From a29508f7cda507785f8f1d67925288af6f2b4eea Mon Sep 17 00:00:00 2001
From: Dr Bill Mcilhargey <contributor@mcilhargey.com>
Date: Sun, 4 Oct 2026 19:11:37 +0000
Subject: [PATCH 1/5] adsbexchange-stats: add new package

Package the ADSBexchange statistics uploader for OpenWrt, pinned to
upstream commit 11647f27de3eef51fb19bcb39f0dc0b8500a6671. Keep uploads
optional and disabled until the operator explicitly selects an enabled
ADSBexchange feeder and consents to the separate statistics upload.

Use the selected feeder UUID override before the shared station UUID.
Validate live consent and identity with one UCI batch read per upload.
Integrate activation, status and help with readsb-wiedehopf while
keeping the uploader and its dependencies in this separate package.

Provide a main-only procd service, safe generated shell settings,
checked upload metrics, and post-stop cleanup of known runtime files.
Preserve disabled service state during upgrades and reload on relevant
configuration changes. Include a valid upstream patch and regression
coverage for lifecycle, consent, identity, configuration and metrics.

Upstream: https://github.com/ADSBexchange/adsbexchange-stats
Upstream payload remains MIT; packaging files are GPL-2.0-only.

Signed-off-by: Dr Bill Mcilhargey <contributor@mcilhargey.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 utils/adsbexchange-stats/Makefile             | 141 +++++
 utils/adsbexchange-stats/README.md            | 308 ++++++++++
 .../files/adsbexchange-stats.config           |  26 +
 .../files/adsbexchange-stats.functions.sh     | 150 +++++
 .../files/adsbexchange-stats.init             | 265 +++++++++
 .../adsbexchange-stats.json-status-helpers.sh | 181 ++++++
 .../patches/010-openwrt-paths.patch           | 115 ++++
 utils/adsbexchange-stats/tests/stats.sh       | 537 ++++++++++++++++++
 8 files changed, 1723 insertions(+)
 create mode 100644 utils/adsbexchange-stats/Makefile
 create mode 100644 utils/adsbexchange-stats/README.md
 create mode 100644 utils/adsbexchange-stats/files/adsbexchange-stats.config
 create mode 100644 utils/adsbexchange-stats/files/adsbexchange-stats.functions.sh
 create mode 100644 utils/adsbexchange-stats/files/adsbexchange-stats.init
 create mode 100644 utils/adsbexchange-stats/files/adsbexchange-stats.json-status-helpers.sh
 create mode 100644 utils/adsbexchange-stats/patches/010-openwrt-paths.patch
 create mode 100644 utils/adsbexchange-stats/tests/stats.sh

