5)
-      end
-
-      with_db(readonly: true) do |db|
-        db.results_as_hash = true
-        row = db.get_first_row(
-          "SELECT lora_freq, modem_preset FROM nodes WHERE node_id = ?",
-          ["!7c5b0920"],
-        )
-
-        expect(row["lora_freq"]).to eq(868)
-        expect(row["modem_preset"]).to eq("MediumFast")
-      end
-    end
-
-    it "stores decoded positions when decrypting position payloads" do
-      payload_bytes = "position".b
-      encoded_payload = Base64.strict_encode64(payload_bytes)
-      position_payload = {
-        "latitude_i" => 525598720,
-        "longitude_i" => 136577024,
-        "altitude" => 11,
-        "time" => reference_time.to_i,
-        "precision_bits" => 13,
-      }
-
-      allow(PotatoMesh::Application).to receive(:decrypt_meshtastic_message).and_return(
-        {
-          portnum: 3,
-          payload: payload_bytes,
-          text: nil,
-          channel_name: nil,
-        },
-      )
-      allow(PotatoMesh::App::Meshtastic::PayloadDecoder).to receive(:decode).and_return(
-        {
-          "type" => "POSITION_APP",
-          "payload" => position_payload,
-        },
-      )
-
-      with_db do |db|
-        PotatoMesh::Application.insert_message(
-          db,
-          {
-            "packet_id" => 900_002,
-            "rx_time" => reference_time.to_i,
-            "rx_iso" => reference_time.utc.iso8601,
-            "from_id" => "!7c5b0920",
-            "lora_freq" => 868,
-            "modem_preset" => "MediumFast",
-            "encrypted" => encoded_payload,
-          },
-        )
-      end
-
-      with_db(readonly: true) do |db|
-        db.results_as_hash = true
-        row = db.get_first_row(
-          "SELECT id, latitude, longitude, altitude, payload_b64 FROM positions WHERE id = ?",
-          [900_002],
-        )
-
-        expect(row["payload_b64"]).to eq(encoded_payload)
-        expect(row["latitude"]).to be_within(0.0001).of(52.559872)
-        expect(row["longitude"]).to be_within(0.0001).of(13.6577024)
-        expect(row["altitude"]).to eq(11)
-      end
-
-      with_db(readonly: true) do |db|
-        db.results_as_hash = true
-        row = db.get_first_row(
-          "SELECT lora_freq, modem_preset FROM nodes WHERE node_id = ?",
-          ["!7c5b0920"],
-        )
-
-        expect(row["lora_freq"]).to eq(868)
-        expect(row["modem_preset"]).to eq("MediumFast")
-      end
-    end
-
-    it "normalizes numeric node identifiers to hex ids" do
-      payload = {
-        "packet_id" => 920_001,
-        "rx_time" => reference_time.to_i,
-        "rx_iso" => reference_time.utc.iso8601,
-        "from_id" => "1128114236",
-        "to_id" => "2086340896",
-        "text" => "numeric ids",
-      }
-
-      post "/api/messages", payload.to_json, auth_headers
-
-      expect(last_response).to be_ok
-      expect(JSON.parse(last_response.body)).to eq("status" => "ok")
-
-      with_db(readonly: true) do |db|
-        db.results_as_hash = true
-        row = db.get_first_row(
-          "SELECT from_id, to_id FROM messages WHERE id = ?",
-          [payload["packet_id"]],
-        )
-
-        expect(row["from_id"]).to eq("!433da83c")
-        expect(row["to_id"]).to eq("!7c5b0920")
-      end
-    end
-
-    it "clears encrypted payloads when non-text payloads are decoded" do
-      payload_bytes = "position".b
-      encoded_payload = Base64.strict_encode64(payload_bytes)
-      position_payload = {
-        "latitude_i" => 525598720,
-        "longitude_i" => 136577024,
-        "altitude" => 11,
-        "time" => reference_time.to_i,
-        "precision_bits" => 13,
-      }
-
-      allow(PotatoMesh::Application).to receive(:decrypt_meshtastic_message).and_return(
-        {
-          portnum: 3,
-          payload: payload_bytes,
-          text: nil,
-          channel_name: nil,
-        },
-      )
-      allow(PotatoMesh::Application).to receive(:debug_log).and_call_original
-      allow(PotatoMesh::App::Meshtastic::PayloadDecoder).to receive(:decode).and_return(
-        {
-          "type" => "POSITION_APP",
-          "payload" => position_payload,
-        },
-      )
-      allow(PotatoMesh::Application).to receive(:touch_node_last_seen).and_call_original
-
-      with_db do |db|
-        PotatoMesh::Application.insert_message(
-          db,
-          {
-            "packet_id" => 900_005,
-            "rx_time" => reference_time.to_i,
-            "rx_iso" => reference_time.utc.iso8601,
-            "from_id" => "!7c5b0920",
-            "encrypted" => encoded_payload,
-          },
-        )
-      end
-
-      with_db(readonly: true) do |db|
-        db.results_as_hash = true
-        row = db.get_first_row(
-          "SELECT encrypted FROM messages WHERE id = ?",
-          [900_005],
-        )
-
-        expect(row["encrypted"]).to be_nil
-      end
-
-      expect(PotatoMesh::Application).to have_received(:touch_node_last_seen).with(
-        anything,
-        anything,
-        anything,
-        hash_including(source: :position),
-      )
-      expect(PotatoMesh::Application).not_to have_received(:touch_node_last_seen).with(
-        anything,
-        anything,
-        anything,
-        hash_including(source: :message),
-      )
-      expect(PotatoMesh::Application).to have_received(:debug_log).with(
-        "Cleared encrypted payload after decoding",
-        hash_including(context: "data_processing.insert_message", message_id: 900_005, portnum: 3),
-      )
-    end
-
-    it "keeps encrypted payloads when decoded neighbor data is empty" do
-      payload_bytes = "neighbor".b
