fix(security): path-traversal guard on 5 sensing-server endpoints (closes #615) (#616)

Reported by @bannned-bit. Five endpoints in
v2/crates/wifi-densepose-sensing-server embedded user-controlled
identifiers in format!() paths with no sanitization:

  recording.rs       POST   /api/v1/recording/start       (session_name)
  recording.rs       GET    /api/v1/recording/download/:id (id)
  recording.rs       DELETE /api/v1/recording/delete/:id   (id)
  model_manager.rs   POST   /api/v1/models/load           (model_id)
  training_api.rs    load_recording_frames                (dataset_ids[])

Each unauthenticated caller could:
- READ arbitrary files via ../../etc/passwd, ../../.env, etc.
- WRITE attacker-controlled JSONL via recording/start
- LOAD attacker-controlled .rvf model files
- DELETE arbitrary files the server process can touch

New `path_safety` module exports `safe_id(&str) -> Result<&str, PathSafetyError>`
that enforces the rejection envelope BEFORE any user input reaches a
format!() that builds a path:

  - Allowed character set: [A-Za-z0-9._-]
  - Reject leading '.' (rules out '.', '..', '.env', hidden files)
  - Reject empty strings
  - Reject anything > 64 bytes
  - Reject all whitespace, path separators, null bytes, non-ASCII

Applied at all 5 sites. Errors return 400 Bad Request (download) /
status:"error" JSON (others) — not panics.

9 unit tests in path_safety::tests cover:
  - accepts simple alphanumeric / hyphen / underscore / dot
  - rejects empty, leading dot, path separators ('/', '\'),
    null byte, whitespace, shell specials, non-ASCII (including
    fullwidth slash U+FF0F), too-long, boundary at MAX_ID_LEN

  test result: ok. 9 passed; 0 failed
  cargo build -p wifi-densepose-sensing-server --no-default-features: 33s

Fix-marker RuView#615 in scripts/fix-markers.json prevents removing the
guard at any of the 5 call sites. CHANGELOG entry under [Unreleased] /
Security documents the patched endpoints and the rejection envelope.

Severity: critical per reporter — five remotely-reachable paths to read,
write, or delete arbitrary files. Hot per-request paths, not edge cases.

.github/workflows/ci.yml

@@ -33,7 +33,7 @@ jobs:
 
     - name: Set up Python
       continue-on-error: true
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ env.PYTHON_VERSION }}
         cache: 'pip'
@@ -166,7 +166,7 @@ jobs:
 
     - name: Set up Python ${{ matrix.python-version }}
       continue-on-error: true
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ matrix.python-version }}
         cache: 'pip'
@@ -198,7 +198,7 @@ jobs:
 
     - name: Upload coverage reports
       continue-on-error: true
-      uses: codecov/codecov-action@v4
+      uses: codecov/codecov-action@v6
       with:
         file: ./coverage.xml
         flags: unittests
@@ -226,7 +226,7 @@ jobs:
       uses: actions/checkout@v4
 
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ env.PYTHON_VERSION }}
         cache: 'pip'
@@ -285,7 +285,7 @@ jobs:
     - name: Extract metadata
       continue-on-error: true
       id: meta
-      uses: docker/metadata-action@v5
+      uses: docker/metadata-action@v6
       with:
         images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
         tags: |
@@ -296,7 +296,7 @@ jobs:
 
     - name: Build and push Docker image
       continue-on-error: true
-      uses: docker/build-push-action@v5
+      uses: docker/build-push-action@v7
       with:
         context: .
         target: production
@@ -341,7 +341,7 @@ jobs:
       uses: actions/checkout@v4
 
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ env.PYTHON_VERSION }}
         cache: 'pip'

.github/workflows/dashboard-a11y.yml

@@ -34,7 +34,7 @@ jobs:
             --out-dir ../../dashboard/public/nvsim-pkg \
             --release -- --no-default-features --features wasm
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with: { node-version: 20, cache: npm, cache-dependency-path: dashboard/package-lock.json }
 
       - working-directory: dashboard

.github/workflows/dashboard-pages.yml

@@ -57,7 +57,7 @@ jobs:
             -- --no-default-features --features wasm
 
       - name: Setup Node 20
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 20
           cache: npm

.github/workflows/desktop-release.yml

@@ -30,7 +30,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '20'
 
@@ -85,7 +85,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '20'
 

.github/workflows/fix-regression-guard.yml

@@ -23,7 +23,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: '3.11'
 

.github/workflows/nvsim-server-docker.yml

@@ -37,7 +37,7 @@ jobs:
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ghcr.io/ruvnet/nvsim-server
           tags: |
@@ -47,7 +47,7 @@ jobs:
             type=raw,value=latest,enable={{is_default_branch}}
 
       - name: Build + push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: v2
           file: v2/crates/nvsim-server/Dockerfile

.github/workflows/security-scan.yml

@@ -32,7 +32,7 @@ jobs:
 
     - name: Set up Python
       continue-on-error: true
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ env.PYTHON_VERSION }}
         cache: 'pip'
@@ -99,7 +99,7 @@ jobs:
 
     - name: Set up Python
       continue-on-error: true
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ env.PYTHON_VERSION }}
         cache: 'pip'
@@ -170,7 +170,7 @@ jobs:
 
     - name: Build Docker image for scanning
       continue-on-error: true
-      uses: docker/build-push-action@v5
+      uses: docker/build-push-action@v7
       with:
         context: .
         target: production
@@ -197,7 +197,7 @@ jobs:
 
     - name: Run Grype vulnerability scanner
       continue-on-error: true
-      uses: anchore/scan-action@v3
+      uses: anchore/scan-action@v7
       id: grype-scan
       with:
         image: 'wifi-densepose:scan'
@@ -343,7 +343,7 @@ jobs:
 
     - name: Set up Python
       continue-on-error: true
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ env.PYTHON_VERSION }}
         cache: 'pip'

.github/workflows/sensing-server-docker.yml

@@ -68,7 +68,7 @@ jobs:
 
       - name: Compute tags
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             docker.io/ruvnet/wifi-densepose
@@ -81,7 +81,7 @@ jobs:
 
       - name: Build + push
         id: build
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: docker/Dockerfile.rust

.github/workflows/verify-pipeline.yml

@@ -30,7 +30,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -57,7 +57,18 @@ jobs:
           "
 
       - name: Run pipeline verification
-        working-directory: v1
+        working-directory: archive/v1
+        env:
+          # Pin thread count for scipy.fft / BLAS — multi-threaded reduction
+          # order is otherwise non-deterministic across CI runs (issue #560
+          # follow-up: 9- and 6-decimal quantization were not enough because
+          # the divergence is from threading order, not SIMD reordering).
+          # Single-threaded keeps the proof reproducible at a ~2-3x slowdown.
+          OMP_NUM_THREADS: "1"
+          OPENBLAS_NUM_THREADS: "1"
+          MKL_NUM_THREADS: "1"
+          VECLIB_MAXIMUM_THREADS: "1"
+          NUMEXPR_NUM_THREADS: "1"
         run: |
           echo "=== Running pipeline verification ==="
           python data/proof/verify.py
@@ -65,7 +76,13 @@ jobs:
           echo "Pipeline verification PASSED."
 
       - name: Run verification twice to confirm determinism
-        working-directory: v1
+        working-directory: archive/v1
+        env:
+          OMP_NUM_THREADS: "1"
+          OPENBLAS_NUM_THREADS: "1"
+          MKL_NUM_THREADS: "1"
+          VECLIB_MAXIMUM_THREADS: "1"
+          NUMEXPR_NUM_THREADS: "1"
         run: |
           echo "=== Second run for determinism confirmation ==="
           python data/proof/verify.py

.gitignore

@@ -13,6 +13,9 @@ firmware/esp32-csi-node/managed_components/
 firmware/esp32-csi-node/dependencies.lock
 firmware/esp32-csi-node/sdkconfig.defaults.bak
 
+# ESP-IDF set-target backup (local only)
+firmware/esp32-hello-world/sdkconfig.old
+
 # Claude Flow swarm runtime state
 .swarm/
 

CHANGELOG.md

@@ -7,6 +7,40 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+- **Path-traversal vulnerabilities patched in five sensing-server endpoints** (closes #615 — critical). New `wifi_densepose_sensing_server::path_safety::safe_id()` enforces `[A-Za-z0-9._-]` only (no leading `.`, max 64 chars) before any user-controlled identifier reaches a `format!()` building a filesystem path. Applied at:
+  - `POST /api/v1/recording/start` (`recording.rs` — `session_name`)
+  - `GET /api/v1/recording/download/:id` (`recording.rs` — `id`)
+  - `DELETE /api/v1/recording/delete/:id` (`recording.rs` — `id`)
+  - `POST /api/v1/models/load` (`model_manager.rs` — `model_id`)
+  - `training_api.rs` `load_recording_frames` (`dataset_id`s)
+
+  Pre-fix, unauthenticated callers could read `../../etc/passwd`-style paths, write arbitrary JSONL files, load attacker-controlled `.rvf` model files, or delete arbitrary files the server process could touch. 9 unit tests in `path_safety::tests` exercise the rejection envelope (empty, too-long, path separators, parent-dir traversal, null byte, whitespace/specials, non-ASCII).
+
+### Fixed
+- **Proof replay (`archive/v1/data/proof/verify.py`) is now cross-platform deterministic** (closes #560). Three changes together: (1) `features_to_bytes()` now `np.round(.., HASH_QUANTIZATION_DECIMALS=6)`s each feature array before packing as little-endian f64, collapsing ULP-level drift from scipy.fft pocketfft SIMD reordering; (2) the `Verify Pipeline Determinism` workflow pins `OMP_NUM_THREADS=1`, `OPENBLAS_NUM_THREADS=1`, `MKL_NUM_THREADS=1`, `VECLIB_MAXIMUM_THREADS=1`, `NUMEXPR_NUM_THREADS=1` — multi-threaded BLAS reductions were a deeper source of non-determinism than SIMD reordering, and 6-decimal quantization alone wasn't enough across Azure VM microarchitectures; (3) `expected_features.sha256` regenerated under the new conditions. CI now passes the determinism check (same hash across consecutive runs on canonical Linux x86_64 CI runner: `667eb054c44ac510342665bf9c93d608868a8ead948ae8774b2796ebce6f8fe7`). `scripts/probe-fft-platform.py` updated to mirror `HASH_QUANTIZATION_DECIMALS=6` for cross-machine spot-checks.
+- **`archive/v1/src/services/pose_service.py:223` calls the right method on `PhaseSanitizer`** (closes #612). The call was `self.phase_sanitizer.sanitize(phase_data)`, but `PhaseSanitizer`'s full-pipeline entry point is named `sanitize_phase()` (`unwrap_phase` + `remove_outliers` + `smooth_phase` chained, see `archive/v1/src/core/phase_sanitizer.py:266`). The shorter `sanitize` name doesn't exist on the class, so any path that reached this branch raised `AttributeError` and crashed the pose service mid-frame.
+- **`adaptive_classifier.rs:94` no longer panics on NaN feature values** (closes #611).
+  `sorted.sort_by(|a, b| a.partial_cmp(b).unwrap())` returned `None` and panicked
+  whenever a single `NaN` reached the classifier from real ESP32 hardware (silent
+  DSP div-by-zero, empty buffer). One bad frame killed the entire sensing-server
+  process. Swapped for `unwrap_or(Ordering::Equal)`, matching the pattern the
+  same file already used at lines 149-150 and 155. Per-frame hot path; this was
+  a real production crash vector.
+- **`ui/utils/pose-renderer.js` no longer divides by zero** when two render frames land in the same `performance.now()` tick (issue #519 Bug 2). `deltaTime` is now `Math.max(currentTime - lastFrameTime, 1)` before the `1000 / deltaTime` division, capping displayed FPS at 1000 — far above any real render rate, but finite so the EMA `averageFps = averageFps * 0.9 + fps * 0.1` no longer poisons itself to `Infinity` on a single zero-dt tick.
+
+### Removed
+- **Stub crates `wifi-densepose-api`, `wifi-densepose-db`, `wifi-densepose-config`** (closes #578).
+  Each was a single-line doc-comment placeholder with an empty `[dependencies]`
+  section and zero references from any source file or `Cargo.toml`. The names
+  were reserved early for an envisioned REST/database/config split that never
+  materialised; the functionality they would provide is covered today by
+  `wifi-densepose-sensing-server` (Axum REST/WS), per-crate config + CLI args,
+  and the project's real-time-only (no-persistent-state) posture. Removing them
+  from the workspace prevents `cargo` from listing dead crates and shipping
+  empty published artifacts. If any of these names is needed in the future,
+  they can be reintroduced with a real implementation.
+
 ### Added
 - **Real-time CSI introspection / low-latency tap on `wifi-densepose-sensing-server` (ADR-099).**
   New `wifi_densepose_sensing_server::introspection` module wires
@@ -127,6 +161,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   saturation, hyperfine spectroscopy, or pulsed protocols become required.
 
 ### Fixed
+- **WebSocket broadcast handler now handles Lagged events gracefully and sends periodic ping keepalives to prevent dashboard disconnects** —
+  `handle_ws_client` and `handle_ws_pose_client` in `wifi-densepose-sensing-server`
+  were treating `RecvError::Lagged` as a fatal error, causing instant disconnect
+  when clients fell behind the 256-frame broadcast buffer at 10 Hz ingest.
+  Clients would reconnect, immediately lag again, and rapid-cycle every 2–4 s.
+  `Lagged` now continues (drops missed frames, logs debug) rather than breaking.
+  Added 30 s ping keepalive on the sensing handler to prevent proxy idle timeouts.
 - **Ghost skeletons in live UI with multi-node ESP32 setups** (#420, ADR-082) —
   `tracker_bridge::tracker_to_person_detections` documented itself as filtering
   to `is_alive()` tracks but in fact passed every non-Terminated track to the

CLAUDE.md

@@ -14,9 +14,6 @@ Dual codebase: Python v1 (`v1/`) and Rust port (`v2/`).
 | `wifi-densepose-mat` | Mass Casualty Assessment Tool — disaster survivor detection |
 | `wifi-densepose-hardware` | ESP32 aggregator, TDM protocol, channel hopping firmware |
 | `wifi-densepose-ruvector` | RuVector v2.0.4 integration + cross-viewpoint fusion (5 modules) |
-| `wifi-densepose-api` | REST API (Axum) |
-| `wifi-densepose-db` | Database layer (Postgres, SQLite, Redis) |
-| `wifi-densepose-config` | Configuration management |
 | `wifi-densepose-wasm` | WebAssembly bindings for browser deployment |
 | `wifi-densepose-cli` | CLI tool (`wifi-densepose` binary) |
 | `wifi-densepose-sensing-server` | Lightweight Axum server for WiFi sensing UI |
@@ -135,17 +132,14 @@ Crates must be published in dependency order:
 2. `wifi-densepose-vitals` (no internal deps)
 3. `wifi-densepose-wifiscan` (no internal deps)
 4. `wifi-densepose-hardware` (no internal deps)
-5. `wifi-densepose-config` (no internal deps)
-6. `wifi-densepose-db` (no internal deps)
-7. `wifi-densepose-signal` (depends on core)
-8. `wifi-densepose-nn` (no internal deps, workspace only)
-9. `wifi-densepose-ruvector` (no internal deps, workspace only)
-10. `wifi-densepose-train` (depends on signal, nn)
-11. `wifi-densepose-mat` (depends on core, signal, nn)
-12. `wifi-densepose-api` (no internal deps)
-13. `wifi-densepose-wasm` (depends on mat)
-14. `wifi-densepose-sensing-server` (depends on wifiscan)
-15. `wifi-densepose-cli` (depends on mat)
+5. `wifi-densepose-signal` (depends on core)
+6. `wifi-densepose-nn` (no internal deps, workspace only)
+7. `wifi-densepose-ruvector` (no internal deps, workspace only)
+8. `wifi-densepose-train` (depends on signal, nn)
+9. `wifi-densepose-mat` (depends on core, signal, nn)
+10. `wifi-densepose-wasm` (depends on mat)
+11. `wifi-densepose-sensing-server` (depends on wifiscan)
+12. `wifi-densepose-cli` (depends on mat)
 
 ### Validation & Witness Verification (ADR-028)
 

archive/v1/data/proof/expected_features.sha256

@@ -1 +1 @@
-8c0680d7d285739ea9597715e84959d9c356c87ee3ad35b5f1e69a4ca41151c6
+667eb054c44ac510342665bf9c93d608868a8ead948ae8774b2796ebce6f8fe7

archive/v1/data/proof/verify.py

@@ -164,18 +164,44 @@ def frame_to_csi_data(frame, signal_meta):
     )
 
 
+# Quantization precision for cross-platform hash stability (issue #560).
+#
+# The bytes packed below feed SHA-256. Without quantization, the hash diverges
+# across SIMD backends (Intel AVX2/AVX-512 vs ARM NEON vs different x86 micro-
+# architectures in the same CI pool) because scipy.fft's pocketfft kernels
+# reorder vectorized FP operations differently per build. IEEE 754 guarantees
+# per-operation determinism, not associativity under reordering.
+#
+# Empirically: 9 decimals was NOT enough to collapse the divergence — two
+# back-to-back Ubuntu 24.04 / Python 3.11 / scipy 1.17 CI runs landed on
+# different Azure VM microarchitectures (likely Skylake vs Cascade Lake)
+# and produced two different SHA-256s even after np.round(.., 9). The DSP
+# pipeline (preprocess → biquad bandpass → FFT → PSD → variance accumulation)
+# amplifies the ~1e-14 raw FFT divergence by several orders of magnitude
+# downstream — the actual drift at features_to_bytes() input can reach 1e-7
+# or worse.
+#
+# 6 decimals (parts per million) gives ~6 orders of magnitude headroom over
+# observed pipeline-amplified ULP drift and is still far below any meaningful
+# signal change (CSI phase precision is ~1e-3 rad; PSD bins differ by orders
+# of magnitude). Round to this precision, then hash.
+HASH_QUANTIZATION_DECIMALS = 6
+
+
 def features_to_bytes(features):
     """Convert CSIFeatures to a deterministic byte representation.
 
-    We serialize each numpy array to bytes in a canonical order
-    using little-endian float64 representation. This ensures the
-    hash is platform-independent for IEEE 754 compliant systems.
+    Each feature array is quantized to ``HASH_QUANTIZATION_DECIMALS`` decimal
+    places before being packed as little-endian float64. The quantization is
+    what makes the resulting SHA-256 hash actually platform-independent — the
+    raw float values diverge at ULP precision across scipy.fft SIMD backends
+    (issue #560), even though all platforms compute the "correct" answer.
 
     Args:
         features: CSIFeatures instance.
 
     Returns:
-        bytes: Canonical byte representation.
+        bytes: Canonical, quantized byte representation.
     """
     parts = []
 
@@ -189,6 +215,10 @@ def features_to_bytes(features):
         features.power_spectral_density,
     ]:
         flat = np.asarray(array, dtype=np.float64).ravel()
+        # Quantize before packing so SIMD-level FP reordering across
+        # Intel AVX vs Apple Silicon NEON pocketfft kernels does not
+        # leak into the SHA-256 input.
+        flat = np.round(flat, HASH_QUANTIZATION_DECIMALS)
         # Pack as little-endian double (8 bytes each)
         parts.append(struct.pack(f"<{len(flat)}d", *flat))
 

archive/v1/src/middleware/auth.py

@@ -9,6 +9,7 @@ from datetime import datetime, timedelta
 
 from fastapi import Request, Response, HTTPException, status
 from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
+from starlette.middleware.base import BaseHTTPMiddleware
 from jose import JWTError, jwt
 from passlib.context import CryptContext
 
@@ -155,16 +156,17 @@ class UserManager:
         return False
 
 
-class AuthenticationMiddleware:
+class AuthenticationMiddleware(BaseHTTPMiddleware):
     """Authentication middleware for FastAPI."""
-    
-    def __init__(self, settings: Settings):
+
+    def __init__(self, app, settings: Settings):
+        super().__init__(app)
         self.settings = settings
         self.token_manager = TokenManager(settings)
         self.user_manager = UserManager()
         self.enabled = settings.enable_authentication
-    
-    async def __call__(self, request: Request, call_next: Callable) -> Response:
+
+    async def dispatch(self, request: Request, call_next: Callable) -> Response:
         """Process request through authentication middleware."""
         start_time = time.time()
         

archive/v1/src/middleware/rate_limit.py

@@ -11,6 +11,7 @@ from collections import defaultdict, deque
 from dataclasses import dataclass
 
 from fastapi import Request, Response, HTTPException, status
+from starlette.middleware.base import BaseHTTPMiddleware
 from starlette.types import ASGIApp
 
 from src.config.settings import Settings
@@ -299,15 +300,16 @@ class RateLimiter:
         }
 
 
-class RateLimitMiddleware:
+class RateLimitMiddleware(BaseHTTPMiddleware):
     """Rate limiting middleware for FastAPI."""
-    
-    def __init__(self, settings: Settings):
+
+    def __init__(self, app, settings: Settings):
+        super().__init__(app)
         self.settings = settings
         self.rate_limiter = RateLimiter(settings)
         self.enabled = settings.enable_rate_limiting
-    
-    async def __call__(self, request: Request, call_next: Callable) -> Response:
+
+    async def dispatch(self, request: Request, call_next: Callable) -> Response:
         """Process request through rate limiting middleware."""
         if not self.enabled:
             return await call_next(request)

archive/v1/src/services/pose_service.py

@@ -220,7 +220,11 @@ class PoseService:
                 # Apply phase sanitization if we have phase data
                 if hasattr(detection_result.features, 'phase_difference'):
                     phase_data = detection_result.features.phase_difference
-                    sanitized_phase = self.phase_sanitizer.sanitize(phase_data)
+                    # PhaseSanitizer's full-pipeline method is sanitize_phase,
+                    # not sanitize (issue #612). The shorter name was an
+                    # AttributeError waiting to fire on any code path that
+                    # reaches this branch.
+                    sanitized_phase = self.phase_sanitizer.sanitize_phase(phase_data)
                     # Combine amplitude and phase data
                     return np.concatenate([amplitude_data, sanitized_phase])
                 

docker/docker-compose.yml

@@ -9,7 +9,18 @@ services:
     ports:
       - "3000:3000"   # REST API
       - "3001:3001"   # WebSocket
-      - "5005:5005/udp"  # ESP32 UDP
+      # ESP32 UDP. On Linux/macOS this works with multiple ESP32 nodes out of
+      # the box. On Docker Desktop for Windows, multi-source UDP is collapsed
+      # to one source IP at the WSL/Hyper-V boundary, so all-but-one node's
+      # frames are silently dropped (issue #374, #386).
+      #
+      # Windows workaround: change this to "5006:5005/udp" and run the host
+      # relay so every datagram arrives from the same loopback source:
+      #
+      #   python scripts/udp-relay.py --listen-port 5005 --forward-port 5006
+      #
+      # See docs/TROUBLESHOOTING.md §9 for details.
+      - "5005:5005/udp"
     environment:
       - RUST_LOG=info
       # CSI_SOURCE controls the data source for the sensing server.

docs/TROUBLESHOOTING.md

@@ -109,3 +109,75 @@ ssh thyhack@100.90.238.87
 **Symptom:** Plugging into the right USB-C port (when facing the board with USB-C toward you) shows no serial device on the host.
 