diff --git a/utils/adsbexchange-stats/Makefile b/utils/adsbexchange-stats/Makefile
new file mode 100644
index 0000000000000..f14fa8f2bda21
--- /dev/null
+++ b/utils/adsbexchange-stats/Makefile
@@ -0,0 +1,141 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2026 Dr Bill Mcilhargey
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+# Dual-license: OpenWrt packaging files (this Makefile, init script,
+# helpers, patches) are GPL-2.0-only. The upstream json-status payload
+# (ADSBexchange.com, (c) 2020) remains under its original MIT license.
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=adsbexchange-stats
+PKG_VERSION:=2023-02-22
+PKG_RELEASE:=1
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_URL:=https://github.com/ADSBexchange/adsbexchange-stats.git
+PKG_SOURCE_VERSION:=11647f27de3eef51fb19bcb39f0dc0b8500a6671
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.xz
+PKG_MIRROR_HASH:=b16c3c708daea4389f1d850aca1c899cfd9827785038c332c4bf28e541ae5992
+
+PKG_LICENSE:=MIT GPL-2.0-only
+PKG_LICENSE_FILES:=LICENSE
+
+PKG_MAINTAINER:=Dr Bill Mcilhargey <contributor@mcilhargey.com>
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/adsbexchange-stats
+  SECTION:=utils
+  CATEGORY:=Utilities
+  TITLE:=ADSBexchange.com statistics uploader
+  URL:=https://github.com/ADSBexchange/adsbexchange-stats
+  # Hard-depends on readsb-wiedehopf: shares feeder identity, the
+  # readsb-uuid CLI, and /usr/lib/readsb/functions.sh.
+  # gzip is intentionally omitted -- BusyBox provides the `gzip` applet
+  # which is what the upload path uses; +gzip would pull standalone GNU
+  # gzip and break opkg dep resolution on stock feeds.
+  DEPENDS:=+bash +jq +curl +coreutils-stat +readsb-wiedehopf
+  PKGARCH:=all
+endef
+
+define Package/adsbexchange-stats/description
+  ADSBexchange.com statistics uploader for OpenWrt.
+
+  Periodically reads aircraft.json from readsb (via readsb-wiedehopf),
+  aggregates per-aircraft RSSI and counts, and POSTs the result to
+  https://adsbexchange.com identified by the selected enabled feeder's
+  UUID (its override, or readsb.main.uuid). Installation does not enable
+  or start uploads. Use readsb-feeder --setup-companions <name> to opt in.
+
+  Service knobs live in /etc/config/adsbexchange-stats.
+  Manage the station UUID with `readsb-uuid`.
+
+  Daemon control:
+    service adsbexchange-stats {start|stop|restart|reload|status|enable|disable|showurl}
+    logread -e adsbexchange-stats        -- uploader logs
+
+  Extra (non-procd) actions:
+    /etc/init.d/adsbexchange-stats showurl
+                                         -- print the public per-station
+                                            ADSBexchange stats URL
+                                            (derived from the selected feeder)
+    /etc/init.d/adsbexchange-stats about -- package and configuration help
+endef
+
+# Pure shell payload; nothing to compile or stage-install.
+Build/Configure:=:
+Build/Compile:=:
+Build/Install:=:
+
+define Package/adsbexchange-stats/conffiles
+/etc/config/adsbexchange-stats
+endef
+
+define Package/adsbexchange-stats/install
+	$(INSTALL_DIR) \
+		$(1)/etc/config \
+		$(1)/etc/init.d \
+		$(1)/usr/lib/adsbexchange-stats \
+		$(1)/usr/share/adsbexchange-stats
+	$(INSTALL_BIN)  $(PKG_BUILD_DIR)/json-status                 $(1)/usr/share/adsbexchange-stats/json-status
+	$(INSTALL_CONF) ./files/adsbexchange-stats.config            $(1)/etc/config/adsbexchange-stats
+	$(INSTALL_BIN)  ./files/adsbexchange-stats.init              $(1)/etc/init.d/adsbexchange-stats
+	$(INSTALL_DATA) ./files/adsbexchange-stats.functions.sh      $(1)/usr/lib/adsbexchange-stats/functions.sh
+	$(INSTALL_DATA) ./files/adsbexchange-stats.json-status-helpers.sh \
+		                                                     $(1)/usr/lib/adsbexchange-stats/json-status-helpers.sh
+	# Substitute @PKG_*@ placeholders in the init banner so values
+	# stay sourced from this Makefile (PKG_VERSION/PKG_MAINTAINER/...).
+	$(SED) 's,@PKG_VERSION@,$(PKG_VERSION)-$(PKG_RELEASE),g'                          $(1)/etc/init.d/adsbexchange-stats
+	$(SED) 's,@PKG_LICENSE@,$(PKG_LICENSE),g'                                          $(1)/etc/init.d/adsbexchange-stats
+	$(SED) 's,@PKG_URL@,https://github.com/ADSBexchange/adsbexchange-stats,g'          $(1)/etc/init.d/adsbexchange-stats
+	$(SED) 's,@PKG_MAINTAINER@,$(PKG_MAINTAINER),g'                                    $(1)/etc/init.d/adsbexchange-stats
+endef
+
+define Package/adsbexchange-stats/postinst
+#!/bin/sh
+[ -n "$${IPKG_INSTROOT}" ] && exit 0
+[ "$${PKG_UPGRADE}" = "1" ] && {
+/etc/init.d/adsbexchange-stats enabled && /etc/init.d/adsbexchange-stats restart
+exit 0
+}
+cat <<'EOF'
+adsbexchange-stats installed; statistics uploads remain disabled.
+  Optional setup: readsb-feeder --setup-companions <enabled-adsbexchange-feeder>
+  Uploads require separate explicit consent and use the selected feeder UUID.
+  Help: service adsbexchange-stats about
+EOF
+exit 0
+endef
+
+define Package/adsbexchange-stats/prerm
+#!/bin/sh
+# Stop and disable before opkg removes the init script. Output is
+# silenced because procd's `service delete` ubus call emits a harmless
+# "Command failed: Not found" when no live service entry exists.
+[ -n "$${IPKG_INSTROOT}" ] && exit 0
+[ "$${PKG_UPGRADE}" = "1" ] && exit 0
+{
+	if [ -x /etc/init.d/adsbexchange-stats ]; then
+		/etc/init.d/adsbexchange-stats running && \
+			/etc/init.d/adsbexchange-stats stop
+		/etc/init.d/adsbexchange-stats disable
+	fi
+} >/dev/null 2>&1
+exit 0
+endef
+
+define Package/adsbexchange-stats/postrm
+#!/bin/sh
+# Tidy the runtime dir; /var/run is tmpfs and would clear at reboot
+# anyway. Intentionally untouched: readsb.main.uuid (shared station
+# identity) and /etc/config/adsbexchange-stats (opkg `conffiles`).
+[ -n "$${IPKG_INSTROOT}" ] && exit 0
+rm -rf /var/run/adsbexchange-stats
+exit 0
+endef
+
+$(eval $(call BuildPackage,adsbexchange-stats))
diff --git a/utils/adsbexchange-stats/README.md b/utils/adsbexchange-stats/README.md
new file mode 100644
index 0000000000000..d945400f411d5
--- /dev/null
+++ b/utils/adsbexchange-stats/README.md
@@ -0,0 +1,308 @@
+# adsbexchange-stats
+
+Optional ranking-dashboard statistics uploader for ADSBexchange.com on
+OpenWrt. Companion to [`readsb-wiedehopf`](../readsb-wiedehopf/) -- it
+periodically reads `aircraft.json` from the local readsb daemon,
+aggregates per-aircraft RSSI and counts, and POSTs the result to
+ADSBexchange identified by the selected feeder's effective UUID. Pure feeding does
+**not** require this package; install it only if you want your station
+listed on the per-station web ranking.
+
+## Contents
+
+* [Quick start](#quick-start)
+* [What gets installed](#what-gets-installed)
+* [Configuration](#configuration)
+  * [`/etc/config/adsbexchange-stats` -- main section options](#etcconfigadsbexchange-stats----main-section-options)
+* [Station UUID](#station-uuid)
+* [Service control](#service-control)
+* [Logging and diagnostics](#logging-and-diagnostics)
+  * [Log levels](#log-levels)
+* [Relationship to readsb-wiedehopf](#relationship-to-readsb-wiedehopf)
+* [Tests](#tests)
+* [License](#license)
+
+## Quick start
+
+```sh
+opkg install readsb-wiedehopf       # required dependency
+opkg install adsbexchange-stats
+readsb-uuid                          # station UUID, unless the feeder overrides it
+readsb-feeder --setup-companions adsbx # use your enabled ADSBx feeder section name
+service adsbexchange-stats showurl   # print this station's stats URL
+```
+
+Installation **does not enable or start uploads**. OpenWrt's generic
+package hooks may register and invoke the init script, but the default
+`enabled=0` permission prevents any uploader process from starting.
+The readsb wizard
+offers the optional package only when installed or available in cached
+configured-feed metadata. A separate default-No prompt explains the
+statistics upload before installation or activation. Selecting No leaves
+normal ADSBexchange feeding unchanged.
+
+For explicit noninteractive activation (this command constitutes consent
+to the external statistics upload):
+
+```sh
+service adsbexchange-stats activate adsbx
+```
+
+The named section must exist, use `preset adsbexchange`, be enabled,
+and have a valid effective UUID. `activate` selects it, enables the
+uploader's UCI setting and boot service, then restarts the uploader.
+Pending readsb or uploader edits must be explicitly committed or
+reverted before activation.
+There is one uploader selection; changing it replaces the previous
+selection rather than starting a second upload process.
+
+Upgrades preserve the existing boot-enable state and do not auto-enable
+a previously disabled service. Older installations that have no
+`feeder` selection must explicitly select one before uploading; the
+package never guesses which of several feeders to use.
+
+To watch the uploader:
+
+```sh
+logread -e adsbexchange-stats
+```
+
+## What gets installed
+
+| Path                                                  | Purpose                                                                              |
+| ----------------------------------------------------- | ------------------------------------------------------------------------------------ |
+| `/usr/share/adsbexchange-stats/json-status`           | patched upstream uploader (bash; runs under procd)                                   |
+| `/etc/config/adsbexchange-stats`                      | UCI config (declarative; see below)                                                  |
+| `/etc/init.d/adsbexchange-stats`                      | procd service and `activate`, `showurl`, `about` actions |
+| `/usr/lib/adsbexchange-stats/functions.sh`            | shared sh helpers (logging, UUID, json path resolution)                              |
+| `/usr/lib/adsbexchange-stats/json-status-helpers.sh`  | upload-side helpers (curl wrapper, periodic summary)                                 |
+| `/var/run/adsbexchange-stats/`                        | runtime dir (env file, uuid, scratch JSON; tmpfs)                                    |
+
+## Configuration
+
+`/etc/config/adsbexchange-stats` is **declarative-only by design** --
+it carries options, not documentation. Comments (lines starting with
+`#`) do not survive `uci commit`: every committer (manual `uci`, LuCI,
+this package's own reload trigger, `readsb-uuid`) rewrites the file in
+canonical form and strips them. All option documentation therefore
+lives in this source-repository README and in `service adsbexchange-stats about`, never
+inside the conffile itself. (The same convention is used by the
+companion `readsb-wiedehopf` package.)
+
+The init script reads the conffile together with the selected feeder's
+UUID and `readsb.main.write_json` from `/etc/config/readsb`, renders an env
+file at `/var/run/adsbexchange-stats/env`, and supervises the uploader
+under procd.
+Scalar values in that generated file are shell-quoted, including log
+tags and runtime paths; quotes, whitespace, and shell punctuation are
+preserved as data rather than interpreted as commands.
+
+Reload triggers are registered on **both** `adsbexchange-stats` and
+`readsb`, so the recommended workflow is:
+
+```sh
+uci set adsbexchange-stats.main.<option>=<value>
+uci commit adsbexchange-stats
+service adsbexchange-stats reload
+```
+
+### `/etc/config/adsbexchange-stats` -- main section options
+
+Only the named `config adsbexchange-stats 'main'` section is supported.
+Additional sections do not create uploader instances and cannot override
+the main section's consent, feeder selection, or environment. A missing
+or incorrectly typed main section is reported as a configuration error.
+
+| Option                 | Default | Notes                                                                                                                                                          |
+| ---------------------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `enabled`              | `0`     | separate opt-in for external statistics uploads; installation alone does not change it |
+| `feeder`               | empty   | one enabled `adsbexchange` feeder section in `/etc/config/readsb`; chosen by the setup wizard or `activate` |
+| `json_paths_override`  | empty   | space-separated list of directories searched for `aircraft.json`, in preferred order. Empty = derive from `readsb.main.write_json` plus built-in fallbacks. Tokens are restricted to `[A-Za-z0-9/_.+-]`. |
+| `log_level`            | `1`     | uploader verbosity: `0` errors only, `1` + periodic summary, `2` + per-cycle line, `3` + full curl `-v` headers                                                |
+| `log_summary_interval` | `300`   | seconds between summary lines at `log_level >= 1`                                                                                                              |
+| `dns_cache`            | `0`     | enable the uploader's in-process DNS self-cache. Auto-disabled if a `127.0.0.0/8` resolver is in use or if `host`/`perl` are missing.                          |
+| `dns_ttl`              | `600`   | DNS cache TTL in seconds when `dns_cache=1`                                                                                                                    |
+| `dns_ignore_local`     | `0`     | when `dns_cache=1`, set to `'1'` to bypass the cache for `127.0.0.0/8` answers                                                                                 |
+
+The uploader and selected feeder accept OpenWrt's true boolean values
+`1`, `on`, `true`, `yes`, and `enabled` consistently at startup and before
+uploads. False or unrecognized values do not authorize uploading.
+
+`json_paths_override` resolution order:
+
+1. `option json_paths_override` (this file)
+2. `readsb.main.write_json` from `/etc/config/readsb`, plus the built-in
+   fallbacks (`/var/run/readsb`, `/run/adsbexchange-feed`, `/run/dump1090`,
+   `/run/dump1090-fa`)
+3. built-in fallbacks alone
+
+Tokens that contain shell-metacharacters are dropped at startup with a
+`warn`-level log line.
+
+## Station UUID
+
+The uploader uses the identity of the selected ADSBexchange feeder:
+
+1. Nonempty `readsb.<feeder>.uuid`, if configured.
+2. Otherwise `readsb.main.uuid`.
+
+A malformed override is rejected, not silently replaced by the main
+UUID. The station fallback can be managed with:
+
+```sh
+readsb-uuid                # interactive: generate / show / replace
+readsb-uuid --auto         # non-interactive: generate if missing
+readsb-uuid --print        # print current value
+```
+
+The init script never auto-generates the UUID, because doing so would
+race with `readsb-uuid` running concurrently on the same box. If
+the selected feeder is missing, disabled, not an ADSBexchange preset,
+or its effective UUID is missing/malformed, the service refuses to
+start with an explicit error. The upload wrapper rechecks consent,
+selection and identity before each request. If the feeder is disabled,
+removed, reassigned, or its UUID changes without a reload, uploads are
+blocked rather than sent under stale consent or identity.
+Request-time checks use one keyed UCI batch snapshot per upload rather
+than spawning a separate UCI process for each setting. A failed or
+incomplete snapshot blocks the request; configuration values are not
+cached across upload cycles.
+
+## Service control
+
+```sh
+service adsbexchange-stats start
+service adsbexchange-stats stop
+service adsbexchange-stats restart
+service adsbexchange-stats reload      # picks up UCI / readsb-uuid changes
+service adsbexchange-stats status      # procd state
+service adsbexchange-stats enable      # start at boot
+service adsbexchange-stats disable
+service adsbexchange-stats showurl     # public per-station stats URL
+service adsbexchange-stats about       # package help (not procd's built-in info)
+```
+
+`showurl` uses the selected feeder's effective UUID, matching
+`readsb-feeder --url <selected-feeder-name>`.
+
+After the uploader stops, the service removes its environment, UUID,
+temporary JSON files, compressed upload, and fallback curl diagnostics.
+Unexpected files are retained with a warning rather than recursively
+deleted.
+
+To revoke upload permission without disabling the normal feed:
+
+```sh
+uci set adsbexchange-stats.main.enabled=0
+uci commit adsbexchange-stats
+service adsbexchange-stats stop
+service adsbexchange-stats disable
+```
+
+## Logging and diagnostics
+
+All uploader and init-script output goes to syslog under the tag
+`adsbexchange-stats`:
+
+```sh
+logread -e adsbexchange-stats
+```
+
+To persist logs to a file or forward to a remote syslog server, use
+the system-wide OpenWrt logging knobs (this package does not impose
+its own log routing):
+
+```sh
+# Persist to a file (rotated by busybox at log_size KiB):
+uci set system.@system[0].log_file=/var/log/messages
+uci set system.@system[0].log_size=200
+uci commit system && /etc/init.d/log restart
+```
+
+### Log levels
+
+`option log_level` (UCI) controls uploader verbosity. All lines follow
+RFC 5424 / OpenWrt severity convention; filter with `logread -p <level>`.
+
+| `log_level` | Output                                                                                            |
+| ----------- | ------------------------------------------------------------------------------------------------- |
+| `0`         | errors only (curl transport failures, decoder stalls)                                             |
+| `1`         | + periodic upload summary every `log_summary_interval` seconds                                    |
+| `2`         | + one line per upload cycle (aircraft, http code, gzipped bytes, elapsed time)                    |
+| `3`         | + full curl `-v` request/response headers (TLS handshake; verbose, mostly useful for debugging)   |
+
+Init-script lifecycle events (start, stop, refused-UUID, unsafe path
+token) log at `notice` / `warn` / `err` regardless of `log_level`.
+Aircraft/byte metrics are normalized as decimal unsigned integers
+before accounting. Empty, malformed, negative, fractional, or oversized
+values use zero with a warning instead of breaking shell arithmetic.
+The same checked integer conversion is used for DNS and summary
