[dborup-agent]

Relates to #76

Problem

GET /api/nodes/{pubkey}/health and GET /api/nodes/bulk-health returned one observers list: every observer of any transmission the node is involved in, with the SNR/RSSI of the representative observation. That signal belongs to whichever node the observer last heard, often a repeater, not the node the card is about. The same list fed the node page, the side panel, the home My Mesh card, Analytics "Most Observed Nodes" and the Live node panel.

Plan (milestones, all in this PR)

1. Per-observation route evidence in the store. StoreObs.wireRoute keeps the route type from each observation's own frame header (observations.raw_hex, fix(packets): give each observation its own wire bytes in the detail API (port of upstream #2055) #77). It is one byte placed in existing padding, so StoreObs stays 200 bytes. It is set on all five paths that build an observation: Load, loadChunk, chunked load, IngestNewFromDB and IngestNewObservations.
2. Classifier and accumulator (cmd/server/heard_by.go), shared by single and bulk health.
3. API: directObservers / relayObservers replace observers, stats.avgSnr covers direct receptions only, hidden identities are filtered, and OpenAPI plus docs/api-spec.md are updated.
4. Frontend: a shared component (public/heard-by.js) renders the split on the node page, side panel and Live panel. Home My Mesh and Analytics use its counts and texts.
5. Tests: Go unit and handler tests, a JS unit test, a new E2E in scripts/e2e-shards.json, and before/after benchmarks.

Config and customizer: this adds no configurable values, so the customizer is unchanged.

The rule

An observation shows that its observer received the node's own transmission only for an ADVERT whose signature is not known to be invalid. It is read with the observation's own route type and path:

Observation route	Path	Credits
FLOOD / TRANSPORT_FLOOD	empty	the advertiser
FLOOD / TRANSPORT_FLOOD	non-empty	the last hop, when it is the node's full key or a wire prefix unique among relay-capable nodes, and the node is not a listener
DIRECT / TRANSPORT_DIRECT	empty (zero hop)	the advertiser
DIRECT / TRANSPORT_DIRECT	non-empty	nobody

Source of truth is the firmware (src/Mesh.cpp):

• routeRecvPacket appends the forwarder's hash before it retransmits a flood packet, so the last hop is the node that was heard.
• sendFlood starts with an empty path.
• sendZeroHop sends DIRECT / TRANSPORT_DIRECT with path_len = 0.
• A direct forwarder calls removeSelfFromPath before retransmitting, so a non-empty direct path is the remaining route.

The last-hop credit uses the same identity-safe evidence as the #64 liveness (relayKeyMatcher), so #64's health semantics are unchanged.

The route type is the frame header when one is stored. Without a frame it is the transmission's route type, or unknown when route_mask holds both flood and direct bits. This is the same rule as the ingestor's observationRouteType (#308). The upstream design was read for reference only. It classifies by the representative transmission's route type and counts relay observers from the representative observation only; neither is done here.

An observer never counts as hearing its own upload of the node's packet. Every other observer of the node's transmissions goes to relayObservers, counted from all observations. Its packetCount is the number of the node's transmissions it saw, and it carries no SNR/RSSI.

API

• directObservers: HeardDirectObserver[]: observer_id, observer_name, packetCount (direct receptions), avgSnr, avgRssi (over those receptions), and can_relay (node health only, omitted when unknown).
• relayObservers: HeardRelayObserver[]: observer_id, observer_name, packetCount, can_relay.
• stats.avgSnr: the mean over direct receptions; null without one.
• observers is removed. Keeping the name with a new meaning would silently change every client, and keeping the old content would keep the misleading SNR.
• Observers whose identity is hidden (node or observer blacklist, or a recorded or current hidden-name prefix) leave both lists. The current names are read in one query per request; a failed lookup returns 500 rather than an unfiltered list.
• The response rows are named structs. Production map[string]interface{} count: store.go 213 → 209, nothing added elsewhere. The OpenAPI schemas use the typed openAPISchema, and a test pins them to the struct fields. cmd/server stays read-only.

GetBulkHealth also releases its node rows before the store work. Its early break used to keep that connection while relayPrefixMapLocked queried again, which hangs a single-connection pool. A regression test covers it.

Frontend

• Node page and side panel: "Heard By (N observers)" with "Heard directly" (packets, avg SNR, avg RSSI) and "Heard via relay" (packets only). Each heading has a keyboard-reachable help tooltip.
  • When the direct list is empty, the card says: "No observation proves a direct reception here, which is not the same as being out of range."
  • The dead "Regions:" line and Region column are gone; they read o.iata, which these endpoints never emitted.
• Live node panel: the same compact lists, with observer links.
• Home My Mesh card:
  • "Heard directly by: … · N via relay";
  • a "Direct observers" metric and "Direct SNR";
  • the dialog lists direct observers, then relay ones marked "(via relay)".
• Analytics: "Most Observed Nodes" ranks by direct observers, then by relay observers. It and the claimed and best-signal tables show "Direct observers", "Via relay" and "Direct SNR".

