virtual paths fall back to parsedTitle when a file has no title or originalTitle (claims model)

CI accepts four-part tags (v1.2.3.1) for fixes
gitea workflow: push to IPCR's direct host (Cloudflare 100 MB cap)
2026-10-25 19:25:17 +00:00 · 2026-10-25 14:21:58 +01:00 · 2026-10-13 09:58:06 +00:00 · 2026-10-12 18:30:17 +00:00 · 2026-10-04 17:19:28 +00:00 · 2026-10-04 11:51:08 +00:00
11 changed files with 744 additions and 509 deletions
@@ -0,0 +1,98 @@
+# Gitea twin of .github/workflows/docker-publish.yml. Gitea runs only .gitea/workflows/ once this
+# folder exists, and GitHub never reads it.
+#
+# Publishes to IPCR on watch.nsl.sh instead of ghcr.io:
+#   push  ipcr-push-85-17-246-67.nip.io/metadec.eth/<repo>:<tag>   docker login as metadec.eth with the
+#         IPCR_PUSH_TOKEN secret (the metadec.eth namespace token from the IPCR dashboard)
+#   pull  ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/<repo>:<tag>   anonymous
+# The push goes to ipcr-push-85-17-246-67.nip.io, the box's own address, not ipcr-push-watch.nsl.sh: Cloudflare fronts
+# *.watch.nsl.sh and refuses any request over 100 MB (413), which a large image layer is.
+# That host's certificate is signed by the box's private Mesh Router CA, given to buildkit from
+# the IPCR_CA_PEM repo variable. docker login would make the job's Docker daemon check the
+# certificate without that CA, so the login is written straight into ~/.docker/config.json.
+# The runner's job image (node:22-bookworm) has no docker CLI, so the static one is
+# installed first; buildx installs itself. No `type=gha` cache: the runner has none.
+
+name: Build and Push Docker Image
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - 'v*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag for the image (optional, defaults to sha)'
+        required: false
+        type: string
+      meta_core_version:
+        description: 'meta-core version to use (default: latest)'
+        required: false
+        type: string
+        default: 'latest'
+
+env:
+  REGISTRY: ipcr-push-85-17-246-67.nip.io
+  IPCR_PULL: ipcr-watch.nsl.sh/ipns/metadec.eth
+  IMAGE_NAME: metadec.eth/${{ github.event.repository.name }}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install Docker CLI
+        run: curl -fsSL https://download.docker.com/linux/static/stable/x86_64/docker-28.5.1.tgz | tar -xz -C /usr/local/bin --strip-components=1 docker/docker
+
+      - name: Trust the Mesh Router CA
+        run: printf '%s\n' "$IPCR_CA_PEM" > /tmp/ipcr-ca.pem
+        env:
+          IPCR_CA_PEM: ${{ vars.IPCR_CA_PEM }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          version: latest
+          buildkitd-config-inline: |
+            [registry."${{ env.REGISTRY }}"]
+              ca = ["/tmp/ipcr-ca.pem"]
+
+      - name: Log in to IPCR
+        env:
+          IPCR_PUSH_TOKEN: ${{ secrets.IPCR_PUSH_TOKEN }}
+        run: |
+          mkdir -p ~/.docker
+          printf '{"auths":{"%s":{"auth":"%s"}}}\n' "$REGISTRY" "$(printf 'metadec.eth:%s' "$IPCR_PUSH_TOKEN" | base64 -w0)" > ~/.docker/config.json
+
+      - name: Extract metadata (tags, labels)
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=semver,pattern={{version}}
+            # A fix to release 1.2.3 is tagged v1.2.3.1: four numbers are not semver, so
+            # the pattern above makes no tag for it; this one does (image tag 1.2.3.1).
+            type=match,pattern=v(\d+\.\d+\.\d+\.\d+),group=1
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha,prefix=
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=raw,value=${{ inputs.tag }},enable=${{ inputs.tag != '' }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            META_CORE_IMAGE=${{ env.IPCR_PULL }}/metadec.eth/meta-core:${{ inputs.meta_core_version || 'latest' }}
@@ -50,6 +50,9 @@ jobs:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}}
+            # A fix to release 1.2.3 is tagged v1.2.3.1: four numbers are not semver, so
+            # the pattern above makes no tag for it; this one does (image tag 1.2.3.1).
+            type=match,pattern=v(\d+\.\d+\.\d+\.\d+),group=1
            type=semver,pattern={{major}}.{{minor}}
            type=sha,prefix=
            type=raw,value=latest,enable={{is_default_branch}}
@@ -46,12 +46,14 @@ WORKDIR /build
 # Install FUSE development libraries
 RUN apt-get update && apt-get install -y libfuse3-dev pkg-config

-# Copy Rust project
-COPY packages/meta-fuse-driver/Cargo.toml ./
+# Copy Rust project (Cargo.lock included: without it cargo re-resolves every
+# dep to the newest compatible version at build time, which drags in crates
+# whose MSRV is above this image's rustc and breaks the build out of nowhere)
+COPY packages/meta-fuse-driver/Cargo.toml packages/meta-fuse-driver/Cargo.lock ./
 COPY packages/meta-fuse-driver/src/ ./src/

-# Build release binary
-RUN cargo build --release
+# Build release binary (--locked: fail loudly instead of silently re-resolving)
+RUN cargo build --release --locked

 # Stage 4: Runtime
 FROM ubuntu:22.04
@@ -6,12 +6,12 @@ Standalone virtual filesystem service that exposes metadata-organized content vi

 Meta-Fuse is a read-only process in the MetaMesh ecosystem that:

-1. **Connects to shared KV storage** - Reads metadata from Redis/compatible KV database managed by meta-sort
-2. **Mounts virtual filesystem** - Rust-based FUSE driver creates an organized view of media files
-3. **Serves WebDAV** - Network-accessible file sharing for Windows/Mac/Linux clients
-4. **Zero file duplication** - All content points to original files via WebDAV or direct volume access
-5. **Leader-aware KV access** - Discovers and connects to the active KV database via lock file
-6. **WebDAV file access** - Can read files from meta-sort's WebDAV server (supports SMB/rclone mounts)
+1. **Locates meta-core over UDP** - beacon v2 multicast advertise (`239.255.99.1:9099`); no shared volume, no `REDIS_URL`
+2. **Reads metadata through meta-core's HTTP API** - `/meta/{hash}*` reads + SSE live updates on `/api/events/meta` (no direct Redis access)
+3. **Mounts virtual filesystem** - Rust-based FUSE driver creates an organized view of media files
+4. **Serves WebDAV** - Network-accessible, read-only file sharing for Windows/Mac/Linux clients, authenticated with per-device tokens
+5. **Zero file duplication** - File bytes are read from meta-core's WebDAV (`http://<meta-core host>/webdav`), which also covers SMB/rclone mounts; no `/files` mount required
+6. **Configurable renaming rules** - Virtual paths are computed from metadata by editable rules (dashboard rules editor)

 ## Architecture

@@ -20,29 +20,27 @@ Meta-Fuse is a read-only process in the MetaMesh ecosystem that:
 │                           MetaMesh Ecosystem                                 │
 ├─────────────────────────────────────────────────────────────────────────────┤
 │                                                                              │
-│   DATA Volume (Shared)          KV Database (Leader Election)               │
-│   ┌────────────────────┐        ┌────────────────────────────┐              │
-│   │ /data/watch/       │        │  Redis/Compatible DB        │              │
-│   │ /data/output/      │◄──────┐│  - metadata storage         │              │
-│   │ /mnt/remote/       │       ││  - file paths & attributes  │              │
-│   └────────────────────┘       │└────────────────────────────┘              │
-│            ▲                   │             ▲                               │
-│            │                   │             │ reads                         │
-│            │                   │             │                               │
-│   ┌────────┴───────────────────┴─────────────┴──────────────────┐           │
+│   meta-core (owns Redis)                                                     │
+│   ┌──────────────────────────────────────────────┐                          │
+│   │  UDP announce (beacon v2, /urls)     │                          │
+│   │  HTTP API: /meta/{hash}*, /api/events/meta   │                          │
+│   │  WebDAV: /webdav  (file bytes, /files/...)   │                          │
+│   └──────────────────────────────────────────────┘                          │
+│            ▲ metadata (HTTP + SSE)          ▲ file bytes (WebDAV Range)      │
+│   ┌────────┴────────────────────────────────┴───────────────────┐           │
 │   │                        META-FUSE                             │           │
 │   │  ┌─────────────────────────────────────────────────────────┐│           │
-│   │  │                    KV Client Wrapper                     ││           │
-│   │  │  - Reads lock file for leader discovery                  ││           │
-│   │  │  - Connects to active KV database                        ││           │
-│   │  │  - Reconnect loop for failure handling                   ││           │
+│   │  │       Storage client (KVManager / LeaderClient)          ││           │
+│   │  │  - Locates meta-core via UDP (or META_CORE_URL pin)      ││           │
+│   │  │  - Reads metadata over HTTP, events over SSE             ││           │
+│   │  │  - Reconnects when a different meta-core announces       ││           │
 │   │  └─────────────────────────────────────────────────────────┘│           │
 │   │                            │                                 │           │
 │   │              ┌─────────────┴─────────────┐                  │           │
 │   │              ▼                           ▼                  │           │
 │   │  ┌───────────────────────┐   ┌─────────────────────────┐   │           │
 │   │  │    FUSE API Server    │   │    WebDAV Server        │   │           │
-│   │  │    (Node.js/Fastify)  │   │    (WsgiDAV)            │   │           │
+│   │  │    (Node.js/Fastify)  │   │    (WsgiDAV, token auth)│   │           │
 │   │  │    Port 3000          │   │    Port 8080            │   │           │
 │   │  └───────────┬───────────┘   └───────────┬─────────────┘   │           │
 │   │              │                           │                  │           │
@@ -56,10 +54,11 @@ Meta-Fuse is a read-only process in the MetaMesh ecosystem that:
 │                            │                                                 │
 │                            ▼                                                 │
 │              ┌─────────────────────────┐                                    │
-│              │    nginx Reverse Proxy  │                                    │
+│              │    nginx (port 80)      │                                    │
 │              │    /           → UI     │                                    │
 │              │    /webdav     → WebDAV │                                    │
-│              │    /api/fuse   → API    │                                    │
+│              │    /api/       → API    │                                    │
+│              │    /health     → API    │                                    │
 │              └─────────────────────────┘                                    │
 │                            │                                                 │
 └────────────────────────────┼────────────────────────────────────────────────┘
@@ -68,6 +67,8 @@ Meta-Fuse is a read-only process in the MetaMesh ecosystem that:
                    (Windows/Mac/Linux)
 ```

+In the dev stack and the CasaOS store app (`packages/MetaAppStore`, app `MetaFuse`) the backend runs as `metafuse-app` behind an OIDC perimeter container `metafuse` (`nginx-hash-lock` in dev, `appshield` in the store app); in the store app Caddy routes `/health` and `/webdav*` straight to the backend, so WebDAV is authenticated by WebDAV tokens instead. See the meta-root [authentication architecture](../../docs/project-architecture/authentication.md).
+
 ### Service Role in MetaMesh

