diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 22ada61..df5c74f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -270,6 +270,8 @@ jobs:
             -I firmware/lib/odh-radio \
             -I firmware/lib/odh-telemetry \
             -I firmware/lib/odh-web \
+            -I firmware/lib/odh-shell \
+            -I firmware/lib/odh-channel \
             firmware/src \
             firmware/lib
 
diff --git a/.gitignore b/.gitignore
index 59a1aa2..b0b106d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -14,3 +14,6 @@
 *.bak
 *.000
 fp-info-cache
+
+# Python bytecode
+__pycache__
diff --git a/firmware/data/transmitter/index.html b/firmware/data/transmitter/index.html
index 7f1d58a..26acc40 100644
--- a/firmware/data/transmitter/index.html
+++ b/firmware/data/transmitter/index.html
@@ -183,10 +183,6 @@ <h2>Device</h2>
   <label>Device Name</label>
   <input type="text" id="c-devname" maxlength="28">
 
-  <h2>Radio</h2>
-  <label>WiFi Channel (1–13)</label>
-  <input type="number" id="c-radioch" min="1" max="13">
-
   <h2>Battery</h2>
   <label>TX Cells</label>
   <select id="c-txcells">
@@ -266,7 +262,6 @@ <h2>Modules</h2>
         configData = await fetchJson('/api/config');
         const c = configData;
         document.getElementById('c-devname').value = c.device_name || '';
-        document.getElementById('c-radioch').value = c.radio_channel || 1;
         document.getElementById('c-txcells').value = c.tx_cells || 0;
         document.getElementById('c-rxcells').value = c.rx_cells || 0;
 