-      encoded_payload = Base64.strict_encode64(payload_bytes)
-      neighbor_payload = {
-        "node_id" => "!7c5b0920",
-        "neighbors" => [],
-      }
-
-      allow(PotatoMesh::Application).to receive(:decrypt_meshtastic_message).and_return(
-        {
-          portnum: 71,
-          payload: payload_bytes,
-          text: nil,
-          channel_name: nil,
-        },
-      )
-      allow(PotatoMesh::App::Meshtastic::PayloadDecoder).to receive(:decode).and_return(
-        {
-          "type" => "NEIGHBORINFO_APP",
-          "payload" => neighbor_payload,
-        },
-      )
-
-      with_db do |db|
-        PotatoMesh::Application.insert_message(
-          db,
-          {
-            "packet_id" => 900_006,
-            "rx_time" => reference_time.to_i,
-            "rx_iso" => reference_time.utc.iso8601,
-            "from_id" => "!7c5b0920",
-            "encrypted" => encoded_payload,
-          },
-        )
-      end
-
-      with_db(readonly: true) do |db|
-        db.results_as_hash = true
-        row = db.get_first_row(
-          "SELECT encrypted FROM messages WHERE id = ?",
-          [900_006],
-        )
-
-        expect(row["encrypted"]).to eq(encoded_payload)
-      end
-    end
-
-    it "updates node modem metadata when touching last seen" do
-      with_db do |db|
-        db.execute(
-          "INSERT INTO nodes(node_id, last_heard, first_heard) VALUES (?,?,?)",
-          ["!7c5b0920", reference_time.to_i - 10, reference_time.to_i - 10],
-        )
-
-        PotatoMesh::Application.touch_node_last_seen(
-          db,
-          "!7c5b0920",
-          nil,
-          rx_time: reference_time.to_i,
-          source: :message,
-          lora_freq: 868,
-          modem_preset: "MediumFast",
-        )
-      end
-
-      with_db(readonly: true) do |db|
-        db.results_as_hash = true
-        row = db.get_first_row(
-          "SELECT lora_freq, modem_preset FROM nodes WHERE node_id = ?",
-          ["!7c5b0920"],
-        )
-
-        expect(row["lora_freq"]).to eq(868)
-        expect(row["modem_preset"]).to eq("MediumFast")
-      end
-    end
-
-    it "preserves modem metadata when touch last seen omits it" do
-      with_db do |db|
-        db.execute(
-          "INSERT INTO nodes(node_id, last_heard, first_heard, lora_freq, modem_preset) VALUES (?,?,?,?,?)",
-          ["!7c5b0920", reference_time.to_i - 10, reference_time.to_i - 10, 868, "MediumFast"],
-        )
-
-        PotatoMesh::Application.touch_node_last_seen(
-          db,
-          "!7c5b0920",
-          nil,
-          rx_time: reference_time.to_i,
-          source: :message,
-        )
-      end
-
-      with_db(readonly: true) do |db|
-        db.results_as_hash = true
-        row = db.get_first_row(
-          "SELECT lora_freq, modem_preset FROM nodes WHERE node_id = ?",
-          ["!7c5b0920"],
-        )
-
-        expect(row["lora_freq"]).to eq(868)
-        expect(row["modem_preset"]).to eq("MediumFast")
-      end
-    end
-
-    it "skips decrypted payload storage when portnum is unsupported" do
-      with_db do |db|
-        stored = PotatoMesh::Application.store_decrypted_payload(
-          db,
-          { "lora_freq" => 868, "modem_preset" => "MediumFast" },
-          900_007,
-          { payload: "ok".b, portnum: 5, text: nil },
-          rx_time: reference_time.to_i,
-          rx_iso: reference_time.utc.iso8601,
-          from_id: "!7c5b0920",
-          to_id: "^all",
-          channel: 0,
-          portnum: 5,
-          hop_limit: 2,
-          snr: 1.0,
-          rssi: -70,
-        )
-
-        expect(stored).to be(false)
-      end
-    end
-
-    it "stores decoded neighbors when decrypting neighborinfo payloads" do
-      payload_bytes = "neighbor".b
-      encoded_payload = Base64.strict_encode64(payload_bytes)
-      neighbor_payload = {
-        "node_id" => "!7c5b0920",
-        "neighbors" => [
-          { "node_id" => "!1d60dd3c", "snr" => 4.5, "last_rx_time" => reference_time.to_i },
-        ],
-      }
-
-      allow(PotatoMesh::Application).to receive(:decrypt_meshtastic_message).and_return(
-        {
-          portnum: 71,
-          payload: payload_bytes,
-          text: nil,
-          channel_name: nil,
-        },
-      )
-      allow(PotatoMesh::App::Meshtastic::PayloadDecoder).to receive(:decode).and_return(
-        {
-          "type" => "NEIGHBORINFO_APP",
-          "payload" => neighbor_payload,
-        },
-      )
-
-      with_db do |db|
-        PotatoMesh::Application.insert_message(
-          db,
-          {
-            "packet_id" => 900_003,
-            "rx_time" => reference_time.to_i,
-            "rx_iso" => reference_time.utc.iso8601,
-            "from_id" => "!7c5b0920",
-            "encrypted" => encoded_payload,
-          },
-        )
-      end
-
-      with_db(readonly: true) do |db|
-        db.results_as_hash = true
-        row = db.get_first_row(
-          "SELECT node_id, neighbor_id, snr FROM neighbors WHERE node_id = ? AND neighbor_id = ?",
-          ["!7c5b0920", "!1d60dd3c"],
-        )
-
-        expect(row["node_id"]).to eq("!7c5b0920")
-        expect(row["neighbor_id"]).to eq("!1d60dd3c")
-        expect(row["snr"]).to eq(4.5)
-      end
-    end
-
-    it "stores decoded traces when decrypting traceroute payloads" do
-      payload_bytes = "trace".b
-      encoded_payload = Base64.strict_encode64(payload_bytes)
-      trace_payload = {
-        "route" => [1, 2, 3, 4],
-      }
-
-      allow(PotatoMesh::Application).to receive(:decrypt_meshtastic_message).and_return(
-        {
-          portnum: 70,