 ```
@@ -75,54 +76,45 @@ Meta-Fuse is a read-only process in the MetaMesh ecosystem that:
 │  SERVICE ROLES                                                              │
 ├────────────────────────────────────────────────────────────────────────────┤
 │                                                                             │
-│  [1] meta-sort (PROCESS-WRITE)                                             │
-│      └─► Writes metadata to KV, manages remote mounts                       │
+│  [1] meta-core (STORE)                                                      │
+│      └─► Owns Redis, metadata HTTP API, event streams, WebDAV over /files   │
 │                                                                             │
-│  [2] meta-fuse (PROCESS-READ) ◄── YOU ARE HERE                             │
-│      └─► Reads metadata from KV, exposes virtual filesystem                 │
+│  [2] meta-sort (PROCESS-WRITE)                                              │
+│      └─► Watches folders, writes metadata through meta-core                 │
 │                                                                             │
-│  [3] meta-stremio (PROCESS-READ)                                           │
-│      └─► Reads metadata from KV, streams media content                      │
+│  [3] meta-fuse (PROCESS-READ) ◄── YOU ARE HERE                              │
+│      └─► Reads metadata from meta-core, exposes virtual filesystem          │
 │                                                                             │
-│  [4] meta-share (SHARING-READ-WRITE)                                       │
-│      └─► P2P metadata sync across network                                   │
+│  [4] meta-stremio (PROCESS-READ)                                            │
+│      └─► Reads metadata, streams media content                              │
 │                                                                             │
 └────────────────────────────────────────────────────────────────────────────┘
 ```

-### KV Leader Election
+### Locating meta-core (beacon v2)

-All services in MetaMesh use leader discovery via meta-core's lock file and HTTP API:
+meta-core announces itself on UDP multicast `239.255.99.1:9099`, carrying its `/urls` payload. meta-fuse listens (and announces itself on the same group, so it shows up in every neighbour's nav menu):

 ```
-/meta-core/locks/
-├── kv-leader.lock      # flock-based leader election
-└── kv-leader.info      # Leader API URL (plain text)
-
-Lock Info File Format (plain text):
-http://meta-core:9000
-
-/urls API Response (JSON):
+/urls payload (JSON):
 {
  "hostname": "metacore-app",
-  "baseUrl": "http://localhost:8083",
-  "apiUrl": "http://meta-core:9000",
-  "redisUrl": "redis://meta-core:6379",
-  "webdavUrl": "http://localhost:8083/webdav",
-  "webdavUrlInternal": "http://meta-core:9000/webdav",
-  "isLeader": true
+  "baseUrl": "https://metacore-dev.localhost:8083",
+  "apiUrl": "http://<meta-core ip>:9000",
+  "redisUrl": "",                       # always empty since the api-mediated-access lockdown
+  "webdavUrl": "https://metacore-dev.localhost:8083/webdav",
+  "webdavUrlInternal": "http://<meta-core ip>:9000/webdav"
 }

-Leader Discovery Flow:
-1. meta-core acquires flock on kv-leader.lock
-2. Winner (leader) spawns Redis, writes API URL to kv-leader.info
-3. meta-fuse reads kv-leader.info to find API URL
-4. meta-fuse calls /urls API to get Redis URL and other endpoints
-5. meta-fuse connects to Redis as read-only client
-6. On leader failure, flock auto-releases, new leader elected
+Discovery flow:
+1. meta-core advertises `metamesh.core` with its /urls payload (`data.urls`)
+2. meta-fuse picks it up (or uses META_CORE_URL and GET {url}/urls when pinned)
+3. meta-fuse reads metadata from apiUrl (/meta/{hash}*) and streams apiUrl/api/events/meta
+4. File bytes are fetched from http://<hostname>/webdav
+5. An announce carrying a different apiUrl triggers a reconnect
 ```

-**Note**: meta-fuse never becomes leader - it reads the lock file and calls the /urls API to discover the active Redis endpoint managed by meta-core.
+**Note**: meta-fuse never owns storage. If meta-core still publishes a non-empty `redisUrl`, meta-fuse refuses to start (set `ALLOW_LEGACY_REDIS_URL=1` to downgrade that to a warning). Protocol spec: [beacon-v2.md](../../docs/project-architecture/beacon-v2.md).

 ## Core Features

@@ -132,21 +124,21 @@ Leader Discovery Flow:
 - **Path-to-inode mapping**: Translates filesystem paths to FUSE inode numbers
 - **Attribute caching**: 1-second TTL for file attributes
 - **Directory caching**: 30-second TTL for directory listings
- **Error resilience**: Virtual ERROR.txt shown when backend unavailable
+- **Error resilience**: Virtual `ERROR.txt` shown after 3 consecutive API failures
+- **WebDAV reads**: The driver issues HTTP Range requests against the `webdavUrl` returned by `/api/fuse/read`

 ### WebDAV Server

 - **Network file sharing**: Mount as network drive on any OS
 - **Read-only access**: Prevents accidental modifications
- **Basic authentication**: Username/password protection
+- **Per-device tokens**: Minted/revoked from the dashboard (`/api/webdav-tokens`); the token (`mfwd_…`) is the basic-auth password, any non-empty username is accepted. Only sha256 hashes are stored (`$CONFIG_DIR/webdav-tokens.json`); revocation is immediate
 - **Directory browsing**: Web-based file browser

-### KV Client Wrapper
+### Renaming Rules

- **Leader discovery**: Reads lock file to find active database
- **Auto-reconnect**: Handles leader failover gracefully
- **Connection pooling**: Efficient database connections
- **Read-only operations**: No writes to KV database
+- Stored in `$CONFIG_DIR/renaming-rules.json` (timestamped backups on update)
+- Template variables + conditions; preview and validate via the API before saving
+- Only the metadata properties the rules reference are fetched (`RulesPropertyExtractor`)

 ## Package Structure

@@ -155,16 +147,16 @@ meta-fuse/
 ├── packages/
 │   ├── meta-fuse-core/         # Core service (@meta-fuse/core)
 │   │   ├── src/
-│   │   │   ├── api/            # Fastify REST API (APIServer)
-│   │   │   │   └── APIServer.ts
-│   │   │   ├── config/         # Configuration management
-│   │   │   │   └── ConfigStorage.ts
-│   │   │   ├── kv/             # KV client wrapper (FOLLOWER mode only)
+│   │   │   ├── api/APIServer.ts        # Fastify REST API
+│   │   │   ├── config/ConfigStorage.ts # Renaming-rules persistence
+│   │   │   ├── discovery/meshdisco.ts  # beacon v2 (mirrored, see scripts/check-mirrors.sh)
+│   │   │   ├── kv/                     # Storage client (read-only)
 │   │   │   │   ├── IKVClient.ts        # Read-only interface
-│   │   │   │   ├── KVManager.ts        # Leader discovery, connection management
-│   │   │   │   ├── LeaderClient.ts     # Lock file reading + /urls API
-│   │   │   │   ├── RedisClient.ts      # Redis connection with Streams support
-│   │   │   │   └── ServiceDiscovery.ts # Service discovery client
+│   │   │   │   ├── KVManager.ts        # meta-core location, connection management
+│   │   │   │   ├── LeaderClient.ts     # Adapter over MetaCoreLocator (UDP / META_CORE_URL pin)
+│   │   │   │   ├── MetaCoreApiClient.ts # HTTP reads: /meta, /meta/{hash}, /meta/{hash}/{prop}
+│   │   │   │   ├── SSEEventClient.ts   # SSE consumer for /api/events/meta
+│   │   │   │   └── RedisClient.ts      # Storage facade (HTTP-only mode when redisUrl is empty)
 │   │   │   ├── vfs/            # Virtual filesystem logic
 │   │   │   │   ├── VirtualFileSystem.ts       # In-memory VFS representation
 │   │   │   │   ├── StreamingStateBuilder.ts   # Event-driven state management
@@ -172,146 +164,123 @@ meta-fuse/
 │   │   │   │   ├── MetaDataToFolderStruct.ts  # Folder organization
 │   │   │   │   ├── RenamingRule.ts            # Virtual path rules
 │   │   │   │   ├── defaults/                  # Default renaming rules
-│   │   │   │   ├── template/                  # Template engine components
-│   │   │   │   │   ├── TemplateEngine.ts      # Variable interpolation
-│   │   │   │   │   └── ConditionEvaluator.ts  # Rule condition evaluation
-│   │   │   │   └── types/                     # TypeScript type definitions
-│   │   │   │       └── RenamingRuleTypes.ts
+│   │   │   │   ├── template/                  # TemplateEngine, ConditionEvaluator
+│   │   │   │   └── types/                     # RenamingRuleTypes.ts
+│   │   │   ├── webdav/TokenStore.ts    # Per-device WebDAV tokens
 │   │   │   └── index.ts        # Entry point
 │   │   ├── package.json
 │   │   └── tsconfig.json
 │   │
-│   ├── meta-fuse-driver/       # Rust FUSE driver
+│   ├── meta-fuse-driver/       # Rust FUSE driver (fuser)
 │   │   ├── src/
-│   │   │   ├── main.rs         # Entry point
-│   │   │   ├── api_client.rs   # HTTP client to API server
-│   │   │   └── inode_mapper.rs # Path-to-inode mapping
-│   │   └── Cargo.toml
+│   │   │   ├── main.rs         # Entry point, FUSE ops, inode mapping
+│   │   │   └── api_client.rs   # HTTP client to API server
+│   │   ├── Cargo.toml
+│   │   └── Cargo.lock
 │   │
-│   └── meta-fuse-ui/           # Monitoring dashboard (optional)
-│       ├── src/
-│       └── package.json
+│   └── meta-fuse-ui/           # Dashboard (Vite + React): stats, rules editor, WebDAV tokens
 │
 ├── docs/                       # Architecture documentation
-│   ├── vfs-rebuild-architecture.md
-│   ├── streaming-architecture.md
-│   └── api-reference.md
-│
 ├── docker/
 │   ├── nginx.conf                   # Reverse proxy config
 │   ├── wsgidav.yaml                 # WebDAV server config
+│   ├── webdav_token_controller.py   # WsgiDAV DomainController (token auth)
 │   ├── supervisord.conf             # Process management
-│   └── entrypoint.sh           # Service orchestration
+│   ├── start-fuse-driver.sh         # Waits for the API, then mounts
+│   └── welcome.html
 │
 ├── Dockerfile
-├── docker-compose.yml
+├── docker-compose.yml          # Legacy standalone example (see note below)
 ├── package.json                # Workspace root
-├── pnpm-workspace.yaml
-└── README.md
+└── pnpm-workspace.yaml
 ```