The tooltip and docs say that the lists are observed routing evidence, not a radio range.

Performance

The new pass is O(observations of the node's transmissions), with one map lookup per observation. There is no per-node scan of the store, no extra lock and no background job. Bulk health reuses one accumulator across nodes.

BenchmarkHeardBy* uses 2,000 nodes and 30,000 transmissions × 5 observations. Medians of 3 interleaved runs of 20 iterations each, 4-core host. "Before" is master plus only the rows.Close() line, without which the benchmark deadlocks.

benchmark	before	after	B/op before → after	allocs/op before → after
bulk-health, 200 nodes	3.61 ms	7.45 ms	1,188 KB → 953 KB	19,339 → 12,154
one node	0.91 ms	0.93 ms	346 KB → 354 KB	4,349 → 4,328
hub node, 150K observations	7.15 ms	12.26 ms	936 KB → 928 KB	8,745 → 8,364

Bulk health takes 2× the time because it now reads every observation instead of one per transmission. That is required to count relay observers from all observations and to read route evidence per observation. The cost is about 34 ns per observation, with less garbage than before.

Tests

• cmd/server/heard_by_test.go:
  • the rule table: 24 cases, including frame header against a first-ingested route in both directions, colliding 1-byte prefixes, listeners and companions, and missing or malformed paths;
  • per-observation route type;
  • mixed route types per hash, including a mixed mask without frames;
  • relay observers from all observations;
  • signal from direct receptions only, including forged adverts and self-uploads;
  • bulk equals single health;
  • hidden observers on both endpoints;
  • wireRoute on all five observation paths;
  • the StoreObs padding;
  • OpenAPI schemas;
  • the released node rows.
• The Deterministic tie order in four more count-only sorts (node analytics, node/bulk health) #321 tie-order tests now cover both lists. The feat(disambiguator): use new firmware repeat: on|off hint to exclude listening-only observers from path-hop candidates Kpa-clawbot/CoreScope#1290 badge test seeds a real direct reception. The golden shapes are updated.
• test-heard-by.js (in test-all.sh) covers the renderers, tooltips, the empty state and escaping.
• test-issue-76-heard-by-e2e.js (shard 3) runs against the Go server with the CI fixture, without stubs. It checks:
  • the API shape, and single against bulk health;
  • the node page, the side panel, the home card and dialog, the Analytics ranking and the Live panel.
• Existing E2E fixtures moved to the new fields. The two security(ui): escape untrusted node, observer and route values in HTML rendering #333 XSS tests that targeted the removed Regions line now feed hostile observer names through the new renderers.

Run locally on this head:

• go test -race ./... (server) and go test ./... (ingestor) pass.
• sh test-all.sh: 249/249. node test-frontend-helpers.js: 713/713.
• bash scripts/check-xss-sinks.sh --diff origin/master is clean. eslint@8 public/*.js (the CI config, with the new HeardBy global) reports 0 errors and no new warnings in the touched files.
• Against a local Go server on the CI-prepared e2e-fixture.db:
  • test-e2e-playwright.js: 154/157, 3 skipped;
  • test-a11y-axe-1668.js: 0 violations;
  • the new E2E and 9 affected E2Es pass.
• The new E2E and unit test fail on master.
• Browser check of the node page, side panel, home card and Live panel: light and dark theme, desktop, and 390 px with no horizontal scroll.

Not in this PR

• /api/nodes/{pubkey}/analytics still has its own observer coverage with representative SNR. It is a different card and is not part of this change.
• Adverts are the only evidence used. A node heard only through non-advert traffic, or whose prefix collides, gets no direct observer, so the empty state explains that this is missing evidence.

🤖 Generated with Claude Code

[dborup-agent]

Rapport — CS-pve-agent1 PR#451 #76 — head 4fea395

Status: Draft, ready for review. All 18 CI jobs on head 4fea395a are green (run 38570870612). All 32 mutants were killed by test assertions; none died on a compile error. The local Go, JS and E2E suites pass.

Evidence tags:

• [T]: verified by a test or command run on this head, or on master where the row says so.
• [K]: read in the code or in the firmware source.
• [A]: analysis that was not executed.