+interval settings, with their documented defaults on invalid input;
+individual inputs must be within `0`..`2147483647`.
+
+## Relationship to readsb-wiedehopf
+
+This package **hard-depends** on `readsb-wiedehopf` (`DEPENDS:= ...
++readsb-wiedehopf`) for three reasons:
+
+* **Selected feeder identity.** The uploader follows that feeder's UUID
+  override or the common station UUID. It never chooses an arbitrary feeder.
+* **Shared helpers.** `/usr/lib/readsb/functions.sh` provides
+  identity validators and checked private UCI update helpers, which
+  this package's helpers source. Feeder-aware activation requires the
+  matching readsb companion-integration update.
+* **Shared `aircraft.json`.** The default `json_paths_override` reads
+  from `readsb.main.write_json` (default `/var/run/readsb`).
+
+The dependency link is one-way: `adsbexchange-stats` depends on
+`readsb-wiedehopf`, not the other way around. Reload triggers are
+registered on both UCI files so edits via `readsb-uuid`, manual `uci`
+commands on `/etc/config/readsb`, or LuCI all propagate without a
+manual restart.
+
+### Discovery from the readsb side
+
+Once both packages are installed, the readsb-side CLIs detect this
+package automatically and surface its state in their own output -- you
+do not have to remember to run a separate health check:
+
+| readsb command                            | What it does about adsbexchange-stats                                                                                                          |
+| ----------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
+| `readsb-feeder --url <name>` | Prints the named feeder's stats URL. With the selected name it matches `showurl`; works without the uploader installed. |
+| `readsb-feeder --companions [adsbexchange]` | Shows cached availability, installed/disabled/running state, and the selected feeder. Missing or disabled uploads are optional, not faults. |
+| `readsb-feeder --setup-companions <name>` | Default-No consent to optional installation and feeder-specific activation; only for an enabled feeder. |
+| `readsb-setup --status`                   | Same companion-package check as above; surfaces this package's `controls` line including the `showurl` extra action.                            |
+| `readsb-setup --health` | Shows uploader logs when uploads are opted in; deliberately disabled uploaders do not degrade daemon health due to old warnings. |
+
+The optional service is independent of readsb's daemon lifecycle.
+Uploader failures do not stop normal decoding or feeder connections.
+
+## Tests
+
+From this package's feed root, with the companion-aware decoder source
+available:
+
+```sh
+sh utils/adsbexchange-stats/tests/stats.sh /path/to/utils/readsb-wiedehopf
+```
+
+The tests use mocked UCI, procd, package hooks and HTTP calls. They cover
+default-off installation, upgrade enable-state preservation, selected
+feeder UUID resolution, explicit activation, option validation and
+per-request consent/identity guards. They perform no uploads or host
+configuration changes. Run with `bash` or `busybox ash` as well for
+shell compatibility.
+The shared helpers target OpenWrt's BusyBox ash and are tested with
+dash and Bash; they use the supported `local` extension and do not
+claim strict POSIX-only portability. Test cleanup preserves the test
+exit status and warns about leftovers without recursively deleting
+unexpected files.
+
+## License
+
+Licenses by component:
+
+* OpenWrt packaging files (Makefile, init script, helpers, patches) --
+  GPL-2.0-only (matches the surrounding OpenWrt feed).
+* Upstream `json-status` payload (ADSBexchange.com, (c) 2020) -- MIT,
+  preserved as-is in the source tarball.
diff --git a/utils/adsbexchange-stats/files/adsbexchange-stats.config b/utils/adsbexchange-stats/files/adsbexchange-stats.config
new file mode 100644
index 0000000000000..1b54105e24e43
--- /dev/null
+++ b/utils/adsbexchange-stats/files/adsbexchange-stats.config
@@ -0,0 +1,26 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2026 Dr Bill Mcilhargey
+#
+# /etc/config/adsbexchange-stats -- declarative only.
+#
+# Comments in this file DO NOT survive `uci commit`; every committer
+# (uci, LuCI, our init script's reload trigger, readsb-uuid) rewrites
+# the file in canonical form and strips every line starting with `#`.
+# All option documentation therefore lives in:
+#   https://github.com/openwrt/packages/blob/master/utils/adsbexchange-stats/README.md
+# and is also surfaced by:
+#   service adsbexchange-stats about
+#
+# The selected feeder's UUID overrides readsb.main.uuid. Uploads require
+# an enabled adsbexchange feeder and separate consent.
+
+config adsbexchange-stats main
+	option enabled '0'
+	option feeder ''
+	option json_paths_override ''
+	option log_level '1'
+	option log_summary_interval '300'
+	option dns_cache '0'
+	option dns_ttl '600'
+	option dns_ignore_local '0'
diff --git a/utils/adsbexchange-stats/files/adsbexchange-stats.functions.sh b/utils/adsbexchange-stats/files/adsbexchange-stats.functions.sh
new file mode 100644
index 0000000000000..f04af21442228
--- /dev/null
+++ b/utils/adsbexchange-stats/files/adsbexchange-stats.functions.sh
@@ -0,0 +1,150 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2026 Dr Bill Mcilhargey
+#
+# shellcheck shell=sh
+#
+# Shared helpers for adsbexchange-stats. OpenWrt ash-compatible sh;
+# also tested with dash and Bash. Sourced by both
+# /etc/init.d/adsbexchange-stats and json-status-helpers.sh. Pulls in
+# /usr/lib/readsb/functions.sh (guaranteed by DEPENDS) for readsb_is_uuid.
+#
+# shellcheck disable=SC2034  # ADSBX_* constants are consumed by callers
+# shellcheck disable=SC3043  # `local` is an ash/dash extension, not POSIX
+
+# shellcheck disable=SC1091
+. /usr/lib/readsb/functions.sh
+
+: "${ADSBX_LOG_TAG:=adsbexchange-stats}"
+READSB_LOG_TAG=$ADSBX_LOG_TAG
+
+ADSBX_RUNTIME_DIR=/var/run/adsbexchange-stats
+ADSBX_ENV_FILE=$ADSBX_RUNTIME_DIR/env
+ADSBX_UUID_FILE=$ADSBX_RUNTIME_DIR/uuid
+ADSBX_UPLOADER=/usr/share/adsbexchange-stats/json-status
+
+# Fallback aircraft.json search list when neither the UCI override nor
+# readsb.main.write_json is set.
+ADSBX_FALLBACK_PATHS='/var/run/readsb /run/adsbexchange-feed /run/dump1090 /run/dump1090-fa'
+
+# Public per-station stats URL template (mirrors readsb-wiedehopf's
+# adsbexchange preset entry).
+ADSBX_FEED_URL_BASE='https://www.adsbexchange.com/api/feeders/?feed='
+
+# --- logging ----------------------------------------------------------
+# Daemon-facility logger; tag overridable via ADSBX_LOG_TAG.
+# `--` defends against messages starting with `-`.
+_adsbx_log()    { local p="$1"; shift; logger -t "$ADSBX_LOG_TAG" -p "daemon.$p" -- "$@"; }
+adsbx_info()    { _adsbx_log info   "$@"; }
+adsbx_notice()  { _adsbx_log notice "$@"; }
+adsbx_warn()    { _adsbx_log warn   "$@"; }
+adsbx_err()     { _adsbx_log err    "$@" >&2; }
+
+# Normalize decimal input before shell arithmetic, including leading zeros.
+adsbx_uint() {
+	local number
+	number=$(awk -v value="$1" 'BEGIN {
+		if (value !~ /^[0-9]+$/ || value+0 > 2147483647) exit 1
+		printf "%.0f\n", value+0
+	}') || {
+		adsbx_warn "${3:-value} is not an unsigned integer in 0..2147483647; using $2"
+		number=$2
+	}
+	printf '%s\n' "$number"
+}
+
+# --- UUID -------------------------------------------------------------
+adsbx_get_uuid() {
+	local feeder=${1:-} preset enabled uuid
+	[ -n "$feeder" ] || feeder=$(uci -q get adsbexchange-stats.main.feeder)
+	if [ -z "$feeder" ] || ! wiz_v_uci_name "$feeder" \
+	   || ! readsb_feeder_section_exists "$feeder"; then
+		adsbx_err "select an existing feeder with 'readsb-feeder --setup-companions <name>'"
+		return 1
+	fi
+	preset=$(uci -q get "readsb.$feeder.preset")
+	enabled=$(uci -q get "readsb.$feeder.enabled")
+	if [ "$preset" != adsbexchange ]; then
+		adsbx_err "feeder '$feeder' is not an adsbexchange preset"
+		return 1
+	fi
+	case $enabled in
+		1|on|true|yes|enabled) ;;
+		*) adsbx_err "feeder '$feeder' is disabled; statistics uploads are suspended"; return 1 ;;
+	esac
+	uuid=$(uci -q get "readsb.$feeder.uuid")
+	[ -n "$uuid" ] || uuid=$(uci -q get readsb.main.uuid)
+	printf '%s\n' "$uuid"
+}
+
+# Echo the UUID and return 0 on success; log + return nonzero on
+# missing or malformed. Centralizes the gate used by start_instance,
+# showurl, and write_env.
+adsbx_require_uuid() {
+	local uuid
+	uuid=$(adsbx_get_uuid "${1:-}") || return $?
+	if [ -z "$uuid" ]; then
+		adsbx_err "selected feeder has no UUID; set its override or run 'readsb-uuid'"
+		return 1
+	fi
+	if ! readsb_is_uuid "$uuid"; then
+		adsbx_err "selected feeder's UUID is not 8-4-4-4-12 hex; refusing"
+		return 2
+	fi
+	echo "$uuid"
+}
+
+# Public per-station stats URL for a given UUID.
+adsbx_feed_url() { echo "${ADSBX_FEED_URL_BASE}$1"; }
+
+# --- aircraft.json path resolution ------------------------------------
+# Token is safe to embed verbatim in a shell-sourced file when it
+# contains only [A-Za-z0-9/_.+-]. Stricter than POSIX paths but covers
+# every real write_json directory and prevents shell-meta injection.
+_adsbx_safe_path() {
+	case $1 in
+		''|*[!A-Za-z0-9/_.+-]*) return 1 ;;
+		*) return 0 ;;
+	esac
+}
+
+# Resolve aircraft.json search paths in priority order:
+#   1. adsbexchange-stats.main.json_paths_override (UCI)
+#   2. readsb.main.write_json + ADSBX_FALLBACK_PATHS
+#   3. ADSBX_FALLBACK_PATHS alone
+#
+# Subshell so `set -f` (disable globbing while word-splitting UCI input)
+# does not leak to the caller.
+adsbx_resolve_json_paths() (
+	set -f
+	local override readsb_dir clean p out
+	override=$(uci -q get adsbexchange-stats.main.json_paths_override)
+	if [ -n "$override" ]; then
+		clean=
+		for p in $override; do
+			if _adsbx_safe_path "$p"; then
+				clean="${clean:+$clean }$p"
+			else
+				adsbx_warn "ignoring unsafe json_paths_override token: $p"
+			fi
+		done
+		[ -n "$clean" ] && { echo "$clean"; return; }
+	fi
+	readsb_dir=$(uci -q get readsb.main.write_json)
+	if [ -n "$readsb_dir" ] && _adsbx_safe_path "$readsb_dir"; then
+		# Emit readsb_dir first, then fallbacks excluding readsb_dir, so
+		# the merged list stays in priority order without a duplicate
+		# when readsb_dir matches a fallback (the readsb-wiedehopf default
+		# write_json=/var/run/readsb is also the first fallback).
+		out=$readsb_dir
+		for p in $ADSBX_FALLBACK_PATHS; do
+			[ "$p" = "$readsb_dir" ] && continue
+			out="$out $p"
+		done
+		echo "$out"
+		return
+	fi
+	[ -n "$readsb_dir" ] && \
+		adsbx_warn "readsb.main.write_json contains unsafe chars; using fallbacks only"
+	echo "$ADSBX_FALLBACK_PATHS"
+)
diff --git a/utils/adsbexchange-stats/files/adsbexchange-stats.init b/utils/adsbexchange-stats/files/adsbexchange-stats.init
new file mode 100644
index 0000000000000..e3252ff0b3b1e
--- /dev/null
+++ b/utils/adsbexchange-stats/files/adsbexchange-stats.init
@@ -0,0 +1,265 @@
+#!/bin/sh /etc/rc.common
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2026 Dr Bill Mcilhargey
+#
+# /etc/init.d/adsbexchange-stats -- procd init for the
+# ADSBexchange.com statistics uploader.
+#
+# Reads /etc/config/adsbexchange-stats plus the selected feeder UUID /
+# readsb.main.write_json from /etc/config/readsb, renders an env file
+# consumed by the patched upstream json-status uploader, and supervises
+# it under procd. The feeder UUID overrides the shared station UUID.
+#
+# See README for option/UCI/log-level reference.
+#
+# shellcheck disable=SC2034  # START/STOP/USE_PROCD/EXTRA_* read by rc.common
+# shellcheck disable=SC3043  # busybox ash and dash both support `local`
+
+START=92
+STOP=10
+USE_PROCD=1
+
+# shellcheck source=files/adsbexchange-stats.functions.sh
+. /usr/lib/adsbexchange-stats/functions.sh
+
+# Coerce $1 against an allow-list separated by "|", echoing the matched
+# value or the default $3. Defends the env file from arbitrary UCI input.
+_clamp() {
+	local IFS='|' value
+	for value in $2; do
+		[ "$1" = "$value" ] && { echo "$1"; return 0; }
+	done
+	echo "$3"
+}
+_env_assignment() {
+	local name=$1 value=$2
+	printf "%s='" "$name"
+	while :; do
+		case $value in
+			*"'"*)
+				printf "%s'\\\\''" "${value%%\'*}"
+				value=${value#*\'}
+				;;
+			*) printf "%s'\n" "$value"; return 0 ;;
+		esac
+	done
+}
+
+# Render a shell-sourceable env file consumed by the patched json-status.
+# Wrapped in a subshell so the umask change does not leak to procd.
+# UUID is passed in (already validated by start_instance) to avoid a
+# second uci read and the TOCTOU window with concurrent `readsb-uuid`.
+write_env() (
+	local cfg="$1"
+	local uuid="$2"
+	local feeder="$3"
+	local json_paths
+	local dns_cache dns_ttl dns_ignore_local
+	local log_level log_summary_interval
+
+	json_paths=$(adsbx_resolve_json_paths)
+
+	config_get dns_cache            "$cfg" dns_cache 0
+	config_get dns_ttl              "$cfg" dns_ttl 600
+	config_get dns_ignore_local     "$cfg" dns_ignore_local 0
+	config_get log_level            "$cfg" log_level 1
+	config_get log_summary_interval "$cfg" log_summary_interval 300
+
+	dns_cache=$(_clamp "$dns_cache" '0|1' 0)
+	dns_ignore_local=$(_clamp "$dns_ignore_local" '0|1' 0)
+	dns_ttl=$(adsbx_uint "$dns_ttl" 600 dns_ttl)
+	# clamped log_level is consumed locally; subshell scope means it
+	# does not escape (caller re-reads UCI for its own log line).
+	# shellcheck disable=SC2030
+	log_level=$(_clamp "$log_level" '0|1|2|3' 1)
+	log_summary_interval=$(adsbx_uint "$log_summary_interval" 300 log_summary_interval)
+
+	umask 077
+	echo "$uuid" > "$ADSBX_UUID_FILE" || return 1
+
+	umask 022
+	{
+		echo "# Generated by /etc/init.d/adsbexchange-stats; do not edit."
+		_env_assignment UUID_FILE "$ADSBX_UUID_FILE"
+		_env_assignment ADSBX_FEEDER "$feeder"
+		# TEMP_DIR overrides the upstream default (/run/adsbexchange-stats/)
+		# which is missing on builds where /run is not symlinked to /var/run
+		# (e.g. some GL.iNet QSDK derivatives).
+		_env_assignment TEMP_DIR "$ADSBX_RUNTIME_DIR"
+		_env_assignment DNS_CACHE "$dns_cache"
+		_env_assignment DNS_TTL "$dns_ttl"
+		_env_assignment DNS_IGNORE_LOCAL "$dns_ignore_local"
+		_env_assignment ADSBX_LOG_TAG "$ADSBX_LOG_TAG"
+		_env_assignment ADSBX_LOG_LEVEL "$log_level"
+		_env_assignment ADSBX_SUMMARY_INTERVAL "$log_summary_interval"
+		echo ". /usr/lib/adsbexchange-stats/json-status-helpers.sh"
+		# Render JSON_PATHS as a real bash array so the uploader keeps
+		# its `for p in "${JSON_PATHS[@]}"` iteration. Tokens passed
+		# _adsbx_safe_path; disable globbing as belt-and-braces before
+		# the intentional word-split.
+		set -f
+		# shellcheck disable=SC2086
+		set -- $json_paths
+		set +f
+		printf 'JSON_PATHS=('
+		printf '"%s" ' "$@"
+		printf ')\n'
+	} > "$ADSBX_ENV_FILE"
+)
+
+start_instance() {
+	local cfg="$1"
+	local enabled uuid feeder log_level summary_interval json_paths
+
+	config_get_bool enabled "$cfg" enabled 0
+	if [ "$enabled" -ne 1 ]; then
+		adsbx_notice "instance '$cfg' disabled in UCI; set 'option enabled 1'"
+		return 0
+	fi
+
+	# Don't auto-generate UUID here: that would race with `readsb-uuid`.
+	config_get feeder "$cfg" feeder
+	uuid=$(adsbx_require_uuid "$feeder") || return 1
+
+	if ! mkdir -p "$ADSBX_RUNTIME_DIR" || ! write_env "$cfg" "$uuid" "$feeder"; then
+		adsbx_err "cannot prepare the uploader environment; not starting"
+		return 1
+	fi
+
+	config_get log_level        "$cfg" log_level 1
+	config_get summary_interval "$cfg" log_summary_interval 300
+	json_paths=$(adsbx_resolve_json_paths)
+	# log_level is the freshly-read UCI value; the same name was clamped
+	# inside write_env's subshell but did not escape.
+	# shellcheck disable=SC2031
+	adsbx_notice "starting '$cfg' feeder=$feeder uuid=$uuid log_level=$log_level summary=${summary_interval}s paths='$json_paths'"
+
+	procd_open_instance "$cfg"
+	# json-status is bash (arrays, [[ ]], `enable -f sleep`).
+	procd_set_param command /bin/bash "$ADSBX_UPLOADER"
+	procd_set_param env ADSBX_ENV_FILE="$ADSBX_ENV_FILE"
+	procd_set_param respawn 3600 15 0
+	procd_set_param nice 19
+	procd_set_param stdout 1
+	procd_set_param stderr 1
+	procd_close_instance
+}
+
+start_service() {
+	if [ "${PKG_UPGRADE:-}" = 1 ] && ! enabled; then
+		adsbx_notice "upgrade preserves the disabled boot service"
+		return 0
+	fi
+	if [ "$(uci -q get adsbexchange-stats.main)" != adsbexchange-stats ]; then
+		adsbx_err "missing or invalid main section; only 'config adsbexchange-stats main' is supported"
+		return 1
+	fi
+	config_load adsbexchange-stats
+	start_instance main
+}
+
+stop_service() {
+	adsbx_notice "stopping uploader"
+}
+
+# rc.common calls this after stopping procd's process, not before it.
+service_stopped() {
+	[ -d "$ADSBX_RUNTIME_DIR" ] || return 0
+	adsbx_notice "clearing known runtime files in $ADSBX_RUNTIME_DIR"
+	rm -f "$ADSBX_ENV_FILE" "$ADSBX_UUID_FILE" \
+		"$ADSBX_RUNTIME_DIR/tmp.json" "$ADSBX_RUNTIME_DIR/new.json" \
+		"$ADSBX_RUNTIME_DIR/upload.gz" "$ADSBX_RUNTIME_DIR/curl.stderr" || {
+		adsbx_err "could not remove uploader runtime files"
+		return 1
+	}
+	rmdir "$ADSBX_RUNTIME_DIR" 2>/dev/null || \
+		adsbx_warn "retaining $ADSBX_RUNTIME_DIR (unexpected files or directory removal failed)"
+}
+
+service_triggers() {
+	procd_add_reload_trigger "adsbexchange-stats"
+	# Pick up UUID / write_json changes from `readsb-uuid` etc.
+	procd_add_reload_trigger "readsb"
+}
+
+reload_service() {
+	stop
+	start
+}
+
+# `/etc/init.d/adsbexchange-stats showurl` -- public per-station stats URL.
+showurl() {
+	local uuid
+	uuid=$(adsbx_require_uuid) || return $?
+	adsbx_feed_url "$uuid"
+}
+
+# Explicit consent action used by the readsb wizard or an operator.
+activate() {
+	local feeder=${1:-} pending
+	[ -n "$feeder" ] || {
+		adsbx_err "usage: service adsbexchange-stats activate <enabled-adsbexchange-feeder>"
+		return 1
+	}
+	pending=$(uci -q changes readsb) || {
+		adsbx_err "cannot inspect pending readsb configuration"
+		return 1
+	}
+	[ -z "$pending" ] || {
+		adsbx_err "commit or revert pending readsb edits before activating statistics"
+		return 1
+	}
+	adsbx_require_uuid "$feeder" >/dev/null || return 1
+	command -v readsb_uci_apply_package >/dev/null 2>&1 || {
+		adsbx_err "update readsb-wiedehopf before using feeder-aware statistics setup"
+		return 1
+	}
+	if ! readsb_uci_apply_package adsbexchange-stats "main.feeder=$feeder" "main.enabled=1"; then