 ### Key Components (meta-fuse-core)

 | Component | File | Purpose |
 |-----------|------|---------|
-| Entry Point | `src/index.ts` | Initializes KV manager, VFS, API server, stream consumer |
-| API Server | `src/api/APIServer.ts` | Fastify REST API for FUSE operations and rules management |
-| KV Manager | `src/kv/KVManager.ts` | **FOLLOWER-only**: leader discovery, Redis connection, reconnection loop |
-| Leader Client | `src/kv/LeaderClient.ts` | Reads `/meta-core/locks/kv-leader.info`, calls `/urls` API |
-| Redis Client | `src/kv/RedisClient.ts` | Wrapper around ioredis with Redis Streams support |
-| Service Discovery | `src/kv/ServiceDiscovery.ts` | Discovers all MetaMesh services via service files |
-| KV Interface | `src/kv/IKVClient.ts` | Read-only interface (get, scan, subscribe) |
+| Entry Point | `src/index.ts` | Initializes KV manager, VFS, SSE consumer, API server |
+| API Server | `src/api/APIServer.ts` | Fastify REST API for FUSE operations, rules, tokens, neighbours |
+| KV Manager | `src/kv/KVManager.ts` | Never owns storage: locates meta-core, builds the client, reconnects |
+| Leader Client | `src/kv/LeaderClient.ts` | Locates meta-core over UDP (name is legacy: no election involved) |
+| meta-core API Client | `src/kv/MetaCoreApiClient.ts` | `/meta/{hash}/{prop}`, `/meta/{hash}`, `/meta` reads |
+| SSE Event Client | `src/kv/SSEEventClient.ts` | Consumes `/api/events/meta` (replays from `0-0` every start) |
 | Virtual FS | `src/vfs/VirtualFileSystem.ts` | In-memory VFS representation with caching |
-| Streaming State Builder | `src/vfs/StreamingStateBuilder.ts` | Processes `meta:events` stream, builds VFS state incrementally |
+| Streaming State Builder | `src/vfs/StreamingStateBuilder.ts` | Turns `meta:events` into VFS state incrementally |
 | Rules Property Extractor | `src/vfs/RulesPropertyExtractor.ts` | Extracts VFS-relevant properties from renaming rules |
 | Folder Organizer | `src/vfs/MetaDataToFolderStruct.ts` | Converts flat metadata to organized folder structure |
-| Renaming Rules | `src/vfs/RenamingRule.ts` | Rules for virtual path organization |
 | Template Engine | `src/vfs/template/TemplateEngine.ts` | Variable interpolation for renaming templates |
 | Condition Evaluator | `src/vfs/template/ConditionEvaluator.ts` | Evaluates rule conditions against file metadata |
-
-**Note**: Unlike meta-sort, meta-fuse's KVManager is simplified:
- **Never spawns Redis** (always FOLLOWER)
- **Only reads metadata** (read-only interface)
- **Discovers leader** via lock file at `/meta-core/locks/kv-leader.info`
- **Calls `/urls` API** to get Redis URL, WebDAV URL, and other endpoints
- **Uses streaming mode** - processes `meta:events` stream for real-time updates
+| Token Store | `src/webdav/TokenStore.ts` | Mints/lists/revokes WebDAV tokens |

 ## Configuration

 ### Environment Variables

 ```bash
-# Volume Paths
-META_CORE_PATH=/meta-core                           # Infrastructure volume (locks, services)
-FILES_VOLUME=/files                                 # Shared media volume
+# meta-core location
+META_CORE_URL=                                      # Pin meta-core's API URL; UDP discovery never overrides it
+ENABLE_UDP_DISCOVERY=true                           # false/0 disables meta-discovery
+ALLOW_LEGACY_REDIS_URL=                             # 1 = warn instead of fail if meta-core publishes redisUrl

-# KV Connection
-REDIS_URL=                                          # Direct Redis URL (optional, skips discovery)
-REDIS_PREFIX=meta-sort:                             # Key prefix in Redis
+# Announce / nav menu
+BASE_URL=                                           # External (Caddy) URL
+PUBLIC_URL=                                         # Wins over BASE_URL (debug-direct port, no Caddy)
+
+# Paths
+FILES_VOLUME=/files                                 # Prefix for the relative filePath of each record
+CONFIG_DIR=/meta-fuse/config                        # renaming-rules.json, webdav-tokens.json

 # API Server
 API_PORT=3000                                       # API server port
 API_HOST=0.0.0.0                                    # API bind address
-VFS_REFRESH_INTERVAL=30000                          # VFS cache refresh interval (ms)

-# FUSE Driver
-FUSE_MOUNT_POINT=/mnt/virtual                       # Virtual filesystem mount
-FUSE_API_URL=http://localhost:3000                  # API server URL
+# VFS attributes (core)
 FUSE_FILE_MODE=644                                  # File permissions (octal)
 FUSE_DIR_MODE=755                                   # Directory permissions (octal)
-FUSE_ALLOW_OTHER=true                               # Allow other users
+PUID=1000                                           # File owner uid (core + driver)
+PGID=1000                                           # File owner gid (core + driver)

-# User/Group
-PUID=1000                                           # User ID for files
-PGID=1000                                           # Group ID for files
+# FUSE driver (args: <mountpoint> [api-url] [uid] [gid])
+FUSE_API_URL=http://localhost:3000                  # Used when api-url arg is omitted
+FUSE_FILE_PERM / FUSE_DIR_PERM                      # Driver-side permission overrides
+                                                    # Mount always uses allow_other (needs user_allow_other in /etc/fuse.conf)

-# WebDAV (serving files to clients)
-WEBDAV_PORT=8080                                    # WebDAV server port
-WEBDAV_USERNAME=metamesh                            # WebDAV username
-WEBDAV_PASSWORD=metamesh                            # WebDAV password
-WEBDAV_READONLY=true                                # Read-only mode
-
-# meta-core WebDAV Access (reading files from meta-core)
-META_CORE_WEBDAV_URL=http://meta-core/webdav        # URL to access files via meta-core's WebDAV
-                                                    # Enables access to SMB/rclone mounts
+# WsgiDAV
+TOKEN_STORE_PATH=/meta-fuse/config/webdav-tokens.json
 ```

 ### Docker Compose

-```yaml
-version: '3.8'
+The CasaOS store app (`packages/MetaAppStore/Apps/MetaFuse/docker-compose.yml`) is the reference deployment. Trimmed:

+```yaml
 services:
-  meta-fuse:
-    build: .
-    container_name: meta-fuse
-    restart: unless-stopped
+  metafuse-app:
+    image: ghcr.io/worph/meta-fuse:<version>
    privileged: true                    # Required for FUSE
-    cap_add:
-      - SYS_ADMIN
+    cap_add: [SYS_ADMIN, DAC_READ_SEARCH, DAC_OVERRIDE]
    devices:
-      - /dev/fuse
-    ports:
-      - "80:80"                         # nginx (WebDAV, API)
+      - /dev/fuse:/dev/fuse
+    security_opt:
+      - apparmor:unconfined
+    expose:
+      - 80                              # nginx (UI, API, WebDAV)
    volumes:
-      # Infrastructure volume (read-only for followers)
-      - ${META_CORE_PATH:-./data/meta-core}:/meta-core:ro
-      # Shared media volume (read-only)
-      - ${FILES_PATH:-./data/files}:/files:ro
-      # FUSE mount output (if exposing to host)
-      - /mnt/metamesh:/mnt/virtual:rw,shared
+      # No /meta-core mount (UDP discovery), no /files mount (WebDAV via meta-core)
+      - ${DATA_ROOT:-/DATA}/MetaFuse/Library:/mnt/virtual:shared   # FUSE mount output
+      - ${DATA_ROOT:-/DATA}/AppData/metafuse/config:/meta-fuse/config:rw
    environment:
-      - META_CORE_PATH=/meta-core
-      - FILES_VOLUME=/files
-      - FUSE_MOUNT_POINT=/mnt/virtual
-      - REDIS_PREFIX=meta-sort:
-      # Optional: Read files via meta-core WebDAV (enables SMB/rclone mount access)
-      - META_CORE_WEBDAV_URL=http://meta-core/webdav
+      - CONFIG_DIR=/meta-fuse/config
+      - BASE_URL=https://metafuse-$APP_DOMAIN
+    networks: [pcs]                     # must share a multicast-capable network with meta-core
 ```

+The repo-root `docker-compose.yml` predates meta-core (it sets `REDIS_URL` and mounts `/data`) and is not representative.
+
 ## API Endpoints

-### FUSE API (Port 3000)
+### FUSE API (Port 3000, proxied by nginx under `/api/` and `/health`)

 | Method | Endpoint | Description |
 |--------|----------|-------------|
@@ -324,35 +293,34 @@ services:
 | POST | `/api/fuse/readdir` | List directory contents |
 | POST | `/api/fuse/getattr` | Get file/directory attributes |
 | POST | `/api/fuse/exists` | Check path existence |
-| POST | `/api/fuse/read` | Read file content (returns source path or WebDAV URL) |
+| POST | `/api/fuse/read` | Resolve file content (source path / WebDAV URL) |
 | POST | `/api/fuse/metadata` | Get full metadata for a path |
 | GET | `/api/fuse/files` | List all virtual files |
 | GET | `/api/fuse/directories` | List all virtual directories |
-| POST | `/api/fuse/refresh` | Trigger VFS refresh |
+| POST | `/api/fuse/refresh` | Trigger VFS refresh (replays the event stream) |
 | **Renaming Rules** |
 | GET | `/api/fuse/rules` | Get current renaming rules configuration |
 | PUT | `/api/fuse/rules` | Update renaming rules configuration |
 | POST | `/api/fuse/rules/preview` | Preview how files would be renamed |
 | POST | `/api/fuse/rules/validate` | Validate a single rule |
 | GET | `/api/fuse/rules/variables` | Get list of available template variables |
+| **WebDAV Tokens** |
+| GET | `/api/webdav-tokens` | List tokens (hashes/prefixes only) |
+| POST | `/api/webdav-tokens` | Create a token (`{ "label": "..." }`); plaintext returned once |
+| DELETE | `/api/webdav-tokens/:id` | Revoke a token |
 | **Service Discovery** |
-| GET | `/api/services` | List all discovered MetaMesh services |
+| GET | `/api/neighbors` | Services heard over beacon v2 (nav menu) |

 ### Example Responses

 **GET /api/fuse/stats**
 ```json
 {
-  "totalFiles": 1523,
-  "totalDirectories": 48,
+  "fileCount": 1523,
+  "directoryCount": 48,
  "totalSize": 1847392847362,
-  "categories": {
-    "Movies": 523,
-    "TV": 412,
-    "Anime": 588
-  },
-  "kvConnection": "connected",
-  "fuseMount": "mounted"
+  "lastRefresh": "2026-01-15T10:30:00.000Z",
+  "redisConnected": true
 }
 ```

@@ -363,12 +331,7 @@ services:

 // Response
 {
-  "entries": [
-    "Action",
-    "Comedy",
-    "Drama",
-    "Sci-Fi"
-  ]
+  "entries": ["Action", "Comedy", "Drama", "Sci-Fi"]
 }
 ```

@@ -377,66 +340,54 @@ services:
 // Request
 { "path": "/Movies/Action/Movie.mkv" }

-// Response
+// Response (mode includes the file-type bits; times are epoch seconds)
 {
  "size": 4831838208,
-  "mode": "file",
-  "permissions": 644,
-  "atime": "2024-01-15T10:30:00Z",
-  "mtime": "2024-01-15T10:30:00Z",
-  "ctime": "2024-01-15T10:30:00Z",
-  "sourcePath": "/data/watch/downloads/Movie.2024.1080p.mkv"
+  "mode": 33188,
+  "mtime": 1705314600,
+  "atime": 1705314600,
+  "ctime": 1705314600,
+  "nlink": 1,
+  "uid": 1000,
+  "gid": 1000
 }
 ```

 ## Usage

-### Docker (Recommended)
+### Docker

 ```bash
-# Start meta-fuse service
-docker-compose up -d
+# Build the image (bundles UI, backend, FUSE driver, WsgiDAV, nginx)
+docker build -t meta-fuse .