 **Fix:** Use the left USB-C port. On most ESP32-S3-DevKitC boards, the left port is the USB-to-UART bridge (CP2102/CH340) used for flashing and serial monitor. The right port is the native USB (USB-JTAG) which requires different drivers and isn't used by the RuView firmware.
+
+---
+
+## 9. Docker Desktop on Windows drops UDP from multiple ESP32 nodes
+
+**Symptom:** Two or more ESP32 nodes are flashed, provisioned, and visibly transmit on the network — `tcpdump`/Wireshark on the Windows host shows datagrams from every node — but inside the Docker container only one source IP arrives. `/api/v1/sensing/latest` shows a single node and the live UI freezes or only tracks one body. Reported in #374 (4-node bench) and reproduced in #386 (6-node demo, RuView v0.7.0).
+
+**Root cause:** Docker Desktop on Windows runs the engine inside a WSL2 / Hyper-V VM. Inbound UDP from the host LAN is forwarded through `vpnkit` / `vEthernet` and the multi-source-IP datagrams are demultiplexed onto a single virtual socket. The first source-IP "wins"; subsequent unique sources are silently dropped at the VM boundary. This is a Docker Desktop limitation, not a sensing-server bug — `host.docker.internal` and `--network host` do not help (host networking is not implemented for the Linux engine on Windows).
+
+**Fix:** Run the bundled UDP relay on the host so every forwarded datagram arrives from the same loopback source IP, which Docker passes through unchanged.
+
+```powershell
+# 1. Start the relay (PowerShell or any terminal)
+python scripts/udp-relay.py --listen-port 5005 --forward-port 5006
+
+# 2. Edit docker/docker-compose.yml — change the ESP32 UDP mapping from
+#       - "5005:5005/udp"
+#    to
+#       - "5006:5005/udp"
+
+# 3. Bring the stack up
+docker compose -f docker/docker-compose.yml up
+```
+
+ESP32 nodes still target the host on `--target-ip <host>:5005` — no firmware re-provisioning is needed. The relay is `scripts/udp-relay.py` (stdlib only, no extra deps). Verify with `--verbose` that each node's source IP appears at least once before forwarding stabilises on a single ephemeral relay port.
+
+**Prevention:** Linux and macOS hosts are unaffected; the relay only needs to run on Docker Desktop for Windows. If Docker Desktop ships per-source UDP forwarding (tracked at [docker/for-win#1144](https://github.com/docker/for-win/issues/1144) and related), this workaround can be retired.
+
+**Prior art:** PR #413 (`txhno`) proposed a docs-only writeup of the same workaround; this entry supersedes it.
+
+---
+
+## 10. `404` on the visualization page when running sensing-server
+
+**Symptom:** `sensing-server` starts cleanly, logs `HTTP server listening on http://localhost:3000`, but loading `http://localhost:3000/` (or `/ui/index.html`) returns `404 Not Found`. Reported in #188.
+
+**Root cause:** The default `--ui-path ../../ui` is resolved relative to the binary's *current working directory*, not the binary location. When the binary is launched from anywhere other than `crates/wifi-densepose-sensing-server/`, the relative path doesn't reach the UI assets and Axum's static file handler returns 404.
+
+**Fix:** Pass an absolute UI path, run the binary from the crate directory, or use the Docker image (which bundles the UI under `/app/ui`).
+
+```bash
+# Option A — absolute path (recommended for production)
+sensing-server --source esp32 --udp-port 5005 --http-port 3000 \
+  --ws-port 3001 --ui-path /absolute/path/to/ui
+
+# Option B — run from the crate dir (works for local dev / cargo run)
+cd v2/crates/wifi-densepose-sensing-server
+cargo run -- --source esp32
+
+# Option C — Docker (no path config needed)
+docker compose -f docker/docker-compose.yml up sensing-server
+```
+
+**Prevention:** Track future work in #188 to fall back to a path resolved relative to the executable when the cwd-relative path doesn't exist, so the binary works regardless of where it's launched.
+
+---
+
+## 11. Boot loop on `--edge-tier 1` or `--edge-tier 2`
+
+**Symptom:** ESP32-S3 boots normally with `--edge-tier 0`, but flashing the same firmware with `--edge-tier 1` or `2` produces a boot loop. Serial output reaches `cpu_start` and `heap_init`, then resets repeatedly. Reported in #438 against firmware `v0.4.3.1-esp32-3-g66e2fa083-dir`.
+
+**Root cause:** Edge tiers 1 and 2 enable the on-device DSP pipeline on Core 1. In the affected build, the `edge_dsp` task ran a tight per-frame loop without yielding, so the FreeRTOS task watchdog tripped on Core 1 and panicked. Tier 0 is passthrough only and doesn't activate the pipeline, so the watchdog never fires there.
+
+**Fix:** Flash the [v0.4.3.1-esp32](https://github.com/ruvnet/RuView/releases/tag/v0.4.3.1-esp32) release or later — the DSP task yield fixes have shipped on `main` since the build in the report.
+
+```bash
+# Verify what version you're on (look for "App version" in serial output on boot)
+python -m serial.tools.miniterm COM7 115200
+# Expect: "App version: v0.4.3.1-esp32" or higher
+```
+
+If the boot loop persists on a release build, capture a full serial trace including the watchdog backtrace and reopen #438 with the new build hash.

docs/adr/ADR-098-evaluate-midstream-fit.md

@@ -0,0 +1,191 @@
+# ADR-098: Evaluate `ruvnet/midstream` for RuView's CSI / WebSocket / mesh pipeline
+
+| Field | Value |
+|-------|-------|
+| **Status** | Rejected (with crate-level carve-outs for future evaluation) |
+| **Date** | 2026-05-13 |
+| **Deciders** | ruv |
+| **Codename** | **midstream-in-RuView** |
+| **Relates to** | ADR-095 (rvCSI platform), ADR-096 (rvCSI crate topology), ADR-097 (adopt rvCSI as RuView's CSI runtime), ADR-012 (ESP32 CSI mesh), ADR-029 (RuvSense multistatic / TDM), ADR-031 (RuView sensing-first RF mode), ADR-043 (sensing-server UI API completion) |
+| **midstream repo** | [github.com/ruvnet/midstream](https://github.com/ruvnet/midstream) — vendored at `vendor/midstream`, currently pinned at [`30fe5eb`](https://github.com/ruvnet/midstream/commit/30fe5eb7a1f1494aa1ad00d54160088a565ec766) |
+| **Outcome** | Do **not** adopt as a system component. Two of midstream's six workspace crates (`temporal-compare`, `nanosecond-scheduler`) are plausible future-use building blocks; the rest do not fit. `vendor/midstream` is retained as a reference-only submodule. |
+
+---
+
+## 1. Context
+
+`vendor/midstream` is a git submodule of RuView (`.gitmodules:1-4`) but, like `vendor/rvcsi` was before ADR-097, it is **vendored but not consumed**: no `v2/crates/*/Cargo.toml` depends on a `midstreamer-*` crate, no Rust source contains `use midstreamer_…`, and the ESP32 firmware and TypeScript dashboard have no midstream imports.
+
+This ADR settles the standing question of *whether RuView should consume midstream at all*, and if so, where. The user-facing prompt enumerated four candidate seams to evaluate:
+
+1. Streaming / pub-sub for the WebSocket fan-out (today: `tokio::sync::broadcast::channel::<String>(256)` at `v2/crates/wifi-densepose-sensing-server/src/main.rs:4769`).
+2. Stream processing for the CSI → DSP → event pipeline (today: synchronous `EventPipeline` at `vendor/rvcsi/crates/rvcsi-events/src/pipeline.rs`, freshly adopted via ADR-097).
+3. Multi-source merging / TDM coordination for the ESP32 mesh (ADR-029, ADR-073).
+4. Backpressure / flow control between the UDP receiver and downstream consumers (`v2/crates/wifi-densepose-sensing-server/src/main.rs:3638` `udp_receiver_task`; firmware-side `stream_sender` ENOMEM backoff at `firmware/esp32-csi-node/main/csi_collector.c:223-228`).
+
+To evaluate each, we read midstream's workspace `Cargo.toml` (`vendor/midstream/Cargo.toml:1-99`), the `README.md` and `BENCHMARKS_SUMMARY.md`, and every crate's `lib.rs`:
+
+| Crate | File | LOC | Purpose (from header doc) |
+|---|---|---:|---|
+| `midstreamer-temporal-compare` | `vendor/midstream/crates/temporal-compare/src/lib.rs:1-697` | 697 | DTW, LCS, Levenshtein, generic pattern matching on `Sequence<T>` of `TemporalElement<T>` |
+| `midstreamer-scheduler` | `vendor/midstream/crates/nanosecond-scheduler/src/lib.rs:1-406` | 406 | Priority + deadline-aware task scheduler (RM, EDF, LLF) for low-latency real-time tasks |
+| `midstreamer-attractor` | `vendor/midstream/crates/temporal-attractor-studio/src/lib.rs:1-482` | 482 | Phase-space reconstruction, Lyapunov exponents, attractor classification |
+| `midstreamer-neural-solver` | `vendor/midstream/crates/temporal-neural-solver/src/lib.rs:1-509` | 509 | LTL / CTL / MTL temporal-logic verification with neural reasoning |
+| `midstreamer-strange-loop` | `vendor/midstream/crates/strange-loop/src/lib.rs:1-496` | 496 | Multi-level meta-learning, self-referential systems |
+| `midstreamer-quic` | `vendor/midstream/crates/quic-multistream/src/lib.rs:1-255`, `native.rs:1-303`, `wasm.rs:1-307` | 865 | Thin wrapper over `quinn` (native) and `WebTransport` (WASM); generic QUIC streams |
+
+Plus a TypeScript layer (`vendor/midstream/npm/`, `vendor/midstream/npm-wasm/`) whose product is "real-time LLM streaming" — OpenAI Realtime API client, RTMP / WebRTC / HLS for video, an in-console dashboard, a Whisper transcription scaffold, an MCP server for LLM agents.
+
+The top-level identity is unambiguous: `Cargo.toml:16` describes the package as **`"Real-time LLM streaming with inflight analysis"`**, and the README (`vendor/midstream/README.md:45-80`) frames midstream as a platform that "analyzes [LLM] responses **as they stream in real-time** — enabling instant insights, pattern detection, and intelligent decision-making" — i.e. the streaming domain is **LLM tokens and dashboard telemetry**, not RF signals. A search for any of `csi`, `wifi`, `sensing`, or `sensor` across `vendor/midstream/crates/*/src/*.rs` returns zero hits.
+
+This shapes the conclusion: midstream's *abstractions* (DTW pattern matching, attractor analysis, LTL verification, meta-learning) were chosen for a fundamentally different problem domain than CSI, and its *transport* (QUIC) is a thin `quinn` wrapper rather than a sensing-aware backplane. The candidate seams enumerated above are either already filled by simpler primitives in RuView, or filled better by rvCSI under ADR-097.
+
+### 1.1 What this ADR is *not*
+
+- Not a judgment on midstream's quality. It has 139 passing tests and clean Rust; it is well-engineered for its target domain.
+- Not a decision to drop `vendor/midstream`. The submodule pin is cheap to keep, and the carve-outs in §3 may justify revisiting it.
+- Not a position on the *standalone* midstream product (LLM streaming, OpenAI Realtime, dashboards). That product is unaffected by this ADR.
+
+---
+
+## 2. Decision
+
+**Reject midstream as a system component of RuView.** The four candidate seams are either filled (well) by existing RuView primitives, or are filled by rvCSI's freshly-adopted `EventPipeline` and `RfMemoryStore`. The eight decisions below are the architectural contract.
+
+### D1 — Streaming / pub-sub for the WebSocket fan-out: no change
+
+RuView's sensing-server currently fans out updates to WebSocket clients via `tokio::sync::broadcast::channel::<String>(256)` (`v2/crates/wifi-densepose-sensing-server/src/main.rs:4769`). midstream offers no equivalent in-process broadcast primitive — its TypeScript dashboard fan-out is HTTP-server based (`vendor/midstream/npm/src/dashboard.ts`), and its Rust `midstreamer-quic` crate is a generic point-to-point QUIC wrapper (`vendor/midstream/crates/quic-multistream/src/native.rs:31-69`), not a pub-sub bus.
+
+Tokio's `broadcast` channel is the standard Rust idiom for this pattern, costs effectively nothing per subscriber, integrates with the rest of the Axum + Tokio stack already in use (`v2/crates/wifi-densepose-sensing-server/src/main.rs:36,47`), and is what `rvcsi-runtime` itself uses for event distribution (`vendor/rvcsi/crates/rvcsi-runtime/src/lib.rs`). **Keep `tokio::sync::broadcast`.**
+*Consequences:* zero migration; zero new dependency surface; the WebSocket handlers at `main.rs:1989,2030` continue to work unchanged.
+
+### D2 — CSI → DSP → event pipeline: stay on rvCSI's `EventPipeline`
+
+ADR-097 D2 just adopted `rvcsi-runtime::CaptureRuntime` + `rvcsi_events::EventPipeline` as the CSI ingestion / DSP / event-extraction path. `EventPipeline` is **deterministic, synchronous, single-frame-at-a-time** (`vendor/rvcsi/crates/rvcsi-events/src/pipeline.rs:1-5`: *"Feed it frames with `EventPipeline::process_frame` and drain the tail with `EventPipeline::flush`"*) — and that determinism is load-bearing for ADR-095 D9 (replayability) and ADR-095 D13 (quality scoring against learned baselines).
+
+midstream's stream-processing primitives are designed for the opposite shape: `temporal-attractor-studio` (phase-space reconstruction, Lyapunov exponents) and `temporal-neural-solver` (LTL formula verification) operate on **trajectories** of multi-dimensional states over hundreds-to-thousands of samples (`vendor/midstream/README.md:528-531`: *"Attractor detection: <5ms for 1000-point series"*) — that is closer to RuView's existing RuvSense modules (`v2/crates/wifi-densepose-signal/src/ruvsense/longitudinal.rs`, `intention.rs`) than to anything the runtime DSP layer needs.
+
+Replacing rvCSI's event detectors with midstream constructs would (a) break determinism, (b) re-introduce a parallel CSI-processing implementation — exactly the duplication ADR-097 was opened to remove — and (c) force RuView to invent a `Sequence<T: temporal-compare::TemporalElement>` shim around `CsiFrame` for marginal benefit. **Stay on `rvcsi-events::EventPipeline`.**
+*Consequences:* the determinism / replay guarantees of ADR-095 D9 and ADR-097 D6 remain intact; the work to land `rvcsi-adapter-esp32` (ADR-097 D4, P3) is not duplicated.
+
+### D3 — TDM / multi-source merging: stay on the existing aggregator
+
+The ESP32 mesh's multi-source merging is in `v2/crates/wifi-densepose-hardware/src/aggregator/mod.rs:74-220` — a `UdpSocket`-backed aggregator (`mod.rs:74,85`) that receives parsed `CsiFrame`s from N nodes and forwards them on a `SyncSender<CsiFrame>` to the consumer. The TDM coordination (slot assignment, channel hopping, dwell time) lives in firmware (`firmware/esp32-csi-node/main/`) and is governed by ADR-029 and ADR-073. midstream offers nothing for either side: it has no UDP merger, no slot scheduler, and no firmware-side primitives.
+
+`midstreamer-scheduler` is conceptually adjacent — it does priority + deadline-aware scheduling (`vendor/midstream/crates/nanosecond-scheduler/src/lib.rs:53-63`: `RateMonotonic`, `EarliestDeadlineFirst`, `LeastLaxityFirst`, `FixedPriority`) — but its target is **in-process tokio tasks on a 4-thread executor** (`vendor/midstream/README.md:466-477`: *"4 worker threads"*, *"<50 ns scheduling latency"*), not the cross-device, wall-clock-anchored TDM that RuvSense needs. **Keep the existing `wifi-densepose-hardware` aggregator and firmware-side TDM.**
+*Consequences:* ADR-029 stays as-is; the work to migrate the parser to `rvcsi-adapter-esp32` (ADR-097 D4) is unaffected.
+
+### D4 — UDP receiver backpressure / flow control: existing solutions are correct at each end
+
+There are two distinct backpressure problems in RuView, and neither benefits from midstream:
+
+- **Firmware side (`firmware/esp32-csi-node/main/csi_collector.c:64,223-228`):** lwIP pbuf exhaustion produces `ENOMEM` when the ESP32 tries to UDP-send faster than the network drains. The fix in code is a rate-limit on `stream_sender_send` *inside the CSI callback*. This is a C-level firmware concern with no Rust analogue — midstream cannot run on the ESP32.
+- **Host side (`v2/crates/wifi-densepose-sensing-server/src/main.rs:3638-3640`, `4769`):** `udp_receiver_task` reads from `UdpSocket` and pushes onto `broadcast::channel::<String>(256)`. The bounded channel is itself the backpressure mechanism: lagged subscribers see `RecvError::Lagged`, the buffer wraps, no producer ever blocks. The 256-slot capacity is sized to one second of frame envelopes at the target rate; the per-second packet-yield collapse symptom (`adaptive_controller_decide.c:26-28`) is detected and surfaced by ADR-039 / ADR-081's `pkt_yield_per_sec` accessor, not by transport-layer flow control.
+
+midstream's `quic-multistream` provides per-stream prioritization (`vendor/midstream/crates/quic-multistream/src/native.rs:1-303`), which is a useful flow-control primitive *for QUIC* but not for the UDP-CSI / WS-fan-out topology RuView actually uses. Adopting QUIC end-to-end would mean (a) replacing the ESP32's UDP sender — which would need a QUIC stack on a memory-constrained Xtensa MCU and is out of scope for this project — or (b) terminating QUIC at the aggregator only, which provides no benefit the current bounded `broadcast` channel doesn't. **Keep the existing two-tier backpressure.**
+*Consequences:* the ENOMEM rate-limit at `csi_collector.c:223-228` and the bounded `broadcast::channel::<String>(256)` at `main.rs:4769` continue to be the load-bearing primitives.
+
+### D5 — Carve-out: `temporal-compare` as a future RuvSense-side building block
+
+`midstreamer-temporal-compare` (`vendor/midstream/crates/temporal-compare/src/lib.rs:1-697`) is a clean DTW / LCS / Levenshtein implementation with an LRU cache. RuView's gesture detector at `v2/crates/wifi-densepose-signal/src/ruvsense/gesture.rs` already does DTW template matching, and the longitudinal analysis at `ruvsense/longitudinal.rs` could plausibly benefit from cached pattern matching. If we ever need a *separate* DTW implementation that is decoupled from RuvSense's internal types, `temporal-compare` is a reasonable starting point — but only if and when that need arises.
+
+We **do not adopt it today** because RuvSense's gesture matcher already exists, works, and uses RuView-native types, and pulling in `dashmap`, `lru`, and a generic `TemporalElement<T>` abstraction would be net-negative right now. **Tracked as a future evaluation, not a decision.**
+*Consequences:* zero today; one named option for a future ADR if a "second" DTW pattern appears.
+
+### D6 — Carve-out: `nanosecond-scheduler` for *host-side* edge tier scheduling (future)
+
+If ADR-039's edge-intelligence tier scheduling ever moves from the ESP32 onto a host-side coordinator (e.g. a Raspberry Pi running the cluster aggregator), `nanosecond-scheduler`'s deadline-aware policies (`vendor/midstream/crates/nanosecond-scheduler/src/lib.rs:53-63`) could plausibly host that scheduler. Today the scheduling is firmware-side and the C-level RTOS handles it; there is nothing to schedule in Rust at the granularity midstream offers.
+
+Again: **not a current decision, just an option kept open.**
+*Consequences:* zero today.
+
+### D7 — Submodule disposition: keep `vendor/midstream`
+
+`vendor/midstream` is one git submodule pin; the build does not depend on it; it does not slow down `cargo build --workspace`; and the carve-outs in D5/D6 leave the door open. Removing the submodule would also remove the reference material that justified the carve-outs.
+
+**Keep the submodule, no per-release pin advancement.** Unlike `vendor/rvcsi` (whose pin is bumped per RuView release under ADR-097 D7), `vendor/midstream` has no in-build consumer to validate against. If D5 or D6 ever activates, *that* ADR will start the per-release pin process. Until then the pin can drift freely.
+*Consequences:* one line of `.gitmodules` (`.gitmodules:1-4`) stays; `git submodule update --init` remains a no-op for normal RuView development.
+
+### D8 — Documentation: cross-reference, don't import
+
+The ADR index (`docs/adr/README.md`) gets ADR-098 added under "Architecture and infrastructure". No other docs are updated. The README on the RuView side is untouched; midstream is not part of the RuView platform story.
+*Consequences:* one row added to the ADR index; no churn elsewhere.
+
+---
+
+## 3. Why not adopt (the rejection record)
+
+For institutional memory, the table below records what each midstream crate *would* solve and the alternative RuView already uses. This is the answer to "but we vendored midstream — what is it for?"
+
+| midstream crate | Plausible RuView seam | Already filled by | Verdict |
+|---|---|---|---|
+| `midstreamer-temporal-compare` (DTW, LCS, Levenshtein) | Gesture template matching (`ruvsense/gesture.rs`); longitudinal biomechanics drift | RuvSense's existing DTW gesture matcher | Carve-out only (D5) — not adopted today |
+| `midstreamer-scheduler` (nanosecond priority + deadline) | ESP32 edge-tier scheduling (ADR-039); RuvSense TDM (ADR-029) | Firmware-side RTOS (ESP32); ADR-029's wall-clock-anchored TDM | Carve-out only (D6) — wrong scope today |
+| `midstreamer-attractor` (Lyapunov, phase-space) | RF-field stability detection in `ruvsense/field_model.rs`, `longitudinal.rs` | Welford stats + biomechanics drift (longitudinal.rs); SVD eigenstructure (field_model.rs) | Not adopted — RuvSense's approach is calibrated to RF signal scale and the project's existing dataset, not generic dynamical-systems theory |
+| `midstreamer-neural-solver` (LTL / CTL / MTL verification) | Adversarial signal detection (`ruvsense/adversarial.rs`); coherence-gate decisions | Multi-link consistency checks (adversarial.rs); `coherence_gate.rs` state machine | Not adopted — RuView's adversarial detector is not a formal-verification problem; it's a multi-link physical-consistency check |
+| `midstreamer-strange-loop` (meta-learning, self-modification) | None in RuView's scope | RuView is not a self-modifying learner; AETHER (ADR-024) is contrastive embedding, not meta-learning | Not adopted — out of scope |
+| `midstreamer-quic` (QUIC native + WASM) | Sensing-server → external client transport (alternative to WS) | `tokio::sync::broadcast` + Axum WebSocket + UDP (`main.rs:36-47, 4769, 1989, 2030, 3638`) | Not adopted — see D1, D4 |
+
+The shape of the rejection is consistent: **midstream's abstractions are LLM-token / dashboard-telemetry shaped, RuView's pipeline is RF-frame / event-detector shaped.** Where the two share vocabulary ("streaming", "temporal", "real-time"), the implementations diverge sharply — and the case-by-case analysis above shows that the closer one looks at each seam, the worse the fit gets.
+
+---
+
+## 4. Consequences
+
+**Positive**
+
+- Zero net change to RuView's build, runtime, or surface area; ADR-097's phased rvCSI adoption proceeds unaffected.
+- The decision space around midstream is now bounded and documented; future contributors and AI agents see "ADR-098 already evaluated this; here is why not" before re-opening the question.
+- The two crate-level carve-outs (D5, D6) are explicit, so if the relevant seams appear later, the evaluation can pick up from this ADR rather than start over.
+- `vendor/midstream` (the submodule) remains as reference material, but is correctly marked as not part of the build path.
+
+**Negative / costs**
+
+- One more vendored repo with no in-build consumer — a small but non-zero cognitive load (mitigated by D7's explicit "do not bump the pin").
+- If midstream's published crates evolve materially (e.g. a CSI-aware feature lands), the reasoning in §3 needs revisiting; this is the standard "rejected ADRs go stale" risk and applies to every Rejected ADR in the index.
+
+**Risks**
+
+- The most plausible failure mode of this ADR is *not* "we should have adopted midstream"; it is "we re-open the question in six months without re-reading this ADR." Mitigated by indexing ADR-098 in `docs/adr/README.md` and by the per-crate table in §3 being precise enough to short-circuit the next evaluator.
+
+---
+
+## 5. Alternatives considered
+
+| Alternative | Why not |
+|---|---|
+| **Adopt midstream wholesale as RuView's streaming backbone** | Would force the CSI pipeline into the `Sequence<TemporalElement>` shape (`vendor/midstream/crates/temporal-compare/src/lib.rs:42-70`) and the `quic-multistream` transport (`vendor/midstream/crates/quic-multistream/src/native.rs:1-303`) — both are designed for LLM tokens / arbitrary streams, not validated RF frames with quality scoring. Conflicts directly with ADR-095 D5 (one `CsiFrame` schema), D6 (validate before crossing boundaries), and D9 (deterministic replay). |
+| **Replace `tokio::sync::broadcast` with midstream's QUIC fan-out** | Solves no observed problem. `broadcast::channel::<String>(256)` at `v2/crates/wifi-densepose-sensing-server/src/main.rs:4769` handles N WebSocket subscribers at zero per-subscriber cost; the lagged-subscriber semantics (`RecvError::Lagged`) are exactly what an event-feed wants. QUIC adds TLS + congestion control + per-stream priority — useful for *external* clients across a network, but the sensing-server's clients connect over WS on the same host or LAN. |
+| **Replace `EventPipeline` with `temporal-attractor-studio` / `temporal-neural-solver`** | `EventPipeline` is deterministic by contract (`vendor/rvcsi/crates/rvcsi-events/src/lib.rs:20`) and ADR-097 just made it RuView's event source of truth. Attractor analysis and LTL verification operate on entirely different abstractions; using them as event detectors would re-invent rvCSI's pipeline in a less-determined way. |
+| **Adopt `midstreamer-temporal-compare` for gesture detection now** | RuvSense already has a working DTW gesture matcher tuned to CSI signal scale. Swapping it for a generic `TemporalElement<T>` matcher buys cleanliness but costs a re-tune and a new dep tree (`dashmap`, `lru`). Tracked as D5 for if/when a *second* DTW use case shows up. |
+| **Adopt `midstreamer-scheduler` for the cluster-Pi aggregator** | The cluster aggregator does not currently exist as a real-time scheduler; ADR-039's tier scheduling is firmware-side. Until the host-side schedule appears, importing a deadline-aware scheduler is solution-looking-for-a-problem. Tracked as D6. |
+| **Drop the `vendor/midstream` submodule entirely** | Cheap to keep, useful as the reference material this ADR cites. D7 keeps it on the explicit understanding that the pin is not advanced. |
+
+---
+
+## 6. Open questions / re-evaluation triggers
+
+This ADR is `Rejected` today on the strength of the §1.1 / §3 analysis. The following events would justify re-opening it:
+
+1. **A second DTW / LCS / Levenshtein use case appears in RuView** (e.g. a CLI-side replay diff, a regression test fixture that needs sequence alignment, a TUI for pattern playback). Then re-evaluate `midstreamer-temporal-compare` per D5.
+2. **A host-side real-time scheduler enters RuView's scope** (e.g. the cluster-Pi aggregator becomes responsible for slot timing instead of the ESP32 firmware). Then re-evaluate `midstreamer-scheduler` per D6.
+3. **midstream ships a CSI-aware adapter or RF-scale `Sequence<T>` extension** — i.e. midstream's own scope grows to include sensing primitives. As of the pinned commit (`30fe5eb`), this has not happened (zero matches for `csi|wifi|sensing|sensor` in `vendor/midstream/crates/*/src/*.rs`).
+4. **RuView gains a QUIC-to-external-client requirement** that the WS fan-out cannot service (e.g. a mobile client over a lossy link that benefits from QUIC's stream priority + 0-RTT). Then re-evaluate `midstreamer-quic` per D1 / D4.
+
+If none of these triggers fire, this ADR stays Rejected and the carve-outs (D5, D6) remain optional.
+
+---
+
+## 7. References
+
+- [ADR-095 — rvCSI Edge RF Sensing Platform](ADR-095-rvcsi-edge-rf-sensing-platform.md) — sets the single-`CsiFrame` schema, deterministic replay, and quality-scoring constraints that midstream's abstractions conflict with.
+- [ADR-096 — rvCSI Crate Topology, the napi-c Shim, the napi-rs Surface](ADR-096-rvcsi-ffi-crate-layout.md) — the crate topology that rvCSI fills the candidate seams with.
+- [ADR-097 — Adopt rvCSI as RuView's primary CSI runtime](ADR-097-adopt-rvcsi-as-ruview-csi-runtime.md) — phased adoption (P1-P5) that this ADR explicitly does not duplicate.
+- [ADR-012 — ESP32 CSI Sensor Mesh](ADR-012-esp32-csi-sensor-mesh.md) — the multi-source TDM context for D3.
+- [ADR-029 — RuvSense Multistatic Sensing Mode](ADR-029-ruvsense-multistatic-sensing-mode.md) — the wall-clock-anchored TDM that `midstreamer-scheduler` is the wrong shape for.
+- [ADR-039 — ESP32 Edge Intelligence Pipeline](ADR-039-esp32-edge-intelligence.md) — the firmware-side tier scheduling that would need to move host-side before D6 activates.
+- [`github.com/ruvnet/midstream`](https://github.com/ruvnet/midstream) — 5 published crates on crates.io (`temporal-compare`, `nanosecond-scheduler`, `temporal-attractor-studio`, `temporal-neural-solver`, `strange-loop`) + 1 local crate (`quic-multistream`); 139 passing tests.
+- `vendor/midstream` (submodule) — pinned at `30fe5eb` (`vendor/midstream/Cargo.toml:16` describes the package as *"Real-time LLM streaming with inflight analysis"*).
+- RuView code paths cited in §1: `v2/crates/wifi-densepose-sensing-server/src/main.rs:36,47,1989,2030,3638-3640,4769`; `v2/crates/wifi-densepose-hardware/src/aggregator/mod.rs:74-220`; `firmware/esp32-csi-node/main/csi_collector.c:64,223-228`; `firmware/esp32-csi-node/main/adaptive_controller_decide.c:26-28`.
+- RuvSense code paths cited in §3: `v2/crates/wifi-densepose-signal/src/ruvsense/gesture.rs`, `longitudinal.rs`, `field_model.rs`, `adversarial.rs`, `coherence_gate.rs`.
+- rvCSI code paths cited in §2: `vendor/rvcsi/crates/rvcsi-events/src/lib.rs:1-37`, `vendor/rvcsi/crates/rvcsi-events/src/pipeline.rs:1-5`.

