diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 3b2fa18e0..c409a26e4 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -444,6 +444,7 @@ jobs:
           BASE_URL=http://localhost:13581 node test-issue-165-grouped-hop-warn-e2e.js 2>&1 | tee -a e2e-output.txt
           BASE_URL=http://localhost:13581 node test-packet-detail-sender-hash-size-obs-e2e.js 2>&1 | tee -a e2e-output.txt
           BASE_URL=http://localhost:13581 node test-issue-96-hide-control-e2e.js 2>&1 | tee -a e2e-output.txt
+          BASE_URL=http://localhost:13581 node test-issue-242-type-exclusions-e2e.js 2>&1 | tee -a e2e-output.txt
           BASE_URL=http://localhost:13581 node test-issue-180-packets-url-modal-e2e.js 2>&1 | tee -a e2e-output.txt
           BASE_URL=http://localhost:13581 node test-slideover-1168-munger-e2e.js 2>&1 | tee -a e2e-output.txt
           BASE_URL=http://localhost:13581 node test-logo-pulse-1173-e2e.js 2>&1 | tee -a e2e-output.txt
diff --git a/cmd/server/db.go b/cmd/server/db.go
index a95425e38..8b931eab9 100644
--- a/cmd/server/db.go
+++ b/cmd/server/db.go
@@ -687,6 +687,7 @@ type PacketQuery struct {
 	Limit              int
 	Offset             int
 	Type               *int
+	ExcludeTypes       packetTypeExclusions
 	Route              *int
 	Observer           string
 	Hash               string
@@ -918,6 +919,7 @@ func parseDistinctIatasCSV(v interface{}) []string {
 func (db *DB) buildPacketWhere(q PacketQuery) ([]string, []interface{}) {
 	var where []string
 	var args []interface{}
+	where, args = q.ExcludeTypes.appendSQL(where, args, "payload_type")
 
 	if q.Type != nil {
 		where = append(where, "payload_type = ?")
@@ -962,6 +964,7 @@ func (db *DB) buildPacketWhere(q PacketQuery) ([]string, []interface{}) {
 func (db *DB) buildTransmissionWhere(q PacketQuery) ([]string, []interface{}) {
 	var where []string
 	var args []interface{}
+	where, args = q.ExcludeTypes.appendSQL(where, args, "t.payload_type")
 
 	if q.Type != nil {
 		where = append(where, "t.payload_type = ?")
diff --git a/cmd/server/openapi.go b/cmd/server/openapi.go
index 240ced49b..ee1d5a985 100644
--- a/cmd/server/openapi.go
+++ b/cmd/server/openapi.go
@@ -61,6 +61,7 @@ func routeDescriptions() map[string]routeMeta {
 				{Name: "sort", Description: "Sort field", Type: "string"},
 				{Name: "order", Description: "Sort order (asc/desc)", Type: "string"},
 				{Name: "type", Description: "Filter by packet type", Type: "string"},
+				{Name: "excludeTypes", Description: "Comma-separated numeric payload types 0-15 excluded before pagination and total counting (raw and grouped). At most 16 entries and 64 characters; duplicates collapse. Empty means no exclusions; NULL payload types remain. Intersects with type; exclusion wins on overlap. Invalid/repeated parameters or combination with nodes return 400; single node is supported.", Type: "string"},
 				{Name: "observer", Description: "Filter by observer ID", Type: "string"},
 				{Name: "timeRange", Description: "Time range filter (e.g. 1h, 24h, 7d)", Type: "string"},
 				{Name: "search", Description: "Full-text search", Type: "string"},
diff --git a/cmd/server/packet_exclusions.go b/cmd/server/packet_exclusions.go
new file mode 100644
index 000000000..e805fcc21
--- /dev/null
+++ b/cmd/server/packet_exclusions.go
@@ -0,0 +1,65 @@
+package main
+
+import (
+	"fmt"
+	"net/url"
+	"strconv"
+	"strings"
+)
+
+// Packet.h defines PH_TYPE_MASK=0x0F: include reserved wire codes, not just
+// the currently named types. A mask bounds storage and canonicalizes duplicates.
+type packetTypeExclusions uint16
+
+func parsePacketTypeExclusions(values url.Values) (packetTypeExclusions, error) {
+	entries := values["excludeTypes"]
+	if len(entries) == 0 {
+		return 0, nil
+	}
+	if len(entries) != 1 || len(entries[0]) > 64 {
+		return 0, fmt.Errorf("excludeTypes must be one comma-separated list of at most 16 types (0-15)")
+	}
+	if entries[0] == "" {
+		return 0, nil
+	}
+	parts := strings.Split(entries[0], ",")
+	if len(parts) > 16 {
+		return 0, fmt.Errorf("excludeTypes accepts at most 16 entries")
+	}
+	var mask packetTypeExclusions
+	for _, part := range parts {
+		part = strings.TrimSpace(part)
+		if len(part) < 1 || len(part) > 2 || part[0] < '0' || part[0] > '9' {
+			return 0, fmt.Errorf("excludeTypes entries must be integers from 0 to 15")
+		}
+		n, err := strconv.Atoi(part)
+		if err != nil || n < 0 || n > 15 {
+			return 0, fmt.Errorf("excludeTypes entries must be integers from 0 to 15")
+		}
+		mask |= 1 << uint(n)
+	}
+	return mask, nil
+}
+
+// Test mask first: the default (no exclusion) must not dereference every
+// tx's separately allocated PayloadType in the filter loop.
+func (mask packetTypeExclusions) excludes(typ *int) bool {
+	return mask != 0 && typ != nil && *typ >= 0 && *typ < 16 && mask&(1<<uint(*typ)) != 0
+}
+
+// Keep unknown/NULL payload types, matching the in-memory predicate. The
+// caller supplies a fixed SQL column name; all values remain parameters.
+func (mask packetTypeExclusions) appendSQL(where []string, args []interface{}, column string) ([]string, []interface{}) {
+	if mask == 0 {
+		return where, args
+	}
+	placeholders := make([]string, 0, 16)
+	for typ := 0; typ < 16; typ++ {
+		if mask&(1<<uint(typ)) != 0 {
+			placeholders = append(placeholders, "?")
