From 3f12bea4f3d808bae7c2a7291f83d39cfa0b124e Mon Sep 17 00:00:00 2001
From: dborup <kontakt@meshview.dk>
Date: Wed, 7 Oct 2026 12:05:04 +0200
Subject: [PATCH 1/5] fix(packets): exclude payload types before pagination
 (#242)

---
 .github/workflows/deploy.yml             |   1 +
 cmd/server/db.go                         |   3 +
 cmd/server/openapi.go                    |   1 +
 cmd/server/packet_exclusions.go          |  63 ++++++++
 cmd/server/packet_exclusions_242_test.go | 177 +++++++++++++++++++++++
 cmd/server/routes.go                     |  10 ++
 cmd/server/store.go                      |  12 +-
 docs/api-spec.md                         |  21 ++-
 public/packets.js                        |  52 +++++--
 test-issue-242-type-exclusions-e2e.js    | 140 ++++++++++++++++++
 test-issue-96-hide-control-e2e.js        |  13 +-
 test-issue-96-hide-control.js            |   5 +-
 test-packets.js                          |  18 +++
 13 files changed, 491 insertions(+), 25 deletions(-)
 create mode 100644 cmd/server/packet_exclusions.go
 create mode 100644 cmd/server/packet_exclusions_242_test.go
 create mode 100644 test-issue-242-type-exclusions-e2e.js

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 229aa62b7..58be4e8b4 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -443,6 +443,7 @@ jobs:
           BASE_URL=http://localhost:13581 node test-issue-147-packets-url-obs-e2e.js 2>&1 | tee -a e2e-output.txt
           BASE_URL=http://localhost:13581 node test-packet-detail-sender-hash-size-obs-e2e.js 2>&1 | tee -a e2e-output.txt
           BASE_URL=http://localhost:13581 node test-issue-96-hide-control-e2e.js 2>&1 | tee -a e2e-output.txt
+          BASE_URL=http://localhost:13581 node test-issue-242-type-exclusions-e2e.js 2>&1 | tee -a e2e-output.txt
           BASE_URL=http://localhost:13581 node test-issue-180-packets-url-modal-e2e.js 2>&1 | tee -a e2e-output.txt
           BASE_URL=http://localhost:13581 node test-slideover-1168-munger-e2e.js 2>&1 | tee -a e2e-output.txt
           BASE_URL=http://localhost:13581 node test-logo-pulse-1173-e2e.js 2>&1 | tee -a e2e-output.txt
diff --git a/cmd/server/db.go b/cmd/server/db.go
index 5c8a88737..d68d7d465 100644
--- a/cmd/server/db.go
+++ b/cmd/server/db.go
@@ -687,6 +687,7 @@ type PacketQuery struct {
 	Limit              int
 	Offset             int
 	Type               *int
+	ExcludeTypes       packetTypeExclusions
 	Route              *int
 	Observer           string
 	Hash               string
@@ -904,6 +905,7 @@ func parseDistinctIatasCSV(v interface{}) []string {
 func (db *DB) buildPacketWhere(q PacketQuery) ([]string, []interface{}) {
 	var where []string
 	var args []interface{}
+	where, args = q.ExcludeTypes.appendSQL(where, args, "payload_type")
 
 	if q.Type != nil {
 		where = append(where, "payload_type = ?")
@@ -948,6 +950,7 @@ func (db *DB) buildPacketWhere(q PacketQuery) ([]string, []interface{}) {
 func (db *DB) buildTransmissionWhere(q PacketQuery) ([]string, []interface{}) {
 	var where []string
 	var args []interface{}
+	where, args = q.ExcludeTypes.appendSQL(where, args, "t.payload_type")
 
 	if q.Type != nil {
 		where = append(where, "t.payload_type = ?")
diff --git a/cmd/server/openapi.go b/cmd/server/openapi.go
index 240ced49b..ee1d5a985 100644
--- a/cmd/server/openapi.go
+++ b/cmd/server/openapi.go
@@ -61,6 +61,7 @@ func routeDescriptions() map[string]routeMeta {
 				{Name: "sort", Description: "Sort field", Type: "string"},
 				{Name: "order", Description: "Sort order (asc/desc)", Type: "string"},
 				{Name: "type", Description: "Filter by packet type", Type: "string"},
+				{Name: "excludeTypes", Description: "Comma-separated numeric payload types 0-15 excluded before pagination and total counting (raw and grouped). At most 16 entries and 64 characters; duplicates collapse. Empty means no exclusions; NULL payload types remain. Intersects with type; exclusion wins on overlap. Invalid/repeated parameters or combination with nodes return 400; single node is supported.", Type: "string"},
 				{Name: "observer", Description: "Filter by observer ID", Type: "string"},
 				{Name: "timeRange", Description: "Time range filter (e.g. 1h, 24h, 7d)", Type: "string"},
 				{Name: "search", Description: "Full-text search", Type: "string"},
diff --git a/cmd/server/packet_exclusions.go b/cmd/server/packet_exclusions.go
new file mode 100644
index 000000000..c114f2f6c
--- /dev/null
+++ b/cmd/server/packet_exclusions.go
@@ -0,0 +1,63 @@
+package main
+
+import (
+	"fmt"
+	"net/url"
+	"strconv"
+	"strings"
+)
+
+// Packet.h defines PH_TYPE_MASK=0x0F: include reserved wire codes, not just
+// the currently named types. A mask bounds storage and canonicalizes duplicates.
+type packetTypeExclusions uint16
+
+func parsePacketTypeExclusions(values url.Values) (packetTypeExclusions, error) {
+	entries := values["excludeTypes"]
+	if len(entries) == 0 {
+		return 0, nil
+	}
+	if len(entries) != 1 || len(entries[0]) > 64 {
+		return 0, fmt.Errorf("excludeTypes must be one comma-separated list of at most 16 types (0-15)")
+	}
+	if entries[0] == "" {
+		return 0, nil
+	}
+	parts := strings.Split(entries[0], ",")
+	if len(parts) > 16 {
+		return 0, fmt.Errorf("excludeTypes accepts at most 16 entries")
+	}
+	var mask packetTypeExclusions
+	for _, part := range parts {
+		part = strings.TrimSpace(part)
+		if len(part) < 1 || len(part) > 2 || part[0] < '0' || part[0] > '9' {
+			return 0, fmt.Errorf("excludeTypes entries must be integers from 0 to 15")
+		}
+		n, err := strconv.Atoi(part)
+		if err != nil || n < 0 || n > 15 {
+			return 0, fmt.Errorf("excludeTypes entries must be integers from 0 to 15")
+		}
+		mask |= 1 << uint(n)
+	}
+	return mask, nil
+}
+
+func (mask packetTypeExclusions) excludes(typ *int) bool {
+	return typ != nil && *typ >= 0 && *typ < 16 && mask&(1<<uint(*typ)) != 0
+}
+
+// Keep unknown/NULL payload types, matching the in-memory predicate. The
+// caller supplies a fixed SQL column name; all values remain parameters.
+func (mask packetTypeExclusions) appendSQL(where []string, args []interface{}, column string) ([]string, []interface{}) {
+	if mask == 0 {
+		return where, args
+	}
+	placeholders := make([]string, 0, 16)
+	for typ := 0; typ < 16; typ++ {
+		if mask&(1<<uint(typ)) != 0 {
+			placeholders = append(placeholders, "?")