-# View logs
-docker logs -f meta-fuse
-
-# Check health
-curl http://localhost/api/fuse/health
+# Check health (through nginx on port 80)
+curl http://localhost/health
 ```

-### Mount WebDAV (Windows)
+Images are published to `ghcr.io/worph/meta-fuse` by `.github/workflows/docker-publish.yml`. In the meta-root dev stack the service is `metafuse-app` (`https://metafuse-dev.localhost:8181` via Caddy, debug-direct `http://localhost:18181`); rebuild it with `dev/scripts/reload-meta-fuse.sh`.
+
+### Mount WebDAV
+
+Create a token in the dashboard (WebDAV tokens panel) first; use it as the password. The username can be anything non-empty.

 ```powershell
-# Map network drive
-net use Z: http://localhost/webdav /user:metamesh metamesh
-
-# Access files
+# Windows
+net use Z: https://<metafuse host>/webdav /user:me mfwd_xxxxxxxx
 dir Z:\Movies
 ```

-### Mount WebDAV (Linux)
-
 ```bash
-# Install davfs2
+# Linux (davfs2)
 sudo apt-get install davfs2
-
-# Create mount point
 mkdir -p ~/meta-fuse
-
-# Mount
-sudo mount -t davfs http://localhost/webdav ~/meta-fuse
-# Enter credentials: metamesh / metamesh
-
-# Access files
+sudo mount -t davfs https://<metafuse host>/webdav ~/meta-fuse
+# Credentials: any username / your mfwd_ token
 ls ~/meta-fuse/Movies
 ```

-### Mount WebDAV (macOS)
-
 ```bash
-# Using Finder: Go → Connect to Server
-# Enter: http://localhost/webdav
-# Credentials: metamesh / metamesh
+# macOS: Finder → Go → Connect to Server → https://<metafuse host>/webdav
 ```

 ## Development
@@ -444,39 +395,30 @@ ls ~/meta-fuse/Movies
 ### Prerequisites

 - Node.js 21.6.2+
- pnpm 10.19.0+
- Rust 1.90+ (for FUSE driver)
+- pnpm
+- Rust 1.89+ (for FUSE driver; the Dockerfile builds with `rust:1.89-bookworm`)
 - Docker & Docker Compose

 ### Local Development

 ```bash
-# Install dependencies
 pnpm install
-
-# Build all packages
-pnpm run build
-
-# Start development mode
-pnpm run dev
-
-# Run tests
-pnpm run test
-
-# Lint
+pnpm run build     # all packages
+pnpm run dev       # tsc --watch (core) + vite (ui), in parallel
+pnpm run test      # @meta-fuse/core (mocha)
 pnpm run lint
 ```

+Inside the meta-root, prefer the dev stack's in-container build (`dev/scripts/reload-meta-fuse.sh`) — see the meta-root [CLAUDE.md](../../CLAUDE.md).
+
 ### Building FUSE Driver

 ```bash
 cd packages/meta-fuse-driver
-cargo build --release
+cargo build --release --locked

-# Run driver
-./target/release/meta-fuse-driver \
-  --mount-point /mnt/virtual \
-  --api-url http://localhost:3000
+# Run driver: <mountpoint> [api-url] [uid] [gid]
+./target/release/meta-fuse-driver /mnt/virtual http://localhost:3000
 ```

 ### Project Scripts
@@ -485,9 +427,9 @@ cargo build --release
 |---------|-------------|
 | `pnpm run build` | Build all packages |
 | `pnpm run dev` | Development mode with hot reload |
-| `pnpm run start:core` | Start core service |
-| `pnpm run start:driver` | Start FUSE driver |
-| `pnpm run test` | Run all tests |
+| `pnpm run start` / `start:core` | Start core service |
+| `pnpm run start:ui` | Start UI dev server |
+| `pnpm run test` | Run core tests |
 | `pnpm run lint` | Lint all packages |

 ## How It Works
@@ -498,86 +440,56 @@ cargo build --release
 1. Client opens /mnt/virtual/Movies/Action/Movie.mkv
                    │
                    ▼
-2. FUSE driver receives read request
+2. FUSE driver receives the request
   - Converts path to inode
-   - Calls API: POST /api/fuse/getattr
+   - Calls API: POST /api/fuse/getattr, then /api/fuse/read
                    │
                    ▼
-3. API server queries KV database
-   - Looks up metadata by virtual path
-   - Returns sourcePath pointing to actual file
+3. API server resolves the path from its in-memory VFS
+   - Returns a webdavUrl on meta-core's WebDAV for the source file
                    │
                    ▼
-4. FUSE driver reads from sourcePath
-   - /data/watch/downloads/Movie.2024.1080p.mkv
+4. FUSE driver reads byte ranges from that URL (HTTP Range)
                    │
                    ▼
 5. Content streamed to client
   - No file duplication
-   - Direct read from original location
+   - Bytes come from the original location via meta-core
 ```

-### KV Data Structure
+### Metadata Access

-meta-fuse reads metadata stored by meta-sort using flat Redis keys:
+meta-fuse never talks to Redis. It reads records through meta-core's HTTP API:

 ```
-# File metadata stored by meta-sort (flat key format)
-file:{hashId}/title          → "Inception"
-file:{hashId}/year           → "2010"
-file:{hashId}/filePath       → "media1/Movies/Inception (2010)/Inception.mkv"
-file:{hashId}/size           → 4831838208
-file:{hashId}/video/codec    → "h265"
-file:{hashId}/titles/eng     → "Inception"
+GET /meta                    → { hashIds: [...] }       enumerate records
+GET /meta/{hash}             → { metadata: {...} }      full flat record
+GET /meta/{hash}/{prop}      → text/plain value        one property (e.g. titles/eng)

-# File index for enumeration
-file:__index__               → SET of all hashIds
-
-# VFS paths are computed dynamically from metadata
-# meta-fuse builds virtual paths like:
+# VFS paths are computed from metadata by the renaming rules, e.g.
 #   /Movies/Inception (2010)/Inception.mkv
-#   → resolves to sourcePath: /files/media1/Movies/Inception (2010)/Inception.mkv
+#   → filePath "media1/Movies/Inception (2010)/Inception.mkv" (relative to FILES_VOLUME)
 ```

-**Key Format**: `file:{hashId}/{property}` where:
- `hashId` is the midhash256 content identifier
- `property` can be flat (e.g., `title`) or nested (e.g., `titles/eng`)
+Field names and value formats: meta-root [METADATA_KEYS.md](../../METADATA_KEYS.md). File paths are **relative to FILES_VOLUME** (`/files`).

-**Note**: File paths in Redis are **relative to FILES_VOLUME** (`/files`). meta-fuse prepends the FILES_VOLUME path when resolving actual file locations.
+### Real-Time Updates via SSE

-### Real-Time Updates via Redis Streams
-
-meta-fuse uses the `meta:events` Redis Stream for real-time metadata updates. The streaming architecture provides:
- **Reliable delivery** - Messages persist until consumed
- **Replay capability** - Can rebuild state from stream position 0
- **Memory efficiency** - Only VFS-relevant properties are fetched
+meta-fuse consumes meta-core's `meta:events` stream through SSE at `GET {apiUrl}/api/events/meta`. Each event is a property change:

 ```typescript
-// Stream message format (meta:events)
-interface StreamMessage {
+// SSE event → StreamMessage
+{
    id: string;           // Stream entry ID (e.g., "1703808000000-0")
-    type: 'set' | 'del';  // Operation type
-    key: string;          // Redis key (e.g., "file:abc123/title")
-    ts: string;           // Timestamp
+    type: 'set' | 'del';  // SSE event name
+    key: string;          // e.g. "file:abc123/title"
 }
 ```

 **Startup Sequence**:
-1. **Streaming Bootstrap**: Replay `meta:events` stream from position 0
-2. **Build State**: Process each event, fetch only VFS-relevant properties
-3. **Go Live**: Continue consuming new events from last processed position
-
-**Event Processing Pipeline**:
-1. Parse key to extract `hashId` and `property`
-2. Check if property is VFS-relevant (based on renaming rules)
-3. If relevant, fetch property value from Redis
-4. Update internal state and notify VFS
-5. When file has `filePath`, it appears in VFS
-
-This streaming architecture enables:
- Sub-second startup (no HGETALL/SCAN)
- Memory-efficient state (~500 bytes/file)
- Real-time VFS updates as files are processed
+1. **Bootstrap**: VFS state is held only in memory, so every start replays from cursor `0-0` (the cursor is deliberately not persisted; a `gap` event resumes from the oldest retained entry)
+2. **Build State**: Parse `file:{hashId}/{property}`, skip properties the rules don't use, fetch the rest
+3. **Go Live**: Keep consuming new events; a file appears in the VFS once it has a `filePath`

 ---

@@ -586,65 +498,42 @@ This streaming architecture enables:
 ### FUSE Mount Not Working

 ```bash
-# Check if FUSE is available
-ls -la /dev/fuse
-
-# Verify mount
-mount | grep virtual
-
-# Check API health
-curl http://localhost:3000/api/fuse/health
-
-# View driver logs
-journalctl -u meta-fuse-driver -f
+ls -la /dev/fuse                     # FUSE available?
+mount | grep virtual                 # mounted?
+curl http://localhost/api/fuse/health
+# Driver logs (inside the container)
+tail -f /var/log/supervisor/fuse-driver.log /var/log/supervisor/fuse-driver_error.log
 ```

-### KV Connection Failed
+### meta-core Not Found

 ```bash
-# Check lock file exists
-cat /meta-core/locks/kv-leader.info
+# Who this service hears over UDP
+curl http://localhost/api/neighbors

-# Check /urls API
+# meta-core's own view + URLs
+curl -k https://metacore-dev.localhost:8083/api/neighbors
 curl -k https://metacore-dev.localhost:8083/api/urls

-# Verify redis is running (on leader)
-docker exec metacore-app redis-cli ping
-
-# Check meta-fuse logs
-docker logs meta-fuse | grep "KV"
+# meta-fuse logs
+docker logs metafuse-app | grep -E "LeaderClient|KVManager|SSE"
 ```