docs/adr/README.md

@@ -108,6 +108,7 @@ Statuses: **Proposed** (under discussion), **Accepted** (approved and/or impleme
 | [ADR-095](ADR-095-rvcsi-edge-rf-sensing-platform.md) | rvCSI — Edge RF Sensing Runtime Platform | Proposed |
 | [ADR-096](ADR-096-rvcsi-ffi-crate-layout.md) | rvCSI — Crate Topology, the napi-c Shim, and the napi-rs Node Surface | Proposed |
 | [ADR-097](ADR-097-adopt-rvcsi-as-ruview-csi-runtime.md) | Adopt rvCSI as RuView's primary CSI runtime (phased adoption) | Proposed |
+| [ADR-098](ADR-098-evaluate-midstream-fit.md) | Evaluate `ruvnet/midstream` for RuView's CSI / WebSocket / mesh pipeline | Rejected |
 | [ADR-099](ADR-099-midstream-introspection-tap.md) | Adopt midstream as RuView's real-time introspection + low-latency tap | Proposed |
 
 ---

docs/tutorials/pi5-cluster-cognitive-rf-observer.md

@@ -0,0 +1,466 @@
+# Pi 5 + Hailo Cluster: Building a Cognitive RF Observer with rvcsi
+
+A field-tested tutorial for turning a 4-node Raspberry Pi 5 cluster into a
+multistatic Wi-Fi CSI cognitive RF observer that learns room states,
+predicts the next one, and flags anomalies — entirely from radio.
+
+**Estimated time:** 4–6 hours (hardware 1h, firmware 1h, software 1h, calibration 1–3h)
+
+**What you will build:** A self-learning 4-node cluster that captures Wi-Fi
+Channel State Information from a stable RF beacon, encodes each frame into a
+128-dimensional fingerprint on an on-device Hailo-8 NPU, clusters those
+fingerprints into discrete room states with stable IDs across runs, models
+state transitions with a 2nd-order Markov chain (with measurable predictive
+skill above chance), and persists everything to a queryable brain corpus on
+a workstation. The whole thing runs over Tailscale and is operated through
+a single CLI with **34 subcommands**.
+
+**Who this is for:** RF engineers, smart-home hackers, security researchers,
+and ML/embedded folks comfortable with Linux + systemd. No specific signal-
+processing background required — but you do need patience for hardware
+quirks (nexmon_csi cross-compile is a known dead end; see step 3).
+
+> **The TL;DR**: 4× Pi 5 + 2× Hailo-8 → CSI → 128-d embeddings → cosine
+> k-means with warm-start → 2nd-order Markov → SQLite brain → 34-subcommand
+> operator CLI. Production-grade signal: 39% top-1 ceiling on next-state
+> prediction (16× chance baseline), continuous fleet/drift/anomaly
+> monitoring, and a 12-category time-series corpus.
+
+> **About the name "rvcsi" in this tutorial.** When this tutorial was
+> first written, the cluster's per-Pi capture services were named with
+> an `rvcsi` prefix (`cog-rvcsi-stream`, `cog-rvcsi-correlator`) as
+> branding only — the actual code was Python and didn't depend on the
+> upstream [`ruvnet/rvcsi`](https://github.com/ruvnet/rvcsi) Rust
+> runtime. **As of 2026-05-13**, the v0-appliance project has accepted
+> [ADR-207](https://github.com/ruvnet/v0-appliance/blob/main/docs/adr/ADR-207-rvcsi-library-integration.md)
+> (rvCSI library integration — Option D) and shipped a Rust binary
+> `cog-rvcsi-pi` built on rvcsi-runtime 0.3 that replaces the three
+> Python services. The cutover is per-Pi, operator-driven, with
+> one-command rollback (`scripts/rvcsi-pi/install-rvcsi-pi.sh` and
+> `uninstall-rvcsi-pi.sh`). A given cluster may be running either
+> stack while migration is in progress; the schema and operator
+> surface are unchanged across the cutover. See ADR-207's
+> Implementation log for the current state.
+
+---
+
+## Table of Contents
+
+1. [Prerequisites](#1-prerequisites)
+2. [Architecture overview](#2-architecture-overview)
+3. [Per-node firmware: nexmon_csi on Pi 5](#3-per-node-firmware-nexmon_csi-on-pi-5)
+4. [Per-node services](#4-per-node-services)
+5. [Workstation pipeline](#5-workstation-pipeline)
+6. [Calibration: getting from raw CSI to room states](#6-calibration-getting-from-raw-csi-to-room-states)
+7. [Operating the cluster: the cog-query CLI](#7-operating-the-cluster-the-cog-query-cli)
+8. [What you can measure](#8-what-you-can-measure)
+9. [Troubleshooting](#9-troubleshooting)
+10. [Next steps](#10-next-steps)
+
+---
+
+## 1. Prerequisites
+
+### Hardware
+
+| Item | Quantity | Approx. cost | Notes |
+|------|----------|--------------|-------|
+| Raspberry Pi 5 (8GB) | 4 | ~$80 each | 4GB works but tight under sustained load |
+| Hailo-8 M.2 HAT (AI Kit) | 2 | ~$110 each | Only 2 needed — encoder is split across cluster-1 + cluster-2 |
+| MicroSD (64GB, A2) | 4 | ~$10 each | A2 class strongly recommended for sustained writes |
+| USB-C PD power supply (27W) | 4 | ~$12 each | Pi 5 draws 5A at full Hailo load |
+| Active cooler | 4 | ~$5 each | Cluster-2 sustains thermal load — passive will throttle |
+| Workstation (≥16GB RAM, Linux) | 1 | — | Hosts the brain HTTP service + clusterer + anomaly daemon |
+| Stable Wi-Fi beacon | 1 | — | Any AP on the same 5 GHz channel. We use ch.149/80MHz. Stability matters more than identity. |
+
+**Total parts cost:** ~$580 plus workstation.
+
+> **Important:** All 4 Pi 5s must use the on-board `bcm43455c0` radio. USB
+> Wi-Fi adapters with otherwise-similar chipsets **will not** work — nexmon's
+> firmware patches are silicon-specific. See ADR-206 § "USB Wi-Fi dongle
+> rabbit-hole" for the painful version of that lesson.
+
+### Software prerequisites
+
+| Component | Version | Notes |
+|-----------|---------|-------|
+| Pi OS Bookworm (Lite) | 64-bit, kernel 6.6+ | Use the Lite image — Desktop slows boot and burns SD writes |
+| Tailscale | ≥1.60 | Mesh networking across the cluster |
+| Rust toolchain | 1.78+ on workstation, 1.78+ on each Pi | For ruvector + adapter binaries |
+| Python 3.11+ | system Python on workstation | numpy required |
+| systemd-user | already present | Workstation timers run as user units |
+
+---
+
+## 2. Architecture overview
+
+```
+                              ┌─ workstation (Linux, ≥16GB) ──────────────────┐
+                              │                                                │
+                              │  brain HTTP (SQLite, port 9876)                │
+                              │      ↑↑                                        │
+                              │   ┌──┴┴──────────────────────────────────┐    │
+                              │   │ rfmem-tail  ← ingests live brain     │    │
+                              │   │ rfmem-recall  → posts category=      │    │
+                              │   │              rfmem-recall when       │    │
+                              │   │              current state ≈ past    │    │
+                              │   │ rfmem-anomaly → 13-axis detector,    │    │
+                              │   │              posts rfmem-anomaly &    │    │
+                              │   │              rfmem-state-transition  │    │
+                              │   │ cog-rfmem-states (timer, hourly)     │    │
+                              │   │              re-clusters w/ warm-start│    │
+                              │   │ cog-rfmem-insights (timer, nightly)  │    │
+                              │   │              writes rfmem-insights    │    │
+                              │   │ cog-rfmem-drift-check (timer, 05:00) │    │
+                              │   │              audits cluster file state│    │
+                              │   └───────────────────────────────────────┘    │
+                              │                                                │
+                              │  cog-query (CLI, 34 subcommands, 4 JSON modes)│
+                              └────────────────────────────────────────────────┘
+                                                ↑
+                       Tailscale mesh ──────────┴───────────────────────────────┐
+                              ↓                              ↓                  ↓
+       ┌─ cluster-1 (Hailo) ┐  ┌─ cluster-2 (Hailo + fusion) ┐  ┌─ cluster-3 ┐ ┌─ v0 ┐
+       │ cog-csi-emitter    │  │ cog-csi-emitter             │  │ same as    │ │ same│
+       │ cog-csi-adapter    │  │ cog-csi-adapter             │  │ cluster-1  │ │ as  │
+       │ cog-rvcsi-stream   │  │ cog-rvcsi-stream            │  │ minus      │ │ c-3 │
+       │ cog-hailo-encoder  │  │ cog-hailo-encoder           │  │ Hailo &    │ │     │
+       │                    │  │ cog-rvcsi-correlator (fusion)│  │ correlator │ │     │
+       └────────────────────┘  └─────────────────────────────┘  └────────────┘ └─────┘
+            4 svc                       5 svc                      3 svc       3 svc
+       └─────────────────────── 15 expected services total ──────────────────────┘
+```
+
+**Why this split?** Multistatic fusion (combining CSI from 4 spatial vantage
+points into a single weighted observation) is computationally cheap but
+benefits from being on **one** node so the other three only do capture +
+encode. Hailo-8 is the bottleneck cost, so we put two on the cluster
+(one for redundancy, one for the fusion node) and let `cluster-3` + `v0`
+run as pure capture sensors.
+
+---
+
+## 3. Per-node firmware: nexmon_csi on Pi 5
+
+**Critical lesson learned (saved you a week):** the workstation x86_64
+cross-compile path for nexmon_csi on Pi 5 **does not work**. The 39-hunk
+patch series applies cleanly on a native Pi 5 ARM build, and fails in
+subtle ways elsewhere.
+
+The recipe that works:
+
+```bash
+# On each Pi 5 (not the workstation):
+sudo apt update && sudo apt install -y \
+    raspberrypi-kernel-headers bc bison flex libssl-dev make \
+    gcc gawk qpdf cmake build-essential libpcap-dev clang gcc-arm-none-eabi
+
+git clone https://github.com/seemoo-lab/nexmon.git ~/nexmon
+cd ~/nexmon
+source setup_env.sh
+make
+
+cd patches
+git clone https://github.com/seemoo-lab/nexmon_csi.git
+cd nexmon_csi
+
+# Apply the Pi-5-friendly patch series — all 39 hunks should apply clean
+# on native ARM. If you see "Hunk #N FAILED", you are almost certainly
+# cross-compiling from x86_64. Stop. Build on the Pi.
+./install.sh
+
+# Switch on:
+sudo mcp                       # 'monitor capability provisioning' — enable
+sudo nexutil -Iwlan0 -s500 -b -l34 -v<86-char base64 capture filter>
+```
+
+> **Pi 5 kernel gotcha:** Pi OS Bookworm ships two kernels — `kernel8.img`
+> (4K pages) and `kernel_2712.img` (16K pages, Pi 5 only). nexmon_csi
+> currently builds clean against `kernel8.img`. Add `kernel=kernel8.img`
+> to `/boot/firmware/config.txt` if you've switched. **After the switch,
+> SSH by hostname via Tailscale** — host keys + DHCP gotchas otherwise.
+
+> **Clock-skew first-boot trap:** Pi 5 has no RTC. First-boot apt will
+> reject "future-dated" `Release` files. Patch your firstboot to wait for
+> `systemd-timesyncd` before running `apt-get`.
+
+The complete commands + full troubleshooting matrix is in the
+[detailed gist](https://gist.github.com/ruvnet/88e7b053c41cb4f4af7a7ec4af873017) — section "Firmware: nexmon_csi on Pi 5".
+
+---
+
+## 4. Per-node services
+
+Each cluster Pi runs a small fixed set of systemd services. Per-host
+topology:
+
+| Service | cluster-1 | cluster-2 | cluster-3 | v0 |
+|---|:--:|:--:|:--:|:--:|
+| `cog-csi-emitter` (raw CSI capture from nexmon) | ✓ | ✓ | ✓ | ✓ |
+| `cog-csi-adapter` (Rust binary; CSI → 256-byte float frames) | ✓ | ✓ | ✓ | ✓ |
+| `cog-rvcsi-stream` (publishes frames to rvcsi-correlator) | ✓ | ✓ | ✓ | ✓ |
+| `cog-hailo-encoder` (frames → 128-d fingerprints on Hailo-8) | ✓ | ✓ | — | — |
+| `cog-rvcsi-correlator` (multistatic fusion across 4 nodes) | — | ✓ | — | — |
+| **Expected service count** | **4** | **5** | **3** | **3** |
+
+The topology is encoded in the workstation's `cog-query fleet-status`
+subcommand, which compares per-host expected services against live
+`systemctl is-active` results. A flat-service check would falsely flag
+cluster-3 and v0 as degraded (they have neither Hailo nor the correlator
+— that's by design).
+
+> **rvcsi cutover (ADR-207 Option D, 2026-05-13).** The three services
+> `cog-csi-emitter`, `cog-csi-adapter`, and `cog-rvcsi-stream` are
+> being consolidated into one Rust binary `cog-rvcsi-pi` built on
+> [rvcsi-runtime](https://crates.io/crates/rvcsi-runtime). The new
+> binary holds the same per-Pi role and the same expected-service
+> count from the operator's view (`fleet-status` already understands
+> both layouts). Deploy with
+> `bash scripts/rvcsi-pi/install-rvcsi-pi.sh <pi-host>`; revert with
+> `scripts/rvcsi-pi/uninstall-rvcsi-pi.sh`. The cutover is per-Pi,
+> not flag-day — mixed Python/Rust clusters are supported. The Hailo
+> encoder + correlator stay Python in this phase; their Rust ports
+> are tracked as follow-on ADRs.
+
+All unit files + the install script are in the
+[detailed gist](https://gist.github.com/ruvnet/88e7b053c41cb4f4af7a7ec4af873017) — section "Per-node systemd units".
+
+---
+
+## 5. Workstation pipeline
+
+The workstation runs ten user-mode units (3 daemons, 7 timers):
+
+| Unit | Type | Cadence | Purpose |
+|---|---|---|---|
+| `cog-rfmem-tail` | daemon | continuous | Ingests live brain entries into the workstation mirror |
+| `cog-rfmem-recall` | daemon | continuous | kNN-matches current fingerprint vs persisted ones, posts `rfmem-recall` |
+| `cog-rfmem-anomaly` | daemon | continuous | 13-axis anomaly detector, posts `rfmem-anomaly` + `rfmem-state-transition` |
+| `cog-rfmem-indexer` | timer | every 5 min | Updates HNSW index for kNN |
+| `cog-rfmem-compress` | timer | hourly | Compresses old brain entries |
+| `cog-rfmem-daily` | timer | nightly 04:00 | Per-day stats roll-up (`rfmem-daily`) |
+| `cog-rfmem-states` | timer | hourly | Re-runs cosine k-means w/ warm-start (`rfmem-state-summary`) |
+| `cog-rfmem-insights` | timer | nightly 04:55 | NL synthesis, posts `rfmem-insights` |
+| `cog-rfmem-drift-check` | timer | nightly 05:00 | Audits cluster file/unit drift, posts `rfmem-drift` |
+| `cog-rfmem-mirror` | timer | hourly | Mirrors cluster-2 brain → workstation read-replica |
+
+Install in one shot:
+
+```bash
+git clone https://github.com/<your-fork>/v0-appliance.git
+cd v0-appliance
+bash scripts/rfmem/install-workstation.sh
+```
+
+The installer is **idempotent** — rerunning is safe and only enables
+units that aren't yet enabled. It also wires a git post-commit hook
+that auto-deploys + auto-smoke-tests on every commit touching
+`scripts/rfmem/`. That closes the "I edited the repo but forgot to
+deploy" gap that bit us repeatedly in early development.
+
+---
+
+## 6. Calibration: getting from raw CSI to room states
+
+This is the longest step but largely passive — let it run.
+
+### 6.1 Walk the room
+
+For 30–60 minutes after the cluster is live, walk through every room you
+want recognized. Sit, stand, move between rooms, repeat. The encoder is
+learning to map "what the room looks like in CSI" into 128-d vectors;
+diversity here matters more than total time.
+
+### 6.2 First clustering pass
+
+```bash
+# Force-trigger the clusterer (it normally fires hourly):
+systemctl --user start cog-rfmem-states.service
+python3 scripts/rfmem/cog-query.py states
+```
+
+Output looks like:
+
+```
+=== rfmem-states — k=16, n=12,847 ===
+  state #0   π=0.184  dwell=42.3s  centroid_drift=0.012  (default)
+  state #1   π=0.121  dwell=18.1s  centroid_drift=0.003
+  state #4   π=0.087  dwell=29.6s  centroid_drift=0.041
+  ...
+```
+
+**Stable IDs across runs.** The warm-start k-means recipe matches new
+centroids to the prior run's centroids by cosine similarity before
+assigning IDs. This means state #4 stays state #4 between hourly runs —
+otherwise downstream Markov transitions would scramble after every
+re-cluster.
+
+### 6.3 Let the Markov chain build
+
+After a few thousand transitions (a few hours of activity), check:
+
+```bash
+python3 scripts/rfmem/cog-query.py prediction-accuracy
+```
+
+You should see something like:
+
+```
+=== prediction-accuracy — training-set top-1 ceilings ===
+  1st-order:  37.1%  (16x chance baseline of 6.25%)
+  2nd-order:  39.4%  (16x chance baseline of 6.25%, 1.06x gain over 1st)
+```
+
+The 2nd-order chain beats 1st-order because it conditions on the
+**previous** state as well as the current one. Self-loops are excluded
+from the argmax (a transition is by definition a state change).
+
+### 6.4 Verify the room learned itself
+
+```bash
+python3 scripts/rfmem/cog-query.py insights
+```
+
+Reads like:
+
+```
+The cluster has observed 446,231 fingerprints, clustering them into
+16 discrete RF states. The room exhibits moderately diverse (stationary
+entropy 0.82/1.0). State #4 is the dominant 'default' state (π=0.214);
+state #13 is the rarest baseline (π=0.018).
+Prediction skill (last hour, 2nd-order): top-1 12.4% (1.98x chance),
+top-3 31.0% (1.65x chance, 412 transitions) (training-set ceiling
+39.4% — operating @ 31% of capacity).
+```
+
+That "operating @ 31% of capacity" line is the operational efficiency:
+how close live performance is to the model's theoretical ceiling. Big
+gap = the room is being noisy in ways the static cluster model doesn't
+capture. Small gap = you're near SOTA for this static model.
+
+---
+
+## 7. Operating the cluster: the cog-query CLI
+
+A single CLI binary with **34 subcommands** + 4 machine-readable JSON
+modes. Practical ones (full list in the gist):
+
+| Subcommand | What it does |
+|---|---|
+| `summary --hours 1` | Bird's-eye view of last hour: anomalies, transitions, recall hits |
+| `top-events --hours 24 --limit 5` | Highest-info events in window (combines novelty + tier + recency) |
+| `top-events --json` | Same, agent-consumable |
+| `insights` | Natural-language synthesis (paragraph) — what the cluster thinks |
+| `insights --json` | Same, structured |
+| `insights --post` | Same, persisted to brain as `rfmem-insights` |
+| `stats` | Corpus: per-category counts, dimensions, vector counts |
+| `motion` | Recent motion events |
+| `anomalies --sort info` | Anomalies sorted by composite info score (1.0–8.0) |
+| `circadian` | 24-hour bin of activity — does the room have a daily rhythm? |
+| `by-state` | Per-state metrics (dwell, σ-baseline, novelty distribution) |
+| `markov` | Top transitions by frequency, both 1st + 2nd-order |
+| `transitions --sort novelty` | Rare/surprising transitions |
+| `dwell-times` | How long the room stays in each state |
+| `prediction-accuracy` | 1st + 2nd-order top-1 ceilings |
+| `baseline-drift` | Has the noise floor shifted? (slow change) |
+| `centroid-drift` | Has any state's RF signature materially changed? |
+| `fleet-status` | Per-host expected-service liveness check |
+| `fleet-status --json` | Same, agent-consumable |
+| `fleet-status --post` | Same, persisted to brain as `rfmem-fleet` (heartbeat) |
+| `check-drift` | Workstation/cluster file + unit drift audit |
+| `replica-status` | Hourly cluster-2 → workstation mirror health |
+
+### The fleet-health triad
+
+Three subcommands cover the operator's full health picture:
+
+- `check-drift` — file content drift (what's deployed vs what's in git)
+- `replica-status` — workstation mirror lag (last successful sync)
+- `fleet-status` — service liveness across the 4 Pis (topology-aware)
+
+If all three are green, the cluster is healthy. If any one fires, you
+have a concrete starting point.
+
+---
+
+## 8. What you can measure
+
+After a week of runtime, you can answer questions like:
+
+- **"What's the room's most common 'baseline' state?"** → `states` shows
+  the π-dominant cluster ID.
+- **"Did anything weird happen last night?"** → `anomalies --sort info
+  --hours 12` sorts by combined-information score (novelty × tier × state-
+  rarity × calmness).
+- **"How predictable is the room?"** → `insights` reports stationary
+  entropy (0.0 = single state, 1.0 = uniform). Most rooms land 0.6–0.9.
+- **"What's the most novel transition ever observed?"** → `transitions
+  --sort novelty --limit 1`. We've seen transitions with
+  `transition_p=0.0000` — never observed before in 446k+ embeddings.
+- **"Is the room changing slowly?"** → `centroid-drift` flags states
+  whose 128-d signature has moved > 0.05 cosine distance since the prior
+  clusterer run. Common cause: a piece of furniture moved.
+- **"What's the daily rhythm?"** → `circadian` bins activity by hour.
+  Most rooms show clear morning/evening peaks.
+
+---
+
+## 9. Troubleshooting
+
+| Symptom | Likely cause | Fix |
+|---|---|---|
+| `nexmon_csi` build fails with FAILED hunks | Cross-compiling from x86_64 | Build on the Pi natively |
+| Pi 5 stops booting after kernel switch | Wrong `kernel=` in `/boot/firmware/config.txt` | Use `kernel=kernel8.img` |
+| First boot fails on `apt update` | No RTC → clock skew, apt rejects "future-dated" Release files | Wait for `systemd-timesyncd` in firstboot |
+| `cog-rfmem-now` times out | Workstation daemon swap-thrashing | Bump `MemoryMax=` in unit file (we run 1G) |
+| `fleet-status` shows DEGRADED on cluster-3 / v0 | Topology unaware (old version) | Update to latest — per-host expected-services |
+| Cluster-2 Hailo encoder silent | `cp -r` made encoder a directory, not a file | `install -m 0755` instead |
+| 2nd-order Markov top-1 = 0% | Self-loop dominates argmax | Zero out self-loop before `.argmax()` |
+| State IDs change between runs | No warm-start k-means | Update clusterer to match new centroids to prior run by cosine |
+| HardFaults during embedded N6 bring-up | (Different topic, see [ADR-027](../adr/) for STM32N6 startup notes) | — |
+
+---
+
+## 10. Next steps
+
+Once your cluster is producing stable predictions and clean fleet health,
+the natural directions are:
+
+1. **Cross-room correlation** — train a second cluster in another room
+   and feed both into the workstation. The brain already supports
+   multiple namespaces.
+2. **Active sensing** — instead of passively observing whatever beacon is
+   present, drive your own (e.g., dedicated 5 GHz beacon AP at fixed
+   power). Eliminates upstream variability.
+3. **Vital signs** — the RuView project has companion code for extracting
+   heart-rate and breathing from CSI; the 128-d encoder output is a
+   reasonable input feature.
+4. **Federated training** — multiple physical sites publishing to a shared
+   brain. Each site keeps its own clusters; transitions are the shared
+   vocabulary.
+5. **Push to upstream RuView** — if your cluster develops capabilities not
+   in this tutorial (you'll know by the time you've written the README),
+   send a PR.
+
+---
+
+## Reference material
+
+- **[Detailed cookbook gist (all commands, configs, unit files)](https://gist.github.com/ruvnet/88e7b053c41cb4f4af7a7ec4af873017)**
+- **[ADR-206: nexmon_csi on Pi 5 cluster](https://github.com/ruvnet/v0-appliance/blob/main/docs/adr/ADR-206-nexmon-csi-on-pi-5-cluster.md)** — the engineering decision record
+  with full rationale, including the painful-but-instructive failures
+- **[v0-appliance repo](https://github.com/ruvnet/v0-appliance)** — the
+  source of truth for `scripts/rfmem/` operator tooling
+- **[seemoo-lab/nexmon_csi](https://github.com/seemoo-lab/nexmon_csi)** —
+  upstream CSI capture firmware
+- **[Hailo-8 documentation](https://hailo.ai/products/hailo-8/)** — NPU
+  reference
+
+---
+
+*This tutorial was built against the v0.5.0-cognitive-rf-observer milestone
+of `v0-appliance`. The cluster has been running continuously for 6+ weeks
+of development with 446k+ fingerprints observed, 16 stable RF states, and
+a 2nd-order Markov model operating at 31% of its 39.4% theoretical
+top-1 ceiling. SOTA is a moving target — but this is a real, working
+cognitive RF observer that you can reproduce.*