@@ -345,7 +340,6 @@ <h2>Modules</h2>
 
       const body = {
         device_name: document.getElementById('c-devname').value,
-        radio_channel: parseInt(document.getElementById('c-radioch').value),
         model_type: parseInt(document.getElementById('c-model').value),
         tx_cells: parseInt(document.getElementById('c-txcells').value),
         rx_cells: parseInt(document.getElementById('c-rxcells').value),
diff --git a/firmware/lib/odh-channel/Channel.h b/firmware/lib/odh-channel/Channel.h
new file mode 100644
index 0000000..4d2ff39
--- /dev/null
+++ b/firmware/lib/odh-channel/Channel.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2026 Peter Buchegger
+ *
+ * This file is part of OpenDriveHub.
+ *
+ * OpenDriveHub is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * OpenDriveHub is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with OpenDriveHub. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
+#pragma once
+
+#include <cstdint>
+
+namespace odh {
+namespace channel {
+
+/// The three non-overlapping 2.4 GHz WiFi channels used for discovery.
+inline constexpr uint8_t kCandidateChannels[]   = {1, 6, 11};
+inline constexpr uint8_t kCandidateChannelCount = 3;
+
+/// Returns true only for channels 1, 6, or 11.
+inline constexpr bool isValidChannel(uint8_t ch) {
+    return ch == 1 || ch == 6 || ch == 11;
+}
+
+/// Fallback channel when NVS is empty or contains an invalid value.
+inline constexpr uint8_t kDefaultChannel = 1;
+
+// -- Discovery timing constants --
+
+/// Wait after switching WiFi channel before sending (ms).
+inline constexpr uint32_t kChannelSettleMs = 10;
+
+/// Wait for a discovery response after sending a request (ms).
+inline constexpr uint32_t kDiscoveryWaitMs = 25;
+
+/// Number of discovery requests per channel scan attempt.
+inline constexpr uint8_t kDiscoveryRetries = 2;
+
+/// Approximate wall-clock time for one full scan of all 3 channels (ms).
+inline constexpr uint32_t kScanRoundMs = 180;
+
+/// Minimum random backoff before a receiver claims a channel (ms).
+inline constexpr uint32_t kFoundingBackoffMinMs = 200;
+
+/// Maximum random backoff before a receiver claims a channel (ms).
+inline constexpr uint32_t kFoundingBackoffMaxMs = 700;
+
+/// Interval at which a receiver broadcasts its presence (ms).
+inline constexpr uint32_t kPresenceIntervalMs = 500;
+
+/// Receiver re-enters discovery if it hears no transmitter for this long (ms).
+inline constexpr uint32_t kTransmitterLossTimeoutMs = 3000;
+
+/// Transmitter prunes receivers not seen for this long (ms).
+inline constexpr uint32_t kPresenceStaleTimeoutMs = 5000;
+
+/// Maps a WiFi channel number to a UDP simulation port.
+/// ch 1 → 7001, ch 6 → 7006, ch 11 → 7011, anything else → 7001.
+inline constexpr uint16_t channelToSimPort(uint8_t ch) {
+    if (ch == 1)
+        return 7001;
+    if (ch == 6)
+        return 7006;
+    if (ch == 11)
+        return 7011;
+    return 7001;
+}
+
+} // namespace channel
+} // namespace odh
diff --git a/firmware/lib/odh-channel/ChannelScanner.cpp b/firmware/lib/odh-channel/ChannelScanner.cpp
new file mode 100644
index 0000000..31da70a
--- /dev/null
+++ b/firmware/lib/odh-channel/ChannelScanner.cpp
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2026 Peter Buchegger
+ *
+ * This file is part of OpenDriveHub.
+ *
+ * OpenDriveHub is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * OpenDriveHub is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with OpenDriveHub. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
+#include "ChannelScanner.h"
+
+#include <cstdlib>
+
+namespace odh {
+
+ChannelScanner::ChannelScanner(SetChannelFn setChannel, SendDiscoveryFn sendDiscovery, DelayFn delayMs)
+    : _setChannel(std::move(setChannel)),
+      _sendDiscovery(std::move(sendDiscovery)),
+      _delay(std::move(delayMs)) {}
+
+ScanResult ChannelScanner::scanChannel(uint8_t channel) {
+    ScanResult result;
+    result.channel = channel;
+
+    // Switch to channel and wait for it to settle
+    _setChannel(channel);
+    _delay(channel::kChannelSettleMs);
+
+    // Reset response flag
+    _responseReceived    = false;
+    _responseRssi        = -127;
+    _responseDeviceCount = 0;
+
+    // Send discovery requests with retries
+    for (uint8_t attempt = 0; attempt < channel::kDiscoveryRetries; ++attempt) {
+        _sendDiscovery(channel);
+        _delay(channel::kDiscoveryWaitMs);
+
+        if (_responseReceived) {
+            result.foundTransmitter = true;
+            result.rssi             = _responseRssi;
+            result.deviceCount      = _responseDeviceCount;
+            return result;
+        }
+    }
+
+    return result;
+}
+
+void ChannelScanner::scanAllChannels(ScanResult results[channel::kCandidateChannelCount]) {
+    for (uint8_t i = 0; i < channel::kCandidateChannelCount; ++i) {
+        results[i] = scanChannel(channel::kCandidateChannels[i]);
+    }
+}
+
+uint8_t ChannelScanner::bestChannel(const ScanResult results[channel::kCandidateChannelCount]) {
+    // First: prefer channels with an active transmitter (best RSSI)
+    int8_t bestRssi = -128;
+    uint8_t bestCh  = channel::kCandidateChannels[0];
+    bool foundAny   = false;
+
+    for (uint8_t i = 0; i < channel::kCandidateChannelCount; ++i) {
+        if (results[i].foundTransmitter && results[i].rssi > bestRssi) {
+            bestRssi = results[i].rssi;
+            bestCh   = results[i].channel;
+            foundAny = true;
+        }
+    }
+
+    if (foundAny) {
+        return bestCh;
+    }
+
+    // No transmitter found: return first candidate (channel selection for
+    // founding a new cluster – caller may do channel quality evaluation)
+    return channel::kCandidateChannels[0];
+}
+
+bool ChannelScanner::anyTransmitterFound(const ScanResult results[channel::kCandidateChannelCount]) {
+    for (uint8_t i = 0; i < channel::kCandidateChannelCount; ++i) {
+        if (results[i].foundTransmitter)
+            return true;
+    }
+    return false;
+}
+
+void ChannelScanner::onDiscoveryResponse(uint8_t /*channel*/, int8_t rssi, uint8_t deviceCount) {
+    _responseRssi        = rssi;
+    _responseDeviceCount = deviceCount;
+    _responseReceived    = true;
+}
+
+} // namespace odh
diff --git a/firmware/lib/odh-channel/ChannelScanner.h b/firmware/lib/odh-channel/ChannelScanner.h
new file mode 100644
index 0000000..57ebf8b
--- /dev/null
+++ b/firmware/lib/odh-channel/ChannelScanner.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2026 Peter Buchegger
+ *
+ * This file is part of OpenDriveHub.
+ *
+ * OpenDriveHub is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * OpenDriveHub is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with OpenDriveHub. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
+#pragma once
+
+#include "Channel.h"
+
+#include <Protocol.h>
+#include <cstdint>
+#include <functional>
+
+namespace odh {
+
+/// Result of scanning a single WiFi channel for transmitter activity.
+struct ScanResult {
+    uint8_t channel       = 0;
+    bool foundTransmitter = false;
+    int8_t rssi           = -127;
+    uint8_t deviceCount   = 0; ///< From DiscoveryResponse
+};
+
+/// Callback types for platform-abstracted channel operations.
+using SetChannelFn    = std::function<bool(uint8_t channel)>;
+using SendDiscoveryFn = std::function<bool(uint8_t channel)>;
+using DelayFn         = std::function<void(uint32_t ms)>;
+
+/**
+ * Shared channel scanner used by both transmitter and receiver.
+ *
+ * Platform-agnostic: uses callbacks for channel switching, packet
+ * sending, and delays so it works on both ESP32 and the simulator.
+ */
+class ChannelScanner {
+public:
+    ChannelScanner(SetChannelFn setChannel, SendDiscoveryFn sendDiscovery, DelayFn delayMs);
+
+    /// Scan a single channel: switch, send discovery request(s), wait for response.
+    ScanResult scanChannel(uint8_t channel);
+
+    /// Scan all candidate channels (1, 6, 11). Returns results for each.
+    void scanAllChannels(ScanResult results[channel::kCandidateChannelCount]);
+
+    /// Pick the best channel from scan results.
+    /// Prefers channels with an active transmitter. Among those, picks best RSSI.
+    /// If none have a transmitter, returns the channel that appears quietest.
+    static uint8_t bestChannel(const ScanResult results[channel::kCandidateChannelCount]);
+
+    /// Returns true if any candidate channel has an active transmitter.
+    static bool anyTransmitterFound(const ScanResult results[channel::kCandidateChannelCount]);
+
+    /// Called by the radio layer when a DiscoveryResponse is received.
+    /// Thread-safe: sets internal flag for the current scan wait.
+    void onDiscoveryResponse(uint8_t channel, int8_t rssi, uint8_t deviceCount);
+
+private:
+    SetChannelFn _setChannel;
+    SendDiscoveryFn _sendDiscovery;
+    DelayFn _delay;
+
+    // Volatile scan state (set by onDiscoveryResponse, read by scanChannel)
+    volatile bool _responseReceived       = false;
+    volatile int8_t _responseRssi         = -127;
+    volatile uint8_t _responseDeviceCount = 0;
+};
+
+} // namespace odh
diff --git a/firmware/lib/odh-channel/library.json b/firmware/lib/odh-channel/library.json
new file mode 100644
index 0000000..b1c6de2
--- /dev/null
+++ b/firmware/lib/odh-channel/library.json
@@ -0,0 +1,8 @@
+{
+    "name": "odh-channel",
+    "version": "1.0.0",
+    "description": "OpenDriveHub shared channel model and discovery scanner",
+    "dependencies": [
+        {"name": "odh-protocol"}
+    ]
+}
diff --git a/firmware/lib/odh-config/Config.h b/firmware/lib/odh-config/Config.h
index 35fd699..055dd82 100644
--- a/firmware/lib/odh-config/Config.h
+++ b/firmware/lib/odh-config/Config.h
@@ -38,9 +38,6 @@ namespace odh::config {
 