+If multicast can't cross your network, pin it with `META_CORE_URL`.
+
 ### WebDAV Not Accessible

 ```bash
-# Check WebDAV health
-curl -u metamesh:metamesh http://localhost/webdav/
-
-# Verify nginx is proxying
-curl -I http://localhost/webdav
-
-# Check WsgiDAV logs
-docker logs meta-fuse | grep "wsgidav"
+curl -u me:mfwd_xxxxxxxx http://localhost/webdav/   # 401 = bad/revoked token
+docker exec metafuse-app tail /var/log/supervisor/wsgidav_error.log
 ```

 ### Files Not Appearing

 ```bash
-# Check Redis has file data (flat key format)
-docker exec metacore-app redis-cli keys "file:*" | head -20
-
-# Check file index
-docker exec metacore-app redis-cli scard "file:__index__"
-
-# Verify source files exist
-ls -la /files/watch/
-
-# Check API stats
-curl http://localhost:3000/api/fuse/stats
-
-# Check streaming state builder stats
+curl http://localhost/api/fuse/stats
 docker logs metafuse-app | grep "State builder"
+curl -k https://metacore-dev.localhost:8083/api/stats   # does meta-core have records?
 ```

 ## Technology Stack
@@ -654,44 +543,32 @@ docker logs metafuse-app | grep "State builder"
 | Core Service | Node.js + TypeScript | API server, VFS logic |
 | HTTP Framework | Fastify 5.x | REST API |
 | FUSE Driver | Rust + fuser | Filesystem interface |
-| WebDAV | WsgiDAV (Python) | Network file sharing |
-| KV Database | Redis (via ioredis) | Metadata storage |
+| WebDAV | WsgiDAV (Python) + token DomainController | Network file sharing |
+| Metadata | meta-core HTTP API + SSE | Reads and live updates |
+| Discovery | beacon v2 (UDP multicast) | Locating meta-core and neighbours |
 | Reverse Proxy | nginx | Request routing |
-| Containerization | Docker | Deployment |
+| Containerization | Docker + supervisord | Deployment |

 ## Integration with MetaMesh

-Meta-Fuse is designed to work seamlessly with other MetaMesh services:
-
- **meta-sort**: Provides metadata in KV database
- **meta-stremio**: Can stream files exposed by meta-fuse
- **meta-share**: Syncs metadata across P2P network
-
-### Connecting to meta-sort
-
-Ensure meta-sort is running and has processed files:
+- **meta-core**: Source of metadata (HTTP/SSE) and file bytes (WebDAV)
+- **meta-sort**: Produces the metadata meta-fuse organizes
+- **meta-stremio**: Reads the same metadata for streaming

 ```bash
-# Check meta-sort processing status
+# Is meta-sort producing records?
 curl -k https://metasort-dev.localhost:8180/api/processing/status
-
-# Verify Redis has metadata (via meta-core)
-docker exec metacore-app redis-cli scard "file:__index__"
-
-# Check meta:events stream has events
-docker exec metacore-app redis-cli xlen "meta:events"
+curl -k https://metacore-dev.localhost:8083/api/stats
 ```

-Meta-fuse will automatically discover the KV database through the shared lock file at `/meta-core/locks/kv-leader.info`.
-
 ## Documentation

-For detailed architecture documentation, see the `docs/` directory:
-
- [VFS Rebuild Architecture](docs/vfs-rebuild-architecture.md) - How VFS state is built from Redis Streams
+- [VFS Rebuild Architecture](docs/vfs-rebuild-architecture.md) - How VFS state is built from the event stream
 - [Streaming Architecture](docs/streaming-architecture.md) - Event processing pipeline details
- [API Reference](docs/api-reference.md) - Complete REST API documentation
+- [API Reference](docs/api-reference.md) - REST API documentation
+
+(These predate the HTTP/SSE migration in places; the code is authoritative.)

 ## License

-MIT License - See [LICENSE](LICENSE) for details.
+MIT (see `package.json`).
@@ -91,7 +91,7 @@ export class APIServer {
    this.app.post('/api/fuse/rules/validate', this.handleValidateRule.bind(this));
    this.app.get('/api/fuse/rules/variables', this.handleGetVariables.bind(this));

-    // meta-discovery v1: neighbours heard over UDP, from this service's own
+    // beacon v2: neighbours heard over UDP, from this service's own
    // map — no meta-core needed, so the nav renders even when the core is down.
    this.app.get('/api/neighbors', this.handleNeighbors.bind(this));

@@ -134,16 +134,17 @@ export class APIServer {
  }

  /**
-   * meta-discovery v1 neighbours, served from this service's own UDP map.
+   * beacon v2 neighbours, served from this service's own UDP map.
   * `services` is an alias kept while older dashboard builds are around.
   */
-  private async handleNeighbors(_request: FastifyRequest, reply: FastifyReply): Promise<void> {
+  private async handleNeighbors(request: FastifyRequest, reply: FastifyReply): Promise<void> {
    const leaderClient = this.kvManager?.getLeaderClient();
    if (!leaderClient) {
      void reply.send({ current: 'meta-fuse', enabled: false, count: 0, neighbors: [] });
      return;
    }
-    const neighbors = leaderClient.getNeighbors();
+    const q = (request.query ?? {}) as { all?: string; cap?: string };
+    const neighbors = leaderClient.getNeighbors({ all: !!q.all, cap: q.cap || undefined });
    void reply.send({
      current: 'meta-fuse',
      enabled: true,
@@ -1,14 +1,14 @@
 /**
- * meta-discovery v1 — UDP multicast service discovery.
+ * Beacon v2 — local resource advertise / discover over UDP multicast
+ * (239.255.99.1:9099).
 *
- * Replaces the two file-based mechanisms that required a shared /meta-core
- * volume: `locks/kv-leader.info` (locating meta-core at boot) and
- * `services/<name>-<host>.json` (the dashboard nav registry). Both answered the
- * same question — where is meta-core, and who else is on this network — so one
- * announce packet answers both, and discovery scope becomes the docker network
- * rather than the mounted volume.
+ * Every node advertises resources tagged with capability strings
+ * (`metamesh.core`, `metamesh.service/meta-sort`, `metamesh.transport/nzb@1`)
+ * and keeps a live view of everyone else's. This service uses it to locate
+ * meta-core (the `metamesh.core` resource carries its /urls block) and to feed
+ * the nav menu (`metamesh.service/*`), with no shared volume.
 *
- * The normative spec is docs/project-architecture/service-discovery.md.
+ * The normative spec is docs/project-architecture/beacon-v2.md.
 *
 * ⚠ MIRRORED FILE. Byte-identical copies live in meta-sort-core, meta-fuse-core
 * and meta-dup-core. They cannot share a package: meta-fuse-core and
@@ -21,17 +21,23 @@
 import dgram from 'dgram';
 import { hostname, networkInterfaces } from 'os';

-export const PROTOCOL_VERSION = 1;
-export const DEFAULT_GROUP = '239.255.77.1';
-export const DEFAULT_PORT = 9399;
+export const PROTO = 'beacon';
+export const VERSION = 2;
+export const DEFAULT_GROUP = '239.255.99.1';
+export const DEFAULT_PORT = 9099;
 export const DEFAULT_INTERVAL_MS = 10_000;
-/** A neighbour unseen for interval × this is dropped. Replaces the reaper. */
+/** A node unheard for interval × this is dropped (evaluated at read time). */
 export const LIVENESS_FACTOR = 3;
+/** Senders stay under this so nothing fragments. */
+export const MAX_DATAGRAM = 1400;

-export const TYPE_DISCOVERY = 'discovery';
-export const TYPE_ANNOUNCE = 'announce';
-export const ROLE_CORE = 'core';
-export const ROLE_SERVICE = 'service';
+export const TYPE_PROBE = 'probe';
+export const TYPE_ADVERTISE = 'advertise';
+export const TYPE_BYE = 'bye';
+
+export const CAP_CORE = 'metamesh.core';
+export const CAP_SERVICE_PREFIX = 'metamesh.service/';
+export const CAP_ANY_SERVICE = 'metamesh.service/*';

 /** Mirrors meta-core's GET /urls response minus redisUrl (retired). */
 export interface MeshUrls {
@@ -42,38 +48,193 @@ export interface MeshUrls {
    webdavUrlInternal: string;
 }

-export interface MeshMessage {
-    v: number;
-    type: string;
-    name?: string;
-    instance?: string;
-    role?: string;
+export interface BeaconNodeInfo {
+    name: string;
+    instance: string;
    version?: string;
+    /** 'starting' | 'running'; absent reads as running. */
    status?: string;
-    baseUrl?: string;
-    /** Present only when role === 'core'. */
-    urls?: MeshUrls;
-    /** Reserved for a future HMAC; v1 ignores it. */
-    token?: string;
 }

-export interface MeshNeighbor extends MeshMessage {
+export interface BeaconResource {
+    id: string;
+    caps: string[];
+    /** Well-known: http, ui, manifest, mcp. A '/…' value is relative to http. */
+    endpoints?: Record<string, string>;
+    rev?: string;
+    /** The one consumer instance this resource belongs to. */
+    binds?: string;
+    data?: Record<string, unknown>;
+}
+
+export interface BeaconMessage {
+    proto: string;
+    v: number;
+    type: string;
+    node?: BeaconNodeInfo;
+    resources?: BeaconResource[];
+    from?: string;
+    want?: string[];
+}
+
+/** A node as served by /api/neighbors. */
+export interface MeshNeighbor extends BeaconNodeInfo {
+    resources: BeaconResource[];
+    /** Every resource's caps, flattened. */
+    caps: string[];
+    /** The metamesh.service/* resource's endpoints.ui (v1-compatible field). */
+    baseUrl?: string;
    /** Source address taken from the packet, never from the payload. */
    addr: string;
+    /** Unix seconds. */
    lastSeen: number;
 }