firmware/esp32-csi-node/main/CMakeLists.txt

@@ -11,7 +11,26 @@ set(SRCS
     "adaptive_controller.c"
 )
 
-set(REQUIRES "")
+# ESP-IDF v6+: headers must resolve via explicit REQUIRES (no implicit deps).
+set(REQUIRES
+    esp_wifi
+    esp_netif
+    esp_event
+    nvs_flash
+    app_update
+    esp_http_server
+    esp_http_client
+    esp_app_format
+    esp_timer
+    esp_pm
+    esp_driver_uart
+    esp_driver_gpio
+    esp_driver_spi
+    esp_driver_i2c
+    driver
+    lwip
+    mbedtls
+)
 
 # ADR-061: Mock CSI generator for QEMU testing + ADR-081 mock radio binding
 if(CONFIG_CSI_MOCK_ENABLED)
@@ -21,7 +40,11 @@ endif()
 # ADR-045: AMOLED display support (compile-time optional)
 if(CONFIG_DISPLAY_ENABLE)
     list(APPEND SRCS "display_hal.c" "display_ui.c" "display_task.c")
-    set(REQUIRES esp_lcd esp_lcd_touch lvgl)
+    list(APPEND REQUIRES esp_lcd esp_lcd_touch lvgl)
+endif()
+
+if(CONFIG_WASM_ENABLE)
+    list(APPEND REQUIRES wasm3)
 endif()
 
 idf_component_register(

firmware/esp32-csi-node/main/csi_collector.c

@@ -371,6 +371,30 @@ void csi_collector_init(void)
 
     ESP_LOGI(TAG, "Promiscuous mode enabled (MGMT-only, RuView#396)");
 
+#if CONFIG_SOC_WIFI_HE_SUPPORT
+    /* Wi-Fi 6 targets (e.g. ESP32-C6): wifi_csi_config_t is wifi_csi_acquire_config_t
+     * (bitfields), not the legacy 802.11n bool layout used on ESP32-S3. */
+    wifi_csi_config_t csi_config;
+    memset(&csi_config, 0, sizeof(csi_config));
+    csi_config.enable = 1U;
+    csi_config.acquire_csi_legacy = 1U;
+    csi_config.acquire_csi_ht20 = 1U;
+    csi_config.acquire_csi_ht40 = 1U;
+    csi_config.acquire_csi_su = 1U;
+    csi_config.acquire_csi_mu = 1U;
+    csi_config.acquire_csi_dcm = 1U;
+    csi_config.acquire_csi_beamformed = 1U;
+#if CONFIG_SOC_WIFI_MAC_VERSION_NUM >= 3
+    csi_config.acquire_csi_force_lltf = 1U;
+    csi_config.acquire_csi_vht = 1U;
+    csi_config.acquire_csi_he_stbc_mode = ESP_CSI_ACQUIRE_STBC_SAMPLE_HELTFS;
+    csi_config.val_scale_cfg = 0U;
+#else
+    csi_config.acquire_csi_he_stbc = ESP_CSI_ACQUIRE_STBC_SAMPLE_HELTFS;
+    csi_config.val_scale_cfg = 0U;
+#endif
+    csi_config.dump_ack_en = 0U;
+#else
     wifi_csi_config_t csi_config = {
         .lltf_en = true,
         .htltf_en = true,
@@ -380,6 +404,7 @@ void csi_collector_init(void)
         .manu_scale = false,
         .shift = false,
     };
+#endif
 
     ESP_ERROR_CHECK(esp_wifi_set_csi_config(&csi_config));
     ESP_ERROR_CHECK(esp_wifi_set_csi_rx_cb(wifi_csi_callback, NULL));

firmware/esp32-csi-node/main/edge_processing.c

@@ -2,8 +2,9 @@
  * @file edge_processing.c
  * @brief ADR-039 Edge Intelligence — dual-core CSI processing pipeline.
  *
- * Core 0 (WiFi task): Pushes raw CSI frames into lock-free SPSC ring buffer.
- * Core 1 (DSP task):  Pops frames, runs signal processing pipeline:
+ * Core 0 (WiFi path): Pushes raw CSI frames into lock-free SPSC ring buffer.
+ * Second core when present (DSP task): pops frames, runs signal processing pipeline.
+ * On unicore targets (e.g. ESP32-C6), the DSP task is pinned to core 0.
  *   1. Phase extraction from I/Q pairs
  *   2. Phase unwrapping (continuous phase)
  *   3. Welford variance tracking per subcarrier
@@ -1050,7 +1051,9 @@ esp_err_t edge_processing_init(const edge_config_t *cfg)
         return ESP_OK;
     }
 
-    /* Start DSP task on Core 1. */
+    /* Pin DSP off WiFi's preferred core when SMP; else core 0 only (ESP32-C6). */
+    const BaseType_t dsp_core = (portNUM_PROCESSORS > 1) ? (BaseType_t)1 : (BaseType_t)0;
+
     BaseType_t ret = xTaskCreatePinnedToCore(
         edge_task,
         "edge_dsp",
@@ -1058,14 +1061,14 @@ esp_err_t edge_processing_init(const edge_config_t *cfg)
         NULL,
         5,          /* Priority 5 — above idle, below WiFi. */
         NULL,
-        1           /* Pin to Core 1. */
-    );
+        dsp_core);
 
     if (ret != pdPASS) {
         ESP_LOGE(TAG, "Failed to create edge DSP task");
         return ESP_ERR_NO_MEM;
     }
 
-    ESP_LOGI(TAG, "Edge DSP task created on Core 1 (stack=8192, priority=5)");
+    ESP_LOGI(TAG, "Edge DSP task created on core %d (stack=8192, priority=5)",
+             (int)dsp_core);
     return ESP_OK;
 }

firmware/esp32-csi-node/main/idf_component.yml

@@ -8,3 +8,6 @@ dependencies:
 
   ## LCD touch abstraction
   espressif/esp_lcd_touch: "^1.0"
+
+  ## Onboard WS2812 LED Disabling
+  espressif/led_strip: "^3.0.0"

firmware/esp32-csi-node/main/main.c

@@ -18,6 +18,7 @@
 #include "nvs_flash.h"
 #include "esp_app_desc.h"
 #include "sdkconfig.h"
+#include "led_strip.h"
 
 #include "csi_collector.h"
 #include "stream_sender.h"
@@ -149,6 +150,23 @@ void app_main(void)
     ESP_LOGI(TAG, "ESP32-S3 CSI Node (ADR-018) — v%s — Node ID: %d",
              app_desc->version, g_nvs_config.node_id);
 
+    /* Turn off onboard WS2812 LED on GPIO 38 */
+    led_strip_handle_t led_strip;
+    led_strip_config_t strip_config = {
+        .strip_gpio_num = 38,
+        .max_leds = 1,
+        .led_model = LED_MODEL_WS2812,
+        .color_component_format = LED_STRIP_COLOR_COMPONENT_FMT_GRB,
+        .flags.invert_out = false,
+    };
+    led_strip_rmt_config_t rmt_config = {
+        .resolution_hz = 10 * 1000 * 1000, // 10MHz
+        .flags.with_dma = false,
+    };
+    if (led_strip_new_rmt_device(&strip_config, &rmt_config, &led_strip) == ESP_OK) {
+        led_strip_clear(led_strip);
+    }
+
     /* Initialize WiFi STA (skip entirely under QEMU mock — no RF hardware) */
 #ifndef CONFIG_CSI_MOCK_SKIP_WIFI_CONNECT
     wifi_init_sta();

firmware/esp32-csi-node/main/mmwave_sensor.c

@@ -109,7 +109,7 @@ static void mr60_process_frame(uint16_t type, const uint8_t *data, uint16_t len)
 
     switch (type) {
     case MR60_TYPE_BREATHING:
-        if (len >= 4) {
+        if (len >= sizeof(float)) {
             /* Breathing rate as float32 (little-endian in payload). */
             float br;
             memcpy(&br, data, sizeof(float));
@@ -120,7 +120,7 @@ static void mr60_process_frame(uint16_t type, const uint8_t *data, uint16_t len)
         break;
 
     case MR60_TYPE_HEARTRATE:
-        if (len >= 4) {
+        if (len >= sizeof(float)) {
             float hr;
             memcpy(&hr, data, sizeof(float));
             if (hr >= 0.0f && hr <= 250.0f) {
@@ -130,13 +130,13 @@ static void mr60_process_frame(uint16_t type, const uint8_t *data, uint16_t len)
         break;
 
     case MR60_TYPE_DISTANCE:
-        if (len >= 8) {
+        if (len >= sizeof(uint32_t) + sizeof(float)) {
             /* Bytes 0-3: range flag (uint32 LE). 0 = no valid distance. */
             uint32_t range_flag;
             memcpy(&range_flag, data, sizeof(uint32_t));
-            if (range_flag != 0 && len >= 8) {
+            if (range_flag != 0) {
                 float dist;
-                memcpy(&dist, &data[4], sizeof(float));
+                memcpy(&dist, &data[sizeof(uint32_t)], sizeof(float));
                 s_state.distance_cm = dist;
             }
         }

firmware/esp32-csi-node/main/rvf_parser.c

@@ -10,7 +10,7 @@
 
 #include <string.h>
 #include "esp_log.h"
-#include "mbedtls/sha256.h"
+#include "psa/crypto.h"
 
 static const char *TAG = "rvf";
 
@@ -125,9 +125,13 @@ esp_err_t rvf_parse(const uint8_t *data, uint32_t data_len, rvf_parsed_t *out)
 
     /* ---- Verify build hash (SHA-256 of WASM payload) ---- */
     uint8_t computed_hash[32];
-    int ret = mbedtls_sha256(wasm_data, hdr->wasm_len, computed_hash, 0);
-    if (ret != 0) {
-        ESP_LOGE(TAG, "SHA-256 computation failed: %d", ret);
+    size_t hash_len = 0;
+    psa_status_t psa_st = psa_hash_compute(PSA_ALG_SHA_256, wasm_data,
+                                            hdr->wasm_len, computed_hash,
+                                            sizeof(computed_hash), &hash_len);
+    if (psa_st != PSA_SUCCESS || hash_len != 32) {
+        ESP_LOGE(TAG, "SHA-256 computation failed: psa=%d len=%u",
+                 (int)psa_st, (unsigned)hash_len);
         return ESP_FAIL;
     }
 
@@ -186,8 +190,7 @@ esp_err_t rvf_verify_signature(const rvf_parsed_t *parsed, const uint8_t *data,
     /*
      * Ed25519 verification.
      *
-     * ESP-IDF v5.2 mbedtls does NOT include Ed25519 (Curve25519 is
-     * for ECDH/X25519 only).  We use a SHA-256-HMAC integrity check:
+     * Legacy mbedtls Ed25519 is optional.  We use a SHA-256 keyed digest:
      *
      *   expected = SHA-256(pubkey || signed_region)
      *
@@ -196,35 +199,34 @@ esp_err_t rvf_verify_signature(const rvf_parsed_t *parsed, const uint8_t *data,
      * pubkey produces a different expected hash, so unauthorized
      * publishers cannot forge a valid signature.
      *
-     * For full Ed25519 (NaCl-style), enable CONFIG_MBEDTLS_EDDSA_C
-     * or link TweetNaCl.  The RVF builder should match this scheme.
+     * For full Ed25519, enable CONFIG_MBEDTLS_EDDSA_C or equivalent.
+     * The RVF builder should match this scheme.
      */
     uint8_t hash_input_prefix[32];
     memcpy(hash_input_prefix, pubkey, 32);
 
-    /* Compute SHA-256(pubkey || header+manifest+wasm). */
-    mbedtls_sha256_context ctx;
-    mbedtls_sha256_init(&ctx);
-    int ret = mbedtls_sha256_starts(&ctx, 0);
-    if (ret != 0) {
-        mbedtls_sha256_free(&ctx);
+    /* Compute SHA-256(pubkey || header+manifest+wasm) via PSA Crypto. */
+    psa_hash_operation_t op = PSA_HASH_OPERATION_INIT;
+    psa_status_t st = psa_hash_setup(&op, PSA_ALG_SHA_256);
+    if (st != PSA_SUCCESS) {
         return ESP_FAIL;
     }
-    ret = mbedtls_sha256_update(&ctx, hash_input_prefix, 32);
-    if (ret != 0) {
-        mbedtls_sha256_free(&ctx);
+    st = psa_hash_update(&op, hash_input_prefix, 32);
+    if (st != PSA_SUCCESS) {
+        (void)psa_hash_abort(&op);
         return ESP_FAIL;
     }
-    ret = mbedtls_sha256_update(&ctx, data, signed_len);
-    if (ret != 0) {
-        mbedtls_sha256_free(&ctx);
+    st = psa_hash_update(&op, data, signed_len);
+    if (st != PSA_SUCCESS) {
+        (void)psa_hash_abort(&op);
         return ESP_FAIL;
     }
 
     uint8_t expected[32];
-    ret = mbedtls_sha256_finish(&ctx, expected);
-    mbedtls_sha256_free(&ctx);
-    if (ret != 0) {
+    size_t out_len = 0;
+    st = psa_hash_finish(&op, expected, sizeof(expected), &out_len);
+    if (st != PSA_SUCCESS || out_len != 32) {
+        (void)psa_hash_abort(&op);
         return ESP_FAIL;
     }
 

firmware/esp32-csi-node/provision.py

@@ -1,12 +1,14 @@
 #!/usr/bin/env python3
 """
-ESP32-S3 CSI Node Provisioning Script
+ESP32 CSI node provisioning (ESP32-S3, ESP32-C6, other targets).
 
 Writes WiFi credentials and aggregator target to the ESP32's NVS partition
 so users can configure a pre-built firmware binary without recompiling.
 
 Usage:
     python provision.py --port COM7 --ssid "MyWiFi" --password "secret" --target-ip 192.168.1.20
+    python provision.py --port /dev/ttyUSB0 --chip esp32c6 --ssid "..." \\
+        --password "..." --target-ip 192.168.1.20
 
 Requirements:
     pip install 'esptool>=5.0' nvs-partition-gen
@@ -143,7 +145,7 @@ def generate_nvs_binary(csv_content, size):
                 os.unlink(p)
 
 
-def flash_nvs(port, baud, nvs_bin):
+def flash_nvs(port, baud, nvs_bin, chip):
     """Flash the NVS partition binary to the ESP32."""
     with tempfile.NamedTemporaryFile(suffix=".bin", delete=False) as f:
         f.write(nvs_bin)
@@ -152,16 +154,13 @@ def flash_nvs(port, baud, nvs_bin):
     try:
         cmd = [
             sys.executable, "-m", "esptool",
-            "--chip", "esp32s3",
+            "--chip", chip,
             "--port", port,
             "--baud", str(baud),
-            # Keep underscore form — ESP-IDF v5.4 bundles esptool 4.10.0 which only
-            # accepts "write_flash". pip's esptool >=5.x accepts both (hyphenated
-            # form preferred) but keeps underscore working. Do not "correct" this.
-            "write_flash",
+            "write-flash",
             hex(NVS_PARTITION_OFFSET), bin_path,
         ]
-        print(f"Flashing NVS partition ({len(nvs_bin)} bytes) to {port}...")
+        print(f"Flashing NVS partition ({len(nvs_bin)} bytes) to {port} (chip={chip})...")
         subprocess.check_call(cmd)
         print("NVS provisioning complete!")
     finally:
@@ -170,10 +169,20 @@ def flash_nvs(port, baud, nvs_bin):
 
 def main():
     parser = argparse.ArgumentParser(
-        description="Provision ESP32-S3 CSI Node with WiFi and aggregator settings",
-        epilog="Example: python provision.py --port COM7 --ssid MyWiFi --password secret --target-ip 192.168.1.20",
+        description="Provision CSI node NVS (WiFi + aggregator); works on S3, C6, etc.",
+        epilog=(
+            "Example: python provision.py --port COM7 --ssid MyWiFi --password secret "
+            "--target-ip 192.168.1.20\n"
+            "ESP32-C6: same, or pass --chip esp32c6 if auto-detect fails "
+            "(default chip is auto for esptool v5+)."
+        ),
     )
     parser.add_argument("--port", required=True, help="Serial port (e.g. COM7, /dev/ttyUSB0)")
+    parser.add_argument(
+        "--chip",
+        default="auto",
+        help="esptool target: auto (default), esp32s3, esp32c6, ... (must match connected chip)",
+    )
     parser.add_argument("--baud", type=int, default=460800, help="Flash baud rate (default: 460800)")
     parser.add_argument("--ssid", help="WiFi SSID")
     parser.add_argument("--password", help="WiFi password")
@@ -337,11 +346,11 @@ def main():
         with open(out, "wb") as f:
             f.write(nvs_bin)
         print(f"NVS binary saved to {out} ({len(nvs_bin)} bytes)")
-        print(f"Flash manually: python -m esptool --chip esp32s3 --port {args.port} "
+        print(f"Flash manually: python -m esptool --chip {args.chip} --port {args.port} "
               f"write-flash 0x9000 {out}")
         return
 
-    flash_nvs(args.port, args.baud, nvs_bin)
+    flash_nvs(args.port, args.baud, nvs_bin, args.chip)
 
 
 if __name__ == "__main__":

firmware/esp32-hello-world/CMakeLists.txt

@@ -1,4 +1,4 @@
-# ESP32-S3 Hello World — Capability Discovery
+# ESP32 Hello World — Capability Discovery (S3 / C6 targets)
 cmake_minimum_required(VERSION 3.16)
 
 include($ENV{IDF_PATH}/tools/cmake/project.cmake)

firmware/esp32-hello-world/main/main.c

@@ -1,11 +1,11 @@
 /**
  * @file main.c
- * @brief ESP32-S3 Hello World — Full Capability Discovery
+ * @brief ESP32 Hello World — Full Capability Discovery
  *
- * Boots up, prints "Hello World!", then probes and reports every major
- * hardware/software capability of the ESP32-S3: chip info, flash, PSRAM,
- * WiFi (including CSI), Bluetooth, GPIOs, peripherals, FreeRTOS stats,
- * and power management features.  No WiFi connection required.
+ * Boots up, prints "Hello World!", then probes chip info, flash, PSRAM,
+ * WiFi (including CSI where enabled), 802.15.4/BLE on C6, GPIOs,
+ * peripherals, FreeRTOS stats, and power management.  No WiFi connection
+ * required.  Supports ESP32-S3 and ESP32-C6 (set IDF target accordingly).
  */
 