+			args = append(args, typ)
+		}
+	}
+	where = append(where, "("+column+" IS NULL OR "+column+" NOT IN ("+strings.Join(placeholders, ",")+"))")
+	return where, args
+}
diff --git a/cmd/server/packet_exclusions_242_test.go b/cmd/server/packet_exclusions_242_test.go
new file mode 100644
index 000000000..5773bbb45
--- /dev/null
+++ b/cmd/server/packet_exclusions_242_test.go
@@ -0,0 +1,177 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+)
+
+// The newest page contains only CONTROL; exclusion must precede pagination.
+func TestPacketExclusionsBeforePagination(t *testing.T) {
+	for _, mode := range []string{"memory", "database", "fallback"} {
+		t.Run(mode, func(t *testing.T) {
+			db := setupTestDB(t)
+			defer db.Close()
+			for i, typ := range []interface{}{nil, 5, 11, 11, 11} {
+				_, err := db.conn.Exec(`INSERT INTO transmissions(raw_hex,hash,first_seen,payload_type) VALUES('AA',?,?,?)`, fmt.Sprintf("%016x", i+1), fmt.Sprintf("2026-01-01T00:00:%02dZ", i), typ)
+				if err != nil {
+					t.Fatal(err)
+				}
+			}
+			srv := NewServer(db, &Config{}, NewHub())
+			if mode != "database" {
+				srv.store = NewPacketStore(db, nil)
+				if err := srv.store.Load(); err != nil {
+					t.Fatal(err)
+				}
+				if !srv.store.WaitIndexesReady(5 * time.Second) {
+					t.Fatal("indexes")
+				}
+				if mode == "fallback" {
+					srv.store.oldestLoaded = "2026-01-02"
+				}
+			}
+			for _, grouped := range []bool{false, true} {
+				suffix := fmt.Sprintf("&groupByHash=%t", grouped)
+				if mode == "fallback" {
+					suffix += "&until=2026-01-01T12:00:00"
+				}
+				check := func(query string, total int, wantHash string) {
+					t.Helper()
+					w := httptest.NewRecorder()
+					srv.handlePackets(w, httptest.NewRequest("GET", "/api/packets?limit=1"+suffix+query, nil))
+					if w.Code != 200 {
+						t.Fatalf("%s: %d %s", query, w.Code, w.Body.String())
+					}
+					var got PacketResult
+					if err := json.Unmarshal(w.Body.Bytes(), &got); err != nil {
+						t.Fatal(err)
+					}
+					if got.Total != total {
+						t.Fatalf("%s grouped=%t total=%d want %d", query, grouped, got.Total, total)
+					}
+					if wantHash == "" {
+						if len(got.Packets) != 0 {
+							t.Fatal("expected empty")
+						}
+						return
+					}
+					if len(got.Packets) != 1 || got.Packets[0]["hash"] != wantHash {
+						t.Fatalf("%s packets=%v want %s", query, got.Packets, wantHash)
+					}
+				}
+				check("", 5, "0000000000000005")
+				check("&excludeTypes=11", 2, "0000000000000002")
+				check("&excludeTypes=11&offset=1", 2, "0000000000000001")
+				check("&excludeTypes=11,5", 1, "0000000000000001")
+				check("&excludeTypes=11&type=11", 0, "")
+				check("&excludeTypes=11&type=5", 1, "0000000000000002")
+				check("&excludeTypes=11&hash=0000000000000005", 0, "")
+				check("", 5, "0000000000000005") // grouped cache must not leak exclusions
+			}
+		})
+	}
+}
+
+func TestPacketExclusionMaskAndIndexes(t *testing.T) {
+	left, err := parsePacketTypeExclusions(url.Values{"excludeTypes": {"11,5,11"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	right, err := parsePacketTypeExclusions(url.Values{"excludeTypes": {"5,11"}})
+	if err != nil || left != right {
+		t.Fatal("equivalent lists must share cache identity")
+	}
+	all, err := parsePacketTypeExclusions(url.Values{"excludeTypes": {"0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for typ := 0; typ < 16; typ++ {
+		if !all.excludes(&typ) {
+			t.Errorf("wire type %d not excluded", typ)
+		}
+	}
+	unknown := 99
+	if all.excludes(nil) || all.excludes(&unknown) {
+		t.Fatal("unknown types must remain")
+	}
+	db := setupTestDB(t)
+	defer db.Close()
+	store := NewPacketStore(db, nil)
+	pk := strings.Repeat("a", 64)
+	for i, typ := range []int{5, 11} {
+		typ := typ
+		tx := &StoreTx{ID: i + 1, Hash: fmt.Sprintf("%016x", i+1), FirstSeen: "2026-01-01", PayloadType: &typ, Observations: []*StoreObs{{ObserverID: "test-observer"}}}
+		store.packets = append(store.packets, tx)
+		store.byHash[tx.Hash] = tx
+		store.byNode[pk] = append(store.byNode[pk], tx)
+	}
+	for _, query := range []PacketQuery{{Hash: "0000000000000002"}, {Observer: "test-observer"}, {Node: pk}} {
+		query.ExcludeTypes = 1 << 11
+		got := store.filterPackets(query)
+		want := 1
+		if query.Hash != "" {
+			want = 0
+		}
+		if len(got) != want {
+			t.Errorf("index query %+v yielded %d rows want %d", query, len(got), want)
+		}
+	}
+}
+
+// Both cases include the complete 30K-row filter/sort/page path. Grouped
+// cache is deliberately invalidated per iteration to measure cold requests.
+func BenchmarkPacketExclusions30K(b *testing.B) {
+	store := NewPacketStore(nil, nil)
+	for i := 0; i < 30000; i++ {
+		typ := 5
+		if i%5 != 0 {
+			typ = 11
+		}
+		stamp := fmt.Sprintf("2026-01-01T%08d", i)
+		store.packets = append(store.packets, &StoreTx{ID: i + 1, Hash: fmt.Sprintf("%016x", i+1), FirstSeen: stamp, LatestSeen: stamp, PayloadType: &typ, PathJSON: "[]"})
+	}
+	for _, grouped := range []bool{false, true} {
+		for _, mask := range []packetTypeExclusions{0, 1 << 5, 1 << 11} {
+			b.Run(fmt.Sprintf("grouped=%t/exclusions=%d", grouped, mask), func(b *testing.B) {
+				q := PacketQuery{Limit: 50, ExcludeTypes: mask}
+				b.ReportAllocs()
+				for i := 0; i < b.N; i++ {
+					var result *PacketResult
+					if grouped {
+						store.groupedCacheTxs = nil
+						result = store.QueryGroupedPackets(q)
+					} else {
+						result = store.QueryPackets(q)
+					}
+					if len(result.Packets) != 50 {
+						b.Fatal("page size")
+					}
+				}
+			})
+		}
+	}
+}
+
+func TestPacketExclusionsValidation(t *testing.T) {
+	srv, _ := setupTestServer(t)
+	defer srv.db.Close()
+	for _, query := range []string{"-1", "16", "CONTROL", "11,", "1,,2", "1.5", "%2B1", "1&excludeTypes=2", "0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0", "11&nodes=abcd", strings.Repeat("1", 65)} {
+		w := httptest.NewRecorder()
+		srv.handlePackets(w, httptest.NewRequest("GET", "/api/packets?excludeTypes="+query, nil))
+		if w.Code != 400 {
+			t.Errorf("%s: got %d want400", query, w.Code)
+		}
+	}
+	for _, query := range []string{"", "0", "15", "11,11", "%2011%20,5", "0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15"} {
+		w := httptest.NewRecorder()
+		srv.handlePackets(w, httptest.NewRequest("GET", "/api/packets?excludeTypes="+query, nil))
+		if w.Code != 200 {
+			t.Errorf("%s: got %d want200", query, w.Code)
+		}
+	}
+}
diff --git a/cmd/server/routes.go b/cmd/server/routes.go
index 111439f94..a5094c115 100644
--- a/cmd/server/routes.go
+++ b/cmd/server/routes.go
@@ -1263,6 +1263,15 @@ func (s *Server) handlePerfReset(w http.ResponseWriter, r *http.Request) {
 // --- Packet Handlers ---
 
 func (s *Server) handlePackets(w http.ResponseWriter, r *http.Request) {
+	excludeTypes, parseErr := parsePacketTypeExclusions(r.URL.Query())
+	if parseErr != nil {
+		writeError(w, 400, parseErr.Error())
+		return
+	}
+	if excludeTypes != 0 && r.URL.Query().Get("nodes") != "" {
+		writeError(w, 400, "excludeTypes is not supported with nodes; use the single node filter")
+		return
+	}
 	// Multi-node filter: comma-separated pubkeys (Node.js parity)
 	if nodesParam := r.URL.Query().Get("nodes"); nodesParam != "" {
 		pubkeys := strings.Split(nodesParam, ",")
@@ -1300,6 +1309,7 @@ func (s *Server) handlePackets(w http.ResponseWriter, r *http.Request) {
 	}
 
 	q := PacketQuery{
+		ExcludeTypes:       excludeTypes,
 		Limit:              queryLimit(r, 50, s.cfg.ListLimits.PacketsMax),
 		Offset:             queryInt(r, "offset", 0),
 		Observer:           r.URL.Query().Get("observer"),
diff --git a/cmd/server/store.go b/cmd/server/store.go
index 7ad0237ad..9b1acc605 100644
--- a/cmd/server/store.go
+++ b/cmd/server/store.go
@@ -2347,6 +2347,9 @@ func (s *PacketStore) QueryGroupedPackets(q PacketQuery) *PacketResult {
 
 	// Cache key covers all filter dimensions. Empty key = no filters.
