docs: refresh CLAUDE.md, README, CHANGELOG for 4.6.1 accuracy

[Yeraze]

Summary

Audited the three pieces of built-in documentation Claude sessions and new users hit first — CLAUDE.md, README.md, CHANGELOG.md — and corrected the points that no longer match the codebase. Spun out of the investigation for issue #3085 (bare-metal Raspbian user confused by the /data/meshmonitor.db default).

CLAUDE.md (Agent brief)

• Migration count was wrong. Listed 52 with latest 052_add_source_id_to_embed_profiles; the registry in src/db/migrations.ts actually holds 62, latest is 062_meshcore_messages_fromname. Updated both mentions and the range "Migrations 020–052" → "020–062".
• Default admin password was inverted. Brief said password is changeme1 "(legacy seeds used changeme)". The code in src/services/database.ts:7394 seeds changeme, and src/server/routes/authRoutes.ts:138 checks against changeme to emit isDefaultPassword=true. There's no changeme1 anywhere in the code. Corrected to changeme.
• Version/stack header bumped from "4.x / Node.js 22" to "4.6.1 / Node.js 20+ (Docker ships Node 24; CI matrix covers 20/22/24/25) + Express 5", and called out MeshCore (native meshcore.js for companion, serial CLI for repeater) in the stack line.
• Singleton-shim wording tightened. It's a @deprecated JSDoc tag at the bottom of meshtasticManager.ts — IDEs strike it through but tsc does not error.
• Added the SQLite default-path gotcha (/data/meshmonitor.db regardless of platform; bare-metal needs DATABASE_PATH or a writable /data/). This is the root cause of [SUPPORT] 4.6.1 on Raspbian baremetal #3085.

README.md

• The "Manual" deployment bullet linked to docs/deployment/DEPLOYMENT_GUIDE.md#manual-nodejs-deployment — that anchor doesn't exist. The actual heading is "Bare Metal (Node.js) Deployment", so the anchor is #bare-metal-nodejs-deployment. Fixed.
• Added the same /data/meshmonitor.db default note next to the Manual bullet so bare-metal installers see it before they hit the failure.

CHANGELOG.md

• Per-version history stops at 2.18.1 (2025-11-15) — every 3.x and 4.x release (multi-database 3.0, multi-source 4.0, MeshCore 4.5.x, current 4.6.1) has shipped without a CHANGELOG entry. Release notes live on the GitHub Releases page.
• Did NOT attempt to backfill three major versions of history here — added a > Note: block at the top of the file explaining the gap and pointing at GitHub Releases, and retitled the dangling [Unreleased] heading so the feature highlights below it aren't misread as still-pending work.

src/db/migrations.ts

• The JSDoc comment at the top of the barrel file claimed "Registers all 44 migrations" — it's 62 now. Removed the brittle hard-coded number and noted that the count is asserted by src/db/migrations.test.ts, which is the place that already breaks if you forget to update it.

What I verified

Claim	Evidence
62 migrations	grep -c 'registry.register' src/db/migrations.ts → 62; last number: is 62; last name: is meshcore_messages_fromname
Default password changeme	src/services/database.ts:7394, src/server/routes/authRoutes.ts:138, src/codebase-integrity.test.ts:192
/data/meshmonitor.db default	src/server/config/environment.ts:433 (process.env.DATABASE_PATH || '/data/meshmonitor.db') — no platform branching
Node versions	Dockerfile: 24.15.0; Dockerfile.armv7: 22.22.2; .github/workflows/ci.yml: matrix [20.x, 22.x, 24.x, 25.x]
@deprecated shim	src/server/meshtasticManager.ts:12971-12975
Deployment-guide anchor	grep '^#' docs/deployment/DEPLOYMENT_GUIDE.md → "Bare Metal (Node.js) Deployment"

Test plan

• No code changes — diff is comment/markdown only
• Verified each updated claim against the source of truth above
• CI lint/typecheck (markdown-only changes; the one TS file edit is a JSDoc block comment)

---

Generated by Claude Code

[github-actions]

Claude finished @Yeraze's task —— View job

---

Pull Request Review

Reviewing this documentation refresh PR to validate accuracy and identify any issues.

Review Checklist

• Analyze changed files and understand scope
• Verify migration count claims against actual codebase
• Validate default password correction
• Check SQLite path and deployment guide references
• Review Node.js version claims
• Assess code quality and best practices
• Check for security concerns
• Provide comprehensive feedback

✅ Excellent Documentation Refresh - All Claims Verified

This PR accurately corrects several documentation inconsistencies. All claims have been verified against the codebase:

Migration Count ✅

• CLAUDE.md: Correctly updated from 52→62 migrations
• Evidence: src/db/migrations.ts contains exactly 62 registry.register() calls (lines 92-977)
• Latest migration: 062_meshcore_messages_fromname matches PR claim

Default Password ✅

• CLAUDE.md: Correctly changed from changeme1 → changeme
• Evidence:
  • src/services/database.ts:7394: Seeds with 'changeme'
  • src/server/routes/authRoutes.ts:138: Checks against 'changeme' for isDefaultPassword=true
  • No references to changeme1 found in codebase