 // ── Shared settings ─────────────────────────────────────────────────────
 
-/// ESP-NOW WiFi channel (1-13). Must match on TX and RX.
-inline constexpr uint8_t kRadioWifiChannel = 1;
-
 /// Failsafe timeout (ms) – if no control packet arrives within this window,
 /// the receiver applies failsafe values.
 inline constexpr uint32_t kRadioFailsafeTimeoutMs = 500;
@@ -85,9 +82,6 @@ inline constexpr uint8_t kChannelCount = 8;
 /// Default vehicle name for broadcast announcements.
 inline constexpr const char *kVehicleName = "Vehicle";
 
-/// Announce broadcast interval (ms).
-inline constexpr uint32_t kAnnounceIntervalMs = 500;
-
 /// Telemetry send interval (ms).
 inline constexpr uint32_t kTelemetrySendIntervalMs = 100;
 
diff --git a/firmware/lib/odh-protocol/FunctionMap.h b/firmware/lib/odh-protocol/FunctionMap.h
index eeb5cd4..ff0c9b9 100644
--- a/firmware/lib/odh-protocol/FunctionMap.h
+++ b/firmware/lib/odh-protocol/FunctionMap.h
@@ -259,13 +259,13 @@ inline const char *odh_model_name(uint8_t model) {
 #endif
 }
 
-inline uint8_t odh_default_function_map(uint8_t model, OdhFunctionMapEntry_t *entries) {
+inline uint8_t odh_default_function_map(uint8_t model, FunctionMapEntry *entries) {
     auto map = odh::defaultFunctionMap(model);
-    std::memcpy(entries, map.entries.data(), sizeof(OdhFunctionMapEntry_t) * map.count);
+    std::memcpy(entries, map.entries.data(), sizeof(FunctionMapEntry) * map.count);
     return map.count;
 }
 