+			args = append(args, typ)
+		}
+	}
+	where = append(where, "("+column+" IS NULL OR "+column+" NOT IN ("+strings.Join(placeholders, ",")+"))")
+	return where, args
+}
diff --git a/cmd/server/packet_exclusions_242_test.go b/cmd/server/packet_exclusions_242_test.go
new file mode 100644
index 000000000..5773bbb45
--- /dev/null
+++ b/cmd/server/packet_exclusions_242_test.go
@@ -0,0 +1,177 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+)
+
+// The newest page contains only CONTROL; exclusion must precede pagination.
+func TestPacketExclusionsBeforePagination(t *testing.T) {
+	for _, mode := range []string{"memory", "database", "fallback"} {
+		t.Run(mode, func(t *testing.T) {
+			db := setupTestDB(t)
+			defer db.Close()
+			for i, typ := range []interface{}{nil, 5, 11, 11, 11} {
+				_, err := db.conn.Exec(`INSERT INTO transmissions(raw_hex,hash,first_seen,payload_type) VALUES('AA',?,?,?)`, fmt.Sprintf("%016x", i+1), fmt.Sprintf("2026-01-01T00:00:%02dZ", i), typ)
+				if err != nil {
+					t.Fatal(err)
+				}
+			}
+			srv := NewServer(db, &Config{}, NewHub())
+			if mode != "database" {
+				srv.store = NewPacketStore(db, nil)
+				if err := srv.store.Load(); err != nil {
+					t.Fatal(err)
+				}
+				if !srv.store.WaitIndexesReady(5 * time.Second) {
+					t.Fatal("indexes")
+				}
+				if mode == "fallback" {
+					srv.store.oldestLoaded = "2026-01-02"
+				}
+			}
+			for _, grouped := range []bool{false, true} {
+				suffix := fmt.Sprintf("&groupByHash=%t", grouped)
+				if mode == "fallback" {
+					suffix += "&until=2026-01-01T12:00:00"
+				}
+				check := func(query string, total int, wantHash string) {
+					t.Helper()
+					w := httptest.NewRecorder()
+					srv.handlePackets(w, httptest.NewRequest("GET", "/api/packets?limit=1"+suffix+query, nil))
+					if w.Code != 200 {
+						t.Fatalf("%s: %d %s", query, w.Code, w.Body.String())
+					}
+					var got PacketResult
+					if err := json.Unmarshal(w.Body.Bytes(), &got); err != nil {
+						t.Fatal(err)
+					}
+					if got.Total != total {
+						t.Fatalf("%s grouped=%t total=%d want %d", query, grouped, got.Total, total)
+					}
+					if wantHash == "" {
+						if len(got.Packets) != 0 {
+							t.Fatal("expected empty")
+						}
+						return
+					}
+					if len(got.Packets) != 1 || got.Packets[0]["hash"] != wantHash {
+						t.Fatalf("%s packets=%v want %s", query, got.Packets, wantHash)
+					}
+				}
+				check("", 5, "0000000000000005")
+				check("&excludeTypes=11", 2, "0000000000000002")
+				check("&excludeTypes=11&offset=1", 2, "0000000000000001")
+				check("&excludeTypes=11,5", 1, "0000000000000001")
+				check("&excludeTypes=11&type=11", 0, "")
+				check("&excludeTypes=11&type=5", 1, "0000000000000002")
+				check("&excludeTypes=11&hash=0000000000000005", 0, "")
+				check("", 5, "0000000000000005") // grouped cache must not leak exclusions
+			}
+		})
+	}
+}
+
+func TestPacketExclusionMaskAndIndexes(t *testing.T) {
+	left, err := parsePacketTypeExclusions(url.Values{"excludeTypes": {"11,5,11"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	right, err := parsePacketTypeExclusions(url.Values{"excludeTypes": {"5,11"}})
+	if err != nil || left != right {
+		t.Fatal("equivalent lists must share cache identity")
+	}
+	all, err := parsePacketTypeExclusions(url.Values{"excludeTypes": {"0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for typ := 0; typ < 16; typ++ {
+		if !all.excludes(&typ) {
+			t.Errorf("wire type %d not excluded", typ)
+		}
+	}
+	unknown := 99
+	if all.excludes(nil) || all.excludes(&unknown) {
+		t.Fatal("unknown types must remain")
+	}
+	db := setupTestDB(t)
+	defer db.Close()
+	store := NewPacketStore(db, nil)
+	pk := strings.Repeat("a", 64)
+	for i, typ := range []int{5, 11} {
+		typ := typ
+		tx := &StoreTx{ID: i + 1, Hash: fmt.Sprintf("%016x", i+1), FirstSeen: "2026-01-01", PayloadType: &typ, Observations: []*StoreObs{{ObserverID: "test-observer"}}}
+		store.packets = append(store.packets, tx)
+		store.byHash[tx.Hash] = tx
+		store.byNode[pk] = append(store.byNode[pk], tx)
+	}
+	for _, query := range []PacketQuery{{Hash: "0000000000000002"}, {Observer: "test-observer"}, {Node: pk}} {
+		query.ExcludeTypes = 1 << 11
+		got := store.filterPackets(query)
+		want := 1
+		if query.Hash != "" {
+			want = 0
+		}
+		if len(got) != want {
+			t.Errorf("index query %+v yielded %d rows want %d", query, len(got), want)
+		}
+	}
+}
+
+// Both cases include the complete 30K-row filter/sort/page path. Grouped
+// cache is deliberately invalidated per iteration to measure cold requests.