Commits

sha	content
1183a516	tests only. Red on master code: Go fails to build on the missing wireRoute / heardDirect / observationRouteType; test-heard-by.js cannot load public/heard-by.js [T]
b3b43778	implementation
4fea395a	.eslintrc.json: declares the new HeardBy global (the first CI run failed on no-undef)

Requirements

#	Requirement	Evidence	Tests (red before → green after)	Mutants (all killed)
1	Own design, no cherry-pick of upstream; references only, no links or mentions	[T] the branch is 3 own commits on 94dedd78. [K] the PR body and this report carry no upstream links or mentions	—	—
2	Split into heard directly / heard via relay, using per-observation route type (#308) and raw_hex (#77)	[T] [K] heard_by.go; StoreObs.wireRoute set on all 5 observation paths. Firmware read in src/Mesh.cpp: routeRecvPacket, sendFlood, sendZeroHop, removeSelfFromPath [K]	TestHeardDirect_Rule_76 (24 cases), TestObservationRouteType_PerObservation_76, TestHeardBy_MixedRouteTypesPerHash_76, TestWireRoute_SetOnEveryObservationPath_76, E2E step 1 [T]	M1 frame header ignored · M2 mixed mask not unknown · M3 non-empty direct path credits · M4 any flood last hop credits · M5 zero-hop not credited · M6 another node's empty flood path credits · M7 missing path read as zero hop · M8 self-upload credits · M9 forged advert credits · M10 wireRoute missing in IngestNewObservations · M11 missing in chunked load
3	Relay observers counted from all observations	[T]	TestHeardBy_RelayObserversFromAllObservations_76; bulk = single in TestHeardBy_BulkMatchesNodeHealth_76	M12 representative observation only · M13 packets counted per copy, not per transmission
4	SNR/RSSI only on direct rows, never another node's	[T] relay rows have no avgSnr/avgRssi field; stats.avgSnr covers direct receptions only	TestHeardBy_SignalOnlyFromDirectReceptions_76; test-heard-by.js "relay rows ignore signal fields"; E2E steps on node page, side panel and Live	M14 node SNR taken from all copies · M15 direct row SNR dropped · M16 bulk avgSnr not from direct · F1 relay row renders SNR
5	Keep #64 health/liveness semantics	[K] updateOwnAdvertActivity and updateIndexedRelayActivityLocked are unchanged; the last-hop credit reuses relayKeyMatcher. [T] the existing #64 tests and test-node-liveness-e2e.js pass	TestNodeHealth_LastAdvertIsOwnAdvertNotTraffic, TestNodeHealth_RawPrefixOnlyRelayMatchesRelayActivity (existing)	M24 own-advert activity dropped from bulk health
6	Every consumer updated consistently: node page, side panel, home My Mesh, Analytics "Most Observed", Live	[T] shared public/heard-by.js; browser check in light and dark theme, desktop and 390 px	test-issue-76-heard-by-e2e.js (real server and fixture, 8 steps); 1147, 1151, 1281, 304, 2027, 1206 and xss-333 E2Es pass	F5 analytics not ranked by direct · F6 home relay count missing · F7 Live without observer links · F8 node page renders the compact list
7	Respect hidden identities and blacklists	[T] observer blacklist, recorded name and current name (one bulk lookup); a lookup error returns 500	TestHeardBy_HiddenObserversRemoved_76 (both endpoints)	M17 bulk filter skipped · M18 node filter skipped · M19 current names ignored
8	Perf: O(observations), no per-node scans, measured before/after on 30K	[T] BenchmarkHeardBy*, 30K tx / 150K obs, medians of 3. Bulk (200 nodes) 3.61 → 7.45 ms; node 0.91 → 0.93 ms; hub (150K obs) 7.15 → 12.26 ms. B/op and allocs/op go down in all three	TestGetBulkHealth_ReleasesNodeRowsBeforeStoreWork_76, TestStoreObsLayoutFitsWireRouteInPadding_76	M20 node rows held (deadlock) · M21 StoreObs grows
9	API: named structs, no new map[string]interface{}, read-only server, OpenAPI updated	[T] production count store.go 213 → 209, 0 added; readonly_invariant_test passes; HeardDirectObserver, HeardRelayObserver, NodeHealthResponse, BulkHealthEntry, BulkHealthResponse	TestOpenAPI_HeardBySchemas_76; parity golden shapes; #321 tie order on both lists	M22 OpenAPI field dropped · M23 tie order reversed
10	Precise tooltip and docs text (observed routing evidence, not radio range)	[T] the tooltips use focusable .sort-help buttons; docs/api-spec.md "Heard By (#76)" section [K]	test-heard-by.js tooltip and empty-state tests; E2E tooltip-on-focus step	F2 wording changed · F3 empty-state text dropped · F4 observer name not escaped
11	Unit tests for the classification incl. mixed route types per hash; E2E in scripts/e2e-shards.json	[T] run-e2e-shard.js --validate and test-ci-shards.js pass; the suite ran in CI shard 3 (E2E SUITE END: test-issue-76-heard-by-e2e.js)	see #2	—
12	PR as "Relates to #76"; draft; title without a closing keyword	[T] the body starts with Relates to #76; draft	—	—