 	cacheKey := q.Since + "|" + q.Until + "|" + q.Region + "|" + q.Area + "|" + q.Node + "|" + q.Hash + "|" + q.Observer + "|" + q.Channel
+	if q.ExcludeTypes != 0 {
+		cacheKey += fmt.Sprintf("|x%d", q.ExcludeTypes)
+	}
 	if q.Type != nil {
 		cacheKey += fmt.Sprintf("|t%d", *q.Type)
 	}
@@ -3908,7 +3911,7 @@ func (s *PacketStore) MaxObservationID() int {
 // filterPackets applies PacketQuery filters to the in-memory packet list.
 func (s *PacketStore) filterPackets(q PacketQuery) []*StoreTx {
 	// Fast path: single-key index lookups
-	if q.Hash != "" && q.Type == nil && q.Route == nil && q.Observer == "" &&
+	if q.Hash != "" && q.Type == nil && q.ExcludeTypes == 0 && q.Route == nil && q.Observer == "" &&
 		q.Region == "" && q.Area == "" && q.Node == "" && q.Channel == "" && q.Since == "" && q.Until == "" {
 		h := strings.ToLower(q.Hash)
 		tx := s.byHash[h]
@@ -3917,7 +3920,7 @@ func (s *PacketStore) filterPackets(q PacketQuery) []*StoreTx {
 		}
 		return []*StoreTx{tx}
 	}
-	if q.Observer != "" && q.Type == nil && q.Route == nil &&
+	if q.Observer != "" && q.Type == nil && q.ExcludeTypes == 0 && q.Route == nil &&
 		q.Region == "" && q.Area == "" && q.Node == "" && q.Channel == "" && q.Hash == "" && q.Since == "" && q.Until == "" {
 		return s.transmissionsForObserver(q.Observer, nil)
 	}
@@ -3986,7 +3989,7 @@ func (s *PacketStore) filterPackets(q PacketQuery) []*StoreTx {
 	// Determine the source slice. Use index-based source when only node
 	// filter is active and an index exists.
 	source := s.packets
-	if hasNode && !hasType && !hasRoute && q.Observer == "" &&
+	if hasNode && !hasType && q.ExcludeTypes == 0 && !hasRoute && q.Observer == "" &&
 		filterHash == "" && !hasSince && !hasUntil && q.Region == "" && q.Area == "" && filterChannel == "" {
 		if indexed, ok := s.byNode[nodePK]; ok {
 			return indexed
@@ -4001,6 +4004,9 @@ func (s *PacketStore) filterPackets(q PacketQuery) []*StoreTx {
 		if hasType && (tx.PayloadType == nil || *tx.PayloadType != filterType) {
 			return false
 		}
+		if q.ExcludeTypes.excludes(tx.PayloadType) {
+			return false
+		}
 		if hasRoute && (tx.RouteType == nil || *tx.RouteType != filterRoute) {
 			return false
 		}
diff --git a/docs/api-spec.md b/docs/api-spec.md
index 56e9d5d6e..021f4aa1a 100644
--- a/docs/api-spec.md
+++ b/docs/api-spec.md
@@ -1125,7 +1125,8 @@ Paginated packet (transmission) list with filtering.
 |--------------|--------|---------|----------------------------------------------------|
 | `limit`      | number | `50`    | Page size                                          |
 | `offset`     | number | `0`     | Pagination offset                                  |
-| `type`       | string | —       | Filter by payload type (number or name)            |
+| `type`       | string | —       | Filter by numeric payload type                    |
+| `excludeTypes` | string | —     | Comma-separated numeric payload types (0–15), excluded before pagination |
 | `route`      | string | —       | Filter by route type                               |
 | `region`     | string | —       | Filter by region (IATA code substring)             |
 | `observer`   | string | —       | Filter by observer ID                              |
@@ -1138,6 +1139,24 @@ Paginated packet (transmission) list with filtering.
 | `groupByHash`| string | —       | Set to `"true"` for grouped response               |
 | `expand`     | string | —       | Set to `"observations"` to include observation arrays |
 
+`excludeTypes=11` excludes CONTROL transmissions before `limit`, `offset`, and
+`total` are calculated, for both raw and `groupByHash=true` responses. It uses
+the same filtering in memory and in the SQLite fallback. It does not delete
+packets or affect WebSocket delivery or packet-detail endpoints.
+
+The list accepts at most 16 entries and 64 characters. Whitespace around entries
+is trimmed; duplicates collapse. Empty/omitted means no exclusion. Codes 0–15
+include reserved wire types; unknown/NULL stored types remain in the result.
+An overlapping `type` inclusion and exclusion returns no packets for that type.
+Malformed values, repeated `excludeTypes` parameters, and a nonempty exclusion
+combined with `nodes` return HTTP 400. Use `node` for a supported single-node
+combination. All other existing filters continue to compose normally.
+
+The Packets page refetches when its type selection or Hide CONTROL checkbox
+changes, so excluded traffic cannot fill the fetched page. Live updates are
+still filtered locally. Pinned-hash views omit these exclusions so a direct
+packet link remains visible.
+
 ### Response `200` (default)
 
 ```jsonc
diff --git a/public/packets.js b/public/packets.js
index 7d72ea4d5..b5b9c76e0 100644
--- a/public/packets.js
+++ b/public/packets.js
@@ -739,9 +739,8 @@
     const t = localStorage.getItem('meshcore-type-filter'); if (t) filters.type = t;
   } catch (e) { /* storage unavailable */ }
   // #96 — opt-in "Hide CONTROL packets" display filter, unchecked by default.
-  // Display only: CONTROL packets are still fetched and kept (also live ones),
-  // so unchecking shows them again without a reload, and a pinned hash (a
-  // direct link to one packet) bypasses it like every other client filter.