+func BenchmarkPacketExclusions30K(b *testing.B) {
+	store := NewPacketStore(nil, nil)
+	for i := 0; i < 30000; i++ {
+		typ := 5
+		if i%5 != 0 {
+			typ = 11
+		}
+		stamp := fmt.Sprintf("2026-01-01T%08d", i)
+		store.packets = append(store.packets, &StoreTx{ID: i + 1, Hash: fmt.Sprintf("%016x", i+1), FirstSeen: stamp, LatestSeen: stamp, PayloadType: &typ, PathJSON: "[]"})
+	}
+	for _, grouped := range []bool{false, true} {
+		for _, mask := range []packetTypeExclusions{0, 1 << 5, 1 << 11} {
+			b.Run(fmt.Sprintf("grouped=%t/exclusions=%d", grouped, mask), func(b *testing.B) {
+				q := PacketQuery{Limit: 50, ExcludeTypes: mask}
+				b.ReportAllocs()
+				for i := 0; i < b.N; i++ {
+					var result *PacketResult
+					if grouped {
+						store.groupedCacheTxs = nil
+						result = store.QueryGroupedPackets(q)
+					} else {
+						result = store.QueryPackets(q)
+					}
+					if len(result.Packets) != 50 {
+						b.Fatal("page size")
+					}
+				}
+			})
+		}
+	}
+}
+
+func TestPacketExclusionsValidation(t *testing.T) {
+	srv, _ := setupTestServer(t)
+	defer srv.db.Close()
+	for _, query := range []string{"-1", "16", "CONTROL", "11,", "1,,2", "1.5", "%2B1", "1&excludeTypes=2", "0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0", "11&nodes=abcd", strings.Repeat("1", 65)} {
+		w := httptest.NewRecorder()
+		srv.handlePackets(w, httptest.NewRequest("GET", "/api/packets?excludeTypes="+query, nil))
+		if w.Code != 400 {
+			t.Errorf("%s: got %d want400", query, w.Code)
+		}
+	}
+	for _, query := range []string{"", "0", "15", "11,11", "%2011%20,5", "0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15"} {
+		w := httptest.NewRecorder()
+		srv.handlePackets(w, httptest.NewRequest("GET", "/api/packets?excludeTypes="+query, nil))
+		if w.Code != 200 {
+			t.Errorf("%s: got %d want200", query, w.Code)
+		}
+	}
+}
diff --git a/cmd/server/routes.go b/cmd/server/routes.go
index 111439f94..a5094c115 100644
--- a/cmd/server/routes.go
+++ b/cmd/server/routes.go
@@ -1263,6 +1263,15 @@ func (s *Server) handlePerfReset(w http.ResponseWriter, r *http.Request) {
 // --- Packet Handlers ---
 
 func (s *Server) handlePackets(w http.ResponseWriter, r *http.Request) {
+	excludeTypes, parseErr := parsePacketTypeExclusions(r.URL.Query())
+	if parseErr != nil {
+		writeError(w, 400, parseErr.Error())
+		return
+	}
+	if excludeTypes != 0 && r.URL.Query().Get("nodes") != "" {
+		writeError(w, 400, "excludeTypes is not supported with nodes; use the single node filter")
+		return
+	}
 	// Multi-node filter: comma-separated pubkeys (Node.js parity)
 	if nodesParam := r.URL.Query().Get("nodes"); nodesParam != "" {
 		pubkeys := strings.Split(nodesParam, ",")
@@ -1300,6 +1309,7 @@ func (s *Server) handlePackets(w http.ResponseWriter, r *http.Request) {
 	}
 
 	q := PacketQuery{
+		ExcludeTypes:       excludeTypes,
 		Limit:              queryLimit(r, 50, s.cfg.ListLimits.PacketsMax),
 		Offset:             queryInt(r, "offset", 0),
 		Observer:           r.URL.Query().Get("observer"),
diff --git a/cmd/server/store.go b/cmd/server/store.go
index 2b1cdadad..52423d0f8 100644
--- a/cmd/server/store.go
+++ b/cmd/server/store.go
@@ -2347,6 +2347,9 @@ func (s *PacketStore) QueryGroupedPackets(q PacketQuery) *PacketResult {
 
 	// Cache key covers all filter dimensions. Empty key = no filters.
 	cacheKey := q.Since + "|" + q.Until + "|" + q.Region + "|" + q.Area + "|" + q.Node + "|" + q.Hash + "|" + q.Observer + "|" + q.Channel
+	if q.ExcludeTypes != 0 {
+		cacheKey += fmt.Sprintf("|x%d", q.ExcludeTypes)
+	}
 	if q.Type != nil {
 		cacheKey += fmt.Sprintf("|t%d", *q.Type)
 	}
@@ -3949,7 +3952,7 @@ func (s *PacketStore) MaxObservationID() int {
 // filterPackets applies PacketQuery filters to the in-memory packet list.
 func (s *PacketStore) filterPackets(q PacketQuery) []*StoreTx {
 	// Fast path: single-key index lookups
-	if q.Hash != "" && q.Type == nil && q.Route == nil && q.Observer == "" &&
+	if q.Hash != "" && q.Type == nil && q.ExcludeTypes == 0 && q.Route == nil && q.Observer == "" &&
 		q.Region == "" && q.Area == "" && q.Node == "" && q.Channel == "" && q.Since == "" && q.Until == "" {
 		h := strings.ToLower(q.Hash)
 		tx := s.byHash[h]
@@ -3958,7 +3961,7 @@ func (s *PacketStore) filterPackets(q PacketQuery) []*StoreTx {
 		}
 		return []*StoreTx{tx}
 	}
-	if q.Observer != "" && q.Type == nil && q.Route == nil &&
+	if q.Observer != "" && q.Type == nil && q.ExcludeTypes == 0 && q.Route == nil &&
 		q.Region == "" && q.Area == "" && q.Node == "" && q.Channel == "" && q.Hash == "" && q.Since == "" && q.Until == "" {
 		return s.transmissionsForObserver(q.Observer, nil)
 	}
@@ -4027,7 +4030,7 @@ func (s *PacketStore) filterPackets(q PacketQuery) []*StoreTx {
 	// Determine the source slice. Use index-based source when only node
 	// filter is active and an index exists.
 	source := s.packets
-	if hasNode && !hasType && !hasRoute && q.Observer == "" &&
+	if hasNode && !hasType && q.ExcludeTypes == 0 && !hasRoute && q.Observer == "" &&
 		filterHash == "" && !hasSince && !hasUntil && q.Region == "" && q.Area == "" && filterChannel == "" {
 		if indexed, ok := s.byNode[nodePK]; ok {
 			return indexed
@@ -4042,6 +4045,9 @@ func (s *PacketStore) filterPackets(q PacketQuery) []*StoreTx {
 		if hasType && (tx.PayloadType == nil || *tx.PayloadType != filterType) {
 			return false
 		}
+		if q.ExcludeTypes.excludes(tx.PayloadType) {
+			return false
+		}
 		if hasRoute && (tx.RouteType == nil || *tx.RouteType != filterRoute) {
 			return false
 		}
diff --git a/docs/api-spec.md b/docs/api-spec.md
index 56e9d5d6e..021f4aa1a 100644
--- a/docs/api-spec.md
+++ b/docs/api-spec.md
@@ -1125,7 +1125,8 @@ Paginated packet (transmission) list with filtering.