+		adsbx_err "statistics configuration was not applied"
+		return 1
+	fi
+	# shellcheck disable=SC2169
+	if ! enable || ! restart; then
+		adsbx_err "statistics saved for '$feeder', but service activation failed"
+		return 1
+	fi
+	adsbx_notice "statistics uploads explicitly enabled for feeder '$feeder'"
+}
+
+# `/etc/init.d/adsbexchange-stats about` -- standard project banner.
+# Identity / license / maintainer / source URL / common entry points.
+# Placeholders are substituted by the Makefile at install time so the
+# banner stays in sync with PKG_VERSION / PKG_MAINTAINER / PKG_LICENSE.
+about() {
+	cat <<'EOF'
+adsbexchange-stats -- ADSBexchange.com statistics uploader for OpenWrt
+
+  Version     : @PKG_VERSION@
+  License     : @PKG_LICENSE@
+  Maintainer  : @PKG_MAINTAINER@
+  Source      : @PKG_URL@
+  Depends on  : bash, jq, curl, coreutils-stat, readsb-wiedehopf
+
+Service control:
+  service adsbexchange-stats {start|stop|restart|reload|status|enable|disable}
+  service adsbexchange-stats showurl    Print this station's public stats URL
+  service adsbexchange-stats about      Show this banner
+  service adsbexchange-stats activate <feeder>
+                                       Consent to uploads for an enabled ADSBx feeder
+  readsb-feeder --setup-companions <feeder>
+                                       Interactive, default-No consent
+
+Configuration:
+  /etc/config/adsbexchange-stats        UCI options (see README)
+  readsb-uuid                           Manage the shared station UUID
+  logread -e adsbexchange-stats         Tail uploader logs
+
+Report issues and read the full README at the source URL above.
+EOF
+}
+
+EXTRA_COMMANDS="showurl about activate"
+EXTRA_HELP="	showurl	Print this feeder's public ADSBexchange stats URL
+	about	Show package banner (version, license, maintainer, usage)
+	activate	Enable statistics uploads for the named ADSBx feeder"
diff --git a/utils/adsbexchange-stats/files/adsbexchange-stats.json-status-helpers.sh b/utils/adsbexchange-stats/files/adsbexchange-stats.json-status-helpers.sh
new file mode 100644
index 0000000000000..83c17d75f0eab
--- /dev/null
+++ b/utils/adsbexchange-stats/files/adsbexchange-stats.json-status-helpers.sh
@@ -0,0 +1,181 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2026 Dr Bill Mcilhargey
+#
+# shellcheck shell=sh
+#
+# Helpers sourced by json-status (via $ADSBX_ENV_FILE). OpenWrt
+# ash-compatible sh, also tested with dash; the host script is Bash. Adds a
+# periodic upload-stats summary and a curl wrapper that captures
+# per-request metrics (and full curl -v at debug log level).
+#
+# Set by /etc/init.d/adsbexchange-stats (env file):
+#   ADSBX_LOG_TAG          syslog tag
+#   ADSBX_LOG_LEVEL        0 errors only | 1 +summary | 2 +per-cycle | 3 +curl-v
+#   ADSBX_SUMMARY_INTERVAL summary cadence (sec) at level >= 1
+#
+# shellcheck disable=SC3043  # `local` is an ash/dash extension, not POSIX
+
+# Shared logging + constants. Idempotent if already sourced by the init.
+# shellcheck disable=SC1091
+. /usr/lib/adsbexchange-stats/functions.sh
+
+: "${ADSBX_LOG_LEVEL:=0}"
+: "${ADSBX_SUMMARY_INTERVAL:=300}"
+: "${MAX_CURL_TIME:=10}"
+: "${UUID:=}"
+: "${REMOTE_URL:=}"
+: "${CURL_EXTRA:=}"
+
+# Rolling counters; reset each summary window.
+ADSBX_CYCLE=0 ADSBX_OK=0 ADSBX_FAIL=0
+ADSBX_AC_TOTAL=0 ADSBX_BYTES_TOTAL=0
+ADSBX_LAST_SUMMARY=0
+ADSBX_HTTP_LAST=000 ADSBX_ELAPSED_LAST=0
+
+# One UCI process per upload; keyed show output tolerates missing options
+# without relying on batch get's version-dependent blank-line behavior.
+adsbx_upload_uuid() {
+	local feeder=${ADSBX_FEEDER:-} snapshot uuid rc
+	if ! wiz_v_uci_name "$feeder"; then
+		adsbx_warn "no valid feeder selection; reload adsbexchange-stats before uploading"
+		return 1
+	fi
+	snapshot=$(uci -q batch <<EOF
+show adsbexchange-stats.main
+show readsb.$feeder
+show readsb.main.uuid
+EOF
+	) || {
+		adsbx_err "could not read the upload configuration snapshot"
+		return 1
+	}
+	uuid=$(printf '%s\n' "$snapshot" | awk -v feeder="$feeder" '
+		function enabled(value) { return value ~ /^(1|on|true|yes|enabled)$/ }
+		{
+			separator = index($0, "=")
+			if (!separator) next
+			key = substr($0, 1, separator - 1)
+			value = substr($0, separator + 1)
+			if (value ~ /^\047.*\047$/) value = substr(value, 2, length(value) - 2)
+			settings[key] = value
+		}
+		END {
+			uploader = "adsbexchange-stats.main"
+			selected = "readsb." feeder
+			if (settings[uploader] != "adsbexchange-stats" ||
+			    !enabled(settings[uploader ".enabled"])) exit 1
+			if (settings[uploader ".feeder"] != feeder) exit 2
+			if (settings[selected] != "feeder" ||
+			    settings[selected ".preset"] != "adsbexchange" ||
+			    !enabled(settings[selected ".enabled"])) exit 3
+			uuid = settings[selected ".uuid"]
+			if (uuid == "") uuid = settings["readsb.main.uuid"]
+			print uuid
+		}
+	')
+	rc=$?
+	case $rc in
+		0) ;;
+		1) adsbx_warn "statistics uploads are disabled or unconfigured"; return 1 ;;
+		2) adsbx_warn "selected feeder changed; reload adsbexchange-stats before uploading"; return 1 ;;
+		3) adsbx_warn "selected ADSBexchange feeder is missing or disabled"; return 1 ;;
+		*) adsbx_err "could not interpret the upload configuration snapshot"; return 1 ;;
+	esac
+	if ! readsb_is_uuid "$uuid"; then
+		adsbx_err "selected feeder has no valid upload UUID"
+		return 1
+	fi
+	printf '%s\n' "$uuid"
+}
+
+# adsbx_curl_upload <gz_payload>
+#
+# POST the payload, capture HTTP code into ADSBX_HTTP_LAST and elapsed
+# seconds into ADSBX_ELAPSED_LAST. curl stderr (incl. -v at debug) is
+# captured to a tempfile and either logged at debug priority (level 3)
+# or, on transport failure, drained at warn priority. Returns curl's rv.
+adsbx_curl_upload() {
+	local payload="$1" rv=0 t0 t1 errfile http current_uuid
+	ADSBX_HTTP_LAST=000 ADSBX_ELAPSED_LAST=0
+	current_uuid=$(adsbx_upload_uuid) || return 1
+	if [ "$current_uuid" != "$UUID" ]; then
+		adsbx_warn "selected feeder UUID changed; reload adsbexchange-stats before uploading"
+		return 1
+	fi
+
+	# $@ is function-local in POSIX; CURL_EXTRA is intentionally split.
+	# shellcheck disable=SC2086
+	set -- \
+		-m "$MAX_CURL_TIME" \
+		$CURL_EXTRA \
+		-sS \
+		-X POST \
+		-H "adsbx-uuid: $UUID" \
+		-H "Content_Encoding: gzip" \
+		-o /dev/null \
+		-w '%{http_code}' \
+		--data-binary @- \
+		"$REMOTE_URL"
+	[ "$ADSBX_LOG_LEVEL" -ge 3 ] && set -- -v "$@"
+
+	errfile=$(mktemp -t adsbx-curl.XXXXXX 2>/dev/null)
+	if [ -z "$errfile" ]; then
+		# Keep diagnostics available even when mktemp fails.
+		mkdir -p "$ADSBX_RUNTIME_DIR" 2>/dev/null
+		errfile="$ADSBX_RUNTIME_DIR/curl.stderr"
+		: >"$errfile" 2>/dev/null || errfile=/dev/null
+	fi
+	t0=$(date +%s)
+	http=$(curl "$@" < "$payload" 2>"$errfile") || rv=$?
+	t1=$(date +%s)
+	ADSBX_HTTP_LAST=${http:-000}
+	ADSBX_ELAPSED_LAST=$((t1 - t0))
+
+	if [ "$errfile" != /dev/null ] && [ -s "$errfile" ]; then
+		if [ "$rv" -ne 0 ]; then
+			logger -t "$ADSBX_LOG_TAG" -p daemon.warn < "$errfile"
+		elif [ "$ADSBX_LOG_LEVEL" -ge 3 ]; then
+			logger -t "$ADSBX_LOG_TAG" -p daemon.debug < "$errfile"
+		fi
+	fi
+	[ "$errfile" != /dev/null ] && rm -f "$errfile"
+	return "$rv"
+}
+
+# adsbx_record_upload <aircraft> <bytes>
+#
+# Update counters and emit per-cycle line (level >= 2) plus periodic
+# summary (level >= 1). 200 OK counts as success; anything else as fail.
+adsbx_record_upload() {
+	local aircraft bytes now avg_ac=0 avg_bytes=0
+	aircraft=$(adsbx_uint "${1:-}" 0 "aircraft count")
+	bytes=$(adsbx_uint "${2:-}" 0 "payload byte count")
+
+	ADSBX_CYCLE=$((ADSBX_CYCLE + 1))
+	if [ "$ADSBX_HTTP_LAST" = 200 ]; then
+		ADSBX_OK=$((ADSBX_OK + 1))
+		ADSBX_AC_TOTAL=$((ADSBX_AC_TOTAL + aircraft))
+		ADSBX_BYTES_TOTAL=$((ADSBX_BYTES_TOTAL + bytes))
+	else
+		ADSBX_FAIL=$((ADSBX_FAIL + 1))
+	fi
+
+	[ "$ADSBX_LOG_LEVEL" -ge 2 ] && adsbx_info \
+		"upload aircraft=$aircraft http=$ADSBX_HTTP_LAST bytes=$bytes time=${ADSBX_ELAPSED_LAST}s"
+
+	now=$(date +%s)
+	[ "$ADSBX_LAST_SUMMARY" -eq 0 ] && ADSBX_LAST_SUMMARY=$now
+	if [ "$ADSBX_LOG_LEVEL" -ge 1 ] && \
+	   [ $((now - ADSBX_LAST_SUMMARY)) -ge "$ADSBX_SUMMARY_INTERVAL" ]; then
+		if [ "$ADSBX_OK" -gt 0 ]; then
+			avg_ac=$((ADSBX_AC_TOTAL / ADSBX_OK))
+			avg_bytes=$((ADSBX_BYTES_TOTAL / ADSBX_OK))
+		fi
+		adsbx_info \
+			"summary uploads=$ADSBX_OK/$ADSBX_CYCLE fails=$ADSBX_FAIL aircraft_avg=$avg_ac bytes_avg=$avg_bytes window=$((now - ADSBX_LAST_SUMMARY))s"
+		ADSBX_CYCLE=0 ADSBX_OK=0 ADSBX_FAIL=0
+		ADSBX_AC_TOTAL=0 ADSBX_BYTES_TOTAL=0
+		ADSBX_LAST_SUMMARY=$now
+	fi
+}
diff --git a/utils/adsbexchange-stats/patches/010-openwrt-paths.patch b/utils/adsbexchange-stats/patches/010-openwrt-paths.patch
new file mode 100644
index 0000000000000..549e8b43a2fbb
--- /dev/null
+++ b/utils/adsbexchange-stats/patches/010-openwrt-paths.patch
@@ -0,0 +1,115 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Dr Bill Mcilhargey <contributor@mcilhargey.com>
+Date: Sun, 4 Oct 2026 18:24:24 +0000
+Subject: [PATCH] integrate json-status with OpenWrt feeder configuration
+
+Use OpenWrt runtime paths and source the procd-generated environment
+after legacy overrides. Route uploads through the optional helper for
+consent and feeder-identity checks, diagnostics, and upload metrics.
+Make the optional Perl-based curl-version probe tolerate missing Perl.
+
+The upstream payload remains MIT licensed. OpenWrt integration changes
+are distributed under GPL-2.0-only.
+
+Signed-off-by: Dr Bill Mcilhargey <contributor@mcilhargey.com>
+---
+diff --git a/json-status b/json-status
+index c4b260c..13e5313 100755
+--- a/json-status
++++ b/json-status
+@@ -16,8 +16,8 @@ DNS_TTL=600
+ DNS_IGNORE_LOCAL=0
+ 
+ # List all paths, IN PREFERRED ORDER, separated by a SPACE
+-# By default, only use the json from the feed client
+-JSON_PATHS=("/run/adsbexchange-feed")
++# OpenWrt defaults; procd supplies the configured paths below.
++JSON_PATHS=("/var/run/readsb" "/run/adsbexchange-feed" "/run/dump1090" "/run/dump1090-fa")
+ 
+ ######################################################################################################################
+ # If you know what you're doing, and you want to override the search path, you can do it easily in
+@@ -28,10 +28,7 @@ JSON_PATHS=("/run/adsbexchange-feed")
+ ######################################################################################################################
+ 
+ # UUID file
+-UUID_FILE="/boot/adsbx-uuid"
+-if [[ ! -f "$UUID_FILE" ]]; then
+-    UUID_FILE="/usr/local/share/adsbexchange/adsbx-uuid"
+-fi
++UUID_FILE="/var/run/adsbexchange-stats/uuid"
+ 
+ # source local overrides (commonly the JSON_PATH, or DNS cache settings)
+ if [ -r /etc/default/adsbexchange-stats ]; then
+@@ -44,6 +41,11 @@ if [ -r /etc/default/adsbexchange-stats ]; then
+ 	fi
+ fi
+ 
++# UCI-rendered settings take precedence over legacy local overrides.
++if [ -n "${ADSBX_ENV_FILE:-}" ] && [ -r "$ADSBX_ENV_FILE" ]; then
++	. "$ADSBX_ENV_FILE"
++fi
++
+ # Small bit of sanity...
+ if [ "${#JSON_PATHS[@]}" -le 0 ]; then
+ 	echo "FATAL - You broke something.  JSON_PATHS variable has no locations listed.  Please fix."
+@@ -52,12 +54,13 @@ fi
+ 
+ JSON_DIR=""
+ 
+-TEMP_DIR="/run/adsbexchange-stats/"
++: "${TEMP_DIR:=/var/run/adsbexchange-stats}"
+ TMPFILE="${TEMP_DIR}/tmp.json"
+ NEWFILE="${TEMP_DIR}/new.json"
+ 
+ # Sanity to make sure we can write to our scratch dir in /run
+-T=$(touch $TMPFILE 2>&1)
++mkdir -p "$TEMP_DIR" || exit 99
++T=$(touch "$TMPFILE" 2>&1)
+ RV=$?
+ if [ $RV -ne 0 ]; then
+     echo "ERROR: Unable to write to $TMPFILE, aborting!  ($T)"
+@@ -213,9 +216,8 @@ if ! command -v host &>/dev/null || ! command -v perl &>/dev/null; then
+     DNS_CACHE=0
+ fi
+ 
+-VER_OK=$( echo "$CURL_VER" | perl -ne '@v=split(/\./); if ($v[0] == 7) { if ($v[1] >= 22) { printf("1");exit; } else { printf("0");exit; } } if ($v[0] > 7) { pr
+-intf("1");exit; } printf("0");exit;')
+-if [ $VER_OK -ne 1 ]; then
++VER_OK=$( { echo "$CURL_VER" | perl -ne '@v=split(/\./); print (($v[0] > 7 || ($v[0] == 7 && $v[1] >= 22)) ? 1 : 0)' ; } 2>/dev/null)
++if [ "${VER_OK:-0}" -ne 1 ]; then
+ 	echo "WARNING: curl version is too old ($CURL_VER < 7.22.0), not using script's DNS cache."
+ 	DNS_CACHE=0
+ fi
+@@ -355,16 +357,27 @@ while true; do
+ 	fi
+ 
+     sleep 0.314
+-    gzip -c <$NEWFILE >$TEMP_DIR/upload.gz
++    gzip -c <"$NEWFILE" >"$TEMP_DIR/upload.gz"
+     sleep 0.314
+ 
+ 	# Push up the data.  'curl' will wait no more than $MAX_CURL_TIME seconds for upload to complete
+-	curl -m $MAX_CURL_TIME $CURL_EXTRA -sS -X POST -H "adsbx-uuid: ${UUID}" -H "Content_Encoding: gzip" --data-binary @- $REMOTE_URL 2>&1 <$TEMP_DIR/upload.gz
+-	RV=$?
++	if command -v adsbx_curl_upload >/dev/null 2>&1; then
++		adsbx_curl_upload "$TEMP_DIR/upload.gz"
++		RV=$?
++		ADSBX_AIRCRAFT=$(jq -r '.aircraft | length' < "$NEWFILE")
++		ADSBX_GZ_BYTES=$(stat --printf="%s" "$TEMP_DIR/upload.gz")
++		adsbx_record_upload "$ADSBX_AIRCRAFT" "$ADSBX_GZ_BYTES"
++	else
++		curl -m $MAX_CURL_TIME $CURL_EXTRA -sS -X POST -H "adsbx-uuid: ${UUID}" -H "Content_Encoding: gzip" --data-binary @- $REMOTE_URL 2>&1 <"$TEMP_DIR/upload.gz"
++		RV=$?
++	fi
+ 
+ 	if [ $RV -ne 0 ]; then
+-		echo "WARNING: curl process returned non-zero ($RV): [$CURL]; Sleeping a little extra."
++		if command -v adsbx_warn >/dev/null 2>&1; then
++			adsbx_warn "upload returned non-zero ($RV); backing off"
++		else
++			echo "WARNING: curl process returned non-zero ($RV): [$CURL]; Sleeping a little extra."
++		fi
+ 		sleep $(( 5 + RANDOM % 15 ))
+ 	fi
+ done
+-
diff --git a/utils/adsbexchange-stats/tests/stats.sh b/utils/adsbexchange-stats/tests/stats.sh
new file mode 100644
index 0000000000000..537d0a6aff7ca
--- /dev/null
+++ b/utils/adsbexchange-stats/tests/stats.sh
@@ -0,0 +1,537 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0-only
+# Test overrides intentionally remain in each test's subshell.
+# shellcheck disable=SC2030,SC2031
+
+package_dir=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd) || exit 1
+readsb_dir=${1:-"$package_dir/../readsb-wiedehopf"}
+[ -r "$readsb_dir/files/readsb.functions.sh" ] || {
+	echo "usage: sh tests/stats.sh /path/to/utils/readsb-wiedehopf" >&2
+	exit 1
+}
+tmpdir=$(mktemp -d) || exit 1
+cleanup() {
+	status=$?
+	trap - 0
+	rm -f "$tmpdir/functions.sh" "$tmpdir/init.sh" "$tmpdir/upload.sh" \
+		"$tmpdir/postinst.sh" "$tmpdir/prerm.sh" "$tmpdir/config" \
+		"$tmpdir/calls" "$tmpdir/log" "$tmpdir/uuid" "$tmpdir/env" "$tmpdir/env-check.sh" \
+		"$tmpdir/uci-calls" "$tmpdir/cleanup-output" || \
+		printf 'cleanup: could not remove test files in %s\n' "$tmpdir" >&2
+	rmdir "$tmpdir" 2>/dev/null || \
+		printf 'cleanup: temporary directory retained at %s (leftover files or removal failure)\n' "$tmpdir" >&2
+	exit "$status"
+}
+trap cleanup 0
+trap 'exit 1' HUP INT TERM
+# shellcheck source=/dev/null
+. "$readsb_dir/files/readsb.functions.sh"
+sed '\|^\. /usr/lib/readsb/functions.sh$|d' "$package_dir/files/adsbexchange-stats.functions.sh" > "$tmpdir/functions.sh"
+sed '\|^\. /usr/lib/adsbexchange-stats/functions.sh$|d' "$package_dir/files/adsbexchange-stats.init" > "$tmpdir/init.sh"
+sed '\|^\. /usr/lib/adsbexchange-stats/functions.sh$|d' "$package_dir/files/adsbexchange-stats.json-status-helpers.sh" > "$tmpdir/upload.sh"
+for hook in postinst prerm; do
+	sed -n "/^define Package\\/adsbexchange-stats\\/$hook$/,/^endef$/p" "$package_dir/Makefile" \
+		| sed '1d;$d;s/\$\$/\$/g;s|/etc/init.d/adsbexchange-stats|service_mock|g' > "$tmpdir/$hook.sh"
+done
+# shellcheck source=/dev/null
+. "$tmpdir/functions.sh"
+# shellcheck source=/dev/null
+. "$tmpdir/init.sh"
+# shellcheck source=/dev/null
+. "$tmpdir/upload.sh"
+# shellcheck disable=SC2034
+ADSBX_RUNTIME_DIR=$tmpdir ADSBX_UUID_FILE="$tmpdir/uuid" ADSBX_ENV_FILE="$tmpdir/env"
+
+main_uuid=00000000-0000-4000-8000-000000000001
+override_uuid=00000000-0000-4000-8000-000000000002
+seed() {
+	printf '%s\n' "readsb.main.uuid=$main_uuid" 'readsb.main.write_json=/var/run/readsb' \
+		'readsb.first=feeder' 'readsb.first.preset=adsbexchange' 'readsb.first.enabled=1' \
+		'readsb.second=feeder' 'readsb.second.preset=adsbexchange' 'readsb.second.enabled=1' \
+		"readsb.second.uuid=$override_uuid" \
+		'adsbexchange-stats.main=adsbexchange-stats' 'adsbexchange-stats.main.enabled=0' \
+		'adsbexchange-stats.main.feeder=first' "$@" > "$tmpdir/config"
+	: > "$tmpdir/calls"
+	: > "$tmpdir/uci-calls"
+	: > "$tmpdir/log"
+	rm -f "$tmpdir/env" "$tmpdir/uuid"
+}
+uci() {
+	local staging=''
+	if [ "$1" = -t ]; then staging=$2; shift 2; fi
+	[ "$1" != -q ] || shift
+	printf '%s\n' "$1" >> "$tmpdir/uci-calls"
+	case $1 in
+		batch)
+			[ "${fail_batch:-0}" != 1 ] || return 9
+			while read -r operation key; do
+				[ "$operation" = show ] || return 99
+				awk -v key="$key" '
+					{
+						separator = index($0, "=")
+						name = substr($0, 1, separator - 1)
+						if (name == key || index(name, key ".") == 1)
+							values[name] = substr($0, separator + 1)
+					}
+					END { for (name in values) print name "='\''" values[name] "'\''" }
+				' "$tmpdir/config"
+			done
+			;;
+		get)
+			awk -v key="$2=" 'index($0,key)==1 { value=substr($0,length(key)+1); found=1 }
+				END { if (!found) exit 1; print value }' "$tmpdir/config"
+			;;
+		changes)
+			case $2 in
+				readsb) printf '%s' "${test_pending_readsb:-}" ;;
+				adsbexchange-stats) printf '%s' "${test_pending:-}" ;;
+				*) return 99 ;;
+			esac
+			;;
+		set)
+			[ "${fail_set:-}" != "${2%%=*}" ] || return 9
+			if [ -n "$staging" ]; then
+				printf '%s\n' "$2" >> "$staging/adsbexchange-stats"
+			else
+				printf '%s\n' "$2" >> "$tmpdir/config"
+			fi
+			;;
+		commit)
+			[ "${fail_commit:-0}" != 1 ] || return 9
+			[ -z "$staging" ] || cat "$staging/adsbexchange-stats" >> "$tmpdir/config"
+			echo commit >> "$tmpdir/calls"
+			;;
+		*) echo "unexpected UCI operation: $*" >&2; return 99 ;;
+	esac
+}
+config_get() {
+	test_value=$(uci -q get "adsbexchange-stats.$2.$3") || test_value=${4:-}
+	export "$1=$test_value"
+}
+config_get_bool() {
+	test_bool=$(uci -q get "adsbexchange-stats.$2.$3") || test_bool=${4:-0}
+	case $test_bool in
+		1|on|true|yes|enabled) test_bool=1 ;;
+		0|off|false|no|disabled) test_bool=0 ;;
+		*) test_bool=${4:-0} ;;
+	esac
+	export "$1=$test_bool"
+}
+config_load() { :; }