-          payload: payload_bytes,
-          text: nil,
-          channel_name: nil,
-        },
-      )
-      allow(PotatoMesh::App::Meshtastic::PayloadDecoder).to receive(:decode).and_return(
-        {
-          "type" => "TRACEROUTE_APP",
-          "payload" => trace_payload,
-        },
-      )
-
-      with_db do |db|
-        PotatoMesh::Application.insert_message(
-          db,
-          {
-            "packet_id" => 900_004,
-            "rx_time" => reference_time.to_i,
-            "rx_iso" => reference_time.utc.iso8601,
-            "from_id" => "!7c5b0920",
-            "encrypted" => encoded_payload,
-          },
-        )
-      end
-
-      with_db(readonly: true) do |db|
-        db.results_as_hash = true
-        trace_row = db.get_first_row(
-          "SELECT id, dest FROM traces WHERE id = ?",
-          [900_004],
-        )
-        hop_rows = db.execute(
-          "SELECT hop_index, node_id FROM trace_hops WHERE trace_id = ? ORDER BY hop_index",
-          [900_004],
-        )
-
-        expect(trace_row["id"]).to eq(900_004)
-        expect(trace_row["dest"]).to eq(4)
-        expect(hop_rows.map { |row| row[1] }).to eq([1, 2, 3, 4])
-      end
-    end
-
-    it "overwrites encrypted messages when decrypted text arrives" do
-      encrypted_payload = Base64.strict_encode64("cipher".b)
-      decrypted_text = "decoded"
-      allow(PotatoMesh::Application).to receive(:decrypt_meshtastic_message).and_return(
-        nil,
-        {
-          portnum: 1,
-          payload: "plain".b,
-          text: decrypted_text,
-          channel_name: nil,
-        },
-      )
-
-      with_db do |db|
-        PotatoMesh::Application.insert_message(
-          db,
-          {
-            "packet_id" => 910_001,
-            "rx_time" => reference_time.to_i,
-            "rx_iso" => reference_time.utc.iso8601,
-            "from_id" => "!7c5b0920",
-            "encrypted" => encrypted_payload,
-          },
-        )
-
-        PotatoMesh::Application.insert_message(
-          db,
-          {
-            "packet_id" => 910_001,
-            "rx_time" => reference_time.to_i,
-            "rx_iso" => reference_time.utc.iso8601,
-            "from_id" => "!7c5b0920",
-            "encrypted" => encrypted_payload,
-          },
-        )
-      end
-
-      with_db(readonly: true) do |db|
-        db.results_as_hash = true
-        row = db.get_first_row(
-          "SELECT text, encrypted FROM messages WHERE id = ?",
-          [910_001],
-        )
-
-        expect(row["text"]).to eq(decrypted_text)
-        expect(row["encrypted"]).to be_nil
-      end
-    end
-
-    it "prefers decrypted message fields over encrypted ones" do
-      encrypted_payload = Base64.strict_encode64("cipher".b)
-      encrypted_message = {
-        "packet_id" => 3_189_171_433,
-        "rx_time" => 1_767_957_187,
-        "rx_iso" => Time.at(1_767_957_187).utc.iso8601,
-        "from_id" => "!7c5b0920",
-        "to_id" => "^all",
-        "channel" => 3,
-        "encrypted" => encrypted_payload,
-        "rssi" => -117,
-        "hop_limit" => 7,
-        "lora_freq" => 868,
-        "modem_preset" => "MediumFast",
-        "channel_name" => "PUBLIC",
-        "snr" => -14.0,
-      }
-      decrypted_message = {
-        "packet_id" => 3_189_171_433,
-        "rx_time" => 1_767_957_191,
-        "rx_iso" => Time.at(1_767_957_191).utc.iso8601,
-        "from_id" => "!7c5b0920",
-        "to_id" => "^all",
-        "channel" => 7,
-        "portnum" => "TEXT_MESSAGE_APP",
-        "text" => "FF-TB Beacon",
-        "rssi" => -79,
-        "hop_limit" => 5,
-        "lora_freq" => 868,
-        "modem_preset" => "MediumFast",
-        "channel_name" => "PUBLIC",
-        "snr" => 9.75,
-      }
-
-      with_db do |db|
-        PotatoMesh::Application.insert_message(db, encrypted_message)
-        PotatoMesh::Application.insert_message(db, decrypted_message)
-      end
-
-      with_db(readonly: true) do |db|
-        db.results_as_hash = true
-        row = db.get_first_row(
-          "SELECT text, encrypted, channel, rssi, hop_limit, snr, portnum FROM messages WHERE id = ?",
-          [encrypted_message["packet_id"]],
-        )
-
-        expect(row["text"]).to eq("FF-TB Beacon")
-        expect(row["encrypted"]).to be_nil
-        expect(row["channel"]).to eq(7)
-        expect(row["rssi"]).to eq(-79)
-        expect(row["hop_limit"]).to eq(5)
-        expect(row["snr"]).to eq(9.75)
-        expect(row["portnum"]).to eq("TEXT_MESSAGE_APP")
-      end
-    end
-
-    it "clears encrypted data when a plaintext update arrives" do
-      encrypted_payload = Base64.strict_encode64("cipher".b)
-      base_time = reference_time.to_i - 20
-      updated_time = reference_time.to_i - 10
-      encrypted_message = {
-        "packet_id" => 3_189_171_434,
-        "rx_time" => base_time,
-        "rx_iso" => Time.at(base_time).utc.iso8601,
-        "from_id" => "!7c5b0920",
-        "to_id" => "^all",
-        "channel" => 3,
-        "encrypted" => encrypted_payload,
-        "rssi" => -117,
-        "hop_limit" => 7,
-        "snr" => -14.0,
-      }
-      plaintext_message = {
-        "packet_id" => 3_189_171_434,
-        "rx_time" => updated_time,
-        "rx_iso" => Time.at(updated_time).utc.iso8601,
-        "from_id" => "!7c5b0920",
-        "to_id" => "^all",
-        "channel" => 7,
-        "portnum" => "TEXT_MESSAGE_APP",
-        "text" => "FF-TB Beacon",
-        "rssi" => -79,
-        "hop_limit" => 5,
-        "snr" => 9.75,
-      }
-
-      with_db do |db|
-        PotatoMesh::Application.insert_message(db, encrypted_message)