+  // Excluded from the capped server page and live cache, not deleted from
+  // storage. Unchecking refetches them; a pinned hash bypasses exclusions.
   // Saved as '1' or '0' so an explicit unchecked choice survives a reload.
   const PAYLOAD_TYPE_CONTROL = 11;
   const HIDE_CONTROL_KEY = 'meshcore-hide-control';
@@ -771,13 +770,14 @@
     const hidden = beforeHide.filter(p => p.payload_type === PAYLOAD_TYPE_CONTROL);
     return hidden.length > 0 && laterFilters(hidden).length > 0;
   }
-  // The checkbox's change: re-filters the loaded packets, no new request. The
+  // Re-filter immediately, then fetch a full matching page before the cap. The
   // save comes first but cannot stop the filter or the URL update (#211).
   function setHideControl(hide) {
     hideControl = hide;
     if (saveHideControlPref(hide)) savedHideControl = hide;
     updatePacketsUrl();
     renderTableRows();
+    loadPackets();
   }
   // hideControl is what this view shows; savedHideControl is the saved choice
   // as far as this page knows (it changes only when a save succeeds).
@@ -785,6 +785,7 @@
   // declare both (test-issue-121/147-…, test-issue-96-hide-control.js).
   let savedHideControl = readHideControlPref(null, readStoredHideControl());
   let hideControl = savedHideControl;
+  let packetLoadGeneration = 0;
   let wsHandler = null;
   let packetsPaused = false;
   let pauseBuffer = [];
@@ -1421,6 +1422,8 @@
         // When user pinned a hash, accept ONLY that exact packet — bypass all
         // other filters (window/region/type/observer/node).
         if (filters.hash) return p.hash === filters.hash;
+        // Excluded live traffic must not consume the bounded matching page.
+        if (hideControl && p.payload_type === PAYLOAD_TYPE_CONTROL) return false;
         // Respect time window filter — drop packets outside the selected window
         const windowMin = savedTimeWindowMin;
         if (windowMin > 0) {
@@ -1519,6 +1522,7 @@
   }
 
   function destroy() {
+    ++packetLoadGeneration;
     clearTimeout(_renderTimer);
     if (wsHandler) offWS(wsHandler);
     wsHandler = null;
@@ -1578,7 +1582,7 @@
   // suppresses ALL other filters (region, time window, observer, node,
   // channel). The user is asking for THAT packet regardless of saved
   // selections.
-  function buildPacketsParams({ filters, regionParam, areaParam, windowMin, groupByHash, limit }) {
+  function buildPacketsParams({ filters, hideControl = false, regionParam, areaParam, windowMin, groupByHash, limit }) {
     const params = new URLSearchParams();
     if (filters.hash) {
       params.set('hash', filters.hash);
@@ -1600,6 +1604,14 @@
     if (filters.node) params.set('node', filters.node);
     if (filters.observer) params.set('observer', filters.observer);
     if (filters.channel) params.set('channel', filters.channel);
+    // Payload types occupy four bits, including currently reserved codes.
+    // Complement the inclusion menu and union the optional CONTROL exclusion.
+    const selected = filters.type ? new Set(String(filters.type).split(',').map(Number)) : null;
+    const excluded = [];
+    for (let type = 0; type < 16; type++) {
+      if ((selected && !selected.has(type)) || (hideControl && type === PAYLOAD_TYPE_CONTROL)) excluded.push(type);
+    }
+    if (excluded.length) params.set('excludeTypes', excluded.join(','));
     if (groupByHash) {
       params.set('groupByHash', 'true');
     } else {
@@ -1609,11 +1621,19 @@
   }
 
   async function loadPackets() {
+    const generation = ++packetLoadGeneration;
+    const requestGrouped = groupByHash;
+    const container = document.getElementById('pktLeft');
+    if (container) container.setAttribute('data-loaded', 'false');
     try {
-      const selectedWindow = Number(document.getElementById('fTimeWindow')?.value);
+      // Shared URLs may use a window not present in the dropdown. Its empty
+      // value must not become Number('')=0 and silently widen a refetch.
+      const selectedWindowValue = document.getElementById('fTimeWindow')?.value;
+      const selectedWindow = selectedWindowValue ? Number(selectedWindowValue) : NaN;
       const windowMin = Number.isFinite(selectedWindow) ? selectedWindow : savedTimeWindowMin;
       const params = buildPacketsParams({
         filters,
+        hideControl,
         regionParam: RegionFilter.getRegionParam(),
         areaParam: AreaFilter.getAreaParam(),
         windowMin,
@@ -1622,13 +1642,14 @@
       });
 
       const data = await api('/packets?' + params.toString());
+      if (generation !== packetLoadGeneration) return;
       packets = data.packets || [];
       hashIndex = new Map();
       for (const p of packets) { if (p.hash) hashIndex.set(p.hash, p); }
       totalCount = data.total || packets.length;
 
       // When ungrouped, flatten observations inline (single API call, no N+1)
-      if (!groupByHash) {
+      if (!requestGrouped) {
         const flat = [];
         for (const p of packets) {
           if (p.observations && p.observations.length > 1) {
@@ -1653,16 +1674,18 @@
       // #1692 parallelisation. Hop *names* are a presentation enhancement
       // (paths render as hex prefixes until names arrive), so resolve them
       // in the background and re-render rows when done.
+      const loadedPackets = packets;
       const hopJob = (async () => {
         try {
-          await cacheResolvedPaths(packets);
+          await cacheResolvedPaths(loadedPackets);
+          if (generation !== packetLoadGeneration) return;
           const allHops = new Set();
-          for (const p of packets) {
+          for (const p of loadedPackets) {
             try { getParsedPath(p).forEach(h => allHops.add(h)); } catch {}
           }
           if (allHops.size) await resolveHops([...allHops]);
           // Re-render rows so resolved hop names replace hex prefixes.
-          if (filtersBuilt) renderTableRows();
+          if (generation === packetLoadGeneration && filtersBuilt) renderTableRows();
         } catch (e) {
           console.warn('[packets] background hop resolution failed:', e);
         }
@@ -1671,7 +1694,7 @@
       void hopJob;
 
       // Restore expanded group children (parallel fetch, Map lookup)
-      if (groupByHash && expandedHashes.size > 0) {
+      if (requestGrouped && expandedHashes.size > 0) {
         const expandedArr = [...expandedHashes];
         // Fetch the full packet detail (which includes per-observation rows) for each expanded hash.
         // Previously this used `/packets?hash=X&limit=20` which returned ONE aggregate row, causing
@@ -1684,6 +1707,7 @@
             .then(data => ({ hash, group, data }))
             .catch(() => ({ hash, group, data: null }));
         }));
+        if (generation !== packetLoadGeneration) return;
         for (const { hash, group, data } of results) {
           if (!group) {
             expandedHashes.delete(hash);
@@ -1705,13 +1729,14 @@
       sortPacketsArray();
       renderLeft();
     } catch (e) {
+      if (generation !== packetLoadGeneration) return;
       console.error('Failed to load packets:', e);
       const tbody = document.getElementById('pktBody');
       if (tbody) tbody.innerHTML = '<tr><td colspan="' + _getColCount() + '" class="text-center" style="padding:24px;color:var(--error,#ef4444)"><div role="alert" aria-live="polite">Failed to load packets. Please try again.</div></td></tr>';
     } finally {
       // Always signal data-loaded — even on error — so E2E tests can proceed.
       var pktContainer = document.getElementById('pktLeft') || document.getElementById('pktBody');
-      if (pktContainer) pktContainer.setAttribute('data-loaded', 'true');
+      if (generation === packetLoadGeneration && pktContainer) pktContainer.setAttribute('data-loaded', 'true');
     }
   }
 
@@ -2001,6 +2026,7 @@
       // Clear button (#121).
       updateClearFiltersVisibility();
       renderTableRows();
+      loadPackets();
     });
 
     // --- Channel filter (#812) ---
@@ -2159,7 +2185,7 @@
       this.classList.toggle('active', filters.myNodes);
       loadPackets();
     });
-    // #96 — re-filters the loaded packets; no new request.