+config_foreach() { "$1" main; }
+adsbx_info() { printf 'info: %s\n' "$*" >> "$tmpdir/log"; }
+adsbx_notice() { printf 'notice: %s\n' "$*" >> "$tmpdir/log"; }
+adsbx_warn() { printf 'warn: %s\n' "$*" >> "$tmpdir/log"; }
+adsbx_err() { printf 'error: %s\n' "$*" >> "$tmpdir/log"; }
+_err() { adsbx_err "$@"; }
+enable() { echo enable >> "$tmpdir/calls"; }
+restart() { echo restart >> "$tmpdir/calls"; return "${restart_rc:-0}"; }
+procd_open_instance() { echo open >> "$tmpdir/calls"; }
+procd_set_param() { printf 'procd %s\n' "$*" >> "$tmpdir/calls"; }
+procd_close_instance() { :; }
+service_mock() {
+	printf 'service %s\n' "$*" >> "$tmpdir/calls"
+	case $1 in enabled) return "${boot_enabled_rc:-1}" ;; esac
+}
+
+assert_equal() {
+	[ "$1" = "$2" ] && return 0
+	printf 'expected <%s>, got <%s>\n' "$2" "$1" >&2
+	return 1
+}
+tests=0 failures=0
+run_test() {
+	label=$1; shift
+	tests=$((tests+1))
+	if "$@"; then printf 'ok %s - %s\n' "$tests" "$label"; else
+		printf 'not ok %s - %s\n' "$tests" "$label"; failures=$((failures+1))
+	fi
+}
+test_identity() (
+	selector=$1 expected_rc=$2 expected_uuid=$3; shift 3
+	seed "$@"
+	rc=0
+	value=$(adsbx_require_uuid "$selector") || rc=$?
+	assert_equal "$rc" "$expected_rc" && assert_equal "$value" "$expected_uuid"
+)
+run_test 'default-selected feeder inherits main UUID' test_identity '' 0 "$main_uuid"
+run_test 'selected feeder override wins over main UUID' test_identity second 0 "$override_uuid"
+run_test 'configured selection resolves its own override' test_identity '' 0 "$override_uuid" \
+	'adsbexchange-stats.main.feeder=second'
+run_test 'disabled feeder cannot upload' test_identity first 1 '' 'readsb.first.enabled=0'
+run_test 'wrong provider cannot upload' test_identity first 1 '' 'readsb.first.preset=adsblol'
+run_test 'missing feeder cannot upload' test_identity missing 1 ''
+run_test 'empty selection is not guessed from multiple feeders' test_identity '' 1 '' \
+	'adsbexchange-stats.main.feeder='
+run_test 'malformed feeder override is rejected, not replaced by main UUID' test_identity second 2 '' \
+	'readsb.second.uuid=invalid'
+
+test_disabled_start() (
+	seed
+	start_instance main || return 1
+	[ ! -s "$tmpdir/calls" ] && [ ! -e "$tmpdir/env" ]
+)
+test_enabled_start() (
+	seed 'adsbexchange-stats.main.enabled=1' 'adsbexchange-stats.main.feeder=second'
+	start_instance main || return 1
+	assert_equal "$(cat "$tmpdir/uuid")" "$override_uuid" || return 1
+	grep -qx "ADSBX_FEEDER='second'" "$tmpdir/env" && grep -q '^open$' "$tmpdir/calls"
+)
+test_environment_failure() (
+	seed 'adsbexchange-stats.main.enabled=1'
+	export ADSBX_UUID_FILE="$tmpdir/missing/uuid"
+	rc=0
+	start_instance main 2>/dev/null || rc=$?
+	assert_equal "$rc" 1 && ! grep -q '^open$' "$tmpdir/calls" &&
+		grep -q 'cannot prepare the uploader environment' "$tmpdir/log"
+)
+test_activation() (
+	failure=${1:-}
+	seed
+	original=$(cat "$tmpdir/config")
+	case $failure in
+		write) fail_set=adsbexchange-stats.main.enabled ;;
+		commit) fail_commit=1 ;;
+		pending) test_pending="adsbexchange-stats.main.log_level='3'" ;;
+		readsb-pending) test_pending_readsb="readsb.second.uuid='$main_uuid'" ;;
+	esac
+	rc=0
+	activate second || rc=$?
+	if [ -n "$failure" ]; then
+		[ "$rc" -ne 0 ] && assert_equal "$(cat "$tmpdir/config")" "$original" \
+			&& [ ! -s "$tmpdir/calls" ]
+	else
+		assert_equal "$(uci -q get adsbexchange-stats.main.feeder)" second &&
+			assert_equal "$(uci -q get adsbexchange-stats.main.enabled)" 1 &&
+			assert_equal "$(cat "$tmpdir/calls")" "$(printf 'commit\nenable\nrestart')"
+	fi
+)
+run_test 'disabled uploader does not create an environment or start procd' test_disabled_start
+run_test 'enabled uploader uses selected feeder identity in its environment' test_enabled_start
+run_test 'failed UUID-file write prevents uploader startup' test_environment_failure
+run_test 'explicit activation configures and starts the selected feeder' test_activation
+run_test 'activation write failure leaves settings untouched' test_activation write
+run_test 'activation commit failure does not enable or start the service' test_activation commit
+run_test 'activation refuses pre-existing pending stats edits' test_activation pending
+run_test 'activation refuses an uncommitted feeder identity change' test_activation readsb-pending
+
+test_clamp() {
+	assert_equal "$(_clamp "$1" "$2" "$3")" "$4"
+}
+for level in 0 1 2 3; do run_test "log level $level is retained" test_clamp "$level" '0|1|2|3' 1 "$level"; done
+run_test 'DNS cache can be explicitly enabled' test_clamp 1 '0|1' 0 1
+run_test 'invalid verbosity uses the documented default' test_clamp invalid '0|1|2|3' 1 1
+
+test_hook() (
+	hook=$1 upgrade=$2 offline=$3 boot_enabled_rc=$4 expected=$5
+	seed
+	export PKG_UPGRADE=$upgrade IPKG_INSTROOT=$offline
+	rc=0
+	(
+		# shellcheck source=/dev/null
+		. "$tmpdir/$hook.sh"
+	) >/dev/null 2>&1 || rc=$?
+	assert_equal "$rc" 0 && assert_equal "$(cat "$tmpdir/calls")" "$expected"
+)
+run_test 'fresh install neither enables nor starts the uploader' test_hook postinst '' '' 1 ''
+run_test 'offline image install does not run services' test_hook postinst '' /image 1 ''
+run_test 'upgrade preserves a disabled service' test_hook postinst 1 '' 1 'service enabled'
+run_test 'upgrade restarts only an already-enabled service' test_hook postinst 1 '' 0 \
+	"$(printf 'service enabled\nservice restart')"
+run_test 'upgrade removal does not disable the service' test_hook prerm 1 '' 0 ''
+run_test 'default UCI configuration has uploads disabled' \
+	grep -q "option enabled '0'" "$package_dir/files/adsbexchange-stats.config"
+run_test 'package help avoids the reserved procd info action' \
+	grep -q '^about()' "$package_dir/files/adsbexchange-stats.init"
+
+test_upload_guard() (
+	scenario=$1 expected_rc=$2
+	seed 'adsbexchange-stats.main.enabled=1' 'adsbexchange-stats.main.feeder=second'
+	# shellcheck disable=SC2034
+	ADSBX_FEEDER=second UUID=$override_uuid ADSBX_HTTP_LAST=200 ADSBX_ELAPSED_LAST=12
+	case $scenario in
+		disabled) echo 'adsbexchange-stats.main.enabled=0' >> "$tmpdir/config" ;;
+		feeder-disabled) echo 'readsb.second.enabled=0' >> "$tmpdir/config" ;;
+		switched) echo 'adsbexchange-stats.main.feeder=first' >> "$tmpdir/config" ;;
+		uuid-changed) echo "readsb.second.uuid=$main_uuid" >> "$tmpdir/config" ;;
+		unselected) export ADSBX_FEEDER='' ;;
+	esac
+	curl() { echo curl >> "$tmpdir/calls"; printf 200; }
+	rc=0
+	adsbx_curl_upload "$tmpdir/config" || rc=$?
+	assert_equal "$rc" "$expected_rc" || return 1
+	if [ "$expected_rc" = 0 ]; then
+		assert_equal "$(cat "$tmpdir/calls")" curl && assert_equal "$ADSBX_HTTP_LAST" 200
+	else
+		[ ! -s "$tmpdir/calls" ] && assert_equal "$ADSBX_HTTP_LAST" 000 &&
+			assert_equal "$ADSBX_ELAPSED_LAST" 0
+	fi
+)
+run_test 'approved matching feeder can upload' test_upload_guard matching 0
+for reason in disabled feeder-disabled switched uuid-changed unselected; do
+	run_test "upload is blocked when $reason" test_upload_guard "$reason" 1
+done
+
+test_integrated_setup() (
+	answer=$1
+	seed
+	test_installed=0
+	readsb_pkg_installed() { [ "$test_installed" = 1 ]; }
+	readsb_pkg_status() { echo missing; return 1; }
+	opkg() {
+		case $1 in
+			list) echo 'adsbexchange-stats - test - uploader' ;;
+			install)
+				echo install >> "$tmpdir/calls"
+				test_installed=1
+				;;
+			*) return 99 ;;
+		esac
+	}
+	wiz_say() { :; }
+	wiz_yesno() { [ "$3" = N ] || return 99; export "$1=$answer"; }
+	readsb_companion_service() {
+		[ "$1" = adsbexchange-stats ] && [ "$2" = activate ] || return 99
+		activate "$3"
+	}
+	restart() { echo restart >> "$tmpdir/calls"; start_service; }
+	wiz_offer_install_companions adsbexchange second || return 1
+	if [ "$answer" = 0 ]; then
+		[ ! -s "$tmpdir/calls" ] && [ ! -e "$tmpdir/uuid" ] &&
+			assert_equal "$(uci -q get adsbexchange-stats.main.enabled)" 0
+	else
+		assert_equal "$(head -n 4 "$tmpdir/calls")" "$(printf 'install\ncommit\nenable\nrestart')" &&
+			assert_equal "$(cat "$tmpdir/uuid")" "$override_uuid" &&
+			grep -qx "ADSBX_FEEDER='second'" "$tmpdir/env"
+	fi
+)
+run_test 'integrated decoder consent activates the real stats action with feeder UUID' test_integrated_setup 1
+run_test 'integrated decoder refusal leaves the companion absent and stopped' test_integrated_setup 0
+test_reload() (
+	seed
+	stop() { echo stop >> "$tmpdir/calls"; }
+	start() { echo start >> "$tmpdir/calls"; }
+	reload_service || return 1
+	assert_equal "$(cat "$tmpdir/calls")" "$(printf 'stop\nstart')"
+)
+run_test 'reload restarts the uploader to consume changed UUID and config' test_reload
+test_framework_start() (
+	upgrade=$1 boot_rc=$2 permitted=$3 expected_started=$4
+	seed "adsbexchange-stats.main.enabled=$permitted"
+	# shellcheck disable=SC2034
+	PKG_UPGRADE=$upgrade
+	enabled() { return "$boot_rc"; }
+	start_service || return 1
+	if [ "$expected_started" = 1 ]; then
+		grep -q '^open$' "$tmpdir/calls"
+	else
+		! grep -q '^open$' "$tmpdir/calls" && [ ! -e "$tmpdir/env" ]
+	fi
+)
+run_test 'framework fresh-install start cannot bypass UCI upload consent' \
+	test_framework_start '' 0 0 0
+run_test 'framework upgrade start preserves a disabled boot service' \
+	test_framework_start 1 1 1 0
+run_test 'framework upgrade can start an already-enabled opted-in uploader' \
+	test_framework_start 1 0 1 1
+
+test_boolean_consistency() (
+	scope=$1 value=$2 expected_rc=$3
+	seed 'adsbexchange-stats.main.enabled=1' 'adsbexchange-stats.main.feeder=second'
+	case $scope in
+		uploader) echo "adsbexchange-stats.main.enabled=$value" >> "$tmpdir/config" ;;
+		feeder) echo "readsb.second.enabled=$value" >> "$tmpdir/config" ;;
+	esac
+	# shellcheck disable=SC2034
+	ADSBX_FEEDER=second UUID=$override_uuid
+	curl() { echo curl >> "$tmpdir/calls"; printf 200; }
+	rc=0
+	adsbx_curl_upload "$tmpdir/config" || rc=$?
+	assert_equal "$rc" "$expected_rc" || return 1
+	if [ "$expected_rc" = 0 ]; then
+		grep -q '^curl$' "$tmpdir/calls" || return 1
+		start_service || return 1
+		grep -q '^open$' "$tmpdir/calls"
+	else
+		! grep -q '^curl$' "$tmpdir/calls"
+	fi
+)
+for scope in uploader feeder; do
+	for value in 1 on true yes enabled; do
+		run_test "$scope boolean '$value' permits an approved upload and startup" \
+			test_boolean_consistency "$scope" "$value" 0
+	done
+	for value in 0 off false no disabled invalid ''; do
+		run_test "$scope boolean '$value' blocks upload" \
+			test_boolean_consistency "$scope" "$value" 1
+	done
+done
+
+test_main_section_only() (
+	main_permission=$1
+	seed "adsbexchange-stats.main.enabled=$main_permission" \
+		'adsbexchange-stats.extra=adsbexchange-stats' \
+		'adsbexchange-stats.extra.enabled=1' 'adsbexchange-stats.extra.feeder=second'
+	config_foreach() { "$1" main; "$1" extra; }
+	rc=0
+	start_service || rc=$?
+	assert_equal "$rc" 0 || return 1
+	if [ "$main_permission" = 1 ]; then
+		assert_equal "$(grep -c '^open$' "$tmpdir/calls")" 1 &&
+			assert_equal "$(cat "$tmpdir/uuid")" "$main_uuid" &&
+			grep -qx "ADSBX_FEEDER='first'" "$tmpdir/env"
+	else
+		! grep -q '^open$' "$tmpdir/calls" && [ ! -e "$tmpdir/env" ]
+	fi
+)
+test_invalid_main_section() (
+	seed "adsbexchange-stats.main=$1"
+	rc=0
+	start_service || rc=$?
+	assert_equal "$rc" 1 || return 1
+	[ ! -s "$tmpdir/calls" ] && grep -q "main.*section" "$tmpdir/log"
+)
+run_test 'enabled extra sections cannot replace the main uploader' test_main_section_only 1
+run_test 'enabled extra sections cannot bypass disabled main consent' test_main_section_only 0
+run_test 'missing main section is an explicit configuration error' test_invalid_main_section ''
+run_test 'wrong main section type is an explicit configuration error' test_invalid_main_section wrong-type
+
+test_env_quoting() (
+	seed
+	export ADSBX_LOG_TAG="$1"
+	export ADSBX_RUNTIME_DIR="$tmpdir/runtime path's"
+	write_env main "$main_uuid" first || return 1
+	sed '\|^\. /usr/lib/adsbexchange-stats/json-status-helpers.sh$|d' "$tmpdir/env" > "$tmpdir/env-check.sh"
+	bash -n "$tmpdir/env-check.sh" || return 1
+	bash -c '
+		. "$1" || exit 1
+		[ "$ADSBX_LOG_TAG" = "$2" ] &&
+		[ "$TEMP_DIR" = "$3" ] &&
+		[ "$UUID_FILE" = "$4" ] &&
+		[ "$ADSBX_FEEDER" = first ] &&
+		[ "${JSON_PATHS[0]}" = /var/run/readsb ]
+	' test "$tmpdir/env-check.sh" "$ADSBX_LOG_TAG" "$ADSBX_RUNTIME_DIR" "$ADSBX_UUID_FILE"
+)
+run_test 'generated environment preserves plain scalar values' test_env_quoting adsbexchange-stats
+run_test 'generated environment preserves spaces as data' test_env_quoting 'receiver stats'
+run_test 'generated environment preserves literal quotes and backslashes' test_env_quoting "receiver's \"stats\"\\path"
+run_test 'generated environment preserves a single quote alone' test_env_quoting "'"
+run_test 'generated environment preserves a trailing quote' test_env_quoting "receiver'"
+# shellcheck disable=SC2016
+run_test 'generated environment does not reinterpret shell metacharacters' test_env_quoting 'receiver; # $HOME'
+run_test 'generated environment preserves embedded newlines' test_env_quoting "$(printf 'receiver\nstats')"
+
+test_runtime_cleanup() (
+	seed
+	scenario=$1
+	runtime="$tmpdir/runtime-state"
+	mkdir "$runtime" || return 1
+	trap 'command rm -f "$runtime/env" "$runtime/uuid" "$runtime/tmp.json" "$runtime/new.json" "$runtime/upload.gz" "$runtime/curl.stderr" "$runtime/unexpected"; [ ! -d "$runtime" ] || command rmdir "$runtime"' 0
+	export ADSBX_RUNTIME_DIR="$runtime" ADSBX_ENV_FILE="$runtime/env" ADSBX_UUID_FILE="$runtime/uuid"
+	for filename in env uuid tmp.json new.json upload.gz curl.stderr; do
+		printf 'owned test data\n' > "$runtime/$filename"
+	done
+	[ "$scenario" != unexpected ] || printf 'keep\n' > "$runtime/unexpected"
+	stop_service || return 1
+	[ -f "$runtime/upload.gz" ] || return 1
+	if [ "$scenario" = failure ]; then
+		rm() { return 1; }
+		rc=0
+		service_stopped || rc=$?
+		[ "$rc" -ne 0 ] && grep -q '^error:' "$tmpdir/log"
+	else
+		service_stopped || return 1
+		for filename in env uuid tmp.json new.json upload.gz curl.stderr; do
+			[ ! -e "$runtime/$filename" ] || return 1
+		done
+		if [ "$scenario" = unexpected ]; then
+			[ -f "$runtime/unexpected" ] && grep -q '^warn:' "$tmpdir/log"
+		else
+			[ ! -d "$runtime" ] && service_stopped
+		fi
+	fi
+)
+run_test 'service-stopped clears all known runtime files after stopping' test_runtime_cleanup normal
+run_test 'runtime cleanup preserves unknown files and warns' test_runtime_cleanup unexpected
+run_test 'runtime cleanup reports removal failure' test_runtime_cleanup failure
+
+test_metrics() (
+	seed
+	aircraft_input=$1 bytes_input=$2 expected_aircraft=$3 expected_bytes=$4 expect_warning=$5
+	# shellcheck disable=SC2034
+	ADSBX_LOG_LEVEL=2 ADSBX_SUMMARY_INTERVAL=300 ADSBX_HTTP_LAST=200 ADSBX_ELAPSED_LAST=0
+	ADSBX_CYCLE=0 ADSBX_OK=0 ADSBX_FAIL=0
+	ADSBX_AC_TOTAL=0 ADSBX_BYTES_TOTAL=0 ADSBX_LAST_SUMMARY=100
+	date() { echo 100; }
+	adsbx_record_upload "$aircraft_input" "$bytes_input" || return 1
+	assert_equal "$ADSBX_CYCLE" 1 && assert_equal "$ADSBX_OK" 1 &&
+		assert_equal "$ADSBX_FAIL" 0 && assert_equal "$ADSBX_LAST_SUMMARY" 100 || return 1
+	assert_equal "$ADSBX_AC_TOTAL" "$expected_aircraft" &&
+		assert_equal "$ADSBX_BYTES_TOTAL" "$expected_bytes" || return 1
+	if [ "$expect_warning" = 1 ]; then
+		grep -q '^warn:' "$tmpdir/log"
+	else
+		! grep -q '^warn:' "$tmpdir/log"
+	fi
+)
+run_test 'normal upload metrics remain unchanged' test_metrics 42 1024 42 1024 0
+run_test 'leading-zero metrics are decimal, not octal' test_metrics 0008 0009 8 9 0
+run_test 'zero metrics remain valid' test_metrics 0 0000 0 0 0
+run_test 'maximum supported metric is accepted' test_metrics 2147483647 2147483647 2147483647 2147483647 0
+run_test 'values beyond the supported bound use zero and warn' test_metrics 2147483648 2147483648 0 0 1
+run_test 'empty upload metrics become zero with a warning' test_metrics '' '' 0 0 1
+run_test 'null/failed JSON or stat output becomes zero with a warning' test_metrics null '' 0 0 1
+run_test 'nonnumeric aircraft count does not break metrics accounting' test_metrics invalid 100 0 100 1
+run_test 'invalid byte count does not break metrics accounting' test_metrics 12 '.' 12 0 1
+run_test 'negative metrics are rejected rather than subtracted' test_metrics -1 -2 0 0 1
+run_test 'fractional metrics are rejected rather than evaluated' test_metrics 1.5 4.2 0 0 1
+run_test 'oversized metrics cannot overflow shell arithmetic on input' \
+	test_metrics 999999999999999999999 999999999999999999999 0 0 1
+
+test_patch_attribution() {
+	grep -q '^From: Dr Bill Mcilhargey <contributor@mcilhargey.com>$' "$package_dir/patches/010-openwrt-paths.patch" &&
+		grep -q '^Signed-off-by: Dr Bill Mcilhargey <contributor@mcilhargey.com>$' "$package_dir/patches/010-openwrt-paths.patch" &&
+		! grep -q '^Co-authored-by: Copilot' "$package_dir/patches/010-openwrt-paths.patch"
+}
+run_test 'embedded patch metadata records the human maintainer and sign-off' test_patch_attribution
+
+test_upload_snapshot() (
+	seed 'adsbexchange-stats.main.enabled=1' 'adsbexchange-stats.main.feeder=second'
+	# shellcheck disable=SC2034
+	ADSBX_FEEDER=second UUID=$override_uuid
+	fail_batch=$1 expected_rc=$2
+	curl() { echo curl >> "$tmpdir/calls"; printf 200; }
+	rc=0
+	adsbx_curl_upload "$tmpdir/config" || rc=$?
+	assert_equal "$rc" "$expected_rc" || return 1
+	assert_equal "$(cat "$tmpdir/uci-calls")" batch || return 1
+	if [ "$expected_rc" = 0 ]; then
+		assert_equal "$(cat "$tmpdir/calls")" curl
+	else
+		[ ! -s "$tmpdir/calls" ] && grep -q '^error:' "$tmpdir/log"
+	fi
+)
+run_test 'each upload reads one UCI snapshot rather than multiple queries' test_upload_snapshot 0 0
+run_test 'failed UCI snapshot blocks uploads with an explicit error' test_upload_snapshot 1 1
+
+test_cleanup_status() (
+	wanted=$1 failed_command=$2
+	rc=0
+	(
+		rm() { [ "$failed_command" != rm ]; }
+		rmdir() { [ "$failed_command" != rmdir ]; }
+		trap cleanup 0
+		exit "$wanted"
+	) > "$tmpdir/cleanup-output" 2>&1 || rc=$?
+	assert_equal "$rc" "$wanted" || return 1
+	grep -q '^cleanup:' "$tmpdir/cleanup-output"
+)
+for wanted in 0 7; do
+	for failed_command in rm rmdir; do
+		run_test "test cleanup preserves exit $wanted when $failed_command fails" \
+			test_cleanup_status "$wanted" "$failed_command"
+	done
+done
+
+printf '%s tests, %s failures\n' "$tests" "$failures"
+[ "$failures" -eq 0 ]