-        PotatoMesh::Application.insert_message(db, plaintext_message)
-      end
-
-      with_db(readonly: true) do |db|
-        db.results_as_hash = true
-        row = db.get_first_row(
-          "SELECT text, encrypted, channel, rssi, hop_limit, snr, rx_time FROM messages WHERE id = ?",
-          [encrypted_message["packet_id"]],
-        )
-
-        expect(row["text"]).to eq("FF-TB Beacon")
-        expect(row["encrypted"]).to be_nil
-        expect(row["channel"]).to eq(7)
-        expect(row["rssi"]).to eq(-79)
-        expect(row["hop_limit"]).to eq(5)
-        expect(row["snr"]).to eq(9.75)
-        expect(row["rx_time"]).to eq(updated_time)
-      end
-    end
-
-    it "does not overwrite decrypted messages with encrypted payloads" do
-      encrypted_payload = Base64.strict_encode64("cipher".b)
-      decrypted_text = "decoded"
-      allow(PotatoMesh::Application).to receive(:decrypt_meshtastic_message).and_return(nil)
-
-      with_db do |db|
-        PotatoMesh::Application.insert_message(
-          db,
-          {
-            "packet_id" => 910_002,
-            "rx_time" => reference_time.to_i,
-            "rx_iso" => reference_time.utc.iso8601,
-            "from_id" => "!7c5b0920",
-            "text" => decrypted_text,
-          },
-        )
-
-        PotatoMesh::Application.insert_message(
-          db,
-          {
-            "packet_id" => 910_002,
-            "rx_time" => reference_time.to_i,
-            "rx_iso" => reference_time.utc.iso8601,
-            "from_id" => "!7c5b0920",
-            "encrypted" => encrypted_payload,
-          },
-        )
-      end
-
-      with_db(readonly: true) do |db|
-        db.results_as_hash = true
-        row = db.get_first_row(
-          "SELECT text, encrypted FROM messages WHERE id = ?",
-          [910_002],
-        )
-
-        expect(row["text"]).to eq(decrypted_text)
-        expect(row["encrypted"]).to be_nil
-      end
-    end
-
    it "updates node last_heard for plaintext messages" do
      node_id = "!plainmsg01"
      initial_first = reference_time.to_i - 600
@@ -516,24 +516,6 @@ RSpec.describe PotatoMesh::Config do
    end
  end

-  describe ".announcement" do
-    it "returns nil when unset or blank" do
-      within_env("ANNOUNCEMENT" => nil) do
-        expect(described_class.announcement).to be_nil
-      end
-
-      within_env("ANNOUNCEMENT" => " \t ") do
-        expect(described_class.announcement).to be_nil
-      end
-    end
-
-    it "returns the trimmed announcement text" do
-      within_env("ANNOUNCEMENT" => "  Next Meetup  ") do
-        expect(described_class.announcement).to eq("Next Meetup")
-      end
-    end
-  end
-
  describe ".debug?" do
    it "reflects the DEBUG environment variable" do
      within_env("DEBUG" => "1") do
@@ -166,20 +166,6 @@ RSpec.describe PotatoMesh::App::Database do
    expect(telemetry_columns).to include("rx_time", "battery_level")
  end

-  it "adds decryption metadata columns to existing messages tables" do
-    SQLite3::Database.new(PotatoMesh::Config.db_path) do |db|
-      db.execute("CREATE TABLE nodes(node_id TEXT)")
-      db.execute("CREATE TABLE messages(id INTEGER PRIMARY KEY)")
-    end
-
-    expect(column_names_for("messages")).not_to include("decrypted", "decryption_confidence")
-
-    harness_class.ensure_schema_upgrades
-
-    message_columns = column_names_for("messages")
-    expect(message_columns).to include("decrypted", "decryption_confidence")
-  end
-
  it "creates trace tables when absent" do
    SQLite3::Database.new(PotatoMesh::Config.db_path) do |db|
      db.execute("CREATE TABLE nodes(node_id TEXT)")
@@ -61,7 +61,7 @@ RSpec.describe "Ingestor endpoints" do
      node_id: "!abc12345",
      start_time: now - 120,
      last_seen_time: now - 60,
-      version: "0.5.10",
+      version: "0.5.9",
      lora_freq: 915,
      modem_preset: "LongFast",
    }.merge(overrides)
@@ -133,7 +133,7 @@ RSpec.describe "Ingestor endpoints" do
      with_db do |db|
        db.execute(
          "INSERT INTO ingestors(node_id, start_time, last_seen_time, version) VALUES(?,?,?,?)",
-          ["!fresh000", now - 100, now - 10, "0.5.10"],
+          ["!fresh000", now - 100, now - 10, "0.5.9"],
        )
        db.execute(
          "INSERT INTO ingestors(node_id, start_time, last_seen_time, version) VALUES(?,?,?,?)",
@@ -141,7 +141,7 @@ RSpec.describe "Ingestor endpoints" do
        )
        db.execute(
          "INSERT INTO ingestors(node_id, start_time, last_seen_time, version, lora_freq, modem_preset) VALUES(?,?,?,?,?,?)",
-          ["!rich000", now - 200, now - 100, "0.5.10", 915, "MediumFast"],
+          ["!rich000", now - 200, now - 100, "0.5.9", 915, "MediumFast"],
        )
      end

@@ -173,7 +173,7 @@ RSpec.describe "Ingestor endpoints" do
        )
        db.execute(
          "INSERT INTO ingestors(node_id, start_time, last_seen_time, version) VALUES(?,?,?,?)",
-          ["!new-ingestor", now - 60, now - 30, "0.5.10"],
+          ["!new-ingestor", now - 60, now - 30, "0.5.9"],
        )
      end

@@ -1,300 +0,0 @@
-# Copyright © 2025-26 l5yth & contributors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# frozen_string_literal: true
-
-require "spec_helper"
-
-RSpec.describe PotatoMesh::App::Meshtastic::Cipher do
-  let(:psk_b64) { "Nmh7EooP2Tsc+7pvPwXLcEDDuYhk+fBo2GLnbA1Y1sg=" }
-  let(:cipher_b64) { "Q1R7tgI5yXzMXu/3" }
-  let(:packet_id) { 3_915_687_257 }
-  let(:from_id) { "!9e95cf60" }
-
-  def encode_varint(value)
-    bytes = []
-    remaining = value
-
-    loop do
-      byte = remaining & 0x7f
-      remaining >>= 7
-      if remaining.zero?