 |--------------|--------|---------|----------------------------------------------------|
 | `limit`      | number | `50`    | Page size                                          |
 | `offset`     | number | `0`     | Pagination offset                                  |
-| `type`       | string | —       | Filter by payload type (number or name)            |
+| `type`       | string | —       | Filter by numeric payload type                    |
+| `excludeTypes` | string | —     | Comma-separated numeric payload types (0–15), excluded before pagination |
 | `route`      | string | —       | Filter by route type                               |
 | `region`     | string | —       | Filter by region (IATA code substring)             |
 | `observer`   | string | —       | Filter by observer ID                              |
@@ -1138,6 +1139,24 @@ Paginated packet (transmission) list with filtering.
 | `groupByHash`| string | —       | Set to `"true"` for grouped response               |
 | `expand`     | string | —       | Set to `"observations"` to include observation arrays |
 
+`excludeTypes=11` excludes CONTROL transmissions before `limit`, `offset`, and
+`total` are calculated, for both raw and `groupByHash=true` responses. It uses
+the same filtering in memory and in the SQLite fallback. It does not delete
+packets or affect WebSocket delivery or packet-detail endpoints.
+
+The list accepts at most 16 entries and 64 characters. Whitespace around entries
+is trimmed; duplicates collapse. Empty/omitted means no exclusion. Codes 0–15
+include reserved wire types; unknown/NULL stored types remain in the result.
+An overlapping `type` inclusion and exclusion returns no packets for that type.
+Malformed values, repeated `excludeTypes` parameters, and a nonempty exclusion
+combined with `nodes` return HTTP 400. Use `node` for a supported single-node
+combination. All other existing filters continue to compose normally.
+
+The Packets page refetches when its type selection or Hide CONTROL checkbox
+changes, so excluded traffic cannot fill the fetched page. Live updates are
+still filtered locally. Pinned-hash views omit these exclusions so a direct
+packet link remains visible.
+
 ### Response `200` (default)
 
 ```jsonc
diff --git a/public/packets.js b/public/packets.js
index d1f137ec5..98997e085 100644
--- a/public/packets.js
+++ b/public/packets.js
@@ -739,9 +739,8 @@
     const t = localStorage.getItem('meshcore-type-filter'); if (t) filters.type = t;
   } catch (e) { /* storage unavailable */ }
   // #96 — opt-in "Hide CONTROL packets" display filter, unchecked by default.
-  // Display only: CONTROL packets are still fetched and kept (also live ones),
-  // so unchecking shows them again without a reload, and a pinned hash (a
-  // direct link to one packet) bypasses it like every other client filter.
+  // Excluded from the capped server page and live cache, not deleted from
+  // storage. Unchecking refetches them; a pinned hash bypasses exclusions.
   // Saved as '1' or '0' so an explicit unchecked choice survives a reload.
   const PAYLOAD_TYPE_CONTROL = 11;
   const HIDE_CONTROL_KEY = 'meshcore-hide-control';
@@ -771,13 +770,14 @@
     const hidden = beforeHide.filter(p => p.payload_type === PAYLOAD_TYPE_CONTROL);
     return hidden.length > 0 && laterFilters(hidden).length > 0;
   }
-  // The checkbox's change: re-filters the loaded packets, no new request. The
+  // Re-filter immediately, then fetch a full matching page before the cap. The
   // save comes first but cannot stop the filter or the URL update (#211).
   function setHideControl(hide) {
     hideControl = hide;
     if (saveHideControlPref(hide)) savedHideControl = hide;
     updatePacketsUrl();
     renderTableRows();
+    loadPackets();
   }
   // hideControl is what this view shows; savedHideControl is the saved choice
   // as far as this page knows (it changes only when a save succeeds).
@@ -785,6 +785,7 @@
   // declare both (test-issue-121/147-…, test-issue-96-hide-control.js).
   let savedHideControl = readHideControlPref(null, readStoredHideControl());
   let hideControl = savedHideControl;
+  let packetLoadGeneration = 0;
   let wsHandler = null;
   let packetsPaused = false;
   let pauseBuffer = [];
@@ -1589,6 +1590,8 @@
         // When user pinned a hash, accept ONLY that exact packet — bypass all
         // other filters (window/region/type/observer/node).
         if (filters.hash) return p.hash === filters.hash;
+        // Excluded live traffic must not consume the bounded matching page.
+        if (hideControl && p.payload_type === PAYLOAD_TYPE_CONTROL) return false;
         // Respect time window filter — drop packets outside the selected window
         const windowMin = savedTimeWindowMin;
         if (windowMin > 0) {
@@ -1676,6 +1679,7 @@
   }
 
   function destroy() {
+    ++packetLoadGeneration;
     clearTimeout(_renderTimer);
     if (wsHandler) offWS(wsHandler);
     wsHandler = null;
@@ -1736,7 +1740,7 @@
   // suppresses ALL other filters (region, time window, observer, node,
   // channel). The user is asking for THAT packet regardless of saved
   // selections.
-  function buildPacketsParams({ filters, regionParam, areaParam, windowMin, groupByHash, limit }) {
+  function buildPacketsParams({ filters, hideControl = false, regionParam, areaParam, windowMin, groupByHash, limit }) {
     const params = new URLSearchParams();
     if (filters.hash) {
       params.set('hash', filters.hash);
@@ -1758,6 +1762,14 @@
     if (filters.node) params.set('node', filters.node);
     if (filters.observer) params.set('observer', filters.observer);
     if (filters.channel) params.set('channel', filters.channel);
+    // Payload types occupy four bits, including currently reserved codes.
+    // Complement the inclusion menu and union the optional CONTROL exclusion.
+    const selected = filters.type ? new Set(String(filters.type).split(',').map(Number)) : null;
+    const excluded = [];
+    for (let type = 0; type < 16; type++) {
+      if ((selected && !selected.has(type)) || (hideControl && type === PAYLOAD_TYPE_CONTROL)) excluded.push(type);
+    }
+    if (excluded.length) params.set('excludeTypes', excluded.join(','));
     if (groupByHash) {
       params.set('groupByHash', 'true');
     } else {
@@ -1767,11 +1779,19 @@
   }
 
   async function loadPackets() {
+    const generation = ++packetLoadGeneration;
+    const requestGrouped = groupByHash;
+    const container = document.getElementById('pktLeft');
+    if (container) container.setAttribute('data-loaded', 'false');
     try {
-      const selectedWindow = Number(document.getElementById('fTimeWindow')?.value);
+      // Shared URLs may use a window not present in the dropdown. Its empty
+      // value must not become Number('')=0 and silently widen a refetch.