From 9e581917d7b4855295306438752be3ffbe2be975 Mon Sep 17 00:00:00 2001
From: Dr Bill Mcilhargey <contributor@mcilhargey.com>
Date: Mon, 5 Oct 2026 01:45:37 -0400
Subject: [PATCH 2/5] adsbexchange-stats: align startup logging and service
 help

Clamp startup log settings consistently with the uploader environment
so notices report effective verbosity and summary intervals rather
than raw invalid UCI input. Document the activate action using the
service command form, bump the release, and cover effective settings
with focused regression tests.

Signed-off-by: Dr Bill Mcilhargey <contributor@mcilhargey.com>
---
 utils/adsbexchange-stats/Makefile                 |  9 ++++++---
 .../files/adsbexchange-stats.init                 | 15 ++++++---------
 utils/adsbexchange-stats/tests/stats.sh           | 14 ++++++++++++++
 3 files changed, 26 insertions(+), 12 deletions(-)

diff --git a/utils/adsbexchange-stats/Makefile b/utils/adsbexchange-stats/Makefile
index f14fa8f2bda21..2aaf1accd2b80 100644
--- a/utils/adsbexchange-stats/Makefile
+++ b/utils/adsbexchange-stats/Makefile
@@ -13,7 +13,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=adsbexchange-stats
 PKG_VERSION:=2023-02-22
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/ADSBexchange/adsbexchange-stats.git
@@ -59,11 +59,14 @@ define Package/adsbexchange-stats/description
     logread -e adsbexchange-stats        -- uploader logs
 
   Extra (non-procd) actions:
-    /etc/init.d/adsbexchange-stats showurl
+    service adsbexchange-stats showurl
                                          -- print the public per-station
                                             ADSBexchange stats URL
                                             (derived from the selected feeder)
-    /etc/init.d/adsbexchange-stats about -- package and configuration help
+    service adsbexchange-stats about   -- package and configuration help
+    service adsbexchange-stats activate <feeder>
+                      -- consent to statistics uploads for an
+                       enabled ADSBexchange feeder
 endef
 
 # Pure shell payload; nothing to compile or stage-install.
diff --git a/utils/adsbexchange-stats/files/adsbexchange-stats.init b/utils/adsbexchange-stats/files/adsbexchange-stats.init
index e3252ff0b3b1e..0159b11e54d9c 100644
--- a/utils/adsbexchange-stats/files/adsbexchange-stats.init
+++ b/utils/adsbexchange-stats/files/adsbexchange-stats.init
@@ -56,23 +56,20 @@ write_env() (
 	local feeder="$3"
 	local json_paths
 	local dns_cache dns_ttl dns_ignore_local
-	local log_level log_summary_interval
+	local env_log_level log_summary_interval
 
 	json_paths=$(adsbx_resolve_json_paths)
 
 	config_get dns_cache            "$cfg" dns_cache 0
 	config_get dns_ttl              "$cfg" dns_ttl 600
 	config_get dns_ignore_local     "$cfg" dns_ignore_local 0
-	config_get log_level            "$cfg" log_level 1
+	config_get env_log_level        "$cfg" log_level 1
 	config_get log_summary_interval "$cfg" log_summary_interval 300
 
 	dns_cache=$(_clamp "$dns_cache" '0|1' 0)
 	dns_ignore_local=$(_clamp "$dns_ignore_local" '0|1' 0)
 	dns_ttl=$(adsbx_uint "$dns_ttl" 600 dns_ttl)
-	# clamped log_level is consumed locally; subshell scope means it
-	# does not escape (caller re-reads UCI for its own log line).
-	# shellcheck disable=SC2030
-	log_level=$(_clamp "$log_level" '0|1|2|3' 1)
+	env_log_level=$(_clamp "$env_log_level" '0|1|2|3' 1)
 	log_summary_interval=$(adsbx_uint "$log_summary_interval" 300 log_summary_interval)
 
 	umask 077
@@ -91,7 +88,7 @@ write_env() (
 		_env_assignment DNS_TTL "$dns_ttl"
 		_env_assignment DNS_IGNORE_LOCAL "$dns_ignore_local"
 		_env_assignment ADSBX_LOG_TAG "$ADSBX_LOG_TAG"
-		_env_assignment ADSBX_LOG_LEVEL "$log_level"
+		_env_assignment ADSBX_LOG_LEVEL "$env_log_level"
 		_env_assignment ADSBX_SUMMARY_INTERVAL "$log_summary_interval"
 		echo ". /usr/lib/adsbexchange-stats/json-status-helpers.sh"
 		# Render JSON_PATHS as a real bash array so the uploader keeps
@@ -129,9 +126,9 @@ start_instance() {
 
 	config_get log_level        "$cfg" log_level 1
 	config_get summary_interval "$cfg" log_summary_interval 300
+	log_level=$(_clamp "$log_level" '0|1|2|3' 1)
+	summary_interval=$(adsbx_uint "$summary_interval" 300 log_summary_interval)
 	json_paths=$(adsbx_resolve_json_paths)
-	# log_level is the freshly-read UCI value; the same name was clamped
-	# inside write_env's subshell but did not escape.
 	# shellcheck disable=SC2031
 	adsbx_notice "starting '$cfg' feeder=$feeder uuid=$uuid log_level=$log_level summary=${summary_interval}s paths='$json_paths'"
 
diff --git a/utils/adsbexchange-stats/tests/stats.sh b/utils/adsbexchange-stats/tests/stats.sh
index 537d0a6aff7ca..51a56a69124bb 100644
--- a/utils/adsbexchange-stats/tests/stats.sh
+++ b/utils/adsbexchange-stats/tests/stats.sh
@@ -185,6 +185,20 @@ test_environment_failure() (
 	assert_equal "$rc" 1 && ! grep -q '^open$' "$tmpdir/calls" &&
 		grep -q 'cannot prepare the uploader environment' "$tmpdir/log"
 )
+test_start_logging() (
+	level=$1 interval=$2 expected_level=$3 expected_interval=$4
+	seed 'adsbexchange-stats.main.enabled=1' \
+		"adsbexchange-stats.main.log_level=$level" \
+		"adsbexchange-stats.main.log_summary_interval=$interval"
+	start_instance main || return 1
+	grep -qx "ADSBX_LOG_LEVEL='$expected_level'" "$tmpdir/env" || return 1
+	grep -qx "ADSBX_SUMMARY_INTERVAL='$expected_interval'" "$tmpdir/env" || return 1
+	grep -q "log_level=$expected_level summary=${expected_interval}s" "$tmpdir/log"
+)
+run_test 'startup notice uses effective defaults for invalid logging settings' \
+	test_start_logging invalid invalid 1 300
+run_test 'startup notice preserves valid logging settings' test_start_logging 3 60 3 60
+run_test 'startup notice normalizes a leading-zero interval' test_start_logging 2 00060 2 60
 test_activation() (
 	failure=${1:-}
 	seed

From e3d462d60045ba5b445758b0c09c8a82b6e89a05 Mon Sep 17 00:00:00 2001
From: Dr Bill Mcilhargey <contributor@mcilhargey.com>
Date: Mon, 5 Oct 2026 03:19:21 -0400
Subject: [PATCH 3/5] adsbexchange-stats: surface errors and clarify package
 actions

Print errors explicitly on stderr as well as sending them to syslog.
Keep showurl in the extra-actions section instead of daemon control,
and start the newly introduced package at release 1.

Add focused tests for production logger output and package help.

Signed-off-by: Dr Bill Mcilhargey <contributor@mcilhargey.com>
---
 utils/adsbexchange-stats/Makefile             |  4 ++--
 .../files/adsbexchange-stats.functions.sh     |  5 ++++-
 utils/adsbexchange-stats/tests/stats.sh       | 20 ++++++++++++++++++-
 3 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/utils/adsbexchange-stats/Makefile b/utils/adsbexchange-stats/Makefile
index 2aaf1accd2b80..07ca9ec6af1a5 100644
--- a/utils/adsbexchange-stats/Makefile
+++ b/utils/adsbexchange-stats/Makefile
@@ -13,7 +13,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=adsbexchange-stats
 PKG_VERSION:=2023-02-22
-PKG_RELEASE:=2
+PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/ADSBexchange/adsbexchange-stats.git
@@ -55,7 +55,7 @@ define Package/adsbexchange-stats/description
   Manage the station UUID with `readsb-uuid`.
 