-        bytes << byte
-        break
-      end
-      bytes << (byte | 0x80)
-    end
-
-    bytes.pack("C*")
-  end
-
-  def build_data_message(portnum, payload)
-    tag_portnum = (1 << 3) | 0
-    tag_payload = (2 << 3) | 2
-
-    [
-      tag_portnum,
-    ].pack("C") + encode_varint(portnum) +
-      [tag_payload].pack("C") + encode_varint(payload.bytesize) + payload
-  end
-
-  def encrypt_message(plaintext, psk_b64:, packet_id:, from_id:)
-    key = PotatoMesh::App::Meshtastic::ChannelHash.expanded_key(psk_b64)
-    from_num = described_class.normalize_node_num(from_id, nil)
-    nonce = described_class.build_nonce(packet_id, from_num)
-
-    cipher_name = key.bytesize == 16 ? "aes-128-ctr" : "aes-256-ctr"
-    cipher = OpenSSL::Cipher.new(cipher_name)
-    cipher.encrypt
-    cipher.key = key
-    cipher.iv = nonce
-
-    Base64.strict_encode64(cipher.update(plaintext) + cipher.final)
-  end
-
-  describe PotatoMesh::App::Meshtastic::ChannelHash do
-    it "hashes channel names with the provided PSK" do
-      hash = described_class.channel_hash("BerlinMesh", psk_b64)
-
-      expect(hash).to eq(35)
-    end
-
-    it "resolves the default PSK alias when hashing channel names" do
-      hash = described_class.channel_hash("PUBLIC", "AQ==")
-
-      expect(hash).to eq(3)
-    end
-
-    it "expands short PSKs to AES-128 length" do
-      key = described_class.expanded_key(Base64.strict_encode64("abc"))
-
-      expect(key.bytesize).to eq(16)
-      expect(key.bytes.first(3).pack("C*")).to eq("abc")
-    end
-
-    it "returns nil for unsupported PSK sizes" do
-      key = described_class.expanded_key(Base64.strict_encode64("x" * 33))
-
-      expect(key).to be_nil
-    end
-
-    it "resolves the event PSK alias" do
-      key = described_class.expanded_key(Base64.strict_encode64([2].pack("C")))
-
-      expect(key.bytesize).to eq(32)
-    end
-
-    it "returns nil for unknown aliases" do
-      expect(described_class.default_key_for_alias(99)).to be_nil
-    end
-
-    it "xors byte arrays deterministically" do
-      value = described_class.xor_bytes([0x01, 0x02, 0x03])
-
-      expect(value).to eq(0x00)
-    end
-
-    it "xors byte strings deterministically" do
-      value = described_class.xor_bytes("ABC")
-
-      expect(value).to eq(0x40)
-    end
-
-    it "returns empty key material for empty PSK" do
-      key = described_class.expanded_key("")
-
-      expect(key).to eq("")
-    end
-
-    it "pads 17 byte PSKs up to 32 bytes" do
-      key = described_class.expanded_key(Base64.strict_encode64("x" * 17))
-
-      expect(key.bytesize).to eq(32)
-    end
-  end
-
-  describe PotatoMesh::App::Meshtastic::RainbowTable do
-    it "returns candidate names for a channel hash" do
-      candidates = described_class.channel_names_for(35, psk_b64: psk_b64)
-
-      expect(candidates).to include("BerlinMesh")
-    end
-  end
-
-  it "decrypts the BerlinMesh example payload" do
-    text = described_class.decrypt_text(
-      cipher_b64: cipher_b64,
-      packet_id: packet_id,
-      from_id: from_id,
-      psk_b64: psk_b64,
-    )
-
-    expect(text).to eq("Nabend")
-  end
-
-  it "captures a confidence score for decrypted text" do
-    data = described_class.decrypt_data(
-      cipher_b64: cipher_b64,
-      packet_id: packet_id,
-      from_id: from_id,
-      psk_b64: psk_b64,
-    )
-
-    expect(data[:text]).to eq("Nabend")
-    expect(data[:decryption_confidence]).to be_between(0.0, 1.0)
-  end
-
-  it "decrypts the public PSK alias sample payload" do
-    text = described_class.decrypt_text(
-      cipher_b64: "otu3OyMrTIUlcaisLVDyAnLW",
-      packet_id: 3_189_171_433,
-      from_id: "!7c5b0920",
-      psk_b64: "AQ==",
-    )
-
-    expect(text).to eq("FF-TB Beacon")
-  end
-
-  it "decrypts another public PSK alias payload sample" do
-    text = described_class.decrypt_text(
-      cipher_b64: "Xso0VQhndJ5RJ3pfHRVRLKSA",
-      packet_id: 4_126_217_817,
-      from_id: "!1d60dd3c",
-      psk_b64: "AQ==",
-    )
-
-    expect(text).to eq("FF-ZW Beacon")
-  end
-
-  it "returns nil when the cipher text is invalid" do
-    text = described_class.decrypt_text(
-      cipher_b64: "not-base64",
-      packet_id: packet_id,
-      from_id: from_id,
-      psk_b64: psk_b64,
-    )
-
-    expect(text).to be_nil
-  end
-
-  it "ignores non-text portnums even when payload is UTF-8" do
-    payload = "OK".b
-    plaintext = build_data_message(3, payload)
-    encrypted = encrypt_message(plaintext, psk_b64: psk_b64, packet_id: packet_id, from_id: from_id)
-
-    text = described_class.decrypt_text(
-      cipher_b64: encrypted,
-      packet_id: packet_id,
-      from_id: from_id,
-      psk_b64: psk_b64,
-    )
-
-    data = described_class.decrypt_data(
-      cipher_b64: encrypted,
-      packet_id: packet_id,
-      from_id: from_id,
-      psk_b64: psk_b64,
-    )
-
-    expect(text).to be_nil
-    expect(data).to eq({ portnum: 3, payload: payload, text: nil, decryption_confidence: nil })
-  end
-
-  it "normalizes packet ids from numeric strings" do
-    value = described_class.normalize_packet_id("12345")
-
-    expect(value).to eq(12_345)
-  end
-
-  it "returns nil for negative packet ids" do
-    value = described_class.normalize_packet_id(-1)
-
-    expect(value).to be_nil
-  end
-
-  it "normalizes node numbers from hex identifiers" do
-    value = described_class.normalize_node_num("0x433da83c", nil)
-
-    expect(value).to eq(0x433da83c)
-  end
-
-  it "uses the provided numeric node number when present" do
-    value = described_class.normalize_node_num("!deadbeef", 123)
-
-    expect(value).to eq(123)
-  end
-
-  it "decrypts payload bytes when requested" do
-    payload = "OK".b
-    plaintext = build_data_message(1, payload)
-    encrypted = encrypt_message(plaintext, psk_b64: psk_b64, packet_id: packet_id, from_id: from_id)
-
-    bytes = described_class.decrypt_payload_bytes(
-      cipher_b64: encrypted,
-      packet_id: packet_id,
-      from_id: from_id,
-      psk_b64: psk_b64,
-    )
-
-    expect(bytes).to eq(payload)
-  end
-
-  it "returns nil for non-numeric packet ids" do
-    value = described_class.normalize_packet_id("abc")
-
-    expect(value).to be_nil
-  end
-
-  it "returns nil for invalid node identifiers" do
-    value = described_class.normalize_node_num("not-hex", nil)
-
-    expect(value).to be_nil
-  end
-
-  it "normalizes floating node numbers" do
-    value = described_class.normalize_node_num(nil, 12.5)
-
-    expect(value).to eq(12)
-  end
-
-  it "returns nil when the PSK is an unsupported size" do
-    data = described_class.decrypt_data(
-      cipher_b64: "AA==",
-      packet_id: 1,
-      from_id: "!9e95cf60",
-      psk_b64: Base64.strict_encode64("x" * 33),
-    )
-
-    expect(data).to be_nil
-  end
-
-  it "returns nil when the PSK expands to an empty key" do
-    data = described_class.decrypt_data(
-      cipher_b64: "AA==",
-      packet_id: 1,
-      from_id: "!9e95cf60",
-      psk_b64: "",
-    )
-
-    expect(data).to be_nil
-  end
-
-  it "scores text confidence higher for longer printable content" do
-    low = described_class.text_confidence("AC")
-    high = described_class.text_confidence("This looks like a sentence.")