 #include <stdio.h>
@@ -18,7 +18,6 @@
 #include "esp_chip_info.h"
 #include "esp_flash.h"
 #include "esp_mac.h"
-#include "esp_log.h"
 #include "esp_wifi.h"
 #include "esp_event.h"
 #include "esp_timer.h"
@@ -33,7 +32,24 @@
 #include "driver/temperature_sensor.h"
 #include "sdkconfig.h"
 
-static const char *TAG = "hello";
+/*
+ * Peripheral counts: ESP-IDF v6+ dropped some SOC_* macros; values below
+ * match each target's HAL (esp_hal_* *_ll.h) where applicable.
+ */
+#if CONFIG_IDF_TARGET_ESP32S3
+#define PROBE_I2S_CTRL_NUM   2
+#define PROBE_RMT_CHAN_NUM   8
+#define PROBE_MCPWM_GROUPS   2
+#define PROBE_PCNT_UNITS     4
+#define PROBE_TOUCH_CHAN_NUM ((int)(SOC_TOUCH_MAX_CHAN_ID - SOC_TOUCH_MIN_CHAN_ID + 1))
+#elif CONFIG_IDF_TARGET_ESP32C6
+#define PROBE_I2S_CTRL_NUM   1
+#define PROBE_RMT_CHAN_NUM   4
+#define PROBE_MCPWM_GROUPS   1
+#define PROBE_PCNT_UNITS     4
+#else
+#error "hello-world: add PROBE_* peripheral counts for this IDF target in main.c"
+#endif
 
 /* ── Helpers ─────────────────────────────────────────────────────────── */
 
@@ -46,6 +62,7 @@ static const char *chip_model_str(esp_chip_model_t model)
         case CHIP_ESP32C3: return "ESP32-C3";
         case CHIP_ESP32H2: return "ESP32-H2";
         case CHIP_ESP32C2: return "ESP32-C2";
+        case CHIP_ESP32C6: return "ESP32-C6";
         default:           return "Unknown";
     }
 }
@@ -168,7 +185,11 @@ static void probe_wifi_capabilities(void)
     ESP_ERROR_CHECK(esp_wifi_start());
 
     /* Protocol capabilities */
+#if CONFIG_IDF_TARGET_ESP32C6
+    printf("  Protocols:      802.11 b/g/n/ax (Wi-Fi 6, 2.4 GHz)\n");
+#else
     printf("  Protocols:      802.11 b/g/n\n");
+#endif
 
     /* CSI (Channel State Information) */
 #ifdef CONFIG_ESP_WIFI_CSI_ENABLED
@@ -246,7 +267,7 @@ static void probe_bluetooth(void)
     esp_chip_info(&info);
 
     if (info.features & CHIP_FEATURE_BLE) {
-        printf("  BLE:            Supported (Bluetooth 5.0 LE)\n");
+        printf("  BLE:            Supported (Bluetooth LE)\n");
         printf("    - GATT Server/Client\n");
         printf("    - Advertising & Scanning\n");
         printf("    - Mesh Networking\n");
@@ -256,10 +277,16 @@ static void probe_bluetooth(void)
         printf("  BLE:            Not supported on this chip\n");
     }
 
+#if CONFIG_IDF_TARGET_ESP32C6
+    if (info.features & CHIP_FEATURE_IEEE802154) {
+        printf("  802.15.4:       Supported (Thread / Zigbee style MAC)\n");
+    }
+#endif
+
     if (info.features & CHIP_FEATURE_BT) {
         printf("  BT Classic:     Supported (A2DP, SPP, HFP)\n");
     } else {
-        printf("  BT Classic:     Not available (ESP32-S3 is BLE-only)\n");
+        printf("  BT Classic:     Not available (BLE-only on this chip)\n");
     }
 }
 
@@ -269,24 +296,52 @@ static void probe_peripherals(void)
 
     printf("  GPIOs:          %d total\n", SOC_GPIO_PIN_COUNT);
     printf("  ADC:\n");
+#if CONFIG_IDF_TARGET_ESP32C6
+    printf("    - SAR ADC:    %d channels (12-bit, one controller)\n",
+           (int)SOC_ADC_CHANNEL_NUM(0));
+#else
     printf("    - ADC1:       %d channels (12-bit SAR)\n", SOC_ADC_CHANNEL_NUM(0));
     printf("    - ADC2:       %d channels (shared with WiFi)\n", SOC_ADC_CHANNEL_NUM(1));
-    printf("  DAC:            Not available on ESP32-S3\n");
-    printf("  Touch Sensors:  %d channels (capacitive)\n", SOC_TOUCH_SENSOR_NUM);
-    printf("  SPI:            %d controllers (SPI2/SPI3 for user)\n", SOC_SPI_PERIPH_NUM);
-    printf("  I2C:            %d controllers\n", SOC_I2C_NUM);
-    printf("  I2S:            %d controllers (audio/PDM/TDM)\n", SOC_I2S_NUM);
-    printf("  UART:           %d controllers\n", SOC_UART_NUM);
+#endif
+    printf("  DAC:            Not available on this chip\n");
+#if CONFIG_IDF_TARGET_ESP32S3
+    printf("  Touch Sensors:  %d channels (capacitive)\n", PROBE_TOUCH_CHAN_NUM);
+#elif CONFIG_IDF_TARGET_ESP32C6
+    printf("  Touch Sensors:  Not available (no capacitive touch on ESP32-C6)\n");
+#endif
+    printf("  SPI:            %d controllers\n", SOC_SPI_PERIPH_NUM);
+#if CONFIG_IDF_TARGET_ESP32S3
+    printf("                  (SPI2/SPI3 typical for user apps)\n");
+#endif
+    printf("  I2C:            %d controllers\n", (int)SOC_I2C_NUM);
+    printf("  I2S:            %d controller(s) (audio/PDM/TDM)\n", PROBE_I2S_CTRL_NUM);
+    printf("  UART:           %d controllers\n", (int)SOC_UART_NUM);
+#if CONFIG_IDF_TARGET_ESP32S3
     printf("  USB:            USB-OTG 1.1 (Host & Device)\n");
     printf("  USB-Serial:     Built-in USB-JTAG/Serial (this console)\n");
+#elif CONFIG_IDF_TARGET_ESP32C6
+    printf("  USB:            No native USB-OTG (use SPI/USB bridge or off-chip PHY)\n");
+    printf("  USB-Serial:     Built-in USB Serial/JTAG (this console)\n");
+#endif
+#if CONFIG_IDF_TARGET_ESP32S3
     printf("  TWAI (CAN):     1 controller (CAN 2.0B compatible)\n");
-    printf("  RMT:            %d channels (IR/WS2812/NeoPixel)\n", SOC_RMT_TX_CANDIDATES_PER_GROUP + SOC_RMT_RX_CANDIDATES_PER_GROUP);
+#elif CONFIG_IDF_TARGET_ESP32C6
+    printf("  TWAI (CAN):     %d controller(s) (CAN 2.0B compatible)\n",
+           (int)SOC_TWAI_CONTROLLER_NUM);
+#endif
+    printf("  RMT:            %d channels (IR/WS2812/NeoPixel)\n", PROBE_RMT_CHAN_NUM);
     printf("  LEDC (PWM):     %d channels\n", SOC_LEDC_CHANNEL_NUM);
-    printf("  MCPWM:          %d groups (motor control)\n", SOC_MCPWM_GROUPS);
-    printf("  PCNT:           %d units (pulse counter / encoder)\n", SOC_PCNT_UNITS_PER_GROUP);
+    printf("  MCPWM:          %d group(s) (motor control)\n", PROBE_MCPWM_GROUPS);
+    printf("  PCNT:           %d units (pulse counter / encoder)\n", PROBE_PCNT_UNITS);
+#if CONFIG_IDF_TARGET_ESP32S3
     printf("  LCD:            Parallel 8/16-bit + SPI + I2C interfaces\n");
     printf("  Camera:         DVP 8/16-bit parallel interface\n");
     printf("  SDMMC:          SD/MMC host controller (1-bit / 4-bit)\n");
+#elif CONFIG_IDF_TARGET_ESP32C6
+    printf("  PARLIO:         Parallel TX/RX (e.g. LED matrix / custom buses)\n");
+    printf("  Camera:         SPI / external bridge (no native DVP)\n");
+    printf("  SDIO:           SDIO slave peripheral (see TRM for capabilities)\n");
+#endif
 }
 
 static void probe_security(void)
@@ -309,17 +364,29 @@ static void probe_power(void)
 {
     print_separator("POWER MANAGEMENT");
 
+#if CONFIG_IDF_TARGET_ESP32C6
+    printf("  Clock Modes:\n");
+    printf("    - 160 MHz     (max CPU on ESP32-C6)\n");
+    printf("    - 120 MHz     (balanced)\n");
+    printf("    - 80 MHz      (low power)\n");
+#else
     printf("  Clock Modes:\n");
     printf("    - 240 MHz     (max performance)\n");
     printf("    - 160 MHz     (balanced)\n");
     printf("    - 80 MHz      (low power)\n");
+#endif
     printf("  Sleep Modes:\n");
     printf("    - Modem Sleep  (WiFi off, CPU active)\n");
     printf("    - Light Sleep  (CPU paused, fast wake)\n");
     printf("    - Deep Sleep   (RTC only, ~10 uA)\n");
     printf("    - Hibernation  (RTC timer only, ~5 uA)\n");
+#if CONFIG_IDF_TARGET_ESP32C6
+    printf("  Wake Sources:   GPIO, LP timer, UART, etc.\n");
+    printf("  LP domain:      LP core / LP peripherals (see TRM)\n");
+#else
     printf("  Wake Sources:   GPIO, timer, touch, ULP, UART\n");
-    printf("  ULP Coprocessor: RISC-V + FSM (runs in deep sleep)\n");
+    printf("  ULP Coprocessor: FSM (runs in deep sleep)\n");
+#endif
 }
 
 static void probe_temperature(void)
@@ -389,6 +456,9 @@ static void probe_csi_details(void)
 
 void app_main(void)
 {
+    esp_chip_info_t chip;
+    esp_chip_info(&chip);
+
     /* NVS required for WiFi */
     esp_err_t ret = nvs_flash_init();
     if (ret == ESP_ERR_NVS_NO_FREE_PAGES || ret == ESP_ERR_NVS_NEW_VERSION_FOUND) {
@@ -401,7 +471,7 @@ void app_main(void)
     printf("\n");
     printf("  ╭─────────────────────────────────────────────────╮\n");
     printf("  │                                                 │\n");
-    printf("  │       HELLO WORLD from ESP32-S3!                │\n");
+    printf("  │       HELLO WORLD from %-24s       │\n", chip_model_str(chip.model));
     printf("  │                                                 │\n");
     printf("  │   WiFi-DensePose Capability Discovery v1.0      │\n");
     printf("  │                                                 │\n");
@@ -422,8 +492,9 @@ void app_main(void)
     probe_csi_details();
 
     print_separator("DONE — ALL CAPABILITIES REPORTED");
-    printf("\n  This ESP32-S3 is ready for WiFi-DensePose!\n");
-    printf("  Flash the full firmware (esp32-csi-node) to begin CSI sensing.\n\n");
+    printf("\n  This %s is ready for WiFi-DensePose experiments.\n",
+           chip_model_str(chip.model));
+    printf("  For production CSI on S3, flash esp32-csi-node; C6 path may differ.\n\n");
 
     /* Keep alive — blink a status message every 10 seconds */
     int tick = 0;

firmware/esp32-hello-world/sdkconfig.defaults

@@ -1,5 +1,5 @@
-# ESP32-S3 Hello World — SDK Configuration
-CONFIG_IDF_TARGET="esp32s3"
+# ESP32 Hello World — SDK Configuration (default: ESP32-C6)
+CONFIG_IDF_TARGET="esp32c6"
 
 # Flash: 4MB (this chip has Embedded Flash 4MB)
 CONFIG_ESPTOOLPY_FLASHSIZE_4MB=y

requirements-dev.txt

@@ -5,7 +5,7 @@
 pytest>=7.0.0
 pytest-asyncio>=0.21.0
 pytest-mock>=3.10.0
-pytest-benchmark>=4.0.0
+pytest-benchmark>=5.2.3
 
 # Linting and formatting
 black>=23.0.0

requirements.txt

@@ -7,7 +7,7 @@ torchvision>=0.13.0
 # API dependencies
 fastapi>=0.95.0
 uvicorn>=0.20.0
-websockets>=10.4
+websockets>=15.0.1
 pydantic>=1.10.0
 python-jose[cryptography]>=3.3.0
 python-multipart>=0.0.6
@@ -18,7 +18,7 @@ pydantic-settings>=2.0.0
 # Database dependencies
 sqlalchemy>=2.0.0
 asyncpg>=0.28.0
-aiosqlite>=0.19.0
+aiosqlite>=0.22.1
 redis>=4.5.0
 
 # CLI dependencies
@@ -26,8 +26,8 @@ click>=8.0.0
 alembic>=1.10.0
 
 # Hardware interface dependencies
-asyncio-mqtt>=0.11.0
-aiohttp>=3.8.0
+asyncio-mqtt>=0.16.2
+aiohttp>=3.13.5
 paramiko>=3.0.0
 
 # Data processing dependencies

scripts/fix-markers.json

@@ -110,6 +110,94 @@
       "require": ["VERIFY.sh", "witness-bundle"],
       "rationale": "scripts/generate-witness-bundle.sh produces the self-contained, recipient-verifiable witness bundle (witness log + proof + test results + firmware hashes + VERIFY.sh). Part of the ADR-028 attestation chain.",
       "ref": "docs/WITNESS-LOG-028.md"
+    },
+    {
+      "id": "RuView#559",
+      "title": "./verify wrapper points at archive/v1/ paths (post-v1-archive layout)",
+      "files": ["verify"],
+      "require": ["${SCRIPT_DIR}/archive/v1/data/proof", "${SCRIPT_DIR}/archive/v1/src"],
+      "rationale": "After v1 moved to archive/v1, the ./verify wrapper still pointed at the removed v1/ paths and failed before reaching verify.py on a fresh clone. Reverting to the un-prefixed paths reintroduces the FAIL-before-pipeline regression that #559 reported.",
+      "ref": "https://github.com/ruvnet/RuView/issues/559"
+    },
+    {
+      "id": "RuView#561",
+      "title": "ESP32 CSI firmware README documents the correct flash offsets (app at 0x20000, ota_data at 0xf000)",
+      "files": ["firmware/esp32-csi-node/README.md"],
+      "require": [
+        "0x20000 firmware/esp32-csi-node/build/esp32-csi-node.bin",
+        "0xf000  firmware/esp32-csi-node/build/ota_data_initial.bin",
+        "firmware/esp32-csi-node/provision.py"
+      ],
+      "forbid": [
+        "/0x10000 firmware\\/esp32-csi-node\\/build\\/esp32-csi-node\\.bin/",
+        "/python scripts\\/provision\\.py/"
+      ],
+      "rationale": "Partition tables (partitions_display.csv, partitions_4mb.csv) put ota_0 at 0x20000. The README previously said 0x10000 and pointed at scripts/provision.py (an older copy). Reverting causes first-time users to misflash and miss WiFi provisioning.",
+      "ref": "https://github.com/ruvnet/RuView/issues/561"
+    },
+    {
+      "id": "RuView#588-SEC020",
+      "title": "provision.py prints a fixed (set)/(empty) marker, not a length-leaking asterisk run",
+      "files": ["scripts/provision.py", "firmware/esp32-csi-node/provision.py"],
+      "require": ["(set)' if args.password else '(empty)"],
+      "forbid": ["/'\\*' \\* len\\(args\\.password\\)/"],
+      "rationale": "Both provision.py scripts previously printed '*' * len(args.password), masking the value but leaking the password length. Flagged as SEC020 by Repobility. Fix replaces with a fixed (set)/(empty) marker.",
+      "ref": "https://github.com/ruvnet/RuView/issues/588"
+    },
+    {
+      "id": "RuView#593",
+      "title": "vital_signs.rs uses circular variance for wrapped atan2 phase values",
+      "files": ["v2/crates/wifi-densepose-sensing-server/src/vital_signs.rs"],
+      "require": [
+        "phase_circular_variance",
+        "standard circular variance (1 - mean resultant length)",
+        "test_phase_variance_handles_wraparound"
+      ],
+      "rationale": "Phases come from atan2 and are wrapped to (-pi, pi]. The original linear mean/variance treated two phases straddling +/-pi (physically ~0 rad apart) as ~2*pi apart, producing variance ~pi^2 instead of ~1e-6 and feeding that noise straight into the heart-rate FFT buffer. Caused jumpy vitals in #519 and +/-15 BPM jitter in #485.",
+      "ref": "https://github.com/ruvnet/RuView/issues/593"
+    },
+    {
+      "id": "RuView#590-fuzz-stub",
+      "title": "Fuzz host stubs declare WIFI_PS_NONE / wifi_ps_type_t / esp_wifi_set_ps()",
+      "files": ["firmware/esp32-csi-node/test/stubs/esp_stubs.h"],
+      "require": ["wifi_ps_type_t", "WIFI_PS_NONE", "esp_wifi_set_ps"],
+      "rationale": "csi_collector.c:346 calls esp_wifi_set_ps(WIFI_PS_NONE) per the RuView#521 fix. The host-native fuzz target compiles csi_collector.c against test/stubs/esp_stubs.h; missing these symbols red-greens the Fuzz Testing (ADR-061 Layer 6) job. Was red on main for ~5 weeks before PR #590.",
+      "ref": "https://github.com/ruvnet/RuView/pull/590"
+    },
+    {
+      "id": "RuView#590-swarm-test",
+      "title": "QEMU swarm test passes --force-partial to provision.py for per-node overlays",
+      "files": ["scripts/qemu_swarm.py"],
+      "require": ["--force-partial"],
+      "rationale": "The per-node TDM/channel overlay intentionally omits WiFi creds (those live in the base flash image). Without --force-partial the issue #391 wifi-trio guard in provision.py rejects the call and breaks the Swarm Test (ADR-062) job. Was red on main for ~5 weeks before PR #590.",
+      "ref": "https://github.com/ruvnet/RuView/pull/590"
+    },
+    {
+      "id": "RuView#615",
+      "title": "path_safety::safe_id gates user-controlled IDs at filesystem boundaries",
+      "files": [
+        "v2/crates/wifi-densepose-sensing-server/src/path_safety.rs",
+        "v2/crates/wifi-densepose-sensing-server/src/recording.rs",
+        "v2/crates/wifi-densepose-sensing-server/src/model_manager.rs",
+        "v2/crates/wifi-densepose-sensing-server/src/training_api.rs"
+      ],
+      "require": [
+        "path_safety::safe_id",
+        "pub fn safe_id"
+      ],
+      "rationale": "Five endpoints used to embed user-controlled identifiers (session_name, model_id, dataset_id, recording id) into format!() paths with no sanitization, allowing classic '../../etc/passwd' reads, writes, and deletes on the server filesystem. The safe_id helper enforces [A-Za-z0-9._-] only (no leading '.', max 64 chars) and must run before any user input reaches a format!() that builds a path. Removing the helper or skipping it at any of these call sites reintroduces the #615 attack surface.",
+      "ref": "https://github.com/ruvnet/RuView/issues/615"
+    },
+    {
+      "id": "RuView#560",
+      "title": "verify.py quantizes features before SHA-256 for cross-platform hash stability",
+      "files": ["archive/v1/data/proof/verify.py"],
+      "require": [
+        "HASH_QUANTIZATION_DECIMALS",
+        "np.round(flat, HASH_QUANTIZATION_DECIMALS)"
+      ],
+      "rationale": "Without quantization, the SHA-256 of features_to_bytes() diverges across SIMD backends (Intel AVX2/AVX-512 vs Apple Silicon NEON) because scipy.fft's pocketfft kernels reorder vectorized FP operations differently per build. IEEE 754 guarantees per-operation determinism, not associativity. Rounding to 9 decimal places (~5 orders of magnitude headroom over observed ULP drift) collapses the cross-platform divergence to a single canonical hash. Removing the round() call reintroduces the macOS arm64 vs Linux x86_64 hash mismatch in issue #560.",
+      "ref": "https://github.com/ruvnet/RuView/issues/560"
     }
   ]
 }

scripts/probe-fft-platform.py

@@ -0,0 +1,86 @@
+#!/usr/bin/env python3
+"""Platform probe: reproduce verify.py's hash-relevant FFT steps in isolation.
+
+Runs the same scipy.fft.fft / scipy.signal calls that verify.py hashes
+(csi_processor.py:426, :438, :349) on a deterministic synthetic input,
+without dragging in src.app / pydantic Settings. Used to empirically
+locate the source of platform divergence in issue #560 — and now also to
+verify the quantize-before-hash fix shipped in archive/v1/data/proof/verify.py.
+
+Usage:  python3 scripts/probe-fft-platform.py
+Output: single JSON object on stdout. Run on each platform and diff.
+
+The output now contains TWO hashes:
+- `sha256_raw`       — hash of unrounded little-endian f64 bytes (legacy)
+- `sha256_quantized` — hash after np.round(.., 9) (matches verify.py
+                       behaviour after the issue-#560 fix; should be
+                       IDENTICAL across Intel AVX, ARM NEON, and any
+                       scipy pocketfft build)
+
+If `sha256_raw` differs across machines but `sha256_quantized` matches,
+the quantize-before-hash fix is doing its job.
+"""
+import hashlib
+import json
+import platform
+import struct
+import sys
+
+import numpy as np
+import scipy.fft
+import scipy.signal
+
+# Deterministic synthetic input -- no IO, no .env, no Settings
+rng = np.random.RandomState(42)
+N_FRAMES = 100
+N_SUBC = 100
+amp = rng.randn(N_FRAMES, N_SUBC).astype(np.float64)
+
+# Mirror the three scipy calls verify.py's hash depends on:
+#   archive/v1/src/core/csi_processor.py:349 -> scipy.signal.windows.hamming
+#   archive/v1/src/core/csi_processor.py:426 -> scipy.fft.fft(mean_phase_diff, n=64)
+#   archive/v1/src/core/csi_processor.py:438 -> scipy.fft.fft(amp.flatten(), n=128)
+mean_phase_diff = amp.mean(axis=1)
+doppler = np.abs(scipy.fft.fft(mean_phase_diff, n=64)) ** 2
+psd = np.abs(scipy.fft.fft(amp.flatten(), n=128)) ** 2
+window = scipy.signal.windows.hamming(56)
+
+# Quantization decimals — kept in sync with
+# archive/v1/data/proof/verify.py:HASH_QUANTIZATION_DECIMALS so this probe
+# verifies the production hash, not just the FFT outputs.
+HASH_QUANTIZATION_DECIMALS = 6
+
+
+def pack_floats(arrays, quantize):
+    """Pack arrays as little-endian f64, optionally rounding first."""
+    parts = []
+    for arr in arrays:
+        flat = np.asarray(arr, dtype=np.float64).ravel()
+        if quantize:
+            flat = np.round(flat, HASH_QUANTIZATION_DECIMALS)
+        parts.append(struct.pack(f"<{len(flat)}d", *flat))
+    return b"".join(parts)
+
+
+arrays = (doppler, psd, window)
+blob_raw = pack_floats(arrays, quantize=False)
+blob_quantized = pack_floats(arrays, quantize=True)
+
+try:
+    blas_info = np.show_config(mode="dicts")
+except Exception:
+    blas_info = {"error": "show_config(mode=dicts) unavailable"}
+
+print(json.dumps({
+    "uname": platform.uname()._asdict(),
+    "python": sys.version.split()[0],
+    "numpy": np.__version__,
+    "scipy": __import__("scipy").__version__,
+    "blob_len": len(blob_raw),
+    "sha256_raw": hashlib.sha256(blob_raw).hexdigest(),
+    "sha256_quantized": hashlib.sha256(blob_quantized).hexdigest(),
+    "quantization_decimals": HASH_QUANTIZATION_DECIMALS,
+    "first8_doppler_bytes_hex": doppler[:8].tobytes().hex(),
+    "first4_psd_floats": psd[:4].tolist(),
+    "blas_backend": blas_info if isinstance(blas_info, dict) else str(blas_info),
+}, indent=2, default=str))