   Daemon control:
-    service adsbexchange-stats {start|stop|restart|reload|status|enable|disable|showurl}
+    service adsbexchange-stats {start|stop|restart|reload|status|enable|disable}
     logread -e adsbexchange-stats        -- uploader logs
 
   Extra (non-procd) actions:
diff --git a/utils/adsbexchange-stats/files/adsbexchange-stats.functions.sh b/utils/adsbexchange-stats/files/adsbexchange-stats.functions.sh
index f04af21442228..821643cdc3516 100644
--- a/utils/adsbexchange-stats/files/adsbexchange-stats.functions.sh
+++ b/utils/adsbexchange-stats/files/adsbexchange-stats.functions.sh
@@ -38,7 +38,10 @@ _adsbx_log()    { local p="$1"; shift; logger -t "$ADSBX_LOG_TAG" -p "daemon.$p"
 adsbx_info()    { _adsbx_log info   "$@"; }
 adsbx_notice()  { _adsbx_log notice "$@"; }
 adsbx_warn()    { _adsbx_log warn   "$@"; }
-adsbx_err()     { _adsbx_log err    "$@" >&2; }
+adsbx_err() {
+	printf '%s: %s\n' "$ADSBX_LOG_TAG" "$*" >&2
+	_adsbx_log err "$@"
+}
 
 # Normalize decimal input before shell arithmetic, including leading zeros.
 adsbx_uint() {
diff --git a/utils/adsbexchange-stats/tests/stats.sh b/utils/adsbexchange-stats/tests/stats.sh
index 51a56a69124bb..0c31ac55db9e7 100644
--- a/utils/adsbexchange-stats/tests/stats.sh
+++ b/utils/adsbexchange-stats/tests/stats.sh
@@ -16,7 +16,7 @@ cleanup() {
 	rm -f "$tmpdir/functions.sh" "$tmpdir/init.sh" "$tmpdir/upload.sh" \
 		"$tmpdir/postinst.sh" "$tmpdir/prerm.sh" "$tmpdir/config" \
 		"$tmpdir/calls" "$tmpdir/log" "$tmpdir/uuid" "$tmpdir/env" "$tmpdir/env-check.sh" \
-		"$tmpdir/uci-calls" "$tmpdir/cleanup-output" || \
+		"$tmpdir/uci-calls" "$tmpdir/cleanup-output" "$tmpdir/stderr" "$tmpdir/stdout" || \
 		printf 'cleanup: could not remove test files in %s\n' "$tmpdir" >&2
 	rmdir "$tmpdir" 2>/dev/null || \
 		printf 'cleanup: temporary directory retained at %s (leftover files or removal failure)\n' "$tmpdir" >&2
@@ -154,6 +154,23 @@ test_identity() (
 	value=$(adsbx_require_uuid "$selector") || rc=$?
 	assert_equal "$rc" "$expected_rc" && assert_equal "$value" "$expected_uuid"
 )
+test_error_output() (
+	# shellcheck source=/dev/null
+	. "$tmpdir/functions.sh"
+	ADSBX_LOG_TAG=review-stats
+	: > "$tmpdir/calls"
+	logger() { printf '%s\n' "$*" >> "$tmpdir/calls"; }
+	adsbx_err 'failed to start' > "$tmpdir/stdout" 2> "$tmpdir/stderr" || return 1
+	[ ! -s "$tmpdir/stdout" ] || return 1
+	assert_equal "$(cat "$tmpdir/stderr")" 'review-stats: failed to start' || return 1
+	assert_equal "$(cat "$tmpdir/calls")" '-t review-stats -p daemon.err -- failed to start'
+)
+run_test 'production error logger writes both stderr and syslog without stdout' test_error_output
+run_test 'new uploader package starts at release 1' grep -qx 'PKG_RELEASE:=1' "$package_dir/Makefile"
+run_test 'daemon control help does not misclassify showurl' \
+	grep -Fq 'service adsbexchange-stats {start|stop|restart|reload|status|enable|disable}' "$package_dir/Makefile"
+run_test 'package help retains the extra showurl action' \
+	grep -qx '    service adsbexchange-stats showurl' "$package_dir/Makefile"
 run_test 'default-selected feeder inherits main UUID' test_identity '' 0 "$main_uuid"
 run_test 'selected feeder override wins over main UUID' test_identity second 0 "$override_uuid"
 run_test 'configured selection resolves its own override' test_identity '' 0 "$override_uuid" \
@@ -532,6 +549,7 @@ test_cleanup_status() (
 	wanted=$1 failed_command=$2
 	rc=0
 	(
+		# shellcheck disable=SC2329
 		rm() { [ "$failed_command" != rm ]; }
 		rmdir() { [ "$failed_command" != rmdir ]; }
 		trap cleanup 0

From f61dfa15500284e122a4b8f7e09179f1f49c8b5b Mon Sep 17 00:00:00 2001
From: Dr Bill Mcilhargey <contributor@mcilhargey.com>
Date: Mon, 5 Oct 2026 04:33:04 -0400
Subject: [PATCH 4/5] adsbexchange-stats: harden runtime UUID and logging
 settings

Enforce mode 0600 before writing UUID content, including when a
runtime file already exists. Abort startup if permissions cannot be
secured. Normalize log levels at upload-helper entry points before
numeric comparisons, with a quiet fallback for invalid overrides.

Cover pre-existing UUID permissions, failed chmod, and valid/invalid
manual log-level overrides with focused regression tests.

Signed-off-by: Dr Bill Mcilhargey <contributor@mcilhargey.com>
---
 .../files/adsbexchange-stats.init             |  2 +
 .../adsbexchange-stats.json-status-helpers.sh |  9 ++++
 utils/adsbexchange-stats/tests/stats.sh       | 43 +++++++++++++++++++
 3 files changed, 54 insertions(+)

diff --git a/utils/adsbexchange-stats/files/adsbexchange-stats.init b/utils/adsbexchange-stats/files/adsbexchange-stats.init
index 0159b11e54d9c..a4189c43bd54e 100644
--- a/utils/adsbexchange-stats/files/adsbexchange-stats.init
+++ b/utils/adsbexchange-stats/files/adsbexchange-stats.init
@@ -73,6 +73,8 @@ write_env() (
 	log_summary_interval=$(adsbx_uint "$log_summary_interval" 300 log_summary_interval)
 
 	umask 077
+	: >> "$ADSBX_UUID_FILE" || return 1
+	chmod 600 "$ADSBX_UUID_FILE" || return 1
 	echo "$uuid" > "$ADSBX_UUID_FILE" || return 1
 
 	umask 022
diff --git a/utils/adsbexchange-stats/files/adsbexchange-stats.json-status-helpers.sh b/utils/adsbexchange-stats/files/adsbexchange-stats.json-status-helpers.sh
index 83c17d75f0eab..ea54d688ceff7 100644
--- a/utils/adsbexchange-stats/files/adsbexchange-stats.json-status-helpers.sh
+++ b/utils/adsbexchange-stats/files/adsbexchange-stats.json-status-helpers.sh
@@ -33,6 +33,13 @@ ADSBX_AC_TOTAL=0 ADSBX_BYTES_TOTAL=0
 ADSBX_LAST_SUMMARY=0
 ADSBX_HTTP_LAST=000 ADSBX_ELAPSED_LAST=0
 
+_adsbx_normalize_log_level() {
+	case ${ADSBX_LOG_LEVEL:-} in
+		0|1|2|3) ;;
+		*) ADSBX_LOG_LEVEL=0 ;;
+	esac
+}
+
 # One UCI process per upload; keyed show output tolerates missing options
 # without relying on batch get's version-dependent blank-line behavior.
 adsbx_upload_uuid() {
@@ -97,6 +104,7 @@ EOF
 # or, on transport failure, drained at warn priority. Returns curl's rv.
 adsbx_curl_upload() {
 	local payload="$1" rv=0 t0 t1 errfile http current_uuid
+	_adsbx_normalize_log_level
 	ADSBX_HTTP_LAST=000 ADSBX_ELAPSED_LAST=0
 	current_uuid=$(adsbx_upload_uuid) || return 1
 	if [ "$current_uuid" != "$UUID" ]; then
@@ -149,6 +157,7 @@ adsbx_curl_upload() {
 # summary (level >= 1). 200 OK counts as success; anything else as fail.
 adsbx_record_upload() {
 	local aircraft bytes now avg_ac=0 avg_bytes=0
+	_adsbx_normalize_log_level
 	aircraft=$(adsbx_uint "${1:-}" 0 "aircraft count")
 	bytes=$(adsbx_uint "${2:-}" 0 "payload byte count")
 
diff --git a/utils/adsbexchange-stats/tests/stats.sh b/utils/adsbexchange-stats/tests/stats.sh
index 0c31ac55db9e7..a1fe7f8e3dd9f 100644
--- a/utils/adsbexchange-stats/tests/stats.sh
+++ b/utils/adsbexchange-stats/tests/stats.sh
@@ -202,6 +202,25 @@ test_environment_failure() (
 	assert_equal "$rc" 1 && ! grep -q '^open$' "$tmpdir/calls" &&
 		grep -q 'cannot prepare the uploader environment' "$tmpdir/log"
 )
+test_uuid_permissions() (
+	seed 'adsbexchange-stats.main.enabled=1'
+	printf '%s\n' old-identity > "$tmpdir/uuid"
+	chmod 644 "$tmpdir/uuid" || return 1
+	if [ "$1" = failure ]; then
+		chmod() { return 9; }
+		rc=0
+		start_instance main || rc=$?
+		assert_equal "$rc" 1 || return 1
+		assert_equal "$(cat "$tmpdir/uuid")" old-identity || return 1
+		! grep -q '^open$' "$tmpdir/calls"
+	else
+		start_instance main || return 1
+		assert_equal "$(stat -c %a "$tmpdir/uuid")" 600 || return 1
+		assert_equal "$(cat "$tmpdir/uuid")" "$main_uuid"
+	fi
+)
+run_test 'pre-existing world-readable UUID file is restricted before writing' test_uuid_permissions success
+run_test 'failed UUID permission change prevents writing or starting the uploader' test_uuid_permissions failure
 test_start_logging() (
 	level=$1 interval=$2 expected_level=$3 expected_interval=$4
 	seed 'adsbexchange-stats.main.enabled=1' \
@@ -299,6 +318,28 @@ test_upload_guard() (
 	fi
 )
 run_test 'approved matching feeder can upload' test_upload_guard matching 0
+test_upload_log_level() (
+	seed 'adsbexchange-stats.main.enabled=1' 'adsbexchange-stats.main.feeder=second'
+	ADSBX_FEEDER=second UUID=$override_uuid ADSBX_LOG_LEVEL=$1
+	curl() { printf '%s\n' "$@" > "$tmpdir/calls"; printf 200; }
+	adsbx_curl_upload "$tmpdir/config" > "$tmpdir/stdout" 2> "$tmpdir/stderr" || return 1
+	assert_equal "$ADSBX_LOG_LEVEL" "$2" || return 1
+	[ ! -s "$tmpdir/stderr" ] || return 1
+	if [ "$2" = 3 ]; then
+		grep -qx -- '-v' "$tmpdir/calls" || return 1
+	else
+		! grep -qx -- '-v' "$tmpdir/calls" || return 1
+	fi
+	ADSBX_LOG_LEVEL=$1
+	adsbx_record_upload 1 10 > "$tmpdir/stdout" 2> "$tmpdir/stderr" || return 1
+	assert_equal "$ADSBX_LOG_LEVEL" "$2" && [ ! -s "$tmpdir/stderr" ]
+)
+for level in 0 1 2 3; do
+	run_test "upload helpers preserve valid log level $level" test_upload_log_level "$level" "$level"
+done
+for level in '' invalid -1 99 0003 '3 extra'; do
+	run_test "upload helpers safely normalize invalid log level [$level]" test_upload_log_level "$level" 0
+done
 for reason in disabled feeder-disabled switched uuid-changed unselected; do
 	run_test "upload is blocked when $reason" test_upload_guard "$reason" 1
 done
@@ -531,6 +572,7 @@ test_upload_snapshot() (
 	# shellcheck disable=SC2034
 	ADSBX_FEEDER=second UUID=$override_uuid
 	fail_batch=$1 expected_rc=$2
+	# shellcheck disable=SC2329
 	curl() { echo curl >> "$tmpdir/calls"; printf 200; }
 	rc=0
 	adsbx_curl_upload "$tmpdir/config" || rc=$?
@@ -551,6 +593,7 @@ test_cleanup_status() (
 	(
 		# shellcheck disable=SC2329
 		rm() { [ "$failed_command" != rm ]; }
+		# shellcheck disable=SC2329
 		rmdir() { [ "$failed_command" != rmdir ]; }
 		trap cleanup 0
 		exit "$wanted"

From 0ab2b8e492b608f6d8b987e19e3513f29eeece02 Mon Sep 17 00:00:00 2001
From: Dr Bill Mcilhargey <contributor@mcilhargey.com>
Date: Mon, 5 Oct 2026 07:01:09 -0400
Subject: [PATCH 5/5] adsbexchange-stats: redact diagnostics and preserve
 runtime overrides

Redact station UUIDs, authorization headers, and cookies from curl
diagnostics on success and failure. Omit UUIDs from startup notices.
Preserve configured runtime paths and disable duplicate daemon stderr
logging while retaining useful error output for manual callers.

Remove brittle metadata assertions, align package help, and document
runtime overrides and logging privacy. Add focused behavior tests.
Retain the repository convention for space-separated license IDs.

Signed-off-by: Dr Bill Mcilhargey <contributor@mcilhargey.com>
---
 utils/adsbexchange-stats/Makefile             |  6 +-
 utils/adsbexchange-stats/README.md            | 18 ++++-
 .../files/adsbexchange-stats.functions.sh     | 17 +++--
 .../files/adsbexchange-stats.init             |  4 +-
 .../adsbexchange-stats.json-status-helpers.sh | 25 ++++--
 utils/adsbexchange-stats/tests/stats.sh       | 76 +++++++++++++++++--
 6 files changed, 119 insertions(+), 27 deletions(-)

diff --git a/utils/adsbexchange-stats/Makefile b/utils/adsbexchange-stats/Makefile
index 07ca9ec6af1a5..227d82f53c455 100644
--- a/utils/adsbexchange-stats/Makefile
+++ b/utils/adsbexchange-stats/Makefile
@@ -63,10 +63,10 @@ define Package/adsbexchange-stats/description
                                          -- print the public per-station
                                             ADSBexchange stats URL
                                             (derived from the selected feeder)
-    service adsbexchange-stats about   -- package and configuration help
+    service adsbexchange-stats about     -- package and configuration help
     service adsbexchange-stats activate <feeder>
-                      -- consent to statistics uploads for an
-                       enabled ADSBexchange feeder
+                       -- consent to statistics uploads
+                        for an enabled ADSBexchange feeder
 endef
 
 # Pure shell payload; nothing to compile or stage-install.
diff --git a/utils/adsbexchange-stats/README.md b/utils/adsbexchange-stats/README.md
index d945400f411d5..48aaa2e2aa7ff 100644
--- a/utils/adsbexchange-stats/README.md
+++ b/utils/adsbexchange-stats/README.md
@@ -97,6 +97,10 @@ Scalar values in that generated file are shell-quoted, including log
 tags and runtime paths; quotes, whitespace, and shell punctuation are
 preserved as data rather than interpreted as commands.
 
+The shared helpers preserve preconfigured `ADSBX_RUNTIME_DIR`,
+`ADSBX_ENV_FILE`, `ADSBX_UUID_FILE`, and `ADSBX_UPLOADER` values.
+When file paths are unset, they are derived from the runtime directory.
+
 Reload triggers are registered on **both** `adsbexchange-stats` and
 `readsb`, so the recommended workflow is:
 
@@ -118,7 +122,7 @@ or incorrectly typed main section is reported as a configuration error.
 | `enabled`              | `0`     | separate opt-in for external statistics uploads; installation alone does not change it |
 | `feeder`               | empty   | one enabled `adsbexchange` feeder section in `/etc/config/readsb`; chosen by the setup wizard or `activate` |
 | `json_paths_override`  | empty   | space-separated list of directories searched for `aircraft.json`, in preferred order. Empty = derive from `readsb.main.write_json` plus built-in fallbacks. Tokens are restricted to `[A-Za-z0-9/_.+-]`. |
-| `log_level`            | `1`     | uploader verbosity: `0` errors only, `1` + periodic summary, `2` + per-cycle line, `3` + full curl `-v` headers                                                |
+| `log_level`            | `1`     | uploader verbosity: `0` errors only, `1` + periodic summary, `2` + per-cycle line, `3` + redacted curl `-v` diagnostics |
 | `log_summary_interval` | `300`   | seconds between summary lines at `log_level >= 1`                                                                                                              |
 | `dns_cache`            | `0`     | enable the uploader's in-process DNS self-cache. Auto-disabled if a `127.0.0.0/8` resolver is in use or if `host`/`perl` are missing.                          |
 | `dns_ttl`              | `600`   | DNS cache TTL in seconds when `dns_cache=1`                                                                                                                    |
@@ -229,7 +233,17 @@ RFC 5424 / OpenWrt severity convention; filter with `logread -p <level>`.
 | `0`         | errors only (curl transport failures, decoder stalls)                                             |
 | `1`         | + periodic upload summary every `log_summary_interval` seconds                                    |
 | `2`         | + one line per upload cycle (aircraft, http code, gzipped bytes, elapsed time)                    |
-| `3`         | + full curl `-v` request/response headers (TLS handshake; verbose, mostly useful for debugging)   |
+| `3`         | + redacted curl `-v` diagnostics (TLS handshake; verbose, mostly useful for debugging) |
+
+Curl diagnostics redact the station UUID, authorization headers, and
+cookies before logging, including on transport failures. Hostnames,
+addresses, URLs, and other connection details remain visible; use level
+3 only when needed for troubleshooting. Startup notices omit the UUID.
+
+Errors go to syslog and, by default, stderr for interactive or scripted
+commands. Procd sets `ADSBX_LOG_STDERR=0` for the uploader to prevent
+duplicate errors through captured stderr; manual callers can use the
+same flag to suppress stderr explicitly.
 