-
-    expect(low).to be < high
-    expect(high).to be_between(0.0, 1.0)
-  end
-end
@@ -1,189 +0,0 @@
-# Copyright © 2025-26 l5yth & contributors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# frozen_string_literal: true
-
-require "spec_helper"
-require "fileutils"
-require "tmpdir"
-
-RSpec.describe PotatoMesh::App::Meshtastic::PayloadDecoder do
-  def with_env(key, value)
-    previous = ENV[key]
-    ENV[key] = value
-    yield
-  ensure
-    ENV[key] = previous
-  end
-
-  def with_repo_root(path)
-    allow(PotatoMesh::Config).to receive(:repo_root).and_return(path)
-  end
-
-  it "prefers a configured python path" do
-    Dir.mktmpdir do |dir|
-      with_env("MESHTASTIC_PYTHON", "/custom/python") do
-        with_repo_root(dir) do
-          expect(described_class.python_executable_path).to eq("/custom/python")
-        end
-      end
-    end
-  end
-
-  it "uses the project venv when present" do
-    Dir.mktmpdir do |dir|
-      python_path = File.join(dir, "data", ".venv", "bin", "python")
-      FileUtils.mkdir_p(File.dirname(python_path))
-      File.write(python_path, "")
-      FileUtils.chmod(0o755, python_path)
-
-      with_env("MESHTASTIC_PYTHON", nil) do
-        with_repo_root(dir) do
-          expect(described_class.python_executable_path).to eq(python_path)
-        end
-      end
-    end
-  end
-
-  it "falls back to python on PATH when no venv is available" do
-    Dir.mktmpdir do |dir|
-      fake_bin = File.join(dir, "bin")
-      FileUtils.mkdir_p(fake_bin)
-      python_path = File.join(fake_bin, "python3")
-      File.write(python_path, "#!/bin/sh\n")
-      FileUtils.chmod(0o755, python_path)
-
-      with_env("MESHTASTIC_PYTHON", nil) do
-        with_env("PATH", fake_bin) do
-          with_repo_root(dir) do
-            expect(described_class.python_executable_path).to eq(python_path)
-          end
-        end
-      end
-    end
-  end
-
-  it "resolves the decoder script path from the repo root" do
-    Dir.mktmpdir do |dir|
-      script_path = File.join(dir, "data", "mesh_ingestor", "decode_payload.py")
-      FileUtils.mkdir_p(File.dirname(script_path))
-      File.write(script_path, "")
-
-      with_repo_root(dir) do
-        expect(described_class.decoder_script_path).to eq(script_path)
-      end
-    end
-  end
-
-  it "falls back to the web root when the repo root is unavailable" do
-    Dir.mktmpdir do |dir|
-      script_path = File.join(dir, "data", "mesh_ingestor", "decode_payload.py")
-      FileUtils.mkdir_p(File.dirname(script_path))
-      File.write(script_path, "")
-
-      with_repo_root(Dir.mktmpdir) do
-        allow(PotatoMesh::Config).to receive(:web_root).and_return(dir)
-        expect(described_class.decoder_script_path).to eq(script_path)
-      end
-    end
-  end
-
-  it "returns nil when the decoder script is missing" do
-    Dir.mktmpdir do |dir|
-      with_repo_root(dir) do
-        expect(described_class.decoder_script_path).to be_nil
-      end
-    end
-  end
-
-  it "returns nil when the decoder process fails" do
-    allow(described_class).to receive(:decoder_script_path).and_return("/tmp/decoder.py")
-    allow(described_class).to receive(:python_executable_path).and_return("/usr/bin/python3")
-    allow(Open3).to receive(:capture3).and_return(["{}", "boom", instance_double(Process::Status, success?: false)])
-
-    expect(described_class.decode(portnum: 3, payload_b64: "AA==")).to be_nil
-  end
-
-  it "returns nil when decoder output is invalid JSON" do
-    allow(described_class).to receive(:decoder_script_path).and_return("/tmp/decoder.py")
-    allow(described_class).to receive(:python_executable_path).and_return("/usr/bin/python3")
-    allow(Open3).to receive(:capture3).and_return(["not-json", "", instance_double(Process::Status, success?: true)])
-
-    expect(described_class.decode(portnum: 3, payload_b64: "AA==")).to be_nil
-  end
-
-  it "returns nil when decoder output includes an error" do
-    allow(described_class).to receive(:decoder_script_path).and_return("/tmp/decoder.py")
-    allow(described_class).to receive(:python_executable_path).and_return("/usr/bin/python3")
-    allow(Open3).to receive(:capture3).and_return([JSON.generate("error" => "boom"), "", instance_double(Process::Status, success?: true)])
-
-    expect(described_class.decode(portnum: 3, payload_b64: "AA==")).to be_nil
-  end
-
-  it "returns nil when decoder output is not a hash" do
-    allow(described_class).to receive(:decoder_script_path).and_return("/tmp/decoder.py")
-    allow(described_class).to receive(:python_executable_path).and_return("/usr/bin/python3")
-    allow(Open3).to receive(:capture3).and_return([JSON.generate([1, 2, 3]), "", instance_double(Process::Status, success?: true)])
-
-    expect(described_class.decode(portnum: 3, payload_b64: "AA==")).to be_nil
-  end
-
-  it "returns nil when the decoder executable is missing" do
-    allow(described_class).to receive(:decoder_script_path).and_return("/tmp/decoder.py")
-    allow(described_class).to receive(:python_executable_path).and_return("/missing/python")
-    allow(Open3).to receive(:capture3).and_raise(Errno::ENOENT)
-
-    expect(described_class.decode(portnum: 3, payload_b64: "AA==")).to be_nil
-  end
-
-  it "returns nil when decoder paths are unavailable" do
-    allow(described_class).to receive(:decoder_script_path).and_return(nil)
-    allow(described_class).to receive(:python_executable_path).and_return(nil)
-
-    expect(described_class.decode(portnum: 3, payload_b64: "AA==")).to be_nil
-  end