Always

Rule	Evidence
A test red before and green after, and a mutant per point	[T] the test commit is red on master code; the new E2E is 1/8 against a master server; 32/32 mutants killed
cmd/server stays read-only; no new map[string]interface{} outside tests	[T] no write path is added; readonly_invariant_test passes; count above
No hardcoded colors	[T] no hex or rgb() added in the public/ diff; new CSS uses tokens
bash scripts/check-xss-sinks.sh --diff origin/master	[T] clean (exit 0)
Fork guards unchanged	[T] deploy.yml 9, release-fast-path.yml 1, same as master; .github/ untouched

Local runs on this code

• [T] cmd/server: go test -race ./... ok. cmd/ingestor: go test ./... ok. go vet clean; gofmt clean on touched files.
• [T] sh test-all.sh: 249/249. node test-frontend-helpers.js: 713/713.
• [T] eslint 8 (public/*.js) with the CI config: 0 errors, and no new warnings in the touched files.
• [T] Against a local Go server on the CI-prepared e2e-fixture.db:
  • test-e2e-playwright.js: 154/157, 3 skipped;
  • test-a11y-axe-1668.js: 0 violations in 120 cells;
  • the new E2E: 8/8;
  • 9 affected E2Es pass.

CI per job

The final run is 38570870612 on head 4fea395a. Every job passed:

Job	Result
Go Build & Test	✅
Go Server Tests 1/3, 2/3, 3/3	✅ ✅ ✅
Go Ingestor Tests	✅
Go Libraries & CLI	✅
Verify Go Test Assignments	✅
JavaScript Unit Tests & Lint	✅ (test-heard-by: 8 passed)
Script & Container Unit Checks	✅
Validate Docker Image	✅
Playwright E2E 1/3, 2/3, 3/3	✅ ✅ ✅ (the new E2E ran in 3/3)
Verify E2E Shards & Coverage	✅
Build & Publish Docker Image	✅
Release Artifacts, Deploy Staging, Publish Badges	skipped (PR)

The first run (38567187258, head b3b43778) failed, for two reasons:

• Go Build & Test: eslint no-undef on HeardBy. My omission; 4fea395a addresses it. [T]
• E2E 2/3: the existing test "Explain transmission vs observation counts in node details (upstream #2131) #382 node stats table rows follow the rounded corners in dark theme" failed with overflow ''.
  • This is not flaky: #180 packets URL E2E 'reload shows the same list' depends on fixture age (default 15-min window) #271, so I did not re-run the job.
  • I reproduced it locally as pre-existing on master: with an instrumented frontend (as in shard 2) and 4× CPU throttle, master failed 3/30 and this branch 2/30, always with isConnected=false. The node body re-renders mid-hover; _themeRefreshHandler calls loadFullNode [T][K].
  • The following run on the new head passed it.

The other failures in that run (Verify E2E Shards, Build & Publish) were downstream gates of those two.

Remaining

• Explain transmission vs observation counts in node details (upstream #2131) #382 dark-theme flake (above): the test reads the table across a re-render. It deserves its own issue (query the element again, or wait for the theme refresh). Not changed here. [T]
• Breaking API change: observers is removed from both health endpoints. External clients must move to directObservers / relayObservers. This is documented in OpenAPI and api-spec.md. [K]
• Evidence is advert-only: nodes heard only through non-advert traffic, or whose prefix collides with another relay, get no direct observer. The empty state says that is missing evidence. [A]
• Fixture frames: the CI fixture has no observations.raw_hex values, so the E2E exercises the route-type fallback; the frame-header path is covered by Go tests only. [T]
• Cost under the store read lock: bulk-health takes 2× the time (7.45 ms for 200 nodes); a hub node costs about 34 ns per observation (12 ms at 150K). [T]
• Not changed: /api/nodes/{pubkey}/analytics "observer coverage" still uses representative SNR; it is a different card. [K]
• Not changed: the Live map legend overlay covers part of the node panel on narrow heights. [T]
• A node that is also an observer shows itself under "Heard via relay", since it never receives its own transmission. [T]

[dborup-agent]

Review — CS-pve-agent3 PR#451 — head 4fea395

Dom: APPROVE med nits

Condition: before merge, rebase to resolve the F0 shard-manifest conflict, and get a green CI run.

Independent, read-only review. Evidence tags: [T] = I ran it (test, command, mutant or probe), [K] = I read it in the code or the firmware source, [A] = analysis that I did not execute.

Scope of what I checked: head 4fea395a (3 commits on 94dedd78) and the merged tree git merge-tree --write-tree origin/master 4fea395a = c9248d3b, against origin/master dd003389. That is byte-identical to the tree of the PR merge ref 79a4f8a4 that CI ran on [T]. git ls-remote showed head 4fea395a before and after the review [T].