+      const selectedWindowValue = document.getElementById('fTimeWindow')?.value;
+      const selectedWindow = selectedWindowValue ? Number(selectedWindowValue) : NaN;
       const windowMin = Number.isFinite(selectedWindow) ? selectedWindow : savedTimeWindowMin;
       const params = buildPacketsParams({
         filters,
+        hideControl,
         regionParam: RegionFilter.getRegionParam(),
         areaParam: AreaFilter.getAreaParam(),
         windowMin,
@@ -1780,13 +1800,14 @@
       });
 
       const data = await api('/packets?' + params.toString());
+      if (generation !== packetLoadGeneration) return;
       packets = data.packets || [];
       hashIndex = new Map();
       for (const p of packets) { if (p.hash) hashIndex.set(p.hash, p); }
       totalCount = data.total || packets.length;
 
       // When ungrouped, flatten observations inline (single API call, no N+1)
-      if (!groupByHash) {
+      if (!requestGrouped) {
         const flat = [];
         for (const p of packets) {
           if (p.observations && p.observations.length > 1) {
@@ -1811,12 +1832,14 @@
       // #1692 parallelisation. Hop *names* are a presentation enhancement
       // (paths render as hex prefixes until names arrive), so resolve them
       // in the background and re-render rows when done.
+      const loadedPackets = packets;
       const hopJob = (async () => {
         try {
-          await cacheResolvedPaths(packets);
-          await resolveHopsForPackets(packets);
+          await cacheResolvedPaths(loadedPackets);
+          if (generation !== packetLoadGeneration) return;
+          await resolveHopsForPackets(loadedPackets);
           // Re-render rows so resolved hop names replace hex prefixes.
-          if (filtersBuilt) renderTableRows();
+          if (generation === packetLoadGeneration && filtersBuilt) renderTableRows();
         } catch (e) {
           console.warn('[packets] background hop resolution failed:', e);
         }
@@ -1825,7 +1848,7 @@
       void hopJob;
 
       // Restore expanded group children (parallel fetch, Map lookup)
-      if (groupByHash && expandedHashes.size > 0) {
+      if (requestGrouped && expandedHashes.size > 0) {
         const expandedArr = [...expandedHashes];
         // Fetch the full packet detail (which includes per-observation rows) for each expanded hash.
         // Previously this used `/packets?hash=X&limit=20` which returned ONE aggregate row, causing
@@ -1838,6 +1861,7 @@
             .then(data => ({ hash, group, data }))
             .catch(() => ({ hash, group, data: null }));
         }));
+        if (generation !== packetLoadGeneration) return;
         for (const { hash, group, data } of results) {
           if (!group) {
             expandedHashes.delete(hash);
@@ -1859,13 +1883,14 @@
       sortPacketsArray();
       renderLeft();
     } catch (e) {
+      if (generation !== packetLoadGeneration) return;
       console.error('Failed to load packets:', e);
       const tbody = document.getElementById('pktBody');
       if (tbody) tbody.innerHTML = '<tr><td colspan="' + _getColCount() + '" class="text-center" style="padding:24px;color:var(--error,#ef4444)"><div role="alert" aria-live="polite">Failed to load packets. Please try again.</div></td></tr>';
     } finally {
       // Always signal data-loaded — even on error — so E2E tests can proceed.
       var pktContainer = document.getElementById('pktLeft') || document.getElementById('pktBody');
-      if (pktContainer) pktContainer.setAttribute('data-loaded', 'true');
+      if (generation === packetLoadGeneration && pktContainer) pktContainer.setAttribute('data-loaded', 'true');
     }
   }
 
@@ -2155,6 +2180,7 @@
       // Clear button (#121).
       updateClearFiltersVisibility();
       renderTableRows();
+      loadPackets();
     });
 
     // --- Channel filter (#812) ---
@@ -2313,7 +2339,7 @@
       this.classList.toggle('active', filters.myNodes);
       loadPackets();
     });
-    // #96 — re-filters the loaded packets; no new request.
+    // #242 — refill the capped page using server-side exclusions.
     document.getElementById('fHideControl').addEventListener('change', function () { setHideControl(this.checked); });
 
     // Observation sort dropdown
@@ -3311,7 +3337,10 @@
       detachVScrollListener();
       const colCount = _getColCount();
       // #211: name CONTROL only when hiding it emptied the list, i.e. a CONTROL
-      // packet would get through the filters below the CONTROL pass.
+      // packet would get through the filters below the CONTROL pass. Since
+      // #242 the refetch and live feed drop CONTROL before it reaches
+      // `packets`, so this fires only between the checkbox change and the
+      // refetch; a server-filtered empty list just says "No packets found".
       const emptiedByControl = controlHidden && controlHidingEmptiedList(beforeHideControl, (list) => {
         list = applyObserverFilter(list, filters, groupByHash, hashOnly);
         return filters._packetFilter ? list.filter(filters._packetFilter) : list;
diff --git a/test-issue-1122-details-row-clamp-e2e.js b/test-issue-1122-details-row-clamp-e2e.js
index 57e75b3ad..0ded369c2 100644
--- a/test-issue-1122-details-row-clamp-e2e.js
+++ b/test-issue-1122-details-row-clamp-e2e.js
@@ -63,10 +63,19 @@ async function gotoPackets(page, vp) {
   await page.goto(BASE + '/#/packets?timeWindow=' + pinnedWindowMin(vp), { waitUntil: 'domcontentloaded' });
   await page.waitForSelector('#packetFilterInput', { state: 'attached', timeout: 8000 });
   await page.waitForFunction(() => !!document.querySelector('#filterUxBar'), { timeout: 8000 });
-  // All time, so the fixture's long channel messages are rendered (same as #1122).
+  // Widen to "All time" so the fixture's long channel messages are rendered
+  // (same as #1122) -- but only through the option the page really offers.