-
-  it "returns nil when no python executable can be found" do
-    with_env("MESHTASTIC_PYTHON", nil) do
-      with_env("PATH", "") do
-        with_repo_root(Dir.mktmpdir) do
-          expect(described_class.python_executable_path).to be_nil
-        end
-      end
-    end
-  end
-
-  it "returns nil when inputs are missing" do
-    expect(described_class.decode(portnum: nil, payload_b64: "AA==")).to be_nil
-    expect(described_class.decode(portnum: 3, payload_b64: nil)).to be_nil
-  end
-
-  it "falls back to PATH when configured python is blank" do
-    Dir.mktmpdir do |dir|
-      fake_bin = File.join(dir, "bin")
-      FileUtils.mkdir_p(fake_bin)
-      python_path = File.join(fake_bin, "python")
-      File.write(python_path, "#!/bin/sh\n")
-      FileUtils.chmod(0o755, python_path)
-
-      with_env("MESHTASTIC_PYTHON", " ") do
-        with_env("PATH", fake_bin) do
-          with_repo_root(dir) do
-            expect(described_class.python_executable_path).to eq(python_path)
-          end
-        end
-      end
-    end
-  end
-end
@@ -1,135 +0,0 @@
-# Copyright © 2025-26 l5yth & contributors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# frozen_string_literal: true
-
-require "spec_helper"
-
-RSpec.describe PotatoMesh::App::Meshtastic::Protobuf do
-  def encode_varint(value)
-    bytes = []
-    remaining = value
-    loop do
-      byte = remaining & 0x7f
-      remaining >>= 7
-      if remaining.zero?
-        bytes << byte
-        break
-      end
-      bytes << (byte | 0x80)
-    end
-    bytes.pack("C*")
-  end
-
-  it "extracts a length-delimited field by number" do
-    field_number = 3
-    payload = "blob".b
-    tag = (field_number << 3) | described_class::WIRE_TYPE_LENGTH_DELIMITED
-    message = [tag].pack("C") + encode_varint(payload.bytesize) + payload
-
-    extracted = described_class.extract_field_bytes(message, field_number)
-
-    expect(extracted).to eq(payload)
-  end
-
-  it "returns nil when a varint is truncated" do
-    field_number = 1
-    tag = (field_number << 3) | described_class::WIRE_TYPE_VARINT
-    message = [tag].pack("C") + [0x80].pack("C")
-
-    extracted = described_class.extract_field_bytes(message, field_number)
-
-    expect(extracted).to be_nil
-  end
-
-  it "parses portnum and payload from a data message" do
-    portnum_tag = (1 << 3) | described_class::WIRE_TYPE_VARINT
-    payload_tag = (2 << 3) | described_class::WIRE_TYPE_LENGTH_DELIMITED
-    payload = "OK".b
-    message = [
-      portnum_tag,
-    ].pack("C") + encode_varint(3) +
-              [payload_tag].pack("C") + encode_varint(payload.bytesize) + payload
-
-    data = described_class.parse_data(message)
-
-    expect(data).to eq(portnum: 3, payload: payload)
-  end
-
-  it "returns nil when portnum is missing" do
-    payload_tag = (2 << 3) | described_class::WIRE_TYPE_LENGTH_DELIMITED
-    payload = "OK".b
-    message = [payload_tag].pack("C") + encode_varint(payload.bytesize) + payload
-
-    expect(described_class.parse_data(message)).to be_nil
-  end
-
-  it "returns nil when payload is missing" do
-    portnum_tag = (1 << 3) | described_class::WIRE_TYPE_VARINT
-    message = [portnum_tag].pack("C") + encode_varint(1)
-
-    expect(described_class.parse_data(message)).to be_nil
-  end
-
-  it "rejects invalid varints that overflow" do
-    invalid = ([0x80] * 10).pack("C*")
-
-    expect(described_class.read_varint(invalid.bytes, 0)).to be_nil
-  end
-
-  it "skips 64-bit fields while searching for length-delimited bytes" do
-    target_field = 3
-    junk_tag = (1 << 3) | described_class::WIRE_TYPE_64BIT
-    target_tag = (target_field << 3) | described_class::WIRE_TYPE_LENGTH_DELIMITED
-    message = [junk_tag].pack("C") + ("\x00" * 8) +
-              [target_tag].pack("C") + encode_varint(4) + "test"
-
-    extracted = described_class.extract_field_bytes(message, target_field)
-
-    expect(extracted).to eq("test")
-  end
-
-  it "skips 32-bit fields while searching for length-delimited bytes" do
-    target_field = 4
-    junk_tag = (2 << 3) | described_class::WIRE_TYPE_32BIT
-    target_tag = (target_field << 3) | described_class::WIRE_TYPE_LENGTH_DELIMITED
-    message = [junk_tag].pack("C") + ("\x00" * 4) +
-              [target_tag].pack("C") + encode_varint(3) + "abc"
-
-    extracted = described_class.extract_field_bytes(message, target_field)
-
-    expect(extracted).to eq("abc")
-  end
-
-  it "returns nil on unsupported wire types" do
-    bad_tag = (1 << 3) | 7
-    message = [bad_tag].pack("C")
-
-    expect(described_class.extract_field_bytes(message, 1)).to be_nil
-  end
-
-  it "returns nil when length-delimited field overruns payload" do
-    tag = (1 << 3) | described_class::WIRE_TYPE_LENGTH_DELIMITED
-    message = [tag].pack("C") + encode_varint(10) + "short"
-
-    expect(described_class.extract_field_bytes(message, 1)).to be_nil
-  end
-
-  it "returns nil when length varint is missing" do
-    tag = (1 << 3) | described_class::WIRE_TYPE_LENGTH_DELIMITED
-    message = [tag].pack("C")
-
-    expect(described_class.extract_field_bytes(message, 1)).to be_nil
-  end
-end
@@ -75,7 +75,6 @@ RSpec.describe PotatoMesh::Sanitizer do
    before do
      allow(PotatoMesh::Config).to receive_messages(
        site_name: "  Spec Mesh  ",
-        announcement: "  Next Meetup  ",
        channel: "  #Spec  ",
        frequency: " 915MHz  ",
        contact_link: "  #room:example.org  ",
@@ -85,7 +84,6 @@ RSpec.describe PotatoMesh::Sanitizer do

    it "provides trimmed strings" do