Master moved to c511966a (#449) during the review. That merge conflicts (see F0). I re-verified the JS side on a scratch resolution of it, described below.

Findings

#	Severity	Finding	Evidence
F0	Merge blocker (mechanical)	Against current origin/master c511966a, git merge-tree reports a content conflict in scripts/e2e-shards.json. #449 appended test-issue-217-packets-full-names-e2e.js at the same spot where this PR appends test-issue-76-heard-by-e2e.js. test-all.sh and test-xss-escape-sinks.js auto-merge. The fix is to rebase or merge master, keep both entries, and rerun CI. I resolved it in a scratch tree by keeping both entries. On that tree: run-e2e-shard.js --validate passes (163 suites), test-ci-shards.js 9/9, sh test-all.sh 252/252, test-frontend-helpers.js 713/713, test-xss-escape-sinks.js 120/120, test-heard-by.js 8/8, and against a local server the #76 E2E 8/8, the #217 E2E 48/48 and xss-333 11/11. #449 changes no Go code, so the Go results below still hold.	[T]
F1	Low (fix recommended, before merge or as a follow-up)	stats.avgSnr still averages the direct receptions of hidden observers. The hidden filter runs in the handlers after the store has computed heard.avgSnr(). If every direct observer of a node is hidden, the response is directObservers: [] with stats.avgSnr: 7.5 (the hidden observer's value). Home, Analytics and Live then show "Direct observers 0" or the "No observation proves a direct reception here" line next to a "Direct SNR 7.5 dB" value. This is not a regression: master had no hidden filter and averaged every representative SNR. No id or name leaks. But it is inconsistent with the new docs ("left out of both lists"). In practice this affects hidden-name-prefix observers and pre-blacklist history, because the ingestor drops blacklisted observers at ingest. A clean fix is to pass the hidden predicate into the accumulator, because the handler cannot recompute the mean (the per-row SNR sample count is not exposed).	[T] probe test in a scratch copy (single /health and store stats); [K] heard_by.go add/avgSnr, routes.go handlers
F2	Nit (test gap)	The Analytics "Most Observed Nodes" tie-break by relay count ("ranks by direct observers, then by relay observers" in the PR body) is not pinned. A mutant that drops || (b.health.heard.relay - a.health.heard.relay) survives test-issue-76-heard-by-e2e.js (8/8), because the E2E only checks that the direct column is non-increasing.	[T] mutant MF1 below
F3	Info	The Go tests are red on master only by a compile error (wireRoute, heardDirect, observationRouteType and wireRouteFromRawHex do not exist there). That is expected for new symbols. The behavioural red-before is the new E2E: 1/8 against a master server on the same fixture, and test-heard-by.js cannot load its module on master. My mutants (below) show that the Go assertions themselves are sensitive.	[T]
F4	Info, owner	A node that is also an observer lists itself under "Heard via relay", because self-uploads are correctly not direct receptions. The label "via relay" is not accurate for that row. The author discloses it. Excluding the row, or labelling it, is a UI choice.	[K] add(); [T] TestHeardBy_SignalOnlyFromDirectReceptions_76 expects the uppercased node key in relayObservers
F5	Info	Theoretical only: a DIRECT advert sent with a path would reach the observer after the last forwarder's removeSelfFromPath as a zero-hop DIRECT copy, and would be credited to the advertiser. Stock firmware sends adverts only via sendFlood/sendFloodScoped or sendZeroHop (simple_repeater/MyMesh.cpp sendSelfAdvertisement), so this needs non-stock senders.	[K] firmware Mesh.cpp 95–103, 334–342, 717–738; [A]

No code-level blocking findings. F0 only needs a rebase plus a green CI run before merge.

The points, one by one (issue #76 decision options, the owner's follow-up comment, and the brief)