+    // #242 — refill the capped page using server-side exclusions.
     document.getElementById('fHideControl').addEventListener('change', function () { setHideControl(this.checked); });
 
     // Observation sort dropdown
diff --git a/test-issue-242-type-exclusions-e2e.js b/test-issue-242-type-exclusions-e2e.js
new file mode 100644
index 000000000..02efb9177
--- /dev/null
+++ b/test-issue-242-type-exclusions-e2e.js
@@ -0,0 +1,140 @@
+/* #242: real browser + deterministic capped API fixture. Go tests separately
+ * verify the same exclusion-before-limit contract in memory and SQLite. */
+'use strict';
+const assert = require('assert');
+const { chromium } = require('playwright');
+const BASE = process.env.BASE_URL || 'http://localhost:13581';
+if (!['localhost', '127.0.0.1', '[::1]'].includes(new URL(BASE).hostname)) throw new Error('Local test server required');
+const hash = i => i.toString(16).padStart(16, '0');
+const now = Date.now();
+const packet = (id, type) => ({ id, hash: hash(id), payload_type: type, timestamp: new Date(now - id).toISOString(), latest: new Date(now - id).toISOString(), path_json: '[]', decoded_json: '{}', observer_id: 'fixture', count: 1, observation_count: 1, payload_length: 10 });
+const fixture = [...Array.from({length: 1000}, (_, i) => packet(i + 1, 11)), packet(1001, 5), packet(1002, 4), packet(1003, 5)];
+
+(async () => {
+  const browser = await chromium.launch({ headless: true, executablePath: process.env.CHROMIUM_PATH || undefined });
+  try {
+    // 1024px selects the real 1000-row mobile cap, without replacing production JS.
+    const context = await browser.newContext({ viewport: {width: 1024, height: 900} });
+    const page = await context.newPage();
+    const errors = [];
+    page.on('pageerror', error => errors.push(error.message));
+    let requests = [], holdNext = false, release, held, socket;
+    await page.routeWebSocket('**', ws => { socket = ws; });
+    async function waitForRelease() {
+      const deadline = Date.now() + 15000;
+      while (!release) {
+        if (Date.now() > deadline) throw new Error('Expected held packet request');
+        await new Promise(r => setTimeout(r, 10));
+      }
+    }
+    await page.route('**/api/packets?**', async route => {
+      const q = new URL(route.request().url()).searchParams;
+      requests.push(q);
+      let selected = fixture;
+      if (q.has('hash')) selected = selected.filter(p => p.hash === q.get('hash'));
+      const excluded = new Set((q.get('excludeTypes') || '').split(',').filter(Boolean).map(Number));
+      selected = selected.filter(p => !excluded.has(p.payload_type)).slice(0, Number(q.get('limit')));
+      if (holdNext) {
+        holdNext = false;
+        held = new Promise(resolve => { release = resolve; });
+        await held;
+      }
+      await route.fulfill({json: {packets: selected, total: selected.length}});
+    });
+    const ready = () => page.waitForSelector('#pktLeft[data-loaded="true"]');
+    const shown = () => page.locator('#pktBody tr[data-hash]').evaluateAll(rows => rows.map(r => r.dataset.hash));
+    async function checkHide(value) {
+      if (!(await page.locator('#fHideControl').isVisible())) await page.locator('#filterToggleBtn, .filter-toggle-btn-mirror').filter({visible: true}).first().click();
+      await page.locator('#fHideControl').setChecked(value);
+    }
+    async function type(value) {
+      await page.locator('#typeFilterWrap .multi-select-trigger').click();
+      await page.locator('[data-type-id="' + value + '"]').check();
+      await page.locator('#typeFilterWrap .multi-select-trigger').click();
+    }
+    await page.goto(BASE + '/#/packets');
+    await ready();
+    assert.strictEqual(requests.at(-1).get('limit'), '1000');
+    assert((await shown()).every(h => Number.parseInt(h, 16) <= 1000));
+    await checkHide(true);
+    await ready();
+    assert.strictEqual(requests.at(-1).get('excludeTypes'), '11');
+    assert.deepStrictEqual(await shown(), [hash(1001), hash(1002), hash(1003)]);
+    console.log('PASS: exclusion fills capped grouped page with older non-CONTROL packets');
+    assert(socket, 'WebSocket connected');
+    await page.locator('#pktPauseBtn').click();
+    // More hidden updates than the page cap must not evict matching history.
+    const hiddenUpdates = Array.from({length:1001}, (_, i) => packet(i + 2001, 11));
+    fixture.unshift(...hiddenUpdates); // model server persistence for subsequent uncheck
+    for (const p of hiddenUpdates) socket.send(JSON.stringify({type:'packet', data:{packet:p}}));
+    socket.send(JSON.stringify({type:'packet', data:{packet:packet(3002, 5)}}));
+    await page.waitForFunction(() => document.querySelector('#pktPauseBtn').textContent.includes('1002'));
+    await page.locator('#pktPauseBtn').click();
+    await page.waitForSelector('tr[data-hash="' + hash(3002) + '"]');
+    assert(!(await shown()).includes(hash(2001)), 'live CONTROL must remain hidden');
+    assert((await shown()).includes(hash(1001)), 'hidden live traffic must not evict matching history');
+    console.log('PASS: resumed live packets apply Hide CONTROL without evicting matching history');
+
+    await page.locator('#fGroup').click();
+    await ready();
+    assert.strictEqual(requests.at(-1).get('expand'), 'observations');
+    assert.deepStrictEqual(await shown(), [hash(1001), hash(1002), hash(1003)]);
+    await checkHide(false);
+    await ready();
+    assert.strictEqual(requests.at(-1).get('excludeTypes'), null);
+    assert((await shown()).every(h => Number.parseInt(h, 16) >= 2001));
+    assert((await shown()).includes(hash(2001)), 'unchecking refetches CONTROL received while hidden');
+    console.log('PASS: raw mode and unchecking refill the matching page');
+
+    await type('5');
+    await ready();
+    assert.deepStrictEqual(await shown(), [hash(1001), hash(1003)]);
+    await page.locator('#clearFiltersBtn').click();
+    await ready();
+    assert.strictEqual(requests.at(-1).get('excludeTypes'), null);
+    assert((await shown()).every(h => Number.parseInt(h, 16) >= 2001));
+    console.log('PASS: type selection and Clear refetch, without altering URL type contract');
+
+    holdNext = true;
+    await checkHide(true);
+    await page.waitForFunction(() => document.querySelector('#pktLeft').dataset.loaded === 'false');
+    await waitForRelease();
+    await type('5');
+    await ready();
+    assert.deepStrictEqual(await shown(), [hash(1001), hash(1003)]);
+    const oldRelease = release;
+    release = null;
+    oldRelease();
+    await page.waitForTimeout(200);
+    assert.deepStrictEqual(await shown(), [hash(1001), hash(1003)]);
+    console.log('PASS: late earlier filter response cannot replace newest results');
+    socket.send(JSON.stringify({type:'packet', data:{packet:packet(2003, 4)}}));
+    socket.send(JSON.stringify({type:'packet', data:{packet:packet(2004, 5)}}));
+    await page.waitForSelector('tr[data-hash="' + hash(2004) + '"]');
+    assert(!(await shown()).includes(hash(2003)), 'live packets must respect selected type');
+    console.log('PASS: live packets keep applying the selected type');
+
+    // Hash lookup deliberately ignores both active exclusions.