      expect(described_class.sanitized_site_name).to eq("Spec Mesh")
-      expect(described_class.sanitized_announcement).to eq("Next Meetup")
      expect(described_class.sanitized_channel).to eq("#Spec")
      expect(described_class.sanitized_frequency).to eq("915MHz")
      expect(described_class.sanitized_contact_link).to eq("#room:example.org")
@@ -100,12 +98,6 @@ RSpec.describe PotatoMesh::Sanitizer do
      expect(described_class.sanitized_contact_link_url).to be_nil
    end

-    it "returns nil when the announcement is blank" do
-      allow(PotatoMesh::Config).to receive(:announcement).and_return("  ")
-
-      expect(described_class.sanitized_announcement).to be_nil
-    end
-
    it "returns nil when the distance is not positive" do
      allow(PotatoMesh::Config).to receive(:max_distance_km).and_return(0)

@@ -18,13 +18,8 @@ require "spec_helper"
 require "timeout"

 RSpec.describe PotatoMesh::App::WorkerPool do
-  def with_pool(size: 2, queue: 2, task_timeout: nil)
-    pool = PotatoMesh::App::WorkerPool.new(
-      size: size,
-      max_queue: queue,
-      task_timeout: task_timeout,
-      name: "spec-pool",
-    )
+  def with_pool(size: 2, queue: 2)
+    pool = PotatoMesh::App::WorkerPool.new(size: size, max_queue: queue, name: "spec-pool")
    yield pool
  ensure
    pool&.shutdown(timeout: 0.5)
@@ -38,20 +33,6 @@ RSpec.describe PotatoMesh::App::WorkerPool do
      end
    end

-    it "fails tasks that exceed the configured timeout" do
-      with_pool(task_timeout: 0.01) do |pool|
-        task = pool.schedule { sleep 0.05; :late }
-        expect { task.wait(timeout: 1) }.to raise_error(described_class::TaskTimeoutError)
-      end
-    end
-
-    it "ignores invalid timeout values" do
-      with_pool(task_timeout: "nope") do |pool|
-        task = pool.schedule { sleep 0.01; :ok }
-        expect(task.wait(timeout: 1)).to eq(:ok)
-      end
-    end
-
    it "propagates exceptions raised by the job block" do
      with_pool do |pool|
        task = pool.schedule { raise ArgumentError, "boom" }
@@ -16,7 +16,7 @@
 <section class="federation-page federation-page--full-width">
  <div class="federation-page__content">
    <div class="federation-page__map-row">
-      <%= erb :"shared/_map_panel", locals: { full_screen: true, legend_collapsed: true } %>
+      <%= erb :"shared/_map_panel", locals: { full_screen: true } %>
    </div>
    <%= erb :"shared/_instances_table" %>
  </div>
@@ -94,8 +94,7 @@
   refresh_info_text = full_screen_view ? nil : "#{channel} (#{frequency}) — active nodes: …"
   refresh_row_classes << "refresh-row--no-info" if refresh_info_text.nil?
   refresh_info_classes = ["refresh-info"]
-   refresh_info_classes << "refresh-info--hidden" if refresh_info_text.nil?
-   announcement_markup = announcement_html %>
+   refresh_info_classes << "refresh-info--hidden" if refresh_info_text.nil? %>
 <body
  class="<%= body_classes.join(" ") %>"
  data-app-config="<%= Rack::Utils.escape_html(app_config_json) %>"
@@ -104,11 +103,6 @@
 >
  <div class="<%= shell_classes.join(" ") %>">
    <% if show_header %>
-      <% if announcement_markup && !announcement_markup.empty? %>
-        <div class="announcement-banner" role="status" aria-live="polite">
-          <p class="announcement-banner__content"><%= announcement_markup %></p>
-        </div>
-      <% end %>
      <header class="site-header">
        <div class="site-header__left<%= federation_nav_enabled ? " site-header__left--federation" : "" %>">
          <h1 class="site-title">
@@ -134,7 +128,7 @@
            <a href="<%= nodes_nav_href %>" class="site-nav__link<%= nodes_nav_active ? " is-active" : "" %>"<%= nodes_nav_active ? ' aria-current="page"' : "" %>>Nodes</a>
            <a href="/charts" class="site-nav__link<%= view_mode == :charts ? " is-active" : "" %>"<%= view_mode == :charts ? ' aria-current="page"' : "" %>>Charts</a>
            <% if federation_nav_enabled %>
-              <a href="/federation" class="site-nav__link js-federation-nav<%= view_mode == :federation ? " is-active" : "" %>" data-federation-label="Federation"<%= view_mode == :federation ? ' aria-current="page"' : "" %>>Federation</a>
+              <a href="/federation" class="site-nav__link<%= view_mode == :federation ? " is-active" : "" %>"<%= view_mode == :federation ? ' aria-current="page"' : "" %>>Federation</a>
            <% end %>
          </nav>
          <button
@@ -165,7 +159,7 @@
            <a href="<%= nodes_nav_href %>" class="mobile-nav__link<%= nodes_nav_active ? " is-active" : "" %>"<%= nodes_nav_active ? ' aria-current="page"' : "" %>>Nodes</a>
            <a href="/charts" class="mobile-nav__link<%= view_mode == :charts ? " is-active" : "" %>"<%= view_mode == :charts ? ' aria-current="page"' : "" %>>Charts</a>
            <% if federation_nav_enabled %>
-              <a href="/federation" class="mobile-nav__link js-federation-nav<%= view_mode == :federation ? " is-active" : "" %>" data-federation-label="Federation"<%= view_mode == :federation ? ' aria-current="page"' : "" %>>Federation</a>
+              <a href="/federation" class="mobile-nav__link<%= view_mode == :federation ? " is-active" : "" %>"<%= view_mode == :federation ? ' aria-current="page"' : "" %>>Federation</a>
            <% end %>
          </nav>
        </div>
Author	SHA1	Message	Date
l5y	f8660907e5	matrix: cover missing unit test vectors	2026-01-06 18:05:23 +01:00
l5y	96b2942065	matrix: fix tests	2026-01-06 17:56:20 +01:00
l5y	4f0410c7da	matrix: add docker env boilerplate	2026-01-06 17:54:50 +01:00