scripts/udp-relay.py

@@ -0,0 +1,103 @@
+#!/usr/bin/env python3
+"""
+UDP relay for Docker Desktop on Windows (issue #374, #386).
+
+Docker Desktop on Windows multiplexes inbound UDP from multiple source IPs to
+a single source IP inside the container, which causes packets from all but one
+ESP32 node to be silently dropped at the WSL/Hyper-V boundary.
+
+This relay listens on the host, then re-emits each datagram from its own
+single socket back to a localhost port that Docker forwards into the
+container. Because every forwarded datagram now has the same source IP/port
+(the relay's loopback socket), Docker passes them all through.
+
+Usage:
+    # Default: listen on host:5005, forward to 127.0.0.1:5006
+    # Container should be started with -p 5006:5005/udp.
+    python scripts/udp-relay.py
+
+    # Custom ports
+    python scripts/udp-relay.py --listen-port 5005 --forward-port 5006
+
+    # Verbose (one line per packet)
+    python scripts/udp-relay.py --verbose
+"""
+
+import argparse
+import socket
+import sys
+import time
+
+
+def run_relay(listen_host: str, listen_port: int, forward_host: str,
+              forward_port: int, stats_interval: float, verbose: bool) -> int:
+    rx = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    rx.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+    try:
+        rx.bind((listen_host, listen_port))
+    except OSError as e:
+        print(f"udp-relay: failed to bind {listen_host}:{listen_port}: {e}",
+              file=sys.stderr)
+        return 1
+
+    tx = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    forward_addr = (forward_host, forward_port)
+
+    print(f"udp-relay: listening on {listen_host}:{listen_port} "
+          f"-> forwarding to {forward_host}:{forward_port}")
+    print("udp-relay: collapses multi-source UDP to a single loopback source "
+          "so Docker Desktop on Windows forwards every packet (issue #374).")
+
+    sources: dict[tuple[str, int], int] = {}
+    total = 0
+    last_stats = time.monotonic()
+
+    try:
+        while True:
+            data, src = rx.recvfrom(65535)
+            tx.sendto(data, forward_addr)
+            total += 1
+            sources[src] = sources.get(src, 0) + 1
+
+            if verbose:
+                print(f"udp-relay: {src[0]}:{src[1]} -> "
+                      f"{forward_host}:{forward_port} ({len(data)}B)")
+
+            now = time.monotonic()
+            if now - last_stats >= stats_interval:
+                print(f"udp-relay: forwarded {total} pkts from "
+                      f"{len(sources)} sources in last {stats_interval:.0f}s")
+                sources.clear()
+                total = 0
+                last_stats = now
+    except KeyboardInterrupt:
+        print("udp-relay: stopping")
+        return 0
+    finally:
+        rx.close()
+        tx.close()
+
+
+def main() -> int:
+    p = argparse.ArgumentParser(description=__doc__,
+                                formatter_class=argparse.RawDescriptionHelpFormatter)
+    p.add_argument("--listen-host", default="0.0.0.0",
+                   help="Host interface to bind (default: 0.0.0.0)")
+    p.add_argument("--listen-port", type=int, default=5005,
+                   help="Port the ESP32 nodes send to (default: 5005)")
+    p.add_argument("--forward-host", default="127.0.0.1",
+                   help="Where to forward packets (default: 127.0.0.1)")
+    p.add_argument("--forward-port", type=int, default=5006,
+                   help="Port Docker maps into the container (default: 5006)")
+    p.add_argument("--stats-interval", type=float, default=10.0,
+                   help="Seconds between stats lines (default: 10)")
+    p.add_argument("--verbose", action="store_true",
+                   help="Log every forwarded packet")
+    args = p.parse_args()
+
+    return run_relay(args.listen_host, args.listen_port, args.forward_host,
+                     args.forward_port, args.stats_interval, args.verbose)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

ui/mobile/package.json

@@ -13,15 +13,15 @@
   "dependencies": {
     "@expo/vector-icons": "^15.0.2",
     "@react-native-async-storage/async-storage": "2.2.0",
-    "@react-navigation/bottom-tabs": "^7.15.3",
+    "@react-navigation/bottom-tabs": "^7.15.10",
     "@react-navigation/native": "^7.1.31",
     "@types/three": "^0.183.1",
-    "axios": "^1.13.6",
+    "axios": "^1.15.2",
     "expo": "~55.0.4",
     "expo-status-bar": "~55.0.4",
     "react": "19.2.0",
-    "react-dom": "19.2.0",
-    "react-native": "0.83.2",
+    "react-dom": "19.2.6",
+    "react-native": "0.85.2",
     "react-native-gesture-handler": "~2.30.0",
     "react-native-reanimated": "4.2.1",
     "react-native-safe-area-context": "~5.6.2",
@@ -32,20 +32,20 @@
     "react-native-wifi-reborn": "^4.13.6",
     "three": "^0.183.2",
     "victory-native": "^41.20.2",
-    "zustand": "^5.0.11"
+    "zustand": "^5.0.12"
   },
   "devDependencies": {
     "@testing-library/jest-native": "^5.4.3",
     "@testing-library/react-native": "^13.3.3",
     "@types/jest": "^30.0.0",
     "@types/react": "~19.2.2",
-    "@typescript-eslint/eslint-plugin": "^8.56.1",
+    "@typescript-eslint/eslint-plugin": "^8.59.3",
     "@typescript-eslint/parser": "^8.56.1",
     "babel-preset-expo": "^55.0.10",
-    "eslint": "^10.0.2",
+    "eslint": "^10.2.1",
     "jest": "^30.2.0",
     "jest-expo": "^55.0.9",
-    "prettier": "^3.8.1",
+    "prettier": "^3.8.3",
     "react-native-worklets": "^0.7.4",
     "typescript": "~5.9.2"
   },

ui/utils/pose-renderer.js

@@ -651,14 +651,18 @@ export class PoseRenderer {
     this.performanceMetrics.frameCount++;
 
     if (this.performanceMetrics.lastFrameTime > 0) {
-      const deltaTime = currentTime - this.performanceMetrics.lastFrameTime;
+      // Clamp to a minimum dt so consecutive frames within the same
+      // performance.now() tick don't yield Infinity (issue #519 Bug 2).
+      // 1 ms floor caps the displayed FPS at 1000 — far above any real
+      // render rate, but finite so the EMA stays well-defined.
+      const deltaTime = Math.max(currentTime - this.performanceMetrics.lastFrameTime, 1);
       const fps = 1000 / deltaTime;
-      
+
       // Update average FPS using exponential moving average
       if (this.performanceMetrics.averageFps === 0) {
         this.performanceMetrics.averageFps = fps;
       } else {
-        this.performanceMetrics.averageFps = 
+        this.performanceMetrics.averageFps =
           (this.performanceMetrics.averageFps * 0.9) + (fps * 0.1);
       }
     }

v2/Cargo.lock

@@ -83,18 +83,18 @@ dependencies = [
 
 [[package]]
 name = "ansi-str"
-version = "0.8.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1cf4578926a981ab0ca955dc023541d19de37112bc24c1a197bd806d3d86ad1d"
+checksum = "060de1453b69f46304b28274f382132f4e72c55637cf362920926a70d090890d"
 dependencies = [
  "ansitok",
 ]
 
 [[package]]
 name = "ansitok"
-version = "0.2.0"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "220044e6a1bb31ddee4e3db724d29767f352de47445a6cd75e1a173142136c83"
+checksum = "c0a8acea8c2f1c60f0a92a8cd26bf96ca97db56f10bbcab238bbe0cceba659ee"
 dependencies = [
  "nom",
  "vte",
@@ -180,15 +180,6 @@ version = "1.0.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
 
-[[package]]
-name = "approx"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f2a05fd1bd10b2527e20a2cd32d8873d115b8b39fe219ee25f42a8aca6ba278"
-dependencies = [
- "num-traits",
-]
-
 [[package]]
 name = "approx"
 version = "0.5.1"
@@ -200,9 +191,9 @@ dependencies = [
 
 [[package]]
 name = "arrayvec"
-version = "0.5.2"
+version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23b62fc65de8e4e7f52534fb52b0f3ed04746ae267519eef2a83941e8085068b"
+checksum = "7c02d123df017efcdfbd739ef81735b36c5ba83ec3c59c80a9d7ecc718f92e50"
 
 [[package]]
 name = "as-slice"
@@ -918,10 +909,22 @@ dependencies = [
  "encode_unicode",
  "libc",
  "once_cell",
- "unicode-width 0.2.2",
+ "unicode-width",
  "windows-sys 0.59.0",
 ]
 
+[[package]]
+name = "console"
+version = "0.16.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d64e8af5551369d19cf50138de61f1c42074ab970f74e99be916646777f8fc87"
+dependencies = [
+ "encode_unicode",
+ "libc",
+ "unicode-width",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "console_error_panic_hook"
 version = "0.1.7"
@@ -1348,7 +1351,7 @@ dependencies = [
  "libc",
  "option-ext",
  "redox_users 0.5.2",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -1553,7 +1556,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -2092,7 +2095,7 @@ version = "0.7.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24f8647af4005fa11da47cd56252c6ef030be8fa97bdbf355e7dfb6348f0a82c"
 dependencies = [
- "approx 0.5.1",
+ "approx",
  "num-traits",
  "rstar 0.10.0",
  "rstar 0.11.0",
@@ -2687,7 +2690,7 @@ dependencies = [
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.6.2",
+ "socket2 0.5.10",
  "tokio",
  "tower-service",
  "tracing",
@@ -2880,10 +2883,10 @@ version = "0.17.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "183b3088984b400f4cfac3620d5e076c84da5364016b4f49473de574b2586235"
 dependencies = [
- "console",
+ "console 0.15.11",
  "number_prefix",
  "portable-atomic",
- "unicode-width 0.2.2",
+ "unicode-width",
  "web-time",
 ]
 
@@ -2948,7 +2951,7 @@ checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46"
 dependencies = [
  "hermit-abi",
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -3138,25 +3141,25 @@ dependencies = [
 
 [[package]]
 name = "lapack-sys"
-version = "0.14.0"
+version = "0.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "447f56c85fb410a7a3d36701b2153c1018b1d2b908c5fbaf01c1b04fac33bcbe"
+checksum = "314b879030845b68571809a6978e52d3b67ac5fba07e77b1b317b484092e2fb5"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "lax"
-version = "0.16.0"
+version = "0.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f96a229d9557112e574164f8024ce703625ad9f88a90964c1780809358e53da"
+checksum = "bda593cb87a3b1c06625e73710812005caf1523e45b0b898adcd7716602f8ba2"
 dependencies = [
  "cauchy",
  "katexit",
  "lapack-sys",
  "num-traits",
  "openblas-src",
- "thiserror 1.0.69",
+ "thiserror 2.0.18",
 ]
 
 [[package]]
@@ -3619,7 +3622,7 @@ version = "0.33.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26aecdf64b707efd1310e3544d709c5c0ac61c13756046aaaba41be5c4f66a3b"
 dependencies = [
- "approx 0.5.1",
+ "approx",
  "matrixmultiply",
  "nalgebra-macros",
  "num-complex",
@@ -3672,9 +3675,6 @@ version = "0.15.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "adb12d4e967ec485a5f71c6311fe28158e9d6f4bc4a447b474184d0f91a8fa32"
 dependencies = [
- "approx 0.4.0",
- "cblas-sys",
- "libc",
  "matrixmultiply",
  "num-complex",
  "num-integer",
@@ -3705,6 +3705,9 @@ version = "0.17.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "520080814a7a6b4a6e9070823bb24b4531daac8c4627e08ba5de8c5ef2f2752d"
 dependencies = [
+ "approx",
+ "cblas-sys",
+ "libc",
  "matrixmultiply",
  "num-complex",
  "num-integer",
@@ -3716,18 +3719,18 @@ dependencies = [
 
 [[package]]
 name = "ndarray-linalg"
-version = "0.16.0"
+version = "0.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b0e8dda0c941b64a85c5deb2b3e0144aca87aced64678adfc23eacea6d2cc42"
+checksum = "eb0783188ff249ab498417e0477f7fade3b312d1d287314ca76de570d9a83ee0"
 dependencies = [
  "cauchy",
  "katexit",
  "lax",
- "ndarray 0.15.6",
+ "ndarray 0.17.2",
  "num-complex",
  "num-traits",
  "rand 0.8.5",
- "thiserror 1.0.69",
+ "thiserror 2.0.18",
 ]
 
 [[package]]
@@ -3852,7 +3855,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -3955,7 +3958,7 @@ checksum = "830b246a0e5f20af87141b25c173cd1b609bd7779a4617d6ec582abaf90870f3"
 name = "nvsim"
 version = "0.3.0"
 dependencies = [
- "approx 0.5.1",
+ "approx",
  "criterion",
  "js-sys",
  "rand 0.8.5",
@@ -3964,7 +3967,7 @@ dependencies = [
  "serde-wasm-bindgen",
  "serde_json",
  "sha2",
- "thiserror 1.0.69",
+ "thiserror 2.0.18",
  "tracing",
  "wasm-bindgen",
 ]
@@ -3979,10 +3982,10 @@ dependencies = [
  "nvsim",
  "serde",
  "serde_json",
- "thiserror 1.0.69",
+ "thiserror 2.0.18",
  "tokio",
  "tower 0.4.13",
- "tower-http 0.5.2",
+ "tower-http",
  "tracing",
  "tracing-subscriber",
 ]
@@ -4057,6 +4060,7 @@ checksum = "e3e0adef53c21f888deb4fa59fc59f7eb17404926ee8a6f59f5df0fd7f9f3272"
 dependencies = [
  "bitflags 2.11.0",
  "block2",
+ "libc",
  "objc2",
  "objc2-core-foundation",
 ]
@@ -4256,7 +4260,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.45.0",
 ]
 
 [[package]]
@@ -4286,15 +4290,15 @@ dependencies = [
 
 [[package]]
 name = "papergrid"
-version = "0.11.0"
+version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ad43c07024ef767f9160710b3a6773976194758c7919b17e63b863db0bdf7fb"
+checksum = "6978128c8b51d8f4080631ceb2302ab51e32cc6e8615f735ee2f83fd269ae3f1"
 dependencies = [
  "ansi-str",
  "ansitok",
  "bytecount",
  "fnv",
- "unicode-width 0.1.14",
+ "unicode-width",
 ]
 
 [[package]]
@@ -4834,6 +4838,28 @@ dependencies = [
  "version_check",
 ]
 
+[[package]]
+name = "proc-macro-error-attr2"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96de42df36bb9bba5542fe9f1a054b8cc87e172759a1868aa05c1f3acc89dfc5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+]
+
+[[package]]
+name = "proc-macro-error2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11ec05c52be0a07b08061f7dd003e7d7092e0472bc731b4af7bb1ef876109802"
+dependencies = [
+ "proc-macro-error-attr2",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "proc-macro-hack"
 version = "0.5.20+deprecated"
@@ -4941,7 +4967,7 @@ dependencies = [
  "quinn-udp",
  "rustc-hash",
  "rustls 0.23.37",
- "socket2 0.6.2",
+ "socket2 0.5.10",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
@@ -4980,9 +5006,9 @@ dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2 0.6.2",
+ "socket2 0.5.10",
  "tracing",
- "windows-sys 0.60.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -5385,7 +5411,7 @@ dependencies = [
  "tokio",
  "tokio-native-tls",
  "tower 0.5.3",
- "tower-http 0.6.8",
+ "tower-http",
  "tower-service",
  "url",
  "wasm-bindgen",
@@ -5418,7 +5444,7 @@ dependencies = [
  "tokio",
  "tokio-util",
  "tower 0.5.3",
- "tower-http 0.6.8",
+ "tower-http",
  "tower-service",
  "url",
  "wasm-bindgen",
@@ -5611,7 +5637,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -5703,7 +5729,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -5799,9 +5825,9 @@ dependencies = [
 
 [[package]]
 name = "ruvector-core"
-version = "2.0.5"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc7bc95e3682430c27228d7bc694ba9640cd322dde1bd5e7c9cf96a16afb4ca1"
+checksum = "83fe578d02c93613b26d40105c9663df5e86414195e91db0ea7470d3b9c64843"
 dependencies = [
  "anyhow",
  "bincode 2.0.1",
@@ -5900,9 +5926,9 @@ dependencies = [
 
 [[package]]
 name = "ruvector-temporal-tensor"
-version = "2.0.4"
+version = "2.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "178f93f84a4a72c582026a45d9b8710acf188df4a22a25434c5dbba1df6c4cac"
+checksum = "753a07254fa68db183949ec6c7575d890da4d42404afabc11d610a720fcf570c"
 
 [[package]]
 name = "ryu"
@@ -6191,9 +6217,9 @@ dependencies = [
 
 [[package]]
 name = "serde_spanned"
-version = "1.0.4"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8bbf91e5a4d6315eee45e704372590b30e260ee83af6639d64557f51b067776"
+checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
 dependencies = [
  "serde_core",
 ]
@@ -6377,7 +6403,7 @@ version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c99284beb21666094ba2b75bbceda012e610f5479dfcc2d6e2426f53197ffd95"
 dependencies = [
- "approx 0.5.1",
+ "approx",
  "num-complex",
  "num-traits",
  "paste",
@@ -6715,28 +6741,28 @@ dependencies = [
 
 [[package]]
 name = "tabled"
-version = "0.15.0"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c998b0c8b921495196a48aabaf1901ff28be0760136e31604f7967b0792050e"
+checksum = "e39a2ee1fbcd360805a771e1b300f78cc88fec7b8d3e2f71cd37bbf23e725c7d"
 dependencies = [
  "ansi-str",
  "ansitok",
  "papergrid",
  "tabled_derive",
- "unicode-width 0.1.14",
+ "testing_table",
 ]
 
 [[package]]
 name = "tabled_derive"
-version = "0.7.0"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c138f99377e5d653a371cdad263615634cfc8467685dfe8e73e2b8e98f44b17"
+checksum = "0ea5d1b13ca6cff1f9231ffd62f15eefd72543dab5e468735f1a456728a02846"
 dependencies = [
- "heck 0.4.1",
- "proc-macro-error",
+ "heck 0.5.0",
+ "proc-macro-error2",
  "proc-macro2",
  "quote",
- "syn 1.0.109",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -6938,9 +6964,9 @@ dependencies = [
 
 [[package]]
 name = "tauri-plugin-dialog"
-version = "2.6.0"
+version = "2.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9204b425d9be8d12aa60c2a83a289cf7d1caae40f57f336ed1155b3a5c0e359b"
+checksum = "65981abb771e74e571a38196c3baa11c459379164791eba0e67abc1a5fac9884"
 dependencies = [
  "log",
  "raw-window-handle",
@@ -6956,13 +6982,15 @@ dependencies = [
 
 [[package]]
 name = "tauri-plugin-fs"
-version = "2.4.5"
+version = "2.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed390cc669f937afeb8b28032ce837bac8ea023d975a2e207375ec05afaf1804"
+checksum = "b7ecc274121aca0c036a2b42d1cbe83d368d348f54e0bb8a735c2b1548e8f371"
 dependencies = [
  "anyhow",
  "dunce",
  "glob",
+ "log",
+ "objc2-foundation",
  "percent-encoding",
  "schemars 0.8.22",
  "serde",
@@ -6972,7 +7000,7 @@ dependencies = [
  "tauri-plugin",
  "tauri-utils",
  "thiserror 2.0.18",
- "toml 0.9.12+spec-1.1.0",
+ "toml 1.1.2+spec-1.1.0",
  "url",
 ]
 
@@ -7099,14 +7127,14 @@ dependencies = [
 
 [[package]]
 name = "tch"
-version = "0.14.0"
+version = "0.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ed5dddab3812892bf5fb567136e372ea49f31672931e21cec967ca68aec03da"
+checksum = "0d3f84a069d8ba16dbf720b61e8bf131d90ffb8e958a664eae8e4993c5c2fa6f"
 dependencies = [
  "half",
  "lazy_static",
  "libc",
- "ndarray 0.15.6",
+ "ndarray 0.16.1",
  "rand 0.8.5",
  "safetensors 0.3.3",
  "thiserror 1.0.69",
@@ -7124,7 +7152,7 @@ dependencies = [
  "getrandom 0.4.1",
  "once_cell",
  "rustix",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -7144,6 +7172,16 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f50febec83f5ee1df3015341d8bd429f2d1cc62bcba7ea2076759d315084683"
 
+[[package]]
+name = "testing_table"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f8daae29995a24f65619e19d8d31dea5b389f3d853d8bf297bbf607cd0014cc"
+dependencies = [
+ "ansitok",
+ "unicode-width",
+]
+
 [[package]]
 name = "thiserror"
 version = "1.0.69"
@@ -7388,13 +7426,28 @@ checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863"
 dependencies = [
  "indexmap 2.13.0",
  "serde_core",
- "serde_spanned 1.0.4",
+ "serde_spanned 1.1.1",
  "toml_datetime 0.7.5+spec-1.1.0",
  "toml_parser",
  "toml_writer",
  "winnow 0.7.14",
 ]
 
+[[package]]
+name = "toml"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81f3d15e84cbcd896376e6730314d59fb5a87f31e4b038454184435cd57defee"
+dependencies = [
+ "indexmap 2.13.0",
+ "serde_core",
+ "serde_spanned 1.1.1",
+ "toml_datetime 1.1.1+spec-1.1.0",
+ "toml_parser",
+ "toml_writer",
+ "winnow 1.0.2",
+]
+
 [[package]]
 name = "toml_datetime"
 version = "0.6.3"
@@ -7415,9 +7468,9 @@ dependencies = [
 
 [[package]]
 name = "toml_datetime"
-version = "1.0.0+spec-1.1.0"
+version = "1.1.1+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32c2555c699578a4f59f0cc68e5116c8d7cabbd45e1409b989d4be085b53f13e"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
 dependencies = [
  "serde_core",
 ]
@@ -7453,31 +7506,31 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7193cbd0ce53dc966037f54351dbbcf0d5a642c7f0038c382ef9e677ce8c13f2"
 dependencies = [
  "indexmap 2.13.0",
- "toml_datetime 1.0.0+spec-1.1.0",
+ "toml_datetime 1.1.1+spec-1.1.0",
  "toml_parser",
  "winnow 0.7.14",
 ]
 
 [[package]]
 name = "toml_parser"
-version = "1.0.9+spec-1.1.0"
+version = "1.1.2+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "702d4415e08923e7e1ef96cd5727c0dfed80b4d2fa25db9647fe5eb6f7c5a4c4"
+checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526"
 dependencies = [
- "winnow 0.7.14",
+ "winnow 1.0.2",
 ]
 
 [[package]]
 name = "toml_writer"
-version = "1.0.6+spec-1.1.0"
+version = "1.1.1+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab16f14aed21ee8bfd8ec22513f7287cd4a91aa92e44edfe2c17ddd004e92607"
+checksum = "756daf9b1013ebe47a8776667b466417e2d4c5679d441c26230efd9ef78692db"
 
 [[package]]
 name = "torch-sys"
-version = "0.14.0"
+version = "0.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "803446f89fb877a117503dbfb8375b6a29fa8b0e0f44810fac3863c798ecef22"
+checksum = "f4ba78777379cf09aaa79708c63e477cf0f95e021d04360c6821f1a9f56173f7"
 dependencies = [
  "anyhow",
  "cc",
@@ -7524,9 +7577,9 @@ dependencies = [
 
 [[package]]
 name = "tower-http"
-version = "0.5.2"
+version = "0.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e9cd434a998747dd2c4276bc96ee2e0c7a2eadf3cae88e52be55a05fa9053f5"
+checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
 dependencies = [
  "async-compression",
  "bitflags 2.11.0",
@@ -7538,33 +7591,17 @@ dependencies = [
  "http-body-util",
  "http-range-header",
  "httpdate",
+ "iri-string",
  "mime",
  "mime_guess",
  "percent-encoding",
  "pin-project-lite",
  "tokio",
  "tokio-util",
- "tower-layer",
- "tower-service",
- "tracing",
-]
-
-[[package]]
-name = "tower-http"
-version = "0.6.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
-dependencies = [
- "bitflags 2.11.0",
- "bytes",
- "futures-util",
- "http 1.4.0",
- "http-body 1.0.1",
- "iri-string",
- "pin-project-lite",
  "tower 0.5.3",
  "tower-layer",
  "tower-service",
+ "tracing",
 ]
 