+    await page.locator('#fHash').fill(hash(1));
+    await page.waitForFunction(() => document.querySelector('#pktBody tr[data-hash]')?.dataset.hash === '0000000000000001');
+    await ready();
+    assert.strictEqual(requests.at(-1).get('excludeTypes'), null);
+    assert.deepStrictEqual(await shown(), [hash(1)]);
+    console.log('PASS: pinned CONTROL hash bypasses active type and Hide CONTROL filters');
+
+    holdNext = true;
+    await page.locator('#fHash').fill(hash(2));
+    await waitForRelease();
+    await page.evaluate(() => { location.hash = '#/home'; });
+    await page.waitForSelector('#pktLeft', {state:'detached'});
+    await page.evaluate(() => { location.hash = '#/packets?hash=0000000000000003'; });
+    await ready();
+    assert.deepStrictEqual(await shown(), [hash(3)]);
+    release();
+    await page.waitForTimeout(200);
+    assert.deepStrictEqual(await shown(), [hash(3)]);
+    assert.deepStrictEqual(errors, []);
+    console.log('PASS: departed view request cannot overwrite remounted packet view');
+    if (process.env.SCREENSHOT_PATH) await page.screenshot({path:process.env.SCREENSHOT_PATH});
+  } finally { await browser.close(); }
+})().catch(error => { console.error(error); process.exitCode = 1; });
diff --git a/test-issue-96-hide-control-e2e.js b/test-issue-96-hide-control-e2e.js
index 6e054860e..4e2bd70ca 100644
--- a/test-issue-96-hide-control-e2e.js
+++ b/test-issue-96-hide-control-e2e.js
@@ -4,8 +4,8 @@
  * Against the e2e fixture (4 CONTROL packets, all older than the default
  * time window, so every step opens #/packets?timeWindow=525600):
  * - default: the checkbox is unchecked and CONTROL packets are listed;
- * - checking it hides exactly the CONTROL packets, without a new
- *   /api/packets request, and puts hideControl=1 in the address bar;
+ * - checking it hides exactly the CONTROL packets, refetches the capped
+ *   /api/packets page, and puts hideControl=1 in the address bar;
  * - the choice survives a reload, checked and explicitly unchecked;
  * - hideControl in the URL wins over the saved choice;
  * - a direct link to one CONTROL packet still opens it while the filter is on;
@@ -91,14 +91,15 @@ async function hashQuery(page) {
     assert(!('hideControl' in q), 'hideControl in the URL by default: ' + JSON.stringify(q));
   });
 
-  await step('checking it hides exactly the CONTROL packets, without a new API request', async () => {
+  await step('checking it hides exactly the CONTROL packets and refetches the page', async () => {
     const before = packetsRequests;
     await page.check('#fHideControl');
     await page.waitForFunction((n) => {
       const m = /\((\d+)\)/.exec(document.querySelector('#pktLeft .count')?.textContent || '');
       return m && Number(m[1]) === n;
     }, countAll - controls.length, { timeout: 5000 });
-    assert(packetsRequests === before, `toggling made ${packetsRequests - before} /api/packets request(s)`);
+    await page.waitForSelector('#pktLeft[data-loaded="true"]');
+    assert(packetsRequests === before + 1, `toggling made ${packetsRequests - before} /api/packets request(s)`);
     const q = await hashQuery(page);
     assert(q.hideControl === '1', 'hideControl=1 not in the URL: ' + JSON.stringify(q));
     const shownHashes = await page.$$eval('table tbody tr[data-hash]', (rows) => rows.map((r) => r.dataset.hash));
@@ -158,9 +159,9 @@ async function hashQuery(page) {
     assert(await page.evaluate((k) => localStorage.getItem(k), PREF_KEY) === '1', 'the URL override changed the saved choice');
   });
 
-  await step('#211: the empty-list note names CONTROL only when hiding CONTROL emptied the list', async () => {
+  await step('#242: server-filtered empty lists do not infer unseen CONTROL packets', async () => {
     const onlyControl = await openEmpty(page, LIST + '&hideControl=1&filter=' + encodeURIComponent('type == CONTROL'));
-    assert(onlyControl === 'No packets found (CONTROL packets are hidden)', 'expression matching only CONTROL: ' + onlyControl);
+    assert(onlyControl === 'No packets found', 'server-filtered list has no evidence of hidden matches: ' + onlyControl);
     const nothing = await openEmpty(page, LIST + '&hideControl=1&filter=' + encodeURIComponent('snr > 999'));
     assert(nothing === 'No packets found', 'expression matching nothing blamed CONTROL: ' + nothing);
   });
diff --git a/test-issue-96-hide-control.js b/test-issue-96-hide-control.js
index 91576a7fb..63e9b7c89 100644
--- a/test-issue-96-hide-control.js
+++ b/test-issue-96-hide-control.js
@@ -67,6 +67,7 @@ function makeSandbox(storage) {
     calls: [],
     updatePacketsUrl() { ctx.calls.push('url'); },
     renderTableRows() { ctx.calls.push('render'); },
+    loadPackets() { ctx.calls.push('load'); },
     filters: {},
     hideControl: false,
     savedHideControl: false,
@@ -212,14 +213,14 @@ console.log('\n=== #211 review, nit 1: a throwing localStorage does not stop the
     const ctx = makeSandbox(throwing);
     fn(ctx, 'set')(true);
     assert.strictEqual(ctx.hideControl, true, 'hideControl not set');
-    assert.deepStrictEqual(ctx.calls, ['url', 'render'], 'URL update and re-render must still run');
+    assert.deepStrictEqual(ctx.calls, ['url', 'render', 'load'], 'URL update, re-render and capped-page reload must still run');
   });
   test('setHideControl: saves the choice, then updates the URL, then re-renders', () => {
     const ctx = makeSandbox();
     fn(ctx, 'set')(true);
     assert.strictEqual(ctx.localStorage.getItem(ctx.__fns.key), '1');
     assert.strictEqual(ctx.savedHideControl, true);
-    assert.deepStrictEqual(ctx.calls, ['url', 'render']);
+    assert.deepStrictEqual(ctx.calls, ['url', 'render', 'load']);
   });
 }
 
diff --git a/test-packets.js b/test-packets.js
index 33ed65546..c20e81e55 100644
--- a/test-packets.js
+++ b/test-packets.js
@@ -1923,6 +1923,24 @@ async function testChannelDestinations() {
   }
 }
 
+console.log('\n=== #242 server-side type exclusions ===');
+{
+  const api = loadPacketsSandbox()._packetsTestAPI;
+  const params = (filters, hideControl = false, groupByHash = true) => api.buildPacketsParams({ filters, hideControl, groupByHash, limit: 100 });
+  test('default leaves exclusion absent', () => assert.strictEqual(params({}).get('excludeTypes'), null));
+  test('Hide CONTROL excludes only 11 in raw and grouped requests', () => {
+    for (const grouped of [false, true]) assert.strictEqual(params({}, true, grouped).get('excludeTypes'), '11');
+  });
+  test('selected types exclude their four-bit complement, union Hide CONTROL', () => {
+    assert.strictEqual(params({type: '5,11'}, true).get('excludeTypes'), '0,1,2,3,4,6,7,8,9,10,11,12,13,14,15');
+    assert.strictEqual(params({type: '5,11'}).get('excludeTypes'), '0,1,2,3,4,6,7,8,9,10,12,13,14,15');
+  });
+  test('all sixteen types impose no exclusion', () => assert.strictEqual(params({type: Array.from({length:16}, (_, i) => i).join(',')}).get('excludeTypes'), null));
+  test('invalid stored selection stays restrictive rather than broadening', () => assert.strictEqual(params({type:'invalid'}).get('excludeTypes'), Array.from({length:16}, (_, i) => i).join(',')));
+  test('duplicate selected types produce canonical exclusions', () => assert.strictEqual(params({type:'0,0,15'}).get('excludeTypes'), '1,2,3,4,5,6,7,8,9,10,11,12,13,14'));
+  test('pinned hash bypasses both exclusions', () => assert.strictEqual(params({hash:'ABC', type:'5'}, true).get('excludeTypes'), null));
+}
+
 testChannelDestinations().then(() => {
   console.log(`\n${'='.repeat(40)}`);
   console.log(`packets.js tests: ${passed} passed, ${failed} failed, ${knownBugs} known bug(s) still failing`);

From cdd14df63c9f96dd563f56d60a9c1e20693a2b02 Mon Sep 17 00:00:00 2001
From: dborup <kontakt@meshview.dk>
Date: Wed, 7 Oct 2026 13:47:39 +0200
Subject: [PATCH 2/5] reviewfix(packets): keep the active time window across
 exclusion refetches

The Playwright job went red on #1122's Details row clamp E2E at 900px and
375px once the e2e fixture was older than 15 minutes (CI: 13.7 min after
freshen-fixture.sh). Both viewports rendered an empty or single-row list.