+  // Below 1025px "All time" is deliberately absent (packets.js omits the
+  // option on mobile), so assigning '0' there selects nothing and leaves the
+  // select blank. Since #242 a blank select means "keep the saved window"
+  // (15 min) rather than All time, so forcing '0' at those widths emptied the
+  // list as soon as the fixture was older than 15 minutes. The URL window
+  // pinned above already spans the whole fixture, so leave it in place there.
   await page.evaluate(() => {
     const sel = document.getElementById('fTimeWindow');
-    if (sel) { sel.value = '0'; sel.dispatchEvent(new Event('change', { bubbles: true })); }
+    if (!sel || !sel.querySelector('option[value="0"]')) return;
+    sel.value = '0';
+    sel.dispatchEvent(new Event('change', { bubbles: true }));
   });
   await page.waitForFunction(
     () => document.querySelectorAll('#pktBody tr[data-hash] td.col-details .col-details-clip').length > 20,
diff --git a/test-issue-242-type-exclusions-e2e.js b/test-issue-242-type-exclusions-e2e.js
new file mode 100644
index 000000000..46be7ddce
--- /dev/null
+++ b/test-issue-242-type-exclusions-e2e.js
@@ -0,0 +1,193 @@
+/* #242: real browser + deterministic capped API fixture. Go tests separately
+ * verify the same exclusion-before-limit contract in memory and SQLite. */
+'use strict';
+const assert = require('assert');
+const { chromium } = require('playwright');
+const BASE = process.env.BASE_URL || 'http://localhost:13581';
+if (!['localhost', '127.0.0.1', '[::1]'].includes(new URL(BASE).hostname)) throw new Error('Local test server required');
+const hash = i => i.toString(16).padStart(16, '0');
+const now = Date.now();
+const packet = (id, type) => ({ id, hash: hash(id), payload_type: type, timestamp: new Date(now - id).toISOString(), latest: new Date(now - id).toISOString(), path_json: '[]', decoded_json: '{}', observer_id: 'fixture', count: 1, observation_count: 1, payload_length: 10 });
+const fixture = [...Array.from({length: 1000}, (_, i) => packet(i + 1, 11)), packet(1001, 5), packet(1002, 4), packet(1003, 5)];
+
+(async () => {
+  const browser = await chromium.launch({ headless: true, executablePath: process.env.CHROMIUM_PATH || undefined });
+  try {
+    // 1024px selects the real 1000-row mobile cap, without replacing production JS.
+    const context = await browser.newContext({ viewport: {width: 1024, height: 900} });
+    const page = await context.newPage();
+    const errors = [];
+    page.on('pageerror', error => errors.push(error.message));
+    let requests = [], holdNext = false, release, held, socket;
+    await page.routeWebSocket('**', ws => { socket = ws; });
+    async function waitForRelease() {
+      const deadline = Date.now() + 15000;
+      while (!release) {
+        if (Date.now() > deadline) throw new Error('Expected held packet request');
+        await new Promise(r => setTimeout(r, 10));
+      }
+    }
+    await page.route('**/api/packets?**', async route => {
+      const q = new URL(route.request().url()).searchParams;
+      requests.push(q);
+      let selected = fixture;
+      if (q.has('hash')) selected = selected.filter(p => p.hash === q.get('hash'));
+      const excluded = new Set((q.get('excludeTypes') || '').split(',').filter(Boolean).map(Number));
+      selected = selected.filter(p => !excluded.has(p.payload_type)).slice(0, Number(q.get('limit')));
+      if (holdNext) {
+        holdNext = false;
+        held = new Promise(resolve => { release = resolve; });
+        await held;
+      }
+      await route.fulfill({json: {packets: selected, total: selected.length}});
+    });
+    const ready = () => page.waitForSelector('#pktLeft[data-loaded="true"]');
+    const shown = () => page.locator('#pktBody tr[data-hash]').evaluateAll(rows => rows.map(r => r.dataset.hash));
+    async function checkHide(value) {
+      if (!(await page.locator('#fHideControl').isVisible())) await page.locator('#filterToggleBtn, .filter-toggle-btn-mirror').filter({visible: true}).first().click();
+      await page.locator('#fHideControl').setChecked(value);
+    }
+    async function type(value) {
+      await page.locator('#typeFilterWrap .multi-select-trigger').click();
+      await page.locator('[data-type-id="' + value + '"]').check();
+      await page.locator('#typeFilterWrap .multi-select-trigger').click();
+    }
+    await page.goto(BASE + '/#/packets');
+    await ready();
+    assert.strictEqual(requests.at(-1).get('limit'), '1000');
+    assert((await shown()).every(h => Number.parseInt(h, 16) <= 1000));
+    holdNext = true;
+    await checkHide(true);
+    await waitForRelease();
+    // #211's hint survives only until the refetch: the loaded page was all CONTROL.
+    // textContent: column hiding may hide the message cell at this width.
+    assert.match(await page.locator('#pktBody').textContent(), /CONTROL packets are hidden/);
+    const firstRelease = release;
+    release = null;
+    firstRelease();
+    await ready();
+    assert.strictEqual(requests.at(-1).get('excludeTypes'), '11');
+    assert.deepStrictEqual(await shown(), [hash(1001), hash(1002), hash(1003)]);
+    console.log('PASS: exclusion fills capped grouped page with older non-CONTROL packets');
+    assert(socket, 'WebSocket connected');
+    await page.locator('#pktPauseBtn').click();
+    // More hidden updates than the page cap must not evict matching history.
+    const hiddenUpdates = Array.from({length:1001}, (_, i) => packet(i + 2001, 11));
+    fixture.unshift(...hiddenUpdates); // model server persistence for subsequent uncheck
+    for (const p of hiddenUpdates) socket.send(JSON.stringify({type:'packet', data:{packet:p}}));
+    socket.send(JSON.stringify({type:'packet', data:{packet:packet(3002, 5)}}));
+    await page.waitForFunction(() => document.querySelector('#pktPauseBtn').textContent.includes('1002'));
+    await page.locator('#pktPauseBtn').click();
+    await page.waitForSelector('tr[data-hash="' + hash(3002) + '"]');
+    assert(!(await shown()).includes(hash(2001)), 'live CONTROL must remain hidden');
+    assert((await shown()).includes(hash(1001)), 'hidden live traffic must not evict matching history');
+    console.log('PASS: resumed live packets apply Hide CONTROL without evicting matching history');
+
+    await page.locator('#fGroup').click();
+    await ready();
+    assert.strictEqual(requests.at(-1).get('expand'), 'observations');
+    assert.deepStrictEqual(await shown(), [hash(1001), hash(1002), hash(1003)]);
+    await checkHide(false);
+    await ready();
+    assert.strictEqual(requests.at(-1).get('excludeTypes'), null);
+    assert((await shown()).every(h => Number.parseInt(h, 16) >= 2001));
+    assert((await shown()).includes(hash(2001)), 'unchecking refetches CONTROL received while hidden');
+    console.log('PASS: raw mode and unchecking refill the matching page');
+
+    await type('5');
+    await ready();
+    assert.deepStrictEqual(await shown(), [hash(1001), hash(1003)]);
+    await page.locator('#clearFiltersBtn').click();
+    await ready();
+    assert.strictEqual(requests.at(-1).get('excludeTypes'), null);
+    assert((await shown()).every(h => Number.parseInt(h, 16) >= 2001));
+    console.log('PASS: type selection and Clear refetch, without altering URL type contract');
+
+    holdNext = true;
+    await checkHide(true);
+    await page.waitForFunction(() => document.querySelector('#pktLeft').dataset.loaded === 'false');
+    await waitForRelease();
+    // The server ages 1003 out after answering the held request, so the late
+    // response still carries it and stays visibly stale after client filters.