 export interface MeshNodeConfig {
    name: string;
    instance?: string;
-    role?: string;
    version?: string;
    group?: string;
    port?: number;
    intervalMs?: number;
    enabled?: boolean;
-    /** Rebuilt on every announce so the payload never goes stale. */
-    payload?: () => { baseUrl?: string; status?: string; urls?: MeshUrls };
+    /** Rebuilt on every advertise so the payload never goes stale. */
+    payload?: () => { status?: string; resources: BeaconResource[] };
+}
+
+/** How a discovered resource relates to this consumer (Scan card). */
+export type ScanState = 'configured' | 'addable' | 'bound-elsewhere';
+
+export interface ScanCandidate {
+    instance: string;
+    name: string;
+    version?: string;
+    resourceId: string;
+    caps: string[];
+    /** endpoints.http — what the consumer would register. */
+    url: string;
+    binds?: string;
+    state: ScanState;
+    /** The list entry that already holds this URL (state `configured`). */
+    configuredAs?: string;
+    /** A list-safe name to register it under. */
+    suggestedName: string;
+}
+
+/** Same JSON as meta-feeder-sdk `beacon::ScanReport`. */
+export interface ScanReport {
+    cap: string;
+    self: string;
+    durationMs: number;
+    summary: { nodes: number; capable: number; configured: number; boundElsewhere: number; addable: number };
+    candidates: ScanCandidate[];
+}
+
+/** Lower-case, `[a-z0-9._-]` only — accepted by every consumer's name rules. */
+export function suggestedName(instance: string): string {
+    const s = instance.trim().toLowerCase().replace(/[^a-z0-9._-]/g, '-');
+    return s || 'plugin';
+}
+
+const normUrl = (u: string) => u.trim().replace(/\/+$/, '');
+
+/**
+ * Classify every resource matching `pattern` against the consumer's
+ * `(name, url)` list. Mirrors meta-feeder-sdk `beacon::classify`.
+ */
+export function classifyScan(
+    pattern: string,
+    self: string,
+    neighbors: MeshNeighbor[],
+    configured: Array<[string, string]>,
+): ScanReport {
+    const summary = { nodes: neighbors.length, capable: 0, configured: 0, boundElsewhere: 0, addable: 0 };
+    const candidates: ScanCandidate[] = [];
+    for (const n of neighbors) {
+        for (const r of n.resources) {
+            if (!resourceMatches(r, pattern)) continue;
+            const http = resourceEndpoint(r, 'http');
+            if (!http) continue; // nothing a consumer could register
+            const url = normUrl(http);
+            summary.capable++;
+            const hit = configured.find(([, u]) => normUrl(u) === url);
+            let state: ScanState;
+            if (hit) { state = 'configured'; summary.configured++; }
+            else if (r.binds && r.binds !== self) { state = 'bound-elsewhere'; summary.boundElsewhere++; }
+            else { state = 'addable'; summary.addable++; }
+            candidates.push({
+                instance: n.instance,
+                name: n.name,
+                ...(n.version ? { version: n.version } : {}),
+                resourceId: r.id,
+                caps: r.caps ?? [],
+                url,
+                ...(r.binds ? { binds: r.binds } : {}),
+                state,
+                ...(hit ? { configuredAs: hit[0] } : {}),
+                suggestedName: suggestedName(n.instance),
+            });
+        }
+    }
+    const rank: Record<ScanState, number> = { addable: 0, configured: 1, 'bound-elsewhere': 2 };
+    candidates.sort((a, b) => rank[a.state] - rank[b.state] || a.instance.localeCompare(b.instance));
+    return { cap: pattern, self, durationMs: 0, summary, candidates };
+}
+
+/**
+ * Does capability `cap` satisfy `pattern`? `*` matches everything; an `@N` on
+ * the pattern must equal the cap's contract (none ignores it); `x/*` matches
+ * any variant of `x`; otherwise the bases must be equal.
+ */
+export function capMatches(pattern: string, cap: string): boolean {
+    if (pattern === '*') return true;
+    const split = (s: string): [string, string | null] => {
+        const i = s.lastIndexOf('@');
+        return i >= 0 ? [s.slice(0, i), s.slice(i + 1)] : [s, null];
+    };
+    const [pbase, pc] = split(pattern);
+    const [cbase, cc] = split(cap);
+    if (pc !== null && cc !== pc) return false;
+    if (pbase.endsWith('/*')) {
+        const prefix = pbase.slice(0, -2);
+        if (!cbase.startsWith(prefix)) return false;
+        const rest = cbase.slice(prefix.length);
+        return rest.startsWith('/') && rest.length > 1;
+    }
+    return pbase === cbase;
+}
+
+export function resourceMatches(r: BeaconResource, pattern: string): boolean {
+    return (r.caps ?? []).some((c) => capMatches(pattern, c));
+}
+
+/** The named endpoint as an absolute URL ('/…' joins onto endpoints.http). */
+export function resourceEndpoint(r: BeaconResource, name: string): string | undefined {
+    const v = r.endpoints?.[name];
+    if (!v) return undefined;
+    if (!v.startsWith('/')) return v;
+    const base = r.endpoints?.http;
+    return base ? base.replace(/\/+$/, '') + v : undefined;
+}
+
+/**
+ * Decode a datagram; null for anything that is not a well-formed beacon v2
+ * message (beacon v1, meta-discovery v1, other versions, junk).
+ */
+export function parseMessage(buf: Buffer): BeaconMessage | null {
+    let m: BeaconMessage;
+    try {
+        m = JSON.parse(buf.toString('utf8')) as BeaconMessage;
+    } catch {
+        return null;
+    }
+    if (!m || m.proto !== PROTO || m.v !== VERSION) return null;
+    if (m.type === TYPE_PROBE) return m;
+    if (m.type === TYPE_ADVERTISE || m.type === TYPE_BYE) {
+        if (!m.node?.name || !m.node?.instance) return null;
+        return m;
+    }
+    return null;
 }

 /** IPv4 addresses of every up, non-internal interface. */
@@ -96,15 +257,44 @@ export function localIPv4(): string {
    return localInterfaceAddresses()[0] ?? hostname();
 }

+function envNum(key: string): number | undefined {
+    const n = Number(process.env[key]);
+    return Number.isFinite(n) && n > 0 ? n : undefined;
+}
+
+interface Seen {
+    node: BeaconNodeInfo;
+    resources: BeaconResource[];
+    addr: string;
+    lastSeen: number; // ms
+}
+
+function toNeighbor(s: Seen): MeshNeighbor {
+    const caps: string[] = [];
+    let baseUrl: string | undefined;
+    for (const r of s.resources) {
+        for (const c of r.caps ?? []) if (!caps.includes(c)) caps.push(c);
+        if (!baseUrl && resourceMatches(r, CAP_ANY_SERVICE)) baseUrl = resourceEndpoint(r, 'ui');
+    }
+    return {
+        ...s.node,
+        resources: s.resources,
+        caps,
+        ...(baseUrl ? { baseUrl } : {}),
+        addr: s.addr,
+        lastSeen: s.lastSeen / 1000,
+    };
+}
+
 /**
- * One participant in the mesh: announces itself, answers probes, and keeps a
- * TTL map of everyone else.
+ * One beacon v2 participant: advertises its resources, answers probes, and
+ * keeps a TTL map of every other node.
 */
 export class MeshNode {
    private cfg: Required<Omit<MeshNodeConfig, 'payload'>> & Pick<MeshNodeConfig, 'payload'>;
    private socket: dgram.Socket | null = null;
    private timer: NodeJS.Timeout | null = null;
-    private neighbors = new Map<string, MeshNeighbor>();
+    private nodes = new Map<string, Seen>();
    private ifaceAddrs: string[] = [];
    private listeners: ((n: MeshNeighbor) => void)[] = [];
    private started = false;
@@ -113,11 +303,10 @@ export class MeshNode {
        this.cfg = {
            name: config.name,
            instance: config.instance ?? hostname(),
-            role: config.role ?? ROLE_SERVICE,
            version: config.version ?? '',
-            group: config.group ?? DEFAULT_GROUP,
-            port: config.port ?? DEFAULT_PORT,
-            intervalMs: config.intervalMs ?? DEFAULT_INTERVAL_MS,
+            group: config.group ?? process.env.BEACON_GROUP ?? DEFAULT_GROUP,
+            port: config.port ?? envNum('BEACON_PORT') ?? DEFAULT_PORT,
+            intervalMs: config.intervalMs ?? envNum('BEACON_INTERVAL_MS') ?? DEFAULT_INTERVAL_MS,
            enabled: config.enabled ?? true,
            payload: config.payload,
        };
@@ -125,12 +314,14 @@ export class MeshNode {

    async start(): Promise<void> {
        if (this.started || !this.cfg.enabled) {
-            if (!this.cfg.enabled) console.log('[meshdisco] Disabled by configuration');
+            if (!this.cfg.enabled) console.log('[beacon] Disabled by configuration');
            return;
        }
        this.started = true;

        await new Promise<void>((resolve) => {
+            // reuseAddr sets SO_REUSEADDR (+ SO_REUSEPORT on Linux for udp4),
+            // so several listeners can share 9099 on one host.
            const socket = dgram.createSocket({ type: 'udp4', reuseAddr: true });
            this.socket = socket;

@@ -138,14 +329,14 @@ export class MeshNode {
            socket.on('error', (err) => {
                // Never fatal: a host that blocks multicast must degrade, not
                // take the service down.
-                console.error('[meshdisco] Socket error:', err.message);
+                console.error('[beacon] Socket error:', err.message);
            });

            socket.bind(this.cfg.port, '0.0.0.0', () => {
                try {
                    socket.setMulticastTTL(1); // link-local only
                } catch (e) {
-                    console.warn('[meshdisco] Could not set multicast TTL:', e);
+                    console.warn('[beacon] Could not set multicast TTL:', e);
                }

                // Join on EVERY interface. A container on two docker networks
@@ -157,20 +348,20 @@ export class MeshNode {
                        socket.addMembership(this.cfg.group, addr);
                        joined++;
                    } catch (e) {
-                        console.warn(`[meshdisco] Join ${this.cfg.group} on ${addr} failed:`, e);
+                        console.warn(`[beacon] Join ${this.cfg.group} on ${addr} failed:`, e);
                    }
                }
                console.log(
-                    `[meshdisco] Listening on ${this.cfg.group}:${this.cfg.port} as ` +
+                    `[beacon] Listening on ${this.cfg.group}:${this.cfg.port} as ` +
                    `${this.cfg.name}/${this.cfg.instance} (joined ${joined} of ${this.ifaceAddrs.length} interfaces)`
                );
                resolve();
            });
        });

-        this.announce();
+        this.advertise();
        this.probe();
-        this.timer = setInterval(() => this.announce(), this.cfg.intervalMs);
+        this.timer = setInterval(() => this.advertise(), this.cfg.intervalMs);
        // Don't hold the event loop open on shutdown.
        this.timer.unref?.();
    }
@@ -179,9 +370,9 @@ export class MeshNode {
        if (!this.started) return;
        this.started = false;
        if (this.timer) { clearInterval(this.timer); this.timer = null; }
-        // Final "stopping" announce so neighbours drop us immediately rather
-        // than waiting out the staleness window.
-        this.announce('stopping');
+        // Bye, so neighbours drop us immediately rather than waiting out the
+        // staleness window.
+        this.multicast({ proto: PROTO, v: VERSION, type: TYPE_BYE, node: this.nodeInfo() });
        await new Promise<void>((resolve) => {
            if (!this.socket) return resolve();
            try { this.socket.close(() => resolve()); } catch { resolve(); }
@@ -190,135 +381,150 @@ export class MeshNode {
        this.listeners = [];
    }

-    /** Multicast a probe; every listener replies immediately. */
-    probe(): void {
-        this.send({ v: PROTOCOL_VERSION, type: TYPE_DISCOVERY });
+    /**
+     * Multicast a probe. Every node owning a resource matching one of `want`
+     * (every node, when empty) replies immediately.
+     */
+    probe(want: string[] = []): void {
+        const msg: BeaconMessage = { proto: PROTO, v: VERSION, type: TYPE_PROBE, from: this.cfg.instance };
+        if (want.length) msg.want = want;
+        this.multicast(msg);
    }