Cause: that test widens the list to "All time" by assigning
#fTimeWindow.value = '0'. Below 1025px packets.js deliberately omits the
"All time" option, so the assignment selects nothing and leaves the select
blank. Its change handler then clamps savedTimeWindowMin to 15, and the
blank-value fallback added here resolves the refetch to those 15 minutes
instead of the all-time window the test assumed -- which is empty once the
fixture has aged past it. Desktop kept passing because the option exists
above 1024px.

The fallback itself is the behaviour we want: a shared ?timeWindow=240 URL
also leaves the select blank, and reading that as Number('') === 0 would
silently widen every new refetch to All time. Reading the DOM cannot tell
the two blanks apart, so the test stops forcing an option the page does not
offer: it selects "All time" only where that option exists and otherwise
keeps the URL window it already pins, which spans the whole fixture.

- test-issue-1122-details-row-clamp-e2e.js: select "All time" only when the
  option is present. 18/18 at all three viewports against a 20-minute-old
  fixture, on this branch and on master; 8 failures before the change.
- test-issue-242-type-exclusions-e2e.js: new scenario pinning the contract
  this PR introduced -- a ?timeWindow=240 URL whose window has no dropdown
  option must survive the Hide CONTROL refetch instead of widening to All
  time. Reverting the guard to Number(selectedWindowValue) fails it with
  "the refetch dropped the time window and asked for all time".

Relates to #242.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 test-issue-1122-details-row-clamp-e2e.js | 13 ++++++--
 test-issue-242-type-exclusions-e2e.js    | 41 ++++++++++++++++++++++++
 2 files changed, 52 insertions(+), 2 deletions(-)

diff --git a/test-issue-1122-details-row-clamp-e2e.js b/test-issue-1122-details-row-clamp-e2e.js
index 57e75b3ad..0ded369c2 100644
--- a/test-issue-1122-details-row-clamp-e2e.js
+++ b/test-issue-1122-details-row-clamp-e2e.js
@@ -63,10 +63,19 @@ async function gotoPackets(page, vp) {
   await page.goto(BASE + '/#/packets?timeWindow=' + pinnedWindowMin(vp), { waitUntil: 'domcontentloaded' });
   await page.waitForSelector('#packetFilterInput', { state: 'attached', timeout: 8000 });
   await page.waitForFunction(() => !!document.querySelector('#filterUxBar'), { timeout: 8000 });
-  // All time, so the fixture's long channel messages are rendered (same as #1122).
+  // Widen to "All time" so the fixture's long channel messages are rendered
+  // (same as #1122) -- but only through the option the page really offers.
+  // Below 1025px "All time" is deliberately absent (packets.js omits the
+  // option on mobile), so assigning '0' there selects nothing and leaves the
+  // select blank. Since #242 a blank select means "keep the saved window"
+  // (15 min) rather than All time, so forcing '0' at those widths emptied the
+  // list as soon as the fixture was older than 15 minutes. The URL window
+  // pinned above already spans the whole fixture, so leave it in place there.
   await page.evaluate(() => {
     const sel = document.getElementById('fTimeWindow');
-    if (sel) { sel.value = '0'; sel.dispatchEvent(new Event('change', { bubbles: true })); }
+    if (!sel || !sel.querySelector('option[value="0"]')) return;
+    sel.value = '0';
+    sel.dispatchEvent(new Event('change', { bubbles: true }));
   });
   await page.waitForFunction(
     () => document.querySelectorAll('#pktBody tr[data-hash] td.col-details .col-details-clip').length > 20,
diff --git a/test-issue-242-type-exclusions-e2e.js b/test-issue-242-type-exclusions-e2e.js
index 02efb9177..55ea11099 100644
--- a/test-issue-242-type-exclusions-e2e.js
+++ b/test-issue-242-type-exclusions-e2e.js
@@ -135,6 +135,47 @@ const fixture = [...Array.from({length: 1000}, (_, i) => packet(i + 1, 11)), pac
     assert.deepStrictEqual(await shown(), [hash(3)]);
     assert.deepStrictEqual(errors, []);
     console.log('PASS: departed view request cannot overwrite remounted packet view');
+
+    // A shared URL may name a time window the dropdown carries no option for
+    // (?timeWindow=240), which leaves the select blank. The refetches added
+    // here must keep that window; reading the blank value as Number('')===0
+    // would silently widen every refetch to All time.