 [[package]]
@@ -7802,12 +7839,6 @@ version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
 
-[[package]]
-name = "unicode-width"
-version = "0.1.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"
-
 [[package]]
 name = "unicode-width"
 version = "0.2.2"
@@ -7969,23 +8000,12 @@ dependencies = [
 
 [[package]]
 name = "vte"
-version = "0.10.1"
+version = "0.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6cbce692ab4ca2f1f3047fcf732430249c0e971bfdd2b234cf2c47ad93af5983"
+checksum = "231fdcd7ef3037e8330d8e17e61011a2c244126acc0a982f4040ac3f9f0bc077"
 dependencies = [
  "arrayvec",
- "utf8parse",
- "vte_generate_state_changes",
-]
-
-[[package]]
-name = "vte_generate_state_changes"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e369bee1b05d510a7b4ed645f5faa90619e05437111783ea5848f28d97d3c2e"
-dependencies = [
- "proc-macro2",
- "quote",
+ "memchr",
 ]
 
 [[package]]
@@ -8333,10 +8353,6 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72069c3113ab32ab29e5584db3c6ec55d416895e60715417b5b883a357c3e471"
 
-[[package]]
-name = "wifi-densepose-api"
-version = "0.3.0"
-
 [[package]]
 name = "wifi-densepose-cli"
 version = "0.3.0"
@@ -8346,7 +8362,7 @@ dependencies = [
  "chrono",
  "clap",
  "colored",
- "console",
+ "console 0.16.3",
  "csv",
  "indicatif",
  "predicates",
@@ -8354,7 +8370,7 @@ dependencies = [
  "serde_json",
  "tabled",
  "tempfile",
- "thiserror 1.0.69",
+ "thiserror 2.0.18",
  "tokio",
  "tracing",
  "tracing-subscriber",
@@ -8362,10 +8378,6 @@ dependencies = [
  "wifi-densepose-mat",
 ]
 
-[[package]]
-name = "wifi-densepose-config"
-version = "0.3.0"
-
 [[package]]
 name = "wifi-densepose-core"
 version = "0.3.0"
@@ -8378,14 +8390,10 @@ dependencies = [
  "proptest",
  "serde",
  "serde_json",
- "thiserror 1.0.69",
+ "thiserror 2.0.18",
  "uuid",
 ]
 
-[[package]]
-name = "wifi-densepose-db"
-version = "0.3.0"
-
 [[package]]
 name = "wifi-densepose-desktop"
 version = "0.3.0"
@@ -8408,7 +8416,7 @@ dependencies = [
  "tauri-build",
  "tauri-plugin-dialog",
  "tauri-plugin-shell",
- "thiserror 1.0.69",
+ "thiserror 2.0.18",
  "tokio",
  "tokio-serial",
  "tracing",
@@ -8431,7 +8439,7 @@ dependencies = [
 name = "wifi-densepose-hardware"
 version = "0.3.0"
 dependencies = [
- "approx 0.5.1",
+ "approx",
  "byteorder",
  "chrono",
  "clap",
@@ -8442,7 +8450,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2",
- "thiserror 1.0.69",
+ "thiserror 2.0.18",
  "tokio",
  "tracing",
 ]
@@ -8452,7 +8460,7 @@ name = "wifi-densepose-mat"
 version = "0.3.0"
 dependencies = [
  "anyhow",
- "approx 0.5.1",
+ "approx",
  "async-trait",
  "axum",
  "chrono",
@@ -8468,7 +8476,7 @@ dependencies = [
  "ruvector-temporal-tensor",
  "serde",
  "serde_json",
- "thiserror 1.0.69",
+ "thiserror 2.0.18",
  "tokio",
  "tokio-test",
  "tracing",
@@ -8496,7 +8504,7 @@ dependencies = [
  "serde_json",
  "tch",
  "tempfile",
- "thiserror 1.0.69",
+ "thiserror 2.0.18",
  "tokio",
  "tracing",
 ]
@@ -8514,14 +8522,14 @@ dependencies = [
  "serde",
  "serde_json",
  "tokio",
- "tower-http 0.5.2",
+ "tower-http",
 ]
 
 [[package]]
 name = "wifi-densepose-ruvector"
 version = "0.3.0"
 dependencies = [
- "approx 0.5.1",
+ "approx",
  "criterion",
  "ruvector-attention 2.0.4",
  "ruvector-attn-mincut",
@@ -8534,7 +8542,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2",
- "thiserror 1.0.69",
+ "thiserror 2.0.18",
 ]
 
 [[package]]
@@ -8553,7 +8561,7 @@ dependencies = [
  "tempfile",
  "tokio",
  "tower 0.4.13",
- "tower-http 0.5.2",
+ "tower-http",
  "tracing",
  "tracing-subscriber",
  "wifi-densepose-signal",
@@ -8580,7 +8588,7 @@ dependencies = [
  "ruvector-solver",
  "serde",
  "serde_json",
- "thiserror 1.0.69",
+ "thiserror 2.0.18",
  "wifi-densepose-core",
  "wifi-densepose-ruvector",
 ]
@@ -8590,7 +8598,7 @@ name = "wifi-densepose-train"
 version = "0.3.1"
 dependencies = [
  "anyhow",
- "approx 0.5.1",
+ "approx",
  "chrono",
  "clap",
  "criterion",
@@ -8613,7 +8621,7 @@ dependencies = [
  "sha2",
  "tch",
  "tempfile",
- "thiserror 1.0.69",
+ "thiserror 2.0.18",
  "tokio",
  "toml 0.8.2",
  "tracing",
@@ -8685,7 +8693,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -9243,6 +9251,12 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "winnow"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ee1708bef14716a11bae175f579062d4554d95be2c6829f518df847b7b3fdd0"
+
 [[package]]
 name = "winreg"
 version = "0.50.0"

v2/Cargo.toml

@@ -4,9 +4,16 @@ members = [
     "crates/wifi-densepose-core",
     "crates/wifi-densepose-signal",
     "crates/wifi-densepose-nn",
-    "crates/wifi-densepose-api",
-    "crates/wifi-densepose-db",
-    "crates/wifi-densepose-config",
+    # wifi-densepose-api / -db / -config: removed in #578.
+    # The crate names were reserved early for an envisioned REST/database/config
+    # split, but no implementation followed and no code referenced them. The
+    # functionality they would provide is covered today by:
+    #   - REST/WS: `wifi-densepose-sensing-server` (Axum)
+    #   - Config:  per-crate config + CLI args in `wifi-densepose-sensing-server`
+    #             and `wifi-densepose-desktop`
+    #   - DB:      no persistent state; system is real-time
+    # If we ever need any of these as a published surface, they can be
+    # reintroduced with a real implementation.
     "crates/wifi-densepose-hardware",
     "crates/wifi-densepose-wasm",
     "crates/wifi-densepose-cli",
@@ -46,7 +53,7 @@ categories = ["science", "computer-vision", "wasm"]
 
 [workspace.dependencies]
 # Core utilities
-thiserror = "1.0"
+thiserror = "2.0"
 anyhow = "1.0"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
@@ -57,13 +64,13 @@ tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
 
 # Signal processing
 ndarray = { version = "0.15", features = ["serde"] }
-ndarray-linalg = { version = "0.16", features = ["openblas-static"] }
+ndarray-linalg = { version = "0.18", features = ["openblas-static"] }
 rustfft = "6.1"
 num-complex = "0.4"
 num-traits = "0.2"
 
 # Neural network
-tch = "0.14"
+tch = "0.24"
 ort = { version = "2.0.0-rc.11" }
 candle-core = "0.4"
 candle-nn = "0.4"
@@ -71,7 +78,7 @@ candle-nn = "0.4"
 # Web framework
 axum = { version = "0.7", features = ["ws", "macros"] }
 tower = { version = "0.4", features = ["full"] }
-tower-http = { version = "0.5", features = ["cors", "trace", "compression-gzip"] }
+tower-http = { version = "0.6", features = ["cors", "trace", "compression-gzip"] }
 hyper = { version = "1.1", features = ["full"] }
 
 # Database
@@ -134,10 +141,10 @@ midstreamer-attractor = "0.1.0"
 
 # ruvector integration (published on crates.io)
 # Vendored at v2.1.0 in vendor/ruvector; using crates.io versions until published.
-ruvector-core = "2.0.4"
+ruvector-core = "2.2.0"
 ruvector-mincut = "2.0.4"
 ruvector-attn-mincut = "2.0.4"
-ruvector-temporal-tensor = "2.0.4"
+ruvector-temporal-tensor = "2.0.6"
 ruvector-solver = "2.0.4"
 ruvector-attention = "2.0.4"
 ruvector-crv = "0.1.1"

v2/crates/wifi-densepose-api/Cargo.toml

@@ -1,14 +0,0 @@
-[package]
-name = "wifi-densepose-api"
-version.workspace = true
-edition.workspace = true
-description = "REST API for WiFi-DensePose"
-license.workspace = true
-authors = ["rUv <ruv@ruv.net>", "WiFi-DensePose Contributors"]
-repository.workspace = true
-documentation.workspace = true
-keywords = ["wifi", "api", "rest", "densepose", "websocket"]
-categories = ["web-programming::http-server", "science"]
-readme = "README.md"
-
-[dependencies]

v2/crates/wifi-densepose-api/README.md

@@ -1,71 +0,0 @@
-# wifi-densepose-api
-
-[![Crates.io](https://img.shields.io/crates/v/wifi-densepose-api.svg)](https://crates.io/crates/wifi-densepose-api)
-[![Documentation](https://docs.rs/wifi-densepose-api/badge.svg)](https://docs.rs/wifi-densepose-api)
-[![License](https://img.shields.io/crates/l/wifi-densepose-api.svg)](LICENSE)
-
-REST and WebSocket API layer for the WiFi-DensePose pose estimation system.
-
-## Overview
-
-`wifi-densepose-api` provides the HTTP service boundary for WiFi-DensePose. Built on
-[axum](https://github.com/tokio-rs/axum), it exposes REST endpoints for pose queries, CSI frame
-ingestion, and model management, plus a WebSocket feed for real-time pose streaming to frontend
-clients.
-
-> **Status:** This crate is currently a stub. The intended API surface is documented below.
-
-## Planned Features
-
-- **REST endpoints** -- CRUD for scan zones, pose queries, model configuration, and health checks.
-- **WebSocket streaming** -- Real-time pose estimate broadcasts with per-client subscription filters.
-- **Authentication** -- Token-based auth middleware via `tower` layers.
-- **Rate limiting** -- Configurable per-route limits to protect hardware-constrained deployments.
-- **OpenAPI spec** -- Auto-generated documentation via `utoipa`.
-- **CORS** -- Configurable cross-origin support for browser-based dashboards.
-- **Graceful shutdown** -- Clean connection draining on SIGTERM.
-
-## Quick Start
-
-```rust
-// Intended usage (not yet implemented)
-use wifi_densepose_api::Server;
-
-#[tokio::main]
-async fn main() -> anyhow::Result<()> {
-    let server = Server::builder()
-        .bind("0.0.0.0:3000")
-        .with_websocket("/ws/poses")
-        .build()
-        .await?;
-
-    server.run().await
-}
-```
-
-## Planned Endpoints
-
-| Method | Path | Description |
-|--------|------|-------------|
-| `GET` | `/api/v1/health` | Liveness and readiness probes |
-| `GET` | `/api/v1/poses` | Latest pose estimates |
-| `POST` | `/api/v1/csi` | Ingest raw CSI frames |
-| `GET` | `/api/v1/zones` | List scan zones |
-| `POST` | `/api/v1/zones` | Create a scan zone |
-| `WS` | `/ws/poses` | Real-time pose stream |
-| `WS` | `/ws/vitals` | Real-time vital sign stream |
-
-## Related Crates
-
-| Crate | Role |
-|-------|------|
-| [`wifi-densepose-core`](../wifi-densepose-core) | Shared types and traits |
-| [`wifi-densepose-config`](../wifi-densepose-config) | Configuration loading |
-| [`wifi-densepose-db`](../wifi-densepose-db) | Database persistence |
-| [`wifi-densepose-nn`](../wifi-densepose-nn) | Neural network inference |
-| [`wifi-densepose-signal`](../wifi-densepose-signal) | CSI signal processing |
-| [`wifi-densepose-sensing-server`](../wifi-densepose-sensing-server) | Lightweight sensing UI server |
-
-## License
-
-MIT OR Apache-2.0

v2/crates/wifi-densepose-api/src/lib.rs

@@ -1 +0,0 @@
-//! WiFi-DensePose REST API (stub)

v2/crates/wifi-densepose-cli/Cargo.toml

@@ -28,9 +28,9 @@ clap = { version = "4.4", features = ["derive", "env", "cargo"] }
 
 # Output formatting
 colored = "2.1"
-tabled = { version = "0.15", features = ["ansi"] }
+tabled = { version = "0.20", features = ["ansi"] }
 indicatif = "0.17"
-console = "0.15"
+console = "0.16"
 
 # Async runtime
 tokio = { version = "1.35", features = ["full"] }
@@ -42,7 +42,7 @@ csv = "1.3"
 
 # Error handling
 anyhow = "1.0"
-thiserror = "1.0"
+thiserror = "2.0"
 
 # Time
 chrono = { version = "0.4", features = ["serde"] }

v2/crates/wifi-densepose-config/Cargo.toml

@@ -1,14 +0,0 @@
-[package]
-name = "wifi-densepose-config"
-version.workspace = true
-edition.workspace = true
-description = "Configuration management for WiFi-DensePose"
-license.workspace = true
-authors = ["rUv <ruv@ruv.net>", "WiFi-DensePose Contributors"]
-repository.workspace = true
-documentation.workspace = true
-keywords = ["wifi", "configuration", "densepose", "settings", "toml"]
-categories = ["config", "science"]
-readme = "README.md"
-
-[dependencies]

v2/crates/wifi-densepose-config/README.md

@@ -1,89 +0,0 @@
-# wifi-densepose-config
-
-[![Crates.io](https://img.shields.io/crates/v/wifi-densepose-config.svg)](https://crates.io/crates/wifi-densepose-config)
-[![Documentation](https://docs.rs/wifi-densepose-config/badge.svg)](https://docs.rs/wifi-densepose-config)
-[![License](https://img.shields.io/crates/l/wifi-densepose-config.svg)](LICENSE)
-
-Configuration management for the WiFi-DensePose pose estimation system.
-
-## Overview
-
-`wifi-densepose-config` provides a unified configuration layer that merges values from environment
-variables, TOML/YAML files, and CLI overrides into strongly-typed Rust structs. Built on the
-[config](https://docs.rs/config), [dotenvy](https://docs.rs/dotenvy), and
-[envy](https://docs.rs/envy) ecosystem from the workspace.
-
-> **Status:** This crate is currently a stub. The intended API surface is documented below.
-
-## Planned Features
-
-- **Multi-source loading** -- Merge configuration from `.env`, TOML files, YAML files, and
-  environment variables with well-defined precedence.
-- **Typed configuration** -- Strongly-typed structs for server, signal processing, neural network,
-  hardware, and database settings.
-- **Validation** -- Schema validation with human-readable error messages on startup.
-- **Hot reload** -- Watch configuration files for changes and notify dependent services.
-- **Profile support** -- Named profiles (`development`, `production`, `testing`) with per-profile
-  overrides.
-- **Secret filtering** -- Redact sensitive values (API keys, database passwords) in logs and debug
-  output.
-
-## Quick Start
-
-```rust
-// Intended usage (not yet implemented)
-use wifi_densepose_config::AppConfig;
-
-fn main() -> anyhow::Result<()> {
-    // Loads from env, config.toml, and CLI overrides
-    let config = AppConfig::load()?;
-
-    println!("Server bind: {}", config.server.bind_address);
-    println!("CSI sample rate: {} Hz", config.signal.sample_rate);
-    println!("Model path: {}", config.nn.model_path.display());
-
-    Ok(())
-}
-```
-
-## Planned Configuration Structure
-
-```toml
-# config.toml
-
-[server]
-bind_address = "0.0.0.0:3000"
-websocket_path = "/ws/poses"
-
-[signal]
-sample_rate = 100
-subcarrier_count = 56
-hampel_window = 5
-
-[nn]
-model_path = "./models/densepose.rvf"
-backend = "ort"        # ort | candle | tch
-batch_size = 8
-
-[hardware]
-esp32_udp_port = 5005
-serial_baud = 921600
-
-[database]
-url = "sqlite://data/wifi-densepose.db"
-max_connections = 5
-```
-
-## Related Crates
-
-| Crate | Role |
-|-------|------|
-| [`wifi-densepose-core`](../wifi-densepose-core) | Shared types and traits |
-| [`wifi-densepose-api`](../wifi-densepose-api) | REST API (consumer) |
-| [`wifi-densepose-db`](../wifi-densepose-db) | Database layer (consumer) |
-| [`wifi-densepose-cli`](../wifi-densepose-cli) | CLI (consumer) |
-| [`wifi-densepose-sensing-server`](../wifi-densepose-sensing-server) | Sensing server (consumer) |
-
-## License
-
-MIT OR Apache-2.0

v2/crates/wifi-densepose-config/src/lib.rs

@@ -1 +0,0 @@
-//! WiFi-DensePose configuration (stub)

v2/crates/wifi-densepose-db/Cargo.toml

@@ -1,14 +0,0 @@
-[package]
-name = "wifi-densepose-db"
-version.workspace = true
-edition.workspace = true
-description = "Database layer for WiFi-DensePose"
-license.workspace = true
-authors = ["rUv <ruv@ruv.net>", "WiFi-DensePose Contributors"]
-repository.workspace = true
-documentation.workspace = true
-keywords = ["wifi", "database", "storage", "densepose", "persistence"]
-categories = ["database", "science"]
-readme = "README.md"
-
-[dependencies]

v2/crates/wifi-densepose-db/README.md

@@ -1,106 +0,0 @@
-# wifi-densepose-db
-
-[![Crates.io](https://img.shields.io/crates/v/wifi-densepose-db.svg)](https://crates.io/crates/wifi-densepose-db)
-[![Documentation](https://docs.rs/wifi-densepose-db/badge.svg)](https://docs.rs/wifi-densepose-db)
-[![License](https://img.shields.io/crates/l/wifi-densepose-db.svg)](LICENSE)
-
-Database persistence layer for the WiFi-DensePose pose estimation system.
-
-## Overview
-
-`wifi-densepose-db` implements the `DataStore` trait defined in `wifi-densepose-core`, providing
-persistent storage for CSI frames, pose estimates, scan sessions, and alert history. The intended
-backends are [SQLx](https://docs.rs/sqlx) for relational storage (PostgreSQL and SQLite) and
-[Redis](https://docs.rs/redis) for real-time caching and pub/sub.
-
-> **Status:** This crate is currently a stub. The intended API surface is documented below.
-
-## Planned Features
-
-- **Dual backend** -- PostgreSQL for production deployments, SQLite for single-node and embedded
-  use. Selectable at compile time via feature flags.
-- **Redis caching** -- Connection-pooled Redis for low-latency pose estimate lookups, session
-  state, and pub/sub event distribution.
-- **Migrations** -- Embedded SQL migrations managed by SQLx, applied automatically on startup.
-- **Repository pattern** -- Typed repository structs (`PoseRepository`, `SessionRepository`,
-  `AlertRepository`) implementing the core `DataStore` trait.
-- **Connection pooling** -- Configurable pool sizes via `sqlx::PgPool` / `sqlx::SqlitePool`.
-- **Transaction support** -- Scoped transactions for multi-table writes (e.g., survivor detection
-  plus alert creation).
-- **Time-series optimisation** -- Partitioned tables and retention policies for high-frequency CSI
-  frame storage.
-
-### Planned feature flags
-
-| Flag       | Default | Description |
-|------------|---------|-------------|
-| `postgres` | no      | Enable PostgreSQL backend |
-| `sqlite`   | yes     | Enable SQLite backend |
-| `redis`    | no      | Enable Redis caching layer |
-
-## Quick Start
-
-```rust
-// Intended usage (not yet implemented)
-use wifi_densepose_db::{Database, PoseRepository};
-use wifi_densepose_core::PoseEstimate;
-
-#[tokio::main]
-async fn main() -> anyhow::Result<()> {
-    let db = Database::connect("sqlite://data/wifi-densepose.db").await?;
-    db.run_migrations().await?;
-
-    let repo = PoseRepository::new(db.pool());
-
-    // Store a pose estimate
-    repo.insert(&pose_estimate).await?;
-
-    // Query recent poses
-    let recent = repo.find_recent(10).await?;
-    println!("Last 10 poses: {:?}", recent);
-
-    Ok(())
-}
-```
-
-## Planned Schema
-
-```sql
--- Core tables
-CREATE TABLE csi_frames (
-    id          UUID PRIMARY KEY,
-    session_id  UUID NOT NULL,
-    timestamp   TIMESTAMPTZ NOT NULL,
-    subcarriers BYTEA NOT NULL,
-    antenna_id  INTEGER NOT NULL
-);
-
-CREATE TABLE pose_estimates (
-    id          UUID PRIMARY KEY,
-    frame_id    UUID REFERENCES csi_frames(id),
-    timestamp   TIMESTAMPTZ NOT NULL,
-    keypoints   JSONB NOT NULL,
-    confidence  REAL NOT NULL
-);
-
-CREATE TABLE scan_sessions (
-    id          UUID PRIMARY KEY,
-    started_at  TIMESTAMPTZ NOT NULL,
-    ended_at    TIMESTAMPTZ,
-    config      JSONB NOT NULL
-);
-```
-
-## Related Crates
-
-| Crate | Role |
-|-------|------|
-| [`wifi-densepose-core`](../wifi-densepose-core) | `DataStore` trait definition |
-| [`wifi-densepose-config`](../wifi-densepose-config) | Database connection configuration |
-| [`wifi-densepose-api`](../wifi-densepose-api) | REST API (consumer) |
-| [`wifi-densepose-mat`](../wifi-densepose-mat) | Disaster detection (consumer) |
-| [`wifi-densepose-signal`](../wifi-densepose-signal) | CSI signal processing |
-
-## License
-
-MIT OR Apache-2.0

v2/crates/wifi-densepose-db/src/lib.rs

@@ -1 +0,0 @@
-//! WiFi-DensePose database layer (stub)