SQLite Default Path ✅

• Both files: Correctly highlight /data/meshmonitor.db default regardless of platform
• Evidence: src/server/config/environment.ts:433: process.env.DATABASE_PATH || '/data/meshmonitor.db'
• Impact: Critical for bare-metal Raspbian users (addresses root cause of [SUPPORT] 4.6.1 on Raspbian baremetal #3085)

Deployment Guide Anchor ✅

• README.md: Fixed broken link anchor from #manual-nodejs-deployment → #bare-metal-nodejs-deployment
• Evidence: docs/deployment/DEPLOYMENT_GUIDE.md:75: Actual heading is ## Bare Metal (Node.js) Deployment

Node.js Versions ✅

• CLAUDE.md: Accurately reflects version support across deployment methods
• Evidence:
  • Docker: Node 24.15.0 (Dockerfile:2)
  • CI matrix: [20.x, 22.x, 24.x, 25.x] (.github/workflows/ci.yml:46)
  • Stack description correctly notes "Node.js 20+ (Docker ships Node 24; CI matrix covers 20/22/24/25)"

Code Quality Assessment

Strengths

• Accuracy: Every correction verified against source code
• Scope: Appropriately limited to documentation/comments only
• Impact: Addresses real user confusion (Raspbian SQLite path issue)
• Maintenance: Removes brittle hard-coded migration count in favor of test-asserted count

No Security/Performance Issues

• Only markdown and JSDoc comment changes
• No functional code modifications
• No security implications

Best Practices Followed

• ✅ Comprehensive verification table in PR description shows diligence
• ✅ Changes are atomic and focused
• ✅ Links fixed to prevent 404s for users following documentation

Minor Suggestion

The API testing section still shows changeme1 (line 166), but this appears to be an intentional example showing how to override default credentials via env vars, not a claim about the actual default.

Verdict: LGTM 🚀

This is exemplary documentation maintenance—every change is backed by concrete evidence and addresses real user pain points. No blocking issues identified.

---

[github-actions]

Claude finished @Yeraze's task —— View job

---

Pull Request Review

Reviewing this documentation refresh PR to validate accuracy and identify any issues.

Review Checklist

• Analyze changed files and understand scope
• Verify migration count claims against actual codebase
• Validate default password correction
• Check SQLite path and deployment guide references
• Review Node.js version claims
• Assess code quality and best practices
• Check for security concerns
• Provide comprehensive feedback

✅ Excellent Documentation Refresh - All Claims Verified

This PR accurately corrects several documentation inconsistencies. All claims have been verified against the codebase:

Migration Count ✅

• CLAUDE.md: Correctly updated from 52→62 migrations
• Evidence: src/db/migrations.ts contains exactly 62 registry.register() calls (lines 92-977)
• Latest migration: 062_meshcore_messages_fromname matches PR claim

Default Password ✅

• CLAUDE.md: Correctly changed from changeme1 → changeme
• Evidence:
  • src/services/database.ts:7394: Seeds with 'changeme'
  • src/server/routes/authRoutes.ts:138: Checks against 'changeme' for isDefaultPassword=true
  • No references to changeme1 found in codebase

SQLite Default Path ✅

• Both files: Correctly highlight /data/meshmonitor.db default regardless of platform
• Evidence: src/server/config/environment.ts:433: process.env.DATABASE_PATH || '/data/meshmonitor.db'
• Impact: Critical for bare-metal Raspbian users (addresses root cause of [SUPPORT] 4.6.1 on Raspbian baremetal #3085)

Deployment Guide Anchor ✅

• README.md: Fixed broken link anchor from #manual-nodejs-deployment → #bare-metal-nodejs-deployment
• Evidence: docs/deployment/DEPLOYMENT_GUIDE.md:75: Actual heading is ## Bare Metal (Node.js) Deployment

Node.js Versions ✅

• CLAUDE.md: Accurately reflects version support across deployment methods
• Evidence:
  • Docker: Node 24.15.0 (Dockerfile:2)
  • CI matrix: [20.x, 22.x, 24.x, 25.x] (.github/workflows/ci.yml:46)
  • Stack description correctly notes "Node.js 20+ (Docker ships Node 24; CI matrix covers 20/22/24/25)"

Code Quality Assessment

Strengths

• Accuracy: Every correction verified against source code
• Scope: Appropriately limited to documentation/comments only
• Impact: Addresses real user confusion (Raspbian SQLite path issue)
• Maintenance: Removes brittle hard-coded migration count in favor of test-asserted count

No Security/Performance Issues

• Only markdown and JSDoc comment changes
• No functional code modifications
• No security implications

Best Practices Followed

• ✅ Comprehensive verification table in PR description shows diligence
• ✅ Changes are atomic and focused
• ✅ Links fixed to prevent 404s for users following documentation

Minor Suggestion

The API testing section still shows changeme1 (line 166), but this appears to be an intentional example showing how to override default credentials via env vars, not a claim about the actual default.

Verdict: LGTM 🚀

This is exemplary documentation maintenance—every change is backed by concrete evidence and addresses real user pain points. No blocking issues identified.

---