+    const customCtx = await browser.newContext({ viewport: {width: 1024, height: 900} });
+    const customPage = await customCtx.newPage();
+    const customErrors = [];
+    customPage.on('pageerror', error => customErrors.push(error.message));
+    const windows = [];
+    await customPage.routeWebSocket('**', () => {});
+    await customPage.route('**/api/packets?**', async route => {
+      const q = new URL(route.request().url()).searchParams;
+      const since = q.get('since');
+      windows.push(since === null ? null : Math.round((Date.now() - Date.parse(since)) / 60000));
+      const excluded = new Set((q.get('excludeTypes') || '').split(',').filter(Boolean).map(Number));
+      const selected = fixture.filter(p => !excluded.has(p.payload_type)).slice(0, Number(q.get('limit')));
+      await route.fulfill({json: {packets: selected, total: selected.length}});
+    });
+    await customPage.goto(BASE + '/#/packets?timeWindow=240');
+    await customPage.waitForSelector('#pktLeft[data-loaded="true"]');
+    assert.strictEqual(await customPage.locator('#fTimeWindow').inputValue(), '',
+      'a 240-minute window is expected to have no dropdown option');
+    assert(windows.at(-1) >= 235 && windows.at(-1) <= 245,
+      'cold load must honour the URL window, asked for ' + windows.at(-1) + ' minutes');
+    const beforeRefetch = windows.length;
+    if (!(await customPage.locator('#fHideControl').isVisible())) {
+      await customPage.locator('#filterToggleBtn, .filter-toggle-btn-mirror').filter({visible: true}).first().click();
+    }
+    await customPage.locator('#fHideControl').setChecked(true);
+    const refetchDeadline = Date.now() + 15000;
+    while (windows.length === beforeRefetch) {
+      if (Date.now() > refetchDeadline) throw new Error('Hide CONTROL did not refetch');
+      await new Promise(r => setTimeout(r, 10));
+    }
+    const refetched = windows.at(-1);
+    assert(refetched !== null, 'the refetch dropped the time window and asked for all time');
+    assert(refetched >= 235 && refetched <= 245,
+      'the refetch changed the window to ' + refetched + ' minutes');
+    assert.deepStrictEqual(customErrors, []);
+    console.log('PASS: a URL time window absent from the dropdown survives an exclusion refetch');
     if (process.env.SCREENSHOT_PATH) await page.screenshot({path:process.env.SCREENSHOT_PATH});
   } finally { await browser.close(); }
 })().catch(error => { console.error(error); process.exitCode = 1; });

From 5a17ee367dcc4507a0db8b48da16791f5f2a6a41 Mon Sep 17 00:00:00 2001
From: dborup <kontakt@meshview.dk>
Date: Wed, 7 Oct 2026 16:55:31 +0000
Subject: [PATCH 3/5] reviewfix(test): make the stale-response scenario fail on
 its own (#242)

The held Hide CONTROL response and the newer type response rendered the
same rows after client filters, so dropping the generation check after
api() still passed this scenario. The server now ages one matching packet
out between the two requests, so a late earlier response is visible.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 test-issue-242-type-exclusions-e2e.js | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/test-issue-242-type-exclusions-e2e.js b/test-issue-242-type-exclusions-e2e.js
index 55ea11099..9655082b1 100644
--- a/test-issue-242-type-exclusions-e2e.js
+++ b/test-issue-242-type-exclusions-e2e.js
@@ -99,14 +99,18 @@ const fixture = [...Array.from({length: 1000}, (_, i) => packet(i + 1, 11)), pac
     await checkHide(true);
     await page.waitForFunction(() => document.querySelector('#pktLeft').dataset.loaded === 'false');
     await waitForRelease();
+    // The server ages 1003 out after answering the held request, so the late
+    // response still carries it and stays visibly stale after client filters.
+    const agedOut = fixture.splice(fixture.findIndex(p => p.id === 1003), 1);
     await type('5');
     await ready();
-    assert.deepStrictEqual(await shown(), [hash(1001), hash(1003)]);
+    assert.deepStrictEqual(await shown(), [hash(1001)]);
     const oldRelease = release;
     release = null;
     oldRelease();
     await page.waitForTimeout(200);
-    assert.deepStrictEqual(await shown(), [hash(1001), hash(1003)]);
+    assert.deepStrictEqual(await shown(), [hash(1001)], 'a late earlier response replaced the newest results');
+    fixture.push(...agedOut);
     console.log('PASS: late earlier filter response cannot replace newest results');
     socket.send(JSON.stringify({type:'packet', data:{packet:packet(2003, 4)}}));
     socket.send(JSON.stringify({type:'packet', data:{packet:packet(2004, 5)}}));

From 23ea5efd67cf9109d49a06d737a68eea221666ef Mon Sep 17 00:00:00 2001
From: dborup <kontakt@meshview.dk>
Date: Wed, 7 Oct 2026 17:06:57 +0000
Subject: [PATCH 4/5] reviewfix(server): test the exclusion mask before the
 payload type (#242)

With no exclusion (the default page) excludes() still dereferenced every
tx's separately allocated PayloadType before looking at the mask. Testing
mask != 0 first restores master parity on the in-memory path.

Interleaved A/B, 300K tx, limit=1000, mask 0, cold grouped cache, n=18
(6 rounds x 3, -benchtime 2s), median:
  raw:     15.20 ms -> 13.08 ms (master 13.16 ms)
  grouped: 17.89 ms -> 15.73 ms (master 15.94 ms)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 cmd/server/packet_exclusions.go | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/cmd/server/packet_exclusions.go b/cmd/server/packet_exclusions.go
index c114f2f6c..e805fcc21 100644
--- a/cmd/server/packet_exclusions.go
+++ b/cmd/server/packet_exclusions.go
@@ -41,8 +41,10 @@ func parsePacketTypeExclusions(values url.Values) (packetTypeExclusions, error)
 	return mask, nil
 }
 
+// Test mask first: the default (no exclusion) must not dereference every
+// tx's separately allocated PayloadType in the filter loop.
 func (mask packetTypeExclusions) excludes(typ *int) bool {
-	return typ != nil && *typ >= 0 && *typ < 16 && mask&(1<<uint(*typ)) != 0
+	return mask != 0 && typ != nil && *typ >= 0 && *typ < 16 && mask&(1<<uint(*typ)) != 0
 }
 
 // Keep unknown/NULL payload types, matching the in-memory predicate. The

From 5899d4618cac6eb7449fa54582ce2e0dd827a5ba Mon Sep 17 00:00:00 2001
From: dborup <kontakt@meshview.dk>
Date: Wed, 7 Oct 2026 17:08:58 +0000
Subject: [PATCH 5/5] reviewfix(packets): pin where the #211 Hide CONTROL hint
 still fires (#242)

With CONTROL excluded server-side and dropped from the live feed, the
"(CONTROL packets are hidden)" note can only appear between the checkbox
change and the refetch. Say so at the call site, and pin that window in
the #242 browser test (held refetch over an all-CONTROL page) so the
machinery stays covered rather than silently dead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 public/packets.js                     | 5 ++++-
 test-issue-242-type-exclusions-e2e.js | 8 ++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/public/packets.js b/public/packets.js
index 64337a6e2..98997e085 100644
--- a/public/packets.js
+++ b/public/packets.js
@@ -3337,7 +3337,10 @@
       detachVScrollListener();
       const colCount = _getColCount();
       // #211: name CONTROL only when hiding it emptied the list, i.e. a CONTROL
-      // packet would get through the filters below the CONTROL pass.
+      // packet would get through the filters below the CONTROL pass. Since
+      // #242 the refetch and live feed drop CONTROL before it reaches
+      // `packets`, so this fires only between the checkbox change and the
+      // refetch; a server-filtered empty list just says "No packets found".
       const emptiedByControl = controlHidden && controlHidingEmptiedList(beforeHideControl, (list) => {
         list = applyObserverFilter(list, filters, groupByHash, hashOnly);
         return filters._packetFilter ? list.filter(filters._packetFilter) : list;
diff --git a/test-issue-242-type-exclusions-e2e.js b/test-issue-242-type-exclusions-e2e.js
index 9655082b1..46be7ddce 100644
--- a/test-issue-242-type-exclusions-e2e.js
+++ b/test-issue-242-type-exclusions-e2e.js
@@ -56,7 +56,15 @@ const fixture = [...Array.from({length: 1000}, (_, i) => packet(i + 1, 11)), pac
     await ready();
     assert.strictEqual(requests.at(-1).get('limit'), '1000');
     assert((await shown()).every(h => Number.parseInt(h, 16) <= 1000));
+    holdNext = true;
     await checkHide(true);
+    await waitForRelease();
+    // #211's hint survives only until the refetch: the loaded page was all CONTROL.
+    // textContent: column hiding may hide the message cell at this width.
+    assert.match(await page.locator('#pktBody').textContent(), /CONTROL packets are hidden/);
+    const firstRelease = release;
+    release = null;
+    firstRelease();
     await ready();
     assert.strictEqual(requests.at(-1).get('excludeTypes'), '11');
     assert.deepStrictEqual(await shown(), [hash(1001), hash(1002), hash(1003)]);