-    /** Everyone heard from inside the staleness window, sorted by name. */
+    /** Every live node, sorted by (name, instance). */
    getNeighbors(): MeshNeighbor[] {
        const cutoff = Date.now() - this.cfg.intervalMs * LIVENESS_FACTOR;
        const out: MeshNeighbor[] = [];
-        for (const [key, nb] of this.neighbors) {
-            if (nb.lastSeen < cutoff) { this.neighbors.delete(key); continue; }
-            out.push(nb);
+        for (const [key, s] of this.nodes) {
+            if (s.lastSeen < cutoff) { this.nodes.delete(key); continue; }
+            out.push(toNeighbor(s));
        }
-        return out.sort((a, b) => (a.name ?? '').localeCompare(b.name ?? ''));
+        return out.sort((a, b) => a.name.localeCompare(b.name) || a.instance.localeCompare(b.instance));
    }

-    /** One row per service name, most recently seen instance wins. */
+    /** One row per node name, most recently seen instance wins. */
    getNeighborsByName(): MeshNeighbor[] {
        const best = new Map<string, MeshNeighbor>();
        for (const nb of this.getNeighbors()) {
-            const cur = best.get(nb.name ?? '');
-            if (!cur || nb.lastSeen > cur.lastSeen) best.set(nb.name ?? '', nb);
+            const cur = best.get(nb.name);
+            if (!cur || nb.lastSeen > cur.lastSeen) best.set(nb.name, nb);
        }
-        return [...best.values()].sort((a, b) => (a.name ?? '').localeCompare(b.name ?? ''));
+        return [...best.values()].sort((a, b) => a.name.localeCompare(b.name));
    }

-    /** Cores only — what a locator filters on. */
-    getCores(): MeshNeighbor[] {
-        return this.getNeighbors().filter((n) => n.role === ROLE_CORE && n.urls);
+    /**
+     * The Scan card: probe everyone, wait `waitMs` for the replies, then
+     * classify what matches `pattern` against `configured` ([name, url]).
+     */
+    async scan(pattern: string, configured: Array<[string, string]>, waitMs = 1500): Promise<ScanReport> {
+        const started = Date.now();
+        this.probe();
+        await new Promise((r) => setTimeout(r, waitMs));
+        const report = classifyScan(pattern, this.cfg.instance, this.getNeighbors(), configured);
+        report.durationMs = Date.now() - started;
+        return report;
    }

-    /** This node's own announce, so a UI can render itself without waiting. */
+    /** This node as a row, so a UI can render itself without waiting. */
    self(): MeshNeighbor {
-        return { ...this.buildAnnounce('running'), addr: '', lastSeen: Date.now() };
+        const { status, resources } = this.payload();
+        return toNeighbor({ node: this.nodeInfo(status), resources, addr: '', lastSeen: Date.now() });
    }

-    /** Fires for every announce received (after the self-echo filter). */
-    onAnnounce(cb: (n: MeshNeighbor) => void): void {
+    /** Fires for every advertise received (after the self-echo filter). */
+    onAdvertise(cb: (n: MeshNeighbor) => void): void {
        this.listeners.push(cb);
    }

-    private onMessage(buf: Buffer, rinfo: dgram.RemoteInfo): void {
-        let msg: MeshMessage;
-        try {
-            msg = JSON.parse(buf.toString('utf8')) as MeshMessage;
-        } catch {
-            return; // foreign traffic on the group
+    private payload(): { status?: string; resources: BeaconResource[] } {
+        return this.cfg.payload ? this.cfg.payload() : { resources: [] };
    }
-        if (msg.v !== PROTOCOL_VERSION) return;
-        // Drop our own multicast echo.
-        if (msg.instance && msg.instance === this.cfg.instance && msg.name === this.cfg.name) return;

-        if (msg.type === TYPE_DISCOVERY) {
-            this.replyTo(rinfo);
+    private nodeInfo(status?: string): BeaconNodeInfo {
+        const n: BeaconNodeInfo = { name: this.cfg.name, instance: this.cfg.instance };
+        if (this.cfg.version) n.version = this.cfg.version;
+        if (status) n.status = status;
+        return n;
+    }
+
+    private advertiseMsg(): BeaconMessage {
+        const { status, resources } = this.payload();
+        return { proto: PROTO, v: VERSION, type: TYPE_ADVERTISE, node: this.nodeInfo(status), resources };
+    }
+
+    private onMessage(buf: Buffer, rinfo: dgram.RemoteInfo): void {
+        const msg = parseMessage(buf);
+        if (!msg) return; // v1 or foreign traffic on the shared group
+
+        if (msg.type === TYPE_PROBE) {
+            if (msg.from === this.cfg.instance) return;
+            const ad = this.advertiseMsg();
+            const want = msg.want ?? [];
+            const wanted = want.length === 0 ||
+                (ad.resources ?? []).some((r) => want.some((p) => resourceMatches(r, p)));
+            if (wanted) this.replyTo(ad, rinfo);
            return;
        }
-        if (msg.type !== TYPE_ANNOUNCE || !msg.name) return;

-        const key = msg.instance ? `${msg.name}|${msg.instance}` : msg.name;
-        if (msg.status === 'stopping') { this.neighbors.delete(key); return; }
+        const node = msg.node!;
+        if (node.instance === this.cfg.instance) return; // our own echo
+        if (msg.type === TYPE_BYE) { this.nodes.delete(node.instance); return; }

-        const nb: MeshNeighbor = { ...msg, addr: rinfo.address, lastSeen: Date.now() };
-        this.neighbors.set(key, nb);
+        const seen: Seen = { node, resources: msg.resources ?? [], addr: rinfo.address, lastSeen: Date.now() };
+        this.nodes.set(node.instance, seen);
+        const nb = toNeighbor(seen);
        for (const cb of this.listeners) {
-            try { cb(nb); } catch (e) { console.error('[meshdisco] Listener threw:', e); }
+            try { cb(nb); } catch (e) { console.error('[beacon] Listener threw:', e); }
        }
    }

-    private buildAnnounce(status: string): MeshMessage {
-        const msg: MeshMessage = {
-            v: PROTOCOL_VERSION,
-            type: TYPE_ANNOUNCE,
-            name: this.cfg.name,
-            instance: this.cfg.instance,
-            role: this.cfg.role,
-            version: this.cfg.version,
-            status,
-        };
-        if (this.cfg.payload) {
-            const p = this.cfg.payload();
-            if (p.baseUrl) msg.baseUrl = p.baseUrl;
-            if (p.status && status === 'running') msg.status = p.status;
-            // Only a core may carry a URLs block — a service announcing one
-            // would let any container impersonate meta-core.
-            if (this.cfg.role === ROLE_CORE && p.urls) msg.urls = p.urls;
+    private encode(msg: BeaconMessage): Buffer {
+        const body = Buffer.from(JSON.stringify(msg));
+        if (body.length > MAX_DATAGRAM) {
+            console.warn(`[beacon] ${body.length}-byte datagram exceeds the fragmentation-safe ${MAX_DATAGRAM}`);
        }
-        return msg;
+        return body;
    }

-    private announce(status = 'running'): void {
-        this.send(this.buildAnnounce(status));
+    private advertise(): void {
+        this.multicast(this.advertiseMsg());
    }

-    private replyTo(rinfo: dgram.RemoteInfo): void {
-        const body = Buffer.from(JSON.stringify(this.buildAnnounce('running')));
+    private replyTo(msg: BeaconMessage, rinfo: dgram.RemoteInfo): void {
        try {
-            this.socket?.send(body, rinfo.port, rinfo.address);
+            this.socket?.send(this.encode(msg), rinfo.port, rinfo.address);
        } catch (e) {
-            console.warn('[meshdisco] Reply failed:', e);
+            console.warn('[beacon] Reply failed:', e);
        }
    }

    /** Writes once per interface — the default route alone reaches one network. */
-    private send(msg: MeshMessage): void {
+    private multicast(msg: BeaconMessage): void {
        const socket = this.socket;
        if (!socket) return;
-        const body = Buffer.from(JSON.stringify(msg));
+        const body = this.encode(msg);
        for (const addr of this.ifaceAddrs) {
            try {
                socket.setMulticastInterface(addr);
                socket.send(body, this.cfg.port, this.cfg.group);
            } catch (e) {
-                console.warn(`[meshdisco] Send on ${addr} failed:`, e);
+                console.warn(`[beacon] Send on ${addr} failed:`, e);
            }
        }
    }
 }

 export interface MetaCoreLocatorConfig {
-    /** This service's name, for its own announce. */
+    /** This service's name, for its own advertise. */
    serviceName: string;
    /** Browser-facing URL for the nav menu. */
    baseUrl?: string;
    version?: string;
    /**
     * Explicit meta-core API URL. When set this ALWAYS wins and the wire is
-     * never consulted for core selection — see the spec's "the pin always
-     * wins". This is what stops a client box from latching onto a gateway
-     * box's core when both are reachable on a shared network.
+     * never consulted for core selection — see the spec's "the
+     * metamesh.core pin". This is what stops a client box from latching onto a
+     * gateway box's core when both are reachable on a shared network.
     */
    metaCoreUrl?: string;
    group?: string;
@@ -328,8 +534,9 @@ export interface MetaCoreLocatorConfig {
 }

 /**
- * Locates meta-core over UDP, replacing the read of
- * /meta-core/locks/kv-leader.info.
+ * Locates meta-core over beacon v2 (the first `metamesh.core` resource that
+ * carries `data.urls`), and advertises this service as
+ * `metamesh.service/<serviceName>`.
 */
 export class MetaCoreLocator {
    private node: MeshNode;
@@ -341,35 +548,42 @@ export class MetaCoreLocator {
        this.cfg = config;
        this.node = new MeshNode({
            name: config.serviceName,
-            role: ROLE_SERVICE,
            version: config.version,
            group: config.group,
            port: config.port,
            intervalMs: config.intervalMs,
            enabled: config.enabled,
-            payload: () => ({ baseUrl: config.baseUrl ?? `http://${localIPv4()}` }),
+            payload: () => ({
+                resources: [{
+                    id: 'service',
+                    caps: [CAP_SERVICE_PREFIX + config.serviceName],
+                    endpoints: { ui: config.baseUrl ?? `http://${localIPv4()}` },
+                }],
+            }),
        });