Point	Verdict	Evidence
Classification per observation, not from the representative tx: route type from the frame header (#77 observations.raw_hex), else the tx route, unknown on a mixed route_mask (#308)	✅	[K] observationRouteType, StoreObs.wireRoute set on Load, loadChunk, chunked load, IngestNewFromDB and IngestNewObservations. [T] TestHeardDirect_Rule_76 (24 cases), TestObservationRouteType_PerObservation_76, TestHeardBy_MixedRouteTypesPerHash_76, TestWireRoute_SetOnEveryObservationPath_76; my mutants MR3 and MR4 killed
Rule matches the firmware	✅	[K] routeRecvPacket appends the forwarder hash on flood; sendFlood starts with count 0; sendZeroHop (both variants) sets path_len = 0 on DIRECT/TRANSPORT_DIRECT; the direct forward path calls removeSelfFromPath. See F5 for the one theoretical edge
Relay observers counted from all observations	✅	[K] heardByAccumulator.add iterates tx.Observations, and packetCount counts once per tx (r.last != tx; byNode is deduped by hash in indexByNodeKey). [T] TestHeardBy_RelayObserversFromAllObservations_76
SNR/RSSI only on direct rows	✅ (see F1 for stats.avgSnr with hidden observers)	[K] HeardRelayObserver has no signal fields. [T] Go signal test; test-heard-by.js; E2E node page, side panel and Live steps assert no dB/SNR/RSSI on relay rows
#64 health/liveness semantics preserved	✅	[K] updateOwnAdvertActivity and updateIndexedRelayActivityLocked are untouched in both functions, and the last-hop credit reuses relayKeyMatcher. [T] existing TestNodeHealth* pass; test-node-liveness-e2e.js 35/35 against the local server
All consumers consistent: node page, side panel, home "Heard by" and dialog, Analytics "most observers", Live panel	✅ (F2 test gap)	[K] shared public/heard-by.js. [T] new E2E 8/8 covers all five. My frontend mutants MF2 (home dialog "(via relay)" marker) and MF3 (Live observer links) were killed
Hidden identities and blacklists respected	✅ for both lists on both endpoints, ⚠️ F1 for stats.avgSnr	[T] TestHeardBy_HiddenObserversRemoved_76; my mutants MR2, MR7 and MR8 killed; F1 probe
Perf: GetBulkHealth O(observations), measured	✅	[K] one map lookup per observation; advert decode once per tx; pathLastHop only for adverts; accumulator storage reused across bulk nodes; no new lock or background job. [T] BenchmarkHeardBy* on the merged tree, see below
Mixed route types per hash tested with mutants	✅	[T] MR1 (TRANSPORT_FLOOD dropped from the flood case) killed by the rule table; the author's M1/M2 cover frame-wins and mixed-mask
Unit test for classification + E2E in scripts/e2e-shards.json	✅	[T] test-issue-76-heard-by-e2e.js is registered in shard 3, and CI shows it ran there
Empty-state and tooltip wording (evidence, not range; zero-hop documented)	✅	[K] EMPTY_DIRECT text equals the wording the issue quotes; tooltips mention zero-hop DIRECT/TRANSPORT_DIRECT. [T] test-heard-by.js

Always-rules

Rule	Result
Each acceptance criterion has a test that is red before and green after	✅ (see F3: Go red = compile; E2E red = 1/8 behavioural) [T]
At least two own mutants	✅ 11 own mutants, 10 killed, 1 survived (F2) [T]
No behaviour change beyond the purpose	✅ with disclosed items: observers removed (API break); dead Regions line removed (o.iata was never emitted [K]); rows.Close() in GetBulkHealth (the production pool is 4 connections [K], so it was not a production deadlock, only a held connection); Analytics "Best Signal Quality" now ranks only nodes with direct evidence (follows from stats.avgSnr). See "Left for the owner"
No new config / silent product decision	✅ no config, no customizer change [K]. The product-level choices are disclosed in the PR body; I list them below for the owner
cmd/server read-only	✅ no write SQL added [T grep]; readonly_invariant_test passes [T]
No new map[string]interface{} outside tests	✅ production count under cmd/server (non-test) 729 → 725, 0 added lines [T]
No hardcoded colours	✅ no hex or rgb() added in public/; new CSS uses tokens [T]
scripts/check-xss-sinks.sh --diff origin/master	✅ exit 0, and --file is clean on all 5 touched JS files [T]
Fork guards	✅ deploy.yml 9, release-fast-path.yml 1 on head, master and merged tree; .github/ untouched [T]
No closing keywords	✅ title, body and all 3 commit messages [T]
Commit author	✅ all 3 commits authored and committed by dborup <kontakt@meshview.dk> [T]

Tests I ran

On the merged tree c9248d3b, locally:

• [T] cmd/server: go test -count=1 -timeout 90m ./... ok. Under -race, the full package hit Go's default 10-minute test timeout on this 4-core host, which is a timeout and not a test failure. So I ran -race on the relevant subset (-run '_76|Health|1290|321|Bulk|Liveness|NodeActivity|WireRoute|RouteMask|Ingest|Readonly|OpenAPI|Golden|Shape'): 196 tests pass, no DATA RACE.
• [T] cmd/ingestor: go test -count=1 ./... ok (unchanged by this PR).
• [T] BenchmarkHeardBy* (20 iterations × 3): bulk-health 200 nodes 6.8–7.0 ms, 953 KB, 12,154 allocs/op; one node 0.93–1.02 ms; hub node with 150K observations 11.8–12.1 ms. This matches the author's "after" column.
• [T] sh test-all.sh: 251/251 passed (249 on head plus 2 from master).
• [T] node test-frontend-helpers.js: 713/713.
• [T] Local Go server on e2e-fixture.db, prepared as in CI: freshen, the Packets page collapse button in the left column of the table opens the dialog. Kpa-clawbot/CoreScope#1486/"Group Data" message type missing from packet view window's "message type" filter Kpa-clawbot/CoreScope#1791 seed SQL from deploy.yml, corescope-migrate, seeds 2073, 199 and 245. Results:
  • test-issue-76-heard-by-e2e.js 8/8;
  • test-issue-1151 5/5, test-issue-1206 28/28, test-issue-1281 6/6, test-issue-2027 25/25, test-issue-304 pass, test-xss-333-pages-e2e.js 11/11, test-1659-analytics-warmup.js 34/34, test-issue-1147 2/2, test-node-liveness-e2e.js 35/35.
• [T] test-e2e-playwright.js (fail-fast removed in a scratch copy only): 153 ✅ / 7 ⏭ / 1 ❌ on the merged tree, and exactly the same against a master server on the same fixture. The one failure ("Version info lives on Perf dashboard": #navStats wait times out) is environmental on my host and occurs identically on master, so it is unrelated.
• [T] Red-before: test-issue-76-heard-by-e2e.js against a master server on the same fixture: 1/8 (only "no page errors" passes). test-heard-by.js on master crashes loading public/heard-by.js. The Go _76 tests do not compile on master.
• The servers were stopped by port (fuser -k), not $!.

CI per job (run 38570870612, on the merge ref against dd003389, whose tree equals my merged tree; CI has not run against c511966a) [T]: all 15 executed jobs passed: Go Build & Test, Go Server 1/3–3/3, Go Ingestor, Go Libraries & CLI, Verify Go Test Assignments, JS Unit & Lint, Script & Container, Validate Docker Image, Playwright E2E 1/3–3/3, Verify E2E Shards & Coverage, and Build & Publish Docker Image. Release Artifacts, Deploy Staging and Publish Badges were skipped (PR). No known flake (#256, #267) was involved.

Mutants (my own; each applied alone to the merged tree, then reverted)

#	Mutation	Result
MR1	heardDirect: case RouteTransportFlood, RouteFlood → case RouteFlood	killed: TestHeardDirect_Rule_76 (transport flood cases)
MR2	visibleHeardBy: relay list not filtered	killed: TestHeardBy_HiddenObserversRemoved_76 (both endpoints)
MR3	wireRoute not set in Load	killed: TestWireRoute_SetOnEveryObservationPath_76
MR4	wireRoute not set in IngestNewFromDB	killed: same test (live ingest)
MR5	pathLastHop: flat paths report 0 hops	killed: TestHeardDirect_Rule_76 (last-hop cases)
MR6	GetNodeHealth: can_relay always true	killed: TestNodeHealth_CanRelayCaseInsensitive_Issue1290
MR7	hidden filter ignores the recorded observer name	killed: TestHeardBy_HiddenObserversRemoved_76
MR8	bulk handler collects ids for the current-name lookup from the direct list only	killed: same test (bulk relay)
MF1	analytics.js: drop the relay tie-break in "Most Observed"	survived: F2
MF2	home.js: dialog without the "(via relay)" marker	killed: E2E home step
MF3	live.js: Live panel without observer links	killed: E2E Live step

Left for the owner

• API break: observers is removed from /api/nodes/{pubkey}/health and /api/nodes/bulk-health, which affects any external client of the public API. Documented in OpenAPI and docs/api-spec.md, but no deprecation period. This is a release-note and product decision.
• Last-hop prefix credit: the rule credits a flood last hop that is a wire prefix unique among relay-capable nodes. This is the option-B rule. The issue lists its con ("uniqueness is not proof"), and the PR mitigates it by reusing the fix(nodes): separate advert timestamps from confirmed relay activity #64 relayKeyMatcher (and never a listener). Ratify this rule, or ask for the stricter option-C (own adverts only).
• Self-observer row under "Heard via relay" (F4).
• Analytics "Best Signal Quality" now lists only nodes with direct evidence, so it will be sparser than before.
• Deployment effect: bulk health costs about 2× (the author measured 3.6 → 7.5 ms for 200 nodes) under the store read lock. No migration and no config.

Not verified

• I did not run the author's "before" benchmark (master plus rows.Close()), so the 2× ratio is the author's [A]. I only measured "after".
• No browser screenshots or visual check of light/dark or 390 px: E2E assertions only.
• Not tested against real observations.raw_hex in an E2E. The CI fixture has none, so the frame-header path is covered by the Go tests only (as the author notes).
• No staging or production data; no measure of how sparse the direct list is on real data.
• test-a11y-axe-1668.js was not run.

[dborup-agent]

Rapport — CS-pve-agent1 PR#451 master-sync — head 107f96a

Review feedback addressed (commit 107f96a5)

Evidence tags: [T] = I ran it, [K] = I read it in the code, [A] = analysis, not executed.