+    const agedOut = fixture.splice(fixture.findIndex(p => p.id === 1003), 1);
+    await type('5');
+    await ready();
+    assert.deepStrictEqual(await shown(), [hash(1001)]);
+    const oldRelease = release;
+    release = null;
+    oldRelease();
+    await page.waitForTimeout(200);
+    assert.deepStrictEqual(await shown(), [hash(1001)], 'a late earlier response replaced the newest results');
+    fixture.push(...agedOut);
+    console.log('PASS: late earlier filter response cannot replace newest results');
+    socket.send(JSON.stringify({type:'packet', data:{packet:packet(2003, 4)}}));
+    socket.send(JSON.stringify({type:'packet', data:{packet:packet(2004, 5)}}));
+    await page.waitForSelector('tr[data-hash="' + hash(2004) + '"]');
+    assert(!(await shown()).includes(hash(2003)), 'live packets must respect selected type');
+    console.log('PASS: live packets keep applying the selected type');
+
+    // Hash lookup deliberately ignores both active exclusions.
+    await page.locator('#fHash').fill(hash(1));
+    await page.waitForFunction(() => document.querySelector('#pktBody tr[data-hash]')?.dataset.hash === '0000000000000001');
+    await ready();
+    assert.strictEqual(requests.at(-1).get('excludeTypes'), null);
+    assert.deepStrictEqual(await shown(), [hash(1)]);
+    console.log('PASS: pinned CONTROL hash bypasses active type and Hide CONTROL filters');
+
+    holdNext = true;
+    await page.locator('#fHash').fill(hash(2));
+    await waitForRelease();
+    await page.evaluate(() => { location.hash = '#/home'; });
+    await page.waitForSelector('#pktLeft', {state:'detached'});
+    await page.evaluate(() => { location.hash = '#/packets?hash=0000000000000003'; });
+    await ready();
+    assert.deepStrictEqual(await shown(), [hash(3)]);
+    release();
+    await page.waitForTimeout(200);
+    assert.deepStrictEqual(await shown(), [hash(3)]);
+    assert.deepStrictEqual(errors, []);
+    console.log('PASS: departed view request cannot overwrite remounted packet view');
+
+    // A shared URL may name a time window the dropdown carries no option for
+    // (?timeWindow=240), which leaves the select blank. The refetches added
+    // here must keep that window; reading the blank value as Number('')===0
+    // would silently widen every refetch to All time.
+    const customCtx = await browser.newContext({ viewport: {width: 1024, height: 900} });
+    const customPage = await customCtx.newPage();
+    const customErrors = [];
+    customPage.on('pageerror', error => customErrors.push(error.message));
+    const windows = [];
+    await customPage.routeWebSocket('**', () => {});
+    await customPage.route('**/api/packets?**', async route => {
+      const q = new URL(route.request().url()).searchParams;
+      const since = q.get('since');
+      windows.push(since === null ? null : Math.round((Date.now() - Date.parse(since)) / 60000));
+      const excluded = new Set((q.get('excludeTypes') || '').split(',').filter(Boolean).map(Number));
+      const selected = fixture.filter(p => !excluded.has(p.payload_type)).slice(0, Number(q.get('limit')));
+      await route.fulfill({json: {packets: selected, total: selected.length}});
+    });
+    await customPage.goto(BASE + '/#/packets?timeWindow=240');
+    await customPage.waitForSelector('#pktLeft[data-loaded="true"]');
+    assert.strictEqual(await customPage.locator('#fTimeWindow').inputValue(), '',
+      'a 240-minute window is expected to have no dropdown option');
+    assert(windows.at(-1) >= 235 && windows.at(-1) <= 245,
+      'cold load must honour the URL window, asked for ' + windows.at(-1) + ' minutes');
+    const beforeRefetch = windows.length;
+    if (!(await customPage.locator('#fHideControl').isVisible())) {
+      await customPage.locator('#filterToggleBtn, .filter-toggle-btn-mirror').filter({visible: true}).first().click();
+    }
+    await customPage.locator('#fHideControl').setChecked(true);
+    const refetchDeadline = Date.now() + 15000;
+    while (windows.length === beforeRefetch) {
+      if (Date.now() > refetchDeadline) throw new Error('Hide CONTROL did not refetch');
+      await new Promise(r => setTimeout(r, 10));
+    }
+    const refetched = windows.at(-1);
+    assert(refetched !== null, 'the refetch dropped the time window and asked for all time');
+    assert(refetched >= 235 && refetched <= 245,
+      'the refetch changed the window to ' + refetched + ' minutes');
+    assert.deepStrictEqual(customErrors, []);
+    console.log('PASS: a URL time window absent from the dropdown survives an exclusion refetch');
+    if (process.env.SCREENSHOT_PATH) await page.screenshot({path:process.env.SCREENSHOT_PATH});
+  } finally { await browser.close(); }
+})().catch(error => { console.error(error); process.exitCode = 1; });
diff --git a/test-issue-96-hide-control-e2e.js b/test-issue-96-hide-control-e2e.js
index 6e054860e..4e2bd70ca 100644
--- a/test-issue-96-hide-control-e2e.js
+++ b/test-issue-96-hide-control-e2e.js
@@ -4,8 +4,8 @@
  * Against the e2e fixture (4 CONTROL packets, all older than the default
  * time window, so every step opens #/packets?timeWindow=525600):
  * - default: the checkbox is unchecked and CONTROL packets are listed;
- * - checking it hides exactly the CONTROL packets, without a new
- *   /api/packets request, and puts hideControl=1 in the address bar;
+ * - checking it hides exactly the CONTROL packets, refetches the capped
+ *   /api/packets page, and puts hideControl=1 in the address bar;
  * - the choice survives a reload, checked and explicitly unchecked;
  * - hideControl in the URL wins over the saved choice;