v2/crates/wifi-densepose-desktop/ui/package-lock.json

@@ -1,24 +1,24 @@
 {
   "name": "ruview-desktop-ui",
-  "version": "0.3.0",
+  "version": "0.4.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "ruview-desktop-ui",
-      "version": "0.3.0",
+      "version": "0.4.4",
       "dependencies": {
         "@tauri-apps/api": "^2.0.0",
-        "@tauri-apps/plugin-dialog": "^2.6.0",
+        "@tauri-apps/plugin-dialog": "^2.7.0",
         "@tauri-apps/plugin-shell": "^2.3.5",
         "react": "^18.3.1",
-        "react-dom": "^18.3.1"
+        "react-dom": "^19.2.5"
       },
       "devDependencies": {
         "@types/react": "^18.3.0",
-        "@types/react-dom": "^18.3.0",
+        "@types/react-dom": "^19.2.3",
         "@vitejs/plugin-react": "^4.3.0",
-        "typescript": "^5.5.0",
+        "typescript": "^6.0.3",
         "vite": "^6.0.0"
       }
     },
@@ -53,7 +53,6 @@
       "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.29.0",
         "@babel/generator": "^7.29.0",
@@ -1165,12 +1164,12 @@
       }
     },
     "node_modules/@tauri-apps/plugin-dialog": {
-      "version": "2.6.0",
-      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-dialog/-/plugin-dialog-2.6.0.tgz",
-      "integrity": "sha512-q4Uq3eY87TdcYzXACiYSPhmpBA76shgmQswGkSVio4C82Sz2W4iehe9TnKYwbq7weHiL88Yw19XZm7v28+Micg==",
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-dialog/-/plugin-dialog-2.7.0.tgz",
+      "integrity": "sha512-4nS/hfGMGCXiAS3LtVjH9AgsSAPJeG/7R+q8agTFqytjnMa4Zq95Bq8WzVDkckpanX+yyRHXnRtrKXkANKDHvw==",
       "license": "MIT OR Apache-2.0",
       "dependencies": {
-        "@tauri-apps/api": "^2.8.0"
+        "@tauri-apps/api": "^2.10.1"
       }
     },
     "node_modules/@tauri-apps/plugin-shell": {
@@ -1247,20 +1246,19 @@
       "integrity": "sha512-z9VXpC7MWrhfWipitjNdgCauoMLRdIILQsAEV+ZesIzBq/oUlxk0m3ApZuMFCXdnS4U7KrI+l3WRUEGQ8K1QKw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@types/prop-types": "*",
         "csstype": "^3.2.2"
       }
     },
     "node_modules/@types/react-dom": {
-      "version": "18.3.7",
-      "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-18.3.7.tgz",
-      "integrity": "sha512-MEe3UeoENYVFXzoXEWsvcpg6ZvlrFNlOQ7EOsvhI3CfAXwzPfO8Qwuxd40nepsYKqyyVQnTdEfv68q91yLcKrQ==",
+      "version": "19.2.3",
+      "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-19.2.3.tgz",
+      "integrity": "sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ==",
       "dev": true,
       "license": "MIT",
       "peerDependencies": {
-        "@types/react": "^18.0.0"
+        "@types/react": "^19.2.0"
       }
     },
     "node_modules/@vitejs/plugin-react": {
@@ -1317,7 +1315,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "baseline-browser-mapping": "^2.9.0",
         "caniuse-lite": "^1.0.30001759",
@@ -1587,7 +1584,6 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -1629,7 +1625,6 @@
       "resolved": "https://registry.npmjs.org/react/-/react-18.3.1.tgz",
       "integrity": "sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "loose-envify": "^1.1.0"
       },
@@ -1638,16 +1633,15 @@
       }
     },
     "node_modules/react-dom": {
-      "version": "18.3.1",
-      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-18.3.1.tgz",
-      "integrity": "sha512-5m4nQKp+rZRb09LNH59GM4BxTh9251/ylbKIbpe7TpGxfJ+9kv6BLkLBXIjjspbgbnIBNqlI23tRnTWT0snUIw==",
+      "version": "19.2.5",
+      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.5.tgz",
+      "integrity": "sha512-J5bAZz+DXMMwW/wV3xzKke59Af6CHY7G4uYLN1OvBcKEsWOs4pQExj86BBKamxl/Ik5bx9whOrvBlSDfWzgSag==",
       "license": "MIT",
       "dependencies": {
-        "loose-envify": "^1.1.0",
-        "scheduler": "^0.23.2"
+        "scheduler": "^0.27.0"
       },
       "peerDependencies": {
-        "react": "^18.3.1"
+        "react": "^19.2.5"
       }
     },
     "node_modules/react-refresh": {
@@ -1706,13 +1700,10 @@
       }
     },
     "node_modules/scheduler": {
-      "version": "0.23.2",
-      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.23.2.tgz",
-      "integrity": "sha512-UOShsPwz7NrMUqhR6t0hWjFduvOzbtv7toDH1/hIrfRNIDBnnBWd0CwJTGvTpngVlmwGCdP9/Zl/tVrDqcuYzQ==",
-      "license": "MIT",
-      "dependencies": {
-        "loose-envify": "^1.1.0"
-      }
+      "version": "0.27.0",
+      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.27.0.tgz",
+      "integrity": "sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q==",
+      "license": "MIT"
     },
     "node_modules/semver": {
       "version": "6.3.1",
@@ -1752,9 +1743,9 @@
       }
     },
     "node_modules/typescript": {
-      "version": "5.9.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
-      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-6.0.3.tgz",
+      "integrity": "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
@@ -1802,7 +1793,6 @@
       "integrity": "sha512-+Oxm7q9hDoLMyJOYfUYBuHQo+dkAloi33apOPP56pzj+vsdJDzr+j1NISE5pyaAuKL4A3UD34qd0lx5+kfKp2g==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "esbuild": "^0.25.0",
         "fdir": "^6.4.4",

v2/crates/wifi-densepose-desktop/ui/package.json

@@ -10,16 +10,16 @@
   },
   "dependencies": {
     "@tauri-apps/api": "^2.0.0",
-    "@tauri-apps/plugin-dialog": "^2.6.0",
+    "@tauri-apps/plugin-dialog": "^2.7.0",
     "@tauri-apps/plugin-shell": "^2.3.5",
     "react": "^18.3.1",
-    "react-dom": "^18.3.1"
+    "react-dom": "^19.2.5"
   },
   "devDependencies": {
     "@types/react": "^18.3.0",
-    "@types/react-dom": "^18.3.0",
+    "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^4.3.0",
-    "typescript": "^5.5.0",
+    "typescript": "^6.0.3",
     "vite": "^6.0.0"
   }
 }

v2/crates/wifi-densepose-hardware/Cargo.toml

@@ -32,7 +32,7 @@ byteorder = "1.5"
 # Time
 chrono = { version = "0.4", features = ["serde"] }
 # Error handling
-thiserror = "1.0"
+thiserror = "2.0"
 # Logging
 tracing = "0.1"
 # Serialization

v2/crates/wifi-densepose-mat/Cargo.toml

@@ -39,7 +39,7 @@ axum = { version = "0.7", features = ["ws"] }
 futures-util = "0.3"
 
 # Error handling
-thiserror = "1.0"
+thiserror = "2.0"
 anyhow = "1.0"
 
 # Serialization

v2/crates/wifi-densepose-sensing-server/Cargo.toml

@@ -22,7 +22,7 @@ path = "src/main.rs"
 [dependencies]
 # Web framework
 axum = { workspace = true }
-tower-http = { version = "0.5", features = ["fs", "cors", "set-header"] }
+tower-http = { version = "0.6", features = ["fs", "cors", "set-header"] }
 tokio = { workspace = true, features = ["full", "process"] }
 futures-util = "0.3"
 ruvector-mincut = { workspace = true }

v2/crates/wifi-densepose-sensing-server/src/adaptive_classifier.rs

@@ -91,7 +91,11 @@ fn subcarrier_stats(amps: &[f64]) -> (f64, f64, f64, f64, f64, f64, f64, f64) {
 
     // IQR (inter-quartile range).
     let mut sorted = amps.to_vec();
-    sorted.sort_by(|a, b| a.partial_cmp(b).unwrap());
+    // partial_cmp returns None on NaN — fall back to Equal so a single NaN
+    // frame from real ESP32 hardware (silent DSP div-by-zero, empty buffer)
+    // can't panic the whole sensing server (#611). The same file already
+    // uses unwrap_or(Equal) at lines 149-150 and 155; this was an oversight.
+    sorted.sort_by(|a, b| a.partial_cmp(b).unwrap_or(std::cmp::Ordering::Equal));
     let q1 = sorted[sorted.len() / 4];
     let q3 = sorted[3 * sorted.len() / 4];
     let iqr = q3 - q1;

v2/crates/wifi-densepose-sensing-server/src/cli.rs

@@ -19,8 +19,8 @@ pub struct Args {
     #[arg(long, default_value = "5005")]
     pub udp_port: u16,
 
-    /// Path to UI static files
-    #[arg(long, default_value = "../../ui")]
+    /// Path to UI static files (from `v2/` cwd use `../ui`)
+    #[arg(long, default_value = "../ui")]
     pub ui_path: PathBuf,
 
     /// Tick interval in milliseconds (default 100 ms = 10 fps for smooth pose animation)

v2/crates/wifi-densepose-sensing-server/src/lib.rs

@@ -10,6 +10,7 @@
 pub mod bearer_auth;
 pub mod host_validation;
 pub mod introspection;
+pub mod path_safety;
 pub mod vital_signs;
 pub mod rvf_container;
 pub mod rvf_pipeline;

v2/crates/wifi-densepose-sensing-server/src/main.rs

@@ -83,8 +83,8 @@ struct Args {
     #[arg(long, default_value = "5005")]
     udp_port: u16,
 
-    /// Path to UI static files
-    #[arg(long, default_value = "../../ui")]
+    /// Path to UI static files (repo `ui/`; from `v2/` use `../ui` or rely on auto-detect)
+    #[arg(long, default_value = "../ui")]
     ui_path: PathBuf,
 
     /// Tick interval in milliseconds (default 100 ms = 10 fps for smooth pose animation)
@@ -2023,6 +2023,10 @@ async fn handle_ws_client(mut socket: WebSocket, state: SharedState) {
 
     info!("WebSocket client connected (sensing)");
 
+    // ADR-044/045: ping/pong keepalive to prevent proxy idle timeouts.
+    let mut ping_interval = tokio::time::interval(std::time::Duration::from_secs(30));
+    ping_interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip);
+
     loop {
         tokio::select! {
             msg = rx.recv() => {
@@ -2032,13 +2036,24 @@ async fn handle_ws_client(mut socket: WebSocket, state: SharedState) {
                             break;
                         }
                     }
-                    Err(_) => break,
+                    // Lagged: client fell behind — skip missed frames, don't disconnect.
+                    Err(tokio::sync::broadcast::error::RecvError::Lagged(n)) => {
+                        tracing::debug!("WS client lagged by {n} frames, skipping");
+                        continue;
+                    }
+                    Err(_) => break, // channel closed
+                }
+            }
+            _ = ping_interval.tick() => {
+                if socket.send(Message::Ping(vec![].into())).await.is_err() {
+                    break;
                 }
             }
             msg = socket.recv() => {
                 match msg {
                     Some(Ok(Message::Close(_))) | None => break,
-                    _ => {} // ignore client messages
+                    Some(Ok(Message::Pong(_))) => {} // keepalive response
+                    _ => {} // ignore other client messages
                 }
             }
         }
@@ -2207,7 +2222,12 @@ async fn handle_ws_pose_client(mut socket: WebSocket, state: SharedState) {
                             }
                         }
                     }
-                    Err(_) => break,
+                    // Lagged: skip missed frames, don't disconnect.
+                    Err(tokio::sync::broadcast::error::RecvError::Lagged(n)) => {
+                        tracing::debug!("WS pose client lagged by {n} frames, skipping");
+                        continue;
+                    }
+                    Err(_) => break, // channel closed
                 }
             }
             msg = socket.recv() => {
@@ -2222,6 +2242,7 @@ async fn handle_ws_pose_client(mut socket: WebSocket, state: SharedState) {
                         }
                     }
                     Some(Ok(Message::Close(_))) | None => break,
+                    Some(Ok(Message::Pong(_))) => {} // keepalive response
                     _ => {}
                 }
             }
@@ -4320,6 +4341,25 @@ async fn broadcast_tick_task(state: SharedState, tick_ms: u64) {
 
 // ── Main ─────────────────────────────────────────────────────────────────────
 
+/// If `--ui-path` points nowhere (wrong cwd), try common repo layouts relative to cwd.
+fn coalesce_ui_path(initial: std::path::PathBuf) -> std::path::PathBuf {
+    if initial.is_dir() {
+        return initial;
+    }
+    for rel in &["../ui", "./ui", "../../ui"] {
+        let p = std::path::PathBuf::from(rel);
+        if p.is_dir() {
+            warn!(
+                "UI path {} not found; using {} (set --ui-path explicitly if wrong)",
+                initial.display(),
+                p.display()
+            );
+            return p;
+        }
+    }
+    initial
+}
+
 #[tokio::main]
 async fn main() {
     // Initialize tracing
@@ -4330,7 +4370,8 @@ async fn main() {
         )
         .init();
 
-    let args = Args::parse();
+    let mut args = Args::parse();
+    args.ui_path = coalesce_ui_path(args.ui_path);
 
     // Handle --benchmark mode: run vital sign benchmark and exit
     if args.benchmark {

v2/crates/wifi-densepose-sensing-server/src/model_manager.rs

@@ -215,6 +215,11 @@ async fn scan_models() -> Vec<ModelInfo> {
 
 /// Load a model from disk by ID and return its `LoadedModelState`.
 fn load_model_from_disk(model_id: &str) -> Result<LoadedModelState, String> {
+    // Path-traversal guard (#615). Reject any model_id that contains '/',
+    // '..', null bytes, or anything outside [A-Za-z0-9._-]. The reject
+    // happens before format!() so the path can never escape models_dir().
+    let model_id = crate::path_safety::safe_id(model_id)
+        .map_err(|e| format!("Invalid model_id: {e}"))?;
     let file_path = models_dir().join(format!("{model_id}.rvf"));
     let reader = RvfReader::from_file(&file_path)?;
 

v2/crates/wifi-densepose-sensing-server/src/path_safety.rs

@@ -0,0 +1,203 @@
+//! Identifier sanitization for filesystem paths.
+//!
+//! Defense against directory traversal: the sensing-server has several REST
+//! endpoints that take a user-controlled identifier and use it directly to
+//! build a filesystem path:
+//!
+//!   * `recording.rs`     — `{session_name}.csi.jsonl` under `RECORDINGS_DIR`
+//!   * `model_manager.rs` — `{model_id}.rvf` under `models_dir()`
+//!   * `training_api.rs`  — `{dataset_id}.csi.jsonl` under `RECORDINGS_DIR`
+//!
+//! Without validation, an attacker can pass `../../etc/passwd` or similar to
+//! read, write, or delete arbitrary files the server process can access. See
+//! issue #615 for the full exploit catalogue.
+//!
+//! [`safe_id`] returns the input only when it is safe to embed in a
+//! `format!()` that builds a path under a fixed parent directory.
+
+use std::fmt;
+
+/// Maximum length for a safe identifier. 64 is generous for human-typed
+/// session names while keeping the resulting filename well under
+/// most filesystem limits.
+pub const MAX_ID_LEN: usize = 64;
+
+/// Error returned by [`safe_id`] when the input is not safe to embed in a
+/// filesystem path.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum PathSafetyError {
+    /// Empty string is never a valid identifier.
+    Empty,
+    /// Identifier exceeds `MAX_ID_LEN` bytes.
+    TooLong { len: usize, max: usize },
+    /// Identifier contains a character not in the allowed set
+    /// `[A-Za-z0-9._-]` (and the leading character is not `.`).
+    /// Path separators, null bytes, parent-directory references, and any
+    /// non-printable or non-ASCII characters all hit this.
+    InvalidChar { ch: char, position: usize },
+    /// Identifier is `"."` or `".."`, or any leading `.` that would
+    /// otherwise be interpreted as a hidden file / parent reference.
+    LeadingDot,
+}
+
+impl fmt::Display for PathSafetyError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            PathSafetyError::Empty => write!(f, "identifier is empty"),
+            PathSafetyError::TooLong { len, max } => {
+                write!(f, "identifier is {len} bytes (max {max})")
+            }
+            PathSafetyError::InvalidChar { ch, position } => write!(
+                f,
+                "identifier contains invalid character {ch:?} at position {position} \
+                 (only A-Z, a-z, 0-9, '.', '_', '-' are allowed)"
+            ),
+            PathSafetyError::LeadingDot => write!(
+                f,
+                "identifier may not start with '.' (would be a hidden file \
+                 or parent-directory reference)"
+            ),
+        }
+    }
+}
+
+impl std::error::Error for PathSafetyError {}
+
+/// Return `Ok(input)` if the string is safe to embed in a filesystem path
+/// built under a fixed parent directory; otherwise return a structured error.
+///
+/// The allowed character set is `[A-Za-z0-9._-]`. The first character must
+/// not be `.` (rules out `..`, `.`, and hidden-file shenanigans).
+///
+/// Examples:
+/// ```ignore
+/// assert!(safe_id("my-session_42").is_ok());
+/// assert!(safe_id("session.v2").is_ok());
+/// assert!(safe_id("../../etc/passwd").is_err());
+/// assert!(safe_id("foo/bar").is_err());
+/// assert!(safe_id("..").is_err());
+/// assert!(safe_id(".env").is_err());
+/// assert!(safe_id("").is_err());
+/// ```
+pub fn safe_id(input: &str) -> Result<&str, PathSafetyError> {
+    if input.is_empty() {
+        return Err(PathSafetyError::Empty);
+    }
+    if input.len() > MAX_ID_LEN {
+        return Err(PathSafetyError::TooLong {
+            len: input.len(),
+            max: MAX_ID_LEN,
+        });
+    }
+    // Reject leading '.' to block `.`, `..`, `.env`, etc.
+    if input.starts_with('.') {
+        return Err(PathSafetyError::LeadingDot);
+    }
+    for (position, ch) in input.chars().enumerate() {
+        let ok = ch.is_ascii_alphanumeric() || ch == '.' || ch == '_' || ch == '-';
+        if !ok {
+            return Err(PathSafetyError::InvalidChar { ch, position });
+        }
+    }
+    Ok(input)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn accepts_simple_alphanumeric() {
+        assert!(safe_id("foo").is_ok());
+        assert!(safe_id("MyModel123").is_ok());
+        assert!(safe_id("session-2026-05-17_v2").is_ok());
+        assert!(safe_id("a.b.c").is_ok());
+    }
+
+    #[test]
+    fn rejects_empty() {
+        assert_eq!(safe_id(""), Err(PathSafetyError::Empty));
+    }
+
+    #[test]
+    fn rejects_path_separators() {
+        assert!(matches!(
+            safe_id("foo/bar"),
+            Err(PathSafetyError::InvalidChar { ch: '/', .. })
+        ));
+        assert!(matches!(
+            safe_id("foo\\bar"),
+            Err(PathSafetyError::InvalidChar { ch: '\\', .. })
+        ));
+    }
+
+    #[test]
+    fn rejects_parent_directory_traversal() {
+        assert_eq!(safe_id("."), Err(PathSafetyError::LeadingDot));
+        assert_eq!(safe_id(".."), Err(PathSafetyError::LeadingDot));
+        assert_eq!(safe_id(".env"), Err(PathSafetyError::LeadingDot));
+        // The classic attack vector — even after rejecting leading-dot,
+        // the InvalidChar guard catches the embedded slash.
+        assert!(matches!(
+            safe_id("../../etc/passwd"),
+            Err(PathSafetyError::LeadingDot)
+        ));
+    }
+
+    #[test]
+    fn rejects_null_byte() {
+        assert!(matches!(
+            safe_id("foo\0bar"),
+            Err(PathSafetyError::InvalidChar { ch: '\0', .. })
+        ));
+    }
+
+    #[test]
+    fn rejects_whitespace_and_specials() {
+        assert!(matches!(
+            safe_id("foo bar"),
+            Err(PathSafetyError::InvalidChar { ch: ' ', .. })
+        ));
+        assert!(matches!(
+            safe_id("foo;rm -rf /"),
+            Err(PathSafetyError::InvalidChar { .. })
+        ));
+        assert!(matches!(
+            safe_id("foo$bar"),
+            Err(PathSafetyError::InvalidChar { ch: '$', .. })
+        ));
+    }
+
+    #[test]
+    fn rejects_non_ascii() {
+        // Reject unicode that could normalise to path separators in
+        // weird filesystems, or just look like ASCII.
+        assert!(matches!(
+            safe_id("café"),
+            Err(PathSafetyError::InvalidChar { .. })
+        ));
+        // Fullwidth slash (U+FF0F) — visually similar to '/'.
+        assert!(matches!(
+            safe_id("foo\u{FF0F}bar"),
+            Err(PathSafetyError::InvalidChar { .. })
+        ));
+    }
+
+    #[test]
+    fn rejects_too_long() {
+        let too_long = "a".repeat(MAX_ID_LEN + 1);
+        assert_eq!(
+            safe_id(&too_long),
+            Err(PathSafetyError::TooLong {
+                len: MAX_ID_LEN + 1,
+                max: MAX_ID_LEN
+            })
+        );
+    }
+
+    #[test]
+    fn boundary_max_len() {
+        let at_max = "a".repeat(MAX_ID_LEN);
+        assert!(safe_id(&at_max).is_ok());
+    }
+}

v2/crates/wifi-densepose-sensing-server/src/recording.rs

@@ -274,9 +274,22 @@ async fn start_recording(
         }));
     }
 
+    // Validate session_name BEFORE embedding it in a path. The legacy
+    // `replace(' ', "_")` only normalised whitespace, not path traversal
+    // (#615). Reject any session_name containing path separators or
+    // parent-directory references.
+    let safe_name = match crate::path_safety::safe_id(&body.session_name) {
+        Ok(n) => n,
+        Err(e) => {
+            return Json(serde_json::json!({
+                "status": "error",
+                "message": format!("Invalid session_name: {e}"),
+            }));
+        }
+    };
     let session_id = format!(
         "{}-{}",
-        body.session_name.replace(' ', "_"),
+        safe_name,
         chrono::Utc::now().format("%Y%m%d_%H%M%S")
     );
     let file_name = format!("{session_id}.csi.jsonl");
@@ -346,6 +359,23 @@ async fn download_recording(
     State(_state): State<AppState>,
     AxumPath(id): AxumPath<String>,
 ) -> impl IntoResponse {
+    // Path-traversal guard (#615). Reject any id that contains '/', '..',
+    // null bytes, or anything outside [A-Za-z0-9._-] BEFORE building the
+    // path. Otherwise GET /api/v1/recording/download/../../.env leaks
+    // arbitrary files the server process can read.
+    let id = match crate::path_safety::safe_id(&id) {
+        Ok(s) => s.to_string(),
+        Err(e) => {
+            return (
+                axum::http::StatusCode::BAD_REQUEST,
+                Json(serde_json::json!({
+                    "status": "error",
+                    "message": format!("Invalid recording id: {e}"),
+                })),
+            )
+                .into_response();
+        }
+    };
     let dir = PathBuf::from(RECORDINGS_DIR);
     // Find the JSONL file matching the ID.
     let file_path = dir.join(format!("{id}.csi.jsonl"));
@@ -390,6 +420,19 @@ async fn delete_recording(
     State(_state): State<AppState>,
     AxumPath(id): AxumPath<String>,
 ) -> Json<serde_json::Value> {
+    // Path-traversal guard (#615). Reject any id that contains '/', '..',
+    // null bytes, or anything outside [A-Za-z0-9._-] BEFORE building the
+    // paths. Otherwise DELETE /api/v1/recording/delete/../../config/database
+    // can remove arbitrary files the server process can write.
+    let id = match crate::path_safety::safe_id(&id) {
+        Ok(s) => s.to_string(),
+        Err(e) => {
+            return Json(serde_json::json!({
+                "status": "error",
+                "message": format!("Invalid recording id: {e}"),
+            }));
+        }
+    };
     let dir = PathBuf::from(RECORDINGS_DIR);
     let jsonl_path = dir.join(format!("{id}.csi.jsonl"));
     let meta_path = dir.join(format!("{id}.csi.meta.json"));

v2/crates/wifi-densepose-sensing-server/src/training_api.rs

@@ -239,7 +239,18 @@ async fn load_recording_frames(dataset_ids: &[String]) -> Vec<RecordedFrame> {
     let recordings_dir = PathBuf::from(RECORDINGS_DIR);
 
     for id in dataset_ids {
-        let file_path = recordings_dir.join(format!("{id}.csi.jsonl"));
+        // Path-traversal guard (#615). Reject any dataset_id that contains
+        // '/', '..', null bytes, or anything outside [A-Za-z0-9._-] BEFORE
+        // building the format!() path. Otherwise an attacker could read any
+        // file the server process can access via `dataset_ids: ["../../etc/passwd"]`.
+        let safe = match crate::path_safety::safe_id(id) {
+            Ok(s) => s,
+            Err(e) => {
+                warn!("Skipping invalid dataset_id {id:?}: {e}");
+                continue;
+            }
+        };
+        let file_path = recordings_dir.join(format!("{safe}.csi.jsonl"));
         let data = match tokio::fs::read_to_string(&file_path).await {
             Ok(d) => d,
             Err(e) => {

v2/rust-toolchain.toml

@@ -0,0 +1,7 @@
+# wifi-densepose-sensing-server (ruvector-mincut -> ruvector-core / hnsw_rs / mmap-rs):
+# - mmap-rs 0.7: Cargo must accept edition 2024 in a dependency manifest (1.85+).
+# - hnsw_rs 0.3.4: u*.is_multiple_of (1.86+).
+# - ruvector-core 2.0.5 x86_64: #[target_feature(enable = "avx512f")] (1.89+ stable).
+[toolchain]
+channel = "1.89"
+profile = "minimal"