Findings

1. F0, merge blocker: conflict with master in scripts/e2e-shards.json. Merged origin/master (85538399, after feat(packets): Full Names toggle and better path popover (port of upstream 2090) (#217) #449 and feat(compare): reference-to-many observer comparison over the full window (#122) #450) into the branch with a plain merge commit 98705588. No rebase, amend or force-push. The only conflict was the shard manifest. I took master's version and added test-issue-76-heard-by-e2e.js (shard 3) on top, so master's Feature request: Reference-to-many observer comparison with complete-window packet overlap #122 and Evaluate upstream packet-table sizing, Full Names and path popup improvements (2090) #217 entries and this PR's Node "Heard By" card: decide whether to show direct-RF observers (defer) #76 entry are all kept. test-all.sh and test-xss-escape-sinks.js merged cleanly. [T] run-e2e-shard.js --validate passes (164 suites), test-ci-shards.js 9/9.
2. F1, low (fixed): stats.avgSnr included hidden observers. The hidden filter ran after the store computed the mean, so a node with only hidden direct observers returned directObservers: [] next to a non-null avgSnr. HeardDirectObserver now carries unexported snrSum/snrN (not serialised). The new applyVisibleHeardBy is used by both /health and /bulk-health, and it recomputes the mean over the rows that stay whenever a direct row was removed. Result is null when none stay. [T] Test TestHeardBy_StatsAvgSnrExcludesHiddenObservers_76 (cases: mixed, all hidden; single and bulk) was red first (avgSnr was 7.5 where null was expected; avgSnr was not 3). It is green now. The OpenAPI schema/struct parity test now skips unexported fields.
3. F2, test gap (fixed): "Most Observed" relay tie-break was not pinned. test-issue-76-heard-by-e2e.js now reads the "Via relay" column and asserts that ties on "Direct observers" are ordered by relay, most first. [T] MF1 now fails (tie on 2 direct not ranked by relay). The fixture has such ties.
4. F3, info: Go red-before is a compile error. Agree, nothing to change. The behavioural red-before is the E2E (1/8 on master, per the review).
5. F4, info (owner): a node that is also an observer lists itself under "Heard via relay". Not changed. I agree it is a UI choice, and the PR body already discloses it. I did not make the product decision. Left for the owner.
6. F5, info (theoretical): direct advert with a path. Not changed. Stock firmware does not send it [K, per review]. Disagreement: none. Fixing it would need a rule for non-stock senders, which is out of scope.

Tests

• [T] cmd/server: go test -count=1 ./... ok (42.6 s). cmd/ingestor: ok (222 s).
• [T] sh test-all.sh 253/253. node test-frontend-helpers.js 713/713. test-heard-by.js 8/8. scripts/check-xss-sinks.sh --diff origin/master exit 0.
• [T] Local Go server on a copy of e2e-fixture.db, prepared as in CI (freshen, Packets page collapse button in the left column of the table opens the dialog. Kpa-clawbot/CoreScope#1486 seed, corescope-migrate, seeds 2073, 199, 245, 122): test-issue-76-heard-by-e2e.js 8/8, test-issue-217-packets-full-names-e2e.js 48/48, test-node-liveness-e2e.js 35/35, test-xss-333-pages-e2e.js 11/11.

Mutants (each applied alone, then reverted; all killed)

#	Mutation	Killed by
MF1	analytics.js: drop the relay tie-break	#76 E2E analytics step (was the surviving mutant)
MF1a	applyVisibleHeardBy: never recompute the mean	TestHeardBy_StatsAvgSnrExcludesHiddenObservers_76
MF1b	recompute weights each row once, not by its SNR sample count	same test
MF1c	bulk handler uses visibleHeardBy only (no recompute)	same test (bulk)
MF1d	single handler uses visibleHeardBy only	same test (single)

CI (run 38601747188, head 107f96a5) [T]

Pass: Go Build & Test, Go Ingestor Tests, Go Libraries & CLI, Go Server Tests 1/3, 2/3, 3/3, Verify Go Test Assignments, JavaScript Unit Tests & Lint, Script & Container Unit Checks, Playwright E2E 1/3, 2/3, 3/3, Verify E2E Shards & Coverage, Validate Docker Image, Build & Publish Docker Image. Skipped (PR): Release Artifacts, Deploy Staging, Publish Badges. No flaky test (#271, #301) was involved and no job was rerun.

Rester

• F4 (self-observer row) and F5 are left as described above.
• Owner decisions listed in the review ("Left for the owner": API break, last-hop prefix credit, sparser "Best Signal Quality") are unchanged.
• No browser screenshot or light/dark/390 px check, only E2E assertions.
• The PR is still a draft. No merge, ready or issue close.