-        this.node.onAnnounce((nb) => {
-            if (nb.role !== ROLE_CORE || !nb.urls) return;
+        this.node.onAdvertise((nb) => {
            if (this.cfg.metaCoreUrl) return; // pinned: the wire cannot move us
+            const core = nb.resources.find((r) => resourceMatches(r, CAP_CORE));
+            const urls = core?.data?.urls as MeshUrls | undefined;
+            if (!urls?.apiUrl) return;

            const prev = this.current;
            if (!prev) {
-                this.current = nb.urls;
-                console.log(`[meshdisco] meta-core discovered at ${nb.urls.apiUrl} (${nb.addr})`);
+                this.current = urls;
+                console.log(`[beacon] meta-core discovered at ${urls.apiUrl} (${nb.addr})`);
                this.notifyChange();
                return;
            }
-            if (prev.apiUrl === nb.urls.apiUrl) {
-                this.current = nb.urls; // refresh the rest of the fields
+            if (prev.apiUrl === urls.apiUrl) {
+                this.current = urls; // refresh the rest of the fields
                return;
            }
-            // A second, different core is announcing. Do not flap between
+            // A second, different core is advertising. Do not flap between
            // them — keep the first and say so loudly, because on a PCS box
            // this means a client container can see the gateway's core.
            console.warn(
-                `[meshdisco] Ignoring a second meta-core at ${nb.urls.apiUrl} (${nb.addr}); ` +
+                `[beacon] Ignoring a second meta-core at ${urls.apiUrl} (${nb.addr}); ` +
                `staying with ${prev.apiUrl}. Set META_CORE_URL to pin this explicitly.`
            );
        });
@@ -377,7 +591,7 @@ export class MetaCoreLocator {

    async start(): Promise<void> {
        if (this.cfg.metaCoreUrl) {
-            console.log(`[meshdisco] meta-core pinned to ${this.cfg.metaCoreUrl}; discovery is advisory`);
+            console.log(`[beacon] meta-core pinned to ${this.cfg.metaCoreUrl}; discovery is advisory`);
        }
        await this.node.start();
    }
@@ -409,11 +623,11 @@ export class MetaCoreLocator {
        while (Date.now() < deadline) {
            const url = this.getApiUrl();
            if (url) return url;
-            if (!logged) { console.log('[meshdisco] Waiting for meta-core...'); logged = true; }
-            this.node.probe();
+            if (!logged) { console.log('[beacon] Waiting for meta-core...'); logged = true; }
+            this.node.probe([CAP_CORE]);
            await new Promise((r) => setTimeout(r, 500));
        }
-        throw new Error(`[meshdisco] No meta-core found within ${timeoutMs}ms`);
+        throw new Error(`[beacon] No meta-core found within ${timeoutMs}ms`);
    }

    /** Fires when the elected core's apiUrl changes. Replaces the fs.watch. */
@@ -421,21 +635,32 @@ export class MetaCoreLocator {
        this.changeCallbacks.push(cb);
    }

-    getNeighbors(): MeshNeighbor[] {
-        return this.node.getNeighborsByName();
+    /**
+     * Neighbours for /api/neighbors: one row per name (or every instance with
+     * `all`), optionally only nodes with a resource matching `cap`.
+     */
+    getNeighbors(opts: { all?: boolean; cap?: string } = {}): MeshNeighbor[] {
+        const list = opts.all ? this.node.getNeighbors() : this.node.getNeighborsByName();
+        const cap = opts.cap;
+        return cap ? list.filter((n) => n.resources.some((r) => resourceMatches(r, cap))) : list;
    }

    self(): MeshNeighbor {
        return this.node.self();
    }

-    probe(): void {
-        this.node.probe();
+    /** The Scan card — see {@link MeshNode.scan}. */
+    scan(pattern: string, configured: Array<[string, string]>, waitMs = 1500): Promise<ScanReport> {
+        return this.node.scan(pattern, configured, waitMs);
+    }
+
+    probe(want: string[] = []): void {
+        this.node.probe(want);
    }

    private notifyChange(): void {
        for (const cb of this.changeCallbacks) {
-            try { cb(); } catch (e) { console.error('[meshdisco] Change callback threw:', e); }
+            try { cb(); } catch (e) { console.error('[beacon] Change callback threw:', e); }
        }
    }
 }
@@ -2,7 +2,7 @@
 * KV Manager for meta-fuse (FOLLOWER-only)
 *
 * Simplified KV manager that:
- * 1. Locates meta-core via LeaderClient (UDP announce, meta-discovery v1)
+ * 1. Locates meta-core via LeaderClient (UDP announce, beacon v2)
 * 2. Creates Redis client connection
 * 3. Handles reconnection on leader failure
 *
@@ -1,7 +1,8 @@
 /**
 * LeaderClient - locates meta-core and exposes its URLs.
 *
- * Since meta-discovery v1 this is a thin adapter over MetaCoreLocator
+ * Since UDP discovery (meta-discovery v1, now beacon v2) this is a thin adapter
+ * over MetaCoreLocator
 * (../discovery/meshdisco.js): meta-core is found by UDP announce instead of by
 * reading /meta-core/locks/kv-leader.info, which means this service no longer
 * needs the /meta-core volume mounted at all.
@@ -20,7 +21,7 @@
 */

 import { Logger } from 'tslog';
-import { MetaCoreLocator, type MeshNeighbor } from '../discovery/meshdisco.js';
+import { MetaCoreLocator, type MeshNeighbor, type ScanReport } from '../discovery/meshdisco.js';
 import type { LeaderLockInfo } from './IKVClient.js';

 const logger = new Logger({ name: 'LeaderClient' });
@@ -254,16 +255,24 @@ export class LeaderClient {
        return this.leaderInfo;
    }

-    /** Neighbours for the nav menu (one row per service name). */
-    getNeighbors(): MeshNeighbor[] {
-        return this.locator.getNeighbors();
+    /**
+     * Neighbours for /api/neighbors: one row per name (every instance with
+     * `all`), optionally only nodes with a capability matching `cap`.
+     */
+    getNeighbors(opts: { all?: boolean; cap?: string } = {}): MeshNeighbor[] {
+        return this.locator.getNeighbors(opts);
    }

-    /** This service's own announce, so the menu can show itself. */
+    /** This service's own row, so the menu can show itself. */
    self(): MeshNeighbor {
        return this.locator.self();
    }

+    /** Beacon v2 Scan card: probe, wait, classify `pattern` against `configured`. */
+    scan(pattern: string, configured: Array<[string, string]>, waitMs = 1500): Promise<ScanReport> {
+        return this.locator.scan(pattern, configured, waitMs);
+    }
+
    close(): void {
        this.onChangeCallbacks = [];
        void this.locator.stop();
@@ -62,7 +62,8 @@ export function renamingRule(metadata: Partial<MediaMeta>, filepath?: string): s

    // Get title - try various fields
    // The display name — never the `titles/*` name set (METADATA_KEYS.md §3).
-    const title = metadata.title || metadata.originalTitle;
+    // `parsedTitle` is filename-parser's guess (claims model, D12): last resort.
+    const title = metadata.title || metadata.originalTitle || (metadata as { parsedTitle?: string }).parsedTitle;
    if (!title) {
        if (metadata.fileType !== 'torrent') {
            // Don't warn for torrent files because they don't always have a title
@@ -436,6 +436,7 @@ export class VirtualFileSystem implements VFSUpdateCallback {
     * Compute virtual path for a file using template rules
     */
    private computeVirtualPath(metadata: FileMetadata, sourcePath: string): string {
+        metadata = withParsedTitleFallback(metadata);
        if (!this.rulesConfig) {
            // Fallback to old behavior
            return this.metaDataToFolderStruct.generateSingleVirtualPath(sourcePath, metadata);
@@ -1105,6 +1106,7 @@ export class VirtualFileSystem implements VFSUpdateCallback {
        rules: RenamingRule[],
        defaultRule?: RenamingRule
    ): string {
+        metadata = withParsedTitleFallback(metadata);
        // Sort rules by priority (descending)
        const sortedRules = [...rules]
            .filter(r => r.enabled)
@@ -1304,3 +1306,15 @@ export class VirtualFileSystem implements VFSUpdateCallback {
        this.onFileComplete(hashId, metadata);
    }
 }
+
+/**
+ * filename-parser's guessed title lives under `parsedTitle` since the claims
+ * model (it no longer writes `originalTitle`, which tmdb also writes). The
+ * rules and templates fall back `title` → `originalTitle`; fill a missing
+ * `originalTitle` from `parsedTitle` on a copy so a file with only a parsed
+ * title still gets a path. The record itself is never changed.
+ */
+function withParsedTitleFallback<T extends { originalTitle?: unknown; parsedTitle?: unknown }>(metadata: T): T {
+    if (metadata.originalTitle || !metadata.parsedTitle) return metadata;
+    return { ...metadata, originalTitle: metadata.parsedTitle };
+}
@@ -238,6 +238,10 @@ class MetaServiceMenu extends HTMLElement {
    for (const n of this._neighbors) {
      const name = n.name || "";
      if (!name || seen.has(name)) continue;
+      // Beacon v2 neighbours include plugins; the nav lists services only.
+      // (A row without `caps` comes from a pre-v2 backend — keep it.)
+      const isService = (c) => String(c).startsWith("metamesh.service/");
+      if (Array.isArray(n.caps) && !n.caps.some(isService)) continue;
      seen.add(name);
      rows.push(n);
    }
@@ -275,7 +279,7 @@ class MetaServiceMenu extends HTMLElement {
        el.href = url;
        el.setAttribute("role", "menuitem");
      }
-      if (!isActive && !url) el.title = "No reachable URL announced";
+      if (!isActive && !url) el.title = "No reachable URL advertised";

      const icon = document.createElement("span");
      icon.className = "icon";
@@ -285,7 +289,8 @@ class MetaServiceMenu extends HTMLElement {
      label.textContent = titleCase(n.name);

      el.append(icon, label);
-      if (n.status === "running" || isActive) {
+      // Beacon v2 omits `status` when running.
+      if ((n.status || "running") === "running" || isActive) {
        const dot = document.createElement("span");
        dot.className = "dot";
        dot.title = n.status || "running";
Author	SHA1	Message	Date
Worph	b1179a6f94	virtual paths fall back to parsedTitle when a file has no title or originalTitle (claims model) Build and Push Docker Image / build (push) Successful in 2m15s Details	2026-10-25 19:25:17 +00:00
Manielle	e03b6b1fd4	CI accepts four-part tags (v1.2.3.1) for fixes Build and Push Docker Image / build (push) Successful in 1m56s Details	2026-10-25 14:21:58 +01:00
Worph	4dcac7f690	gitea workflow: push to IPCR's direct host (Cloudflare 100 MB cap) Build and Push Docker Image / build (push) Successful in 2m15s Details	2026-10-13 09:58:06 +00:00
Worph	9825b4317b	gitea workflow: publish to IPCR (metadec.eth) instead of ghcr Build and Push Docker Image / build (push) Failing after 1m49s Details	2026-10-12 18:30:17 +00:00
Worph	33847b1440	meshdisco.ts: beacon v2 scan (probe + classify) mirrored from meta-sort; LeaderClient.scan passthrough Build and Push Docker Image / build (push) Failing after 14s Details	2026-10-04 17:19:28 +00:00
Worph	b425318d21	beacon v2 discovery: meshdisco.ts on 239.255.99.1:9099, core located by metamesh.core cap, /api/neighbors ?cap=, nav lists services only Build and Push Docker Image / build (push) Failing after 13s Details	2026-10-04 11:51:08 +00:00
Worph	58a7474721	README: sync with current code	2026-10-03 11:51:56 +00:00
Worph	a0ffcd11b3	fix CI	2026-09-14 13:10:22 +02:00