 Init-script lifecycle events (start, stop, refused-UUID, unsafe path
 token) log at `notice` / `warn` / `err` regardless of `log_level`.
diff --git a/utils/adsbexchange-stats/files/adsbexchange-stats.functions.sh b/utils/adsbexchange-stats/files/adsbexchange-stats.functions.sh
index 821643cdc3516..6066836b49156 100644
--- a/utils/adsbexchange-stats/files/adsbexchange-stats.functions.sh
+++ b/utils/adsbexchange-stats/files/adsbexchange-stats.functions.sh
@@ -18,18 +18,19 @@
 : "${ADSBX_LOG_TAG:=adsbexchange-stats}"
 READSB_LOG_TAG=$ADSBX_LOG_TAG
 
-ADSBX_RUNTIME_DIR=/var/run/adsbexchange-stats
-ADSBX_ENV_FILE=$ADSBX_RUNTIME_DIR/env
-ADSBX_UUID_FILE=$ADSBX_RUNTIME_DIR/uuid
-ADSBX_UPLOADER=/usr/share/adsbexchange-stats/json-status
+: "${ADSBX_RUNTIME_DIR:=/var/run/adsbexchange-stats}"
+: "${ADSBX_ENV_FILE:=$ADSBX_RUNTIME_DIR/env}"
+: "${ADSBX_UUID_FILE:=$ADSBX_RUNTIME_DIR/uuid}"
+: "${ADSBX_UPLOADER:=/usr/share/adsbexchange-stats/json-status}"
+: "${ADSBX_LOG_STDERR:=1}"
 
 # Fallback aircraft.json search list when neither the UCI override nor
 # readsb.main.write_json is set.
-ADSBX_FALLBACK_PATHS='/var/run/readsb /run/adsbexchange-feed /run/dump1090 /run/dump1090-fa'
+: "${ADSBX_FALLBACK_PATHS:=/var/run/readsb /run/adsbexchange-feed /run/dump1090 /run/dump1090-fa}"
 
 # Public per-station stats URL template (mirrors readsb-wiedehopf's
 # adsbexchange preset entry).
-ADSBX_FEED_URL_BASE='https://www.adsbexchange.com/api/feeders/?feed='
+: "${ADSBX_FEED_URL_BASE:=https://www.adsbexchange.com/api/feeders/?feed=}"
 
 # --- logging ----------------------------------------------------------
 # Daemon-facility logger; tag overridable via ADSBX_LOG_TAG.
@@ -39,7 +40,9 @@ adsbx_info()    { _adsbx_log info   "$@"; }
 adsbx_notice()  { _adsbx_log notice "$@"; }
 adsbx_warn()    { _adsbx_log warn   "$@"; }
 adsbx_err() {
-	printf '%s: %s\n' "$ADSBX_LOG_TAG" "$*" >&2
+	if [ "$ADSBX_LOG_STDERR" = 1 ]; then
+		printf '%s: %s\n' "$ADSBX_LOG_TAG" "$*" >&2
+	fi
 	_adsbx_log err "$@"
 }
 
diff --git a/utils/adsbexchange-stats/files/adsbexchange-stats.init b/utils/adsbexchange-stats/files/adsbexchange-stats.init
index a4189c43bd54e..a0660960f0519 100644
--- a/utils/adsbexchange-stats/files/adsbexchange-stats.init
+++ b/utils/adsbexchange-stats/files/adsbexchange-stats.init
@@ -132,12 +132,12 @@ start_instance() {
 	summary_interval=$(adsbx_uint "$summary_interval" 300 log_summary_interval)
 	json_paths=$(adsbx_resolve_json_paths)
 	# shellcheck disable=SC2031
-	adsbx_notice "starting '$cfg' feeder=$feeder uuid=$uuid log_level=$log_level summary=${summary_interval}s paths='$json_paths'"
+	adsbx_notice "starting '$cfg' feeder=$feeder log_level=$log_level summary=${summary_interval}s paths='$json_paths'"
 
 	procd_open_instance "$cfg"
 	# json-status is bash (arrays, [[ ]], `enable -f sleep`).
 	procd_set_param command /bin/bash "$ADSBX_UPLOADER"
-	procd_set_param env ADSBX_ENV_FILE="$ADSBX_ENV_FILE"
+	procd_set_param env ADSBX_ENV_FILE="$ADSBX_ENV_FILE" ADSBX_LOG_STDERR=0
 	procd_set_param respawn 3600 15 0
 	procd_set_param nice 19
 	procd_set_param stdout 1
diff --git a/utils/adsbexchange-stats/files/adsbexchange-stats.json-status-helpers.sh b/utils/adsbexchange-stats/files/adsbexchange-stats.json-status-helpers.sh
index ea54d688ceff7..62d13c578d939 100644
--- a/utils/adsbexchange-stats/files/adsbexchange-stats.json-status-helpers.sh
+++ b/utils/adsbexchange-stats/files/adsbexchange-stats.json-status-helpers.sh
@@ -96,12 +96,25 @@ EOF
 	printf '%s\n' "$uuid"
 }
 
+adsbx_log_curl_diagnostics() {
+	awk -v uuid="${UUID:-}" '
+		{
+			if (match(tolower($0), /(adsbx-uuid|authorization|proxy-authorization|cookie|set-cookie):[[:space:]]*/)) {
+				$0 = substr($0, 1, RSTART + RLENGTH - 1) "[redacted]"
+			}
+			while (uuid != "" && (position = index(tolower($0), tolower(uuid))) > 0) {
+				$0 = substr($0, 1, position - 1) "[redacted]" substr($0, position + length(uuid))
+			}
+			print
+		}
+	' "$2" | logger -t "$ADSBX_LOG_TAG" -p "daemon.$1"
+}
+
 # adsbx_curl_upload <gz_payload>
 #
-# POST the payload, capture HTTP code into ADSBX_HTTP_LAST and elapsed
-# seconds into ADSBX_ELAPSED_LAST. curl stderr (incl. -v at debug) is
-# captured to a tempfile and either logged at debug priority (level 3)
-# or, on transport failure, drained at warn priority. Returns curl's rv.
+# POST the payload and capture HTTP code and elapsed seconds. Redacted
+# curl stderr is logged at debug level, or warn on transport failure.
+# Returns curl's exit status.
 adsbx_curl_upload() {
 	local payload="$1" rv=0 t0 t1 errfile http current_uuid
 	_adsbx_normalize_log_level
@@ -142,9 +155,9 @@ adsbx_curl_upload() {
 
 	if [ "$errfile" != /dev/null ] && [ -s "$errfile" ]; then
 		if [ "$rv" -ne 0 ]; then
-			logger -t "$ADSBX_LOG_TAG" -p daemon.warn < "$errfile"
+			adsbx_log_curl_diagnostics warn "$errfile"
 		elif [ "$ADSBX_LOG_LEVEL" -ge 3 ]; then
-			logger -t "$ADSBX_LOG_TAG" -p daemon.debug < "$errfile"
+			adsbx_log_curl_diagnostics debug "$errfile"
 		fi
 	fi
 	[ "$errfile" != /dev/null ] && rm -f "$errfile"
diff --git a/utils/adsbexchange-stats/tests/stats.sh b/utils/adsbexchange-stats/tests/stats.sh
index a1fe7f8e3dd9f..55a78b137d66a 100644
--- a/utils/adsbexchange-stats/tests/stats.sh
+++ b/utils/adsbexchange-stats/tests/stats.sh
@@ -158,19 +158,47 @@ test_error_output() (
 	# shellcheck source=/dev/null
 	. "$tmpdir/functions.sh"
 	ADSBX_LOG_TAG=review-stats
+	ADSBX_LOG_STDERR=${1:-1}
 	: > "$tmpdir/calls"
 	logger() { printf '%s\n' "$*" >> "$tmpdir/calls"; }
 	adsbx_err 'failed to start' > "$tmpdir/stdout" 2> "$tmpdir/stderr" || return 1
 	[ ! -s "$tmpdir/stdout" ] || return 1
-	assert_equal "$(cat "$tmpdir/stderr")" 'review-stats: failed to start' || return 1
+	if [ "$ADSBX_LOG_STDERR" = 1 ]; then
+		assert_equal "$(cat "$tmpdir/stderr")" 'review-stats: failed to start' || return 1
+	else
+		[ ! -s "$tmpdir/stderr" ] || return 1
+	fi
 	assert_equal "$(cat "$tmpdir/calls")" '-t review-stats -p daemon.err -- failed to start'
 )
 run_test 'production error logger writes both stderr and syslog without stdout' test_error_output
-run_test 'new uploader package starts at release 1' grep -qx 'PKG_RELEASE:=1' "$package_dir/Makefile"
-run_test 'daemon control help does not misclassify showurl' \
-	grep -Fq 'service adsbexchange-stats {start|stop|restart|reload|status|enable|disable}' "$package_dir/Makefile"
-run_test 'package help retains the extra showurl action' \
-	grep -qx '    service adsbexchange-stats showurl' "$package_dir/Makefile"
+run_test 'daemon errors are sent to syslog without duplicate stderr output' test_error_output 0
+test_runtime_defaults() (
+	unset ADSBX_RUNTIME_DIR ADSBX_ENV_FILE ADSBX_UUID_FILE ADSBX_UPLOADER
+	expected_dir=/var/run/adsbexchange-stats
+	expected_env=$expected_dir/env expected_uuid=$expected_dir/uuid
+	expected_uploader=/usr/share/adsbexchange-stats/json-status
+	case $1 in
+		directory)
+			ADSBX_RUNTIME_DIR="$tmpdir/custom"
+			expected_dir=$ADSBX_RUNTIME_DIR
+			expected_env=$expected_dir/env expected_uuid=$expected_dir/uuid
+			;;
+		explicit)
+			ADSBX_ENV_FILE="$tmpdir/custom-env" ADSBX_UUID_FILE="$tmpdir/custom-uuid"
+			ADSBX_UPLOADER="$tmpdir/custom-uploader"
+			expected_env=$ADSBX_ENV_FILE expected_uuid=$ADSBX_UUID_FILE expected_uploader=$ADSBX_UPLOADER
+			;;
+	esac
+	# shellcheck source=/dev/null
+	. "$tmpdir/functions.sh"
+	assert_equal "$ADSBX_RUNTIME_DIR" "$expected_dir" &&
+		assert_equal "$ADSBX_ENV_FILE" "$expected_env" &&
+		assert_equal "$ADSBX_UUID_FILE" "$expected_uuid" &&
+		assert_equal "$ADSBX_UPLOADER" "$expected_uploader"
+)
+run_test 'unset runtime paths receive production defaults' test_runtime_defaults default
+run_test 'runtime directory override determines default env and UUID paths' test_runtime_defaults directory
+run_test 'explicit runtime file and uploader overrides are preserved' test_runtime_defaults explicit
 run_test 'default-selected feeder inherits main UUID' test_identity '' 0 "$main_uuid"
 run_test 'selected feeder override wins over main UUID' test_identity second 0 "$override_uuid"
 run_test 'configured selection resolves its own override' test_identity '' 0 "$override_uuid" \
@@ -192,7 +220,9 @@ test_enabled_start() (
 	seed 'adsbexchange-stats.main.enabled=1' 'adsbexchange-stats.main.feeder=second'
 	start_instance main || return 1
 	assert_equal "$(cat "$tmpdir/uuid")" "$override_uuid" || return 1
-	grep -qx "ADSBX_FEEDER='second'" "$tmpdir/env" && grep -q '^open$' "$tmpdir/calls"
+	! grep -Fq "$override_uuid" "$tmpdir/log" || return 1
+	grep -qx "ADSBX_FEEDER='second'" "$tmpdir/env" && grep -q '^open$' "$tmpdir/calls" &&
+		grep -q 'ADSBX_LOG_STDERR=0' "$tmpdir/calls"
 )
 test_environment_failure() (
 	seed 'adsbexchange-stats.main.enabled=1'
@@ -318,6 +348,36 @@ test_upload_guard() (
 	fi
 )
 run_test 'approved matching feeder can upload' test_upload_guard matching 0
+test_curl_redaction() (
+	override_uuid=abcdefab-0000-4000-8000-abcdefabcdef
+	seed 'adsbexchange-stats.main.enabled=1' 'adsbexchange-stats.main.feeder=second'
+	ADSBX_FEEDER=second UUID=$override_uuid ADSBX_LOG_LEVEL=$1
+	curl_status=$2 priority=$3
+	curl() {
+		printf '%s\n' \
+			"> adsbx-uuid: $UUID" \
+			'> AuThOrIzAtIoN: Bearer private-token' \
+			'> Proxy-Authorization: private-proxy' \
+			'> Cookie: session=private-cookie' \
+			'< Set-Cookie: session=private-server' \
+			"* [HTTP/2] [1] [adsbx-uuid: $UUID]" \
+			"* identity $UUID" \
+			'* identity ABCDEFAB-0000-4000-8000-ABCDEFABCDEF' \
+			'* identity AbCdEfAb-0000-4000-8000-AbCdEfAbCdEf' '* Connected to test host' >&2
+		printf 200
+		return "$curl_status"
+	}
+	logger() { printf '%s\n' "$*" >> "$tmpdir/calls"; cat >> "$tmpdir/log"; }
+	rc=0
+	adsbx_curl_upload "$tmpdir/config" || rc=$?
+	assert_equal "$rc" "$curl_status" || return 1
+	grep -q "daemon.$priority" "$tmpdir/calls" || return 1
+	grep -q '\[redacted\]' "$tmpdir/log" && grep -q 'Connected to test host' "$tmpdir/log" || return 1
+	! grep -Fiq "$UUID" "$tmpdir/log" && ! grep -Eq 'private-(token|proxy|cookie|server)' "$tmpdir/log"
+)
+run_test 'successful verbose uploads redact UUID and sensitive headers' test_curl_redaction 3 0 debug
+run_test 'failed verbose uploads redact UUID and sensitive headers' test_curl_redaction 3 9 warn
+run_test 'failure diagnostics are redacted even below debug level' test_curl_redaction 0 9 warn
 test_upload_log_level() (
 	seed 'adsbexchange-stats.main.enabled=1' 'adsbexchange-stats.main.feeder=second'
 	ADSBX_FEEDER=second UUID=$override_uuid ADSBX_LOG_LEVEL=$1
@@ -507,6 +567,7 @@ test_runtime_cleanup() (
 	stop_service || return 1
 	[ -f "$runtime/upload.gz" ] || return 1
 	if [ "$scenario" = failure ]; then
+		# shellcheck disable=SC2329
 		rm() { return 1; }
 		rc=0
 		service_stopped || rc=$?
@@ -534,6 +595,7 @@ test_metrics() (
 	ADSBX_LOG_LEVEL=2 ADSBX_SUMMARY_INTERVAL=300 ADSBX_HTTP_LAST=200 ADSBX_ELAPSED_LAST=0
 	ADSBX_CYCLE=0 ADSBX_OK=0 ADSBX_FAIL=0
 	ADSBX_AC_TOTAL=0 ADSBX_BYTES_TOTAL=0 ADSBX_LAST_SUMMARY=100
+	# shellcheck disable=SC2329
 	date() { echo 100; }
 	adsbx_record_upload "$aircraft_input" "$bytes_input" || return 1
 	assert_equal "$ADSBX_CYCLE" 1 && assert_equal "$ADSBX_OK" 1 &&