  * - a direct link to one CONTROL packet still opens it while the filter is on;
@@ -91,14 +91,15 @@ async function hashQuery(page) {
     assert(!('hideControl' in q), 'hideControl in the URL by default: ' + JSON.stringify(q));
   });
 
-  await step('checking it hides exactly the CONTROL packets, without a new API request', async () => {
+  await step('checking it hides exactly the CONTROL packets and refetches the page', async () => {
     const before = packetsRequests;
     await page.check('#fHideControl');
     await page.waitForFunction((n) => {
       const m = /\((\d+)\)/.exec(document.querySelector('#pktLeft .count')?.textContent || '');
       return m && Number(m[1]) === n;
     }, countAll - controls.length, { timeout: 5000 });
-    assert(packetsRequests === before, `toggling made ${packetsRequests - before} /api/packets request(s)`);
+    await page.waitForSelector('#pktLeft[data-loaded="true"]');
+    assert(packetsRequests === before + 1, `toggling made ${packetsRequests - before} /api/packets request(s)`);
     const q = await hashQuery(page);
     assert(q.hideControl === '1', 'hideControl=1 not in the URL: ' + JSON.stringify(q));
     const shownHashes = await page.$$eval('table tbody tr[data-hash]', (rows) => rows.map((r) => r.dataset.hash));
@@ -158,9 +159,9 @@ async function hashQuery(page) {
     assert(await page.evaluate((k) => localStorage.getItem(k), PREF_KEY) === '1', 'the URL override changed the saved choice');
   });
 
-  await step('#211: the empty-list note names CONTROL only when hiding CONTROL emptied the list', async () => {
+  await step('#242: server-filtered empty lists do not infer unseen CONTROL packets', async () => {
     const onlyControl = await openEmpty(page, LIST + '&hideControl=1&filter=' + encodeURIComponent('type == CONTROL'));
-    assert(onlyControl === 'No packets found (CONTROL packets are hidden)', 'expression matching only CONTROL: ' + onlyControl);
+    assert(onlyControl === 'No packets found', 'server-filtered list has no evidence of hidden matches: ' + onlyControl);
     const nothing = await openEmpty(page, LIST + '&hideControl=1&filter=' + encodeURIComponent('snr > 999'));
     assert(nothing === 'No packets found', 'expression matching nothing blamed CONTROL: ' + nothing);
   });
diff --git a/test-issue-96-hide-control.js b/test-issue-96-hide-control.js
index 91576a7fb..63e9b7c89 100644
--- a/test-issue-96-hide-control.js
+++ b/test-issue-96-hide-control.js
@@ -67,6 +67,7 @@ function makeSandbox(storage) {
     calls: [],
     updatePacketsUrl() { ctx.calls.push('url'); },
     renderTableRows() { ctx.calls.push('render'); },
+    loadPackets() { ctx.calls.push('load'); },
     filters: {},
     hideControl: false,
     savedHideControl: false,
@@ -212,14 +213,14 @@ console.log('\n=== #211 review, nit 1: a throwing localStorage does not stop the
     const ctx = makeSandbox(throwing);
     fn(ctx, 'set')(true);
     assert.strictEqual(ctx.hideControl, true, 'hideControl not set');
-    assert.deepStrictEqual(ctx.calls, ['url', 'render'], 'URL update and re-render must still run');
+    assert.deepStrictEqual(ctx.calls, ['url', 'render', 'load'], 'URL update, re-render and capped-page reload must still run');
   });
   test('setHideControl: saves the choice, then updates the URL, then re-renders', () => {
     const ctx = makeSandbox();
     fn(ctx, 'set')(true);
     assert.strictEqual(ctx.localStorage.getItem(ctx.__fns.key), '1');
     assert.strictEqual(ctx.savedHideControl, true);
-    assert.deepStrictEqual(ctx.calls, ['url', 'render']);
+    assert.deepStrictEqual(ctx.calls, ['url', 'render', 'load']);
   });
 }
 
diff --git a/test-packets.js b/test-packets.js
index 33ed65546..c20e81e55 100644
--- a/test-packets.js
+++ b/test-packets.js
@@ -1923,6 +1923,24 @@ async function testChannelDestinations() {
   }
 }
 
+console.log('\n=== #242 server-side type exclusions ===');
+{
+  const api = loadPacketsSandbox()._packetsTestAPI;
+  const params = (filters, hideControl = false, groupByHash = true) => api.buildPacketsParams({ filters, hideControl, groupByHash, limit: 100 });
+  test('default leaves exclusion absent', () => assert.strictEqual(params({}).get('excludeTypes'), null));
+  test('Hide CONTROL excludes only 11 in raw and grouped requests', () => {
+    for (const grouped of [false, true]) assert.strictEqual(params({}, true, grouped).get('excludeTypes'), '11');
+  });
+  test('selected types exclude their four-bit complement, union Hide CONTROL', () => {
+    assert.strictEqual(params({type: '5,11'}, true).get('excludeTypes'), '0,1,2,3,4,6,7,8,9,10,11,12,13,14,15');
+    assert.strictEqual(params({type: '5,11'}).get('excludeTypes'), '0,1,2,3,4,6,7,8,9,10,12,13,14,15');
+  });
+  test('all sixteen types impose no exclusion', () => assert.strictEqual(params({type: Array.from({length:16}, (_, i) => i).join(',')}).get('excludeTypes'), null));
+  test('invalid stored selection stays restrictive rather than broadening', () => assert.strictEqual(params({type:'invalid'}).get('excludeTypes'), Array.from({length:16}, (_, i) => i).join(',')));
+  test('duplicate selected types produce canonical exclusions', () => assert.strictEqual(params({type:'0,0,15'}).get('excludeTypes'), '1,2,3,4,5,6,7,8,9,10,11,12,13,14'));
+  test('pinned hash bypasses both exclusions', () => assert.strictEqual(params({hash:'ABC', type:'5'}, true).get('excludeTypes'), null));
+}
+
 testChannelDestinations().then(() => {
   console.log(`\n${'='.repeat(40)}`);
   console.log(`packets.js tests: ${passed} passed, ${failed} failed, ${knownBugs} known bug(s) still failing`);