-inline uint8_t odh_function_to_channel(const OdhFunctionMapEntry_t *entries, uint8_t count, uint8_t function) {
+inline uint8_t odh_function_to_channel(const FunctionMapEntry *entries, uint8_t count, uint8_t function) {
     for (uint8_t i = 0; i < count; i++) {
         if (entries[i].function == function) {
             return entries[i].channel;
@@ -274,13 +274,13 @@ inline uint8_t odh_function_to_channel(const OdhFunctionMapEntry_t *entries, uin
     return 0xFF;
 }
 
-inline uint8_t odh_channel_to_function(const OdhFunctionMapEntry_t *entries, uint8_t count, uint8_t channel) {
+inline uint8_t odh_channel_to_function(const FunctionMapEntry *entries, uint8_t count, uint8_t channel) {
     for (uint8_t i = 0; i < count; i++) {
         if (entries[i].channel == channel) {
             return entries[i].function;
         }
     }
-    return ODH_FUNC_NONE;
+    return static_cast<uint8_t>(Function::None);
 }
 
 } // namespace odh
diff --git a/firmware/lib/odh-protocol/Protocol.h b/firmware/lib/odh-protocol/Protocol.h
index f4b08a3..0d62724 100644
--- a/firmware/lib/odh-protocol/Protocol.h
+++ b/firmware/lib/odh-protocol/Protocol.h
@@ -65,12 +65,21 @@ inline constexpr uint8_t kVehicleNameMax = 16;
 // ── Packet types ────────────────────────────────────────────────────────
 
 enum class PacketType : uint8_t {
-    Control    = 0x01, ///< TX → RX: function values + trims
-    Telemetry  = 0x02, ///< RX → TX: battery, RSSI, sensor data
-    Bind       = 0x10, ///< Binding handshake (connect request / reply)
-    Ack        = 0x20, ///< Generic acknowledgement
-    Announce   = 0x30, ///< RX → broadcast: vehicle presence announcement
-    Disconnect = 0x40, ///< TX → RX: disconnect / release link
+    Control           = 0x01, ///< TX → RX: function values + trims
+    Telemetry         = 0x02, ///< RX → TX: battery, RSSI, sensor data
+    Bind              = 0x10, ///< Binding handshake (connect request / reply)
+    Disconnect        = 0x40, ///< TX → RX: disconnect / release link
+    DiscoveryRequest  = 0x50, ///< Sent by any device searching for a transmitter
+    DiscoveryResponse = 0x51, ///< TX → broadcast: confirms active transmitter
+    ReceiverPresence  = 0x52, ///< RX → broadcast: periodic presence announcement
+    ChannelMigration  = 0x53, ///< TX → broadcast: notifies channel change
+};
+
+// ── Device roles ────────────────────────────────────────────────────────
+
+enum class DeviceRole : uint8_t {
+    Transmitter = 0x01,
+    Receiver    = 0x02,
 };
 
 // ── Vehicle model types ─────────────────────────────────────────────────
@@ -158,19 +167,51 @@ struct __attribute__((packed)) BindPacket {
     uint8_t checksum;
 };
 
-struct __attribute__((packed)) AnnouncePacket {
+struct __attribute__((packed)) FunctionMapEntry {
+    uint8_t function; ///< odh::Function
+    uint8_t channel;  ///< Output channel index (0-based)
+};
+
+/// Discovery request – sent by any device searching for an active transmitter.
+struct __attribute__((packed)) DiscoveryRequestPacket {
+    uint8_t magic[2];
+    uint8_t version;
+    uint8_t type;   ///< PacketType::DiscoveryRequest
+    uint8_t mac[6]; ///< Sender's MAC address
+    uint8_t role;   ///< DeviceRole of the sender
+    uint8_t checksum;
+};
+
+/// Discovery response – sent by an active transmitter answering a request.
+struct __attribute__((packed)) DiscoveryResponsePacket {
+    uint8_t magic[2];
+    uint8_t version;
+    uint8_t type;         ///< PacketType::DiscoveryResponse
+    uint8_t mac[6];       ///< Transmitter's MAC address
+    uint8_t channel;      ///< Current WiFi channel (1, 6, or 11)
+    uint8_t device_count; ///< Number of known receivers on this channel
+    uint8_t checksum;
+};
+
+/// Receiver presence – periodic broadcast by a receiver on the active channel.
+struct __attribute__((packed)) ReceiverPresencePacket {
     uint8_t magic[2];
     uint8_t version;
-    uint8_t type;       ///< PacketType::Announce
+    uint8_t type;       ///< PacketType::ReceiverPresence
     uint8_t mac[6];
     uint8_t model_type; ///< ModelType
     char name[kVehicleNameMax];
     uint8_t checksum;
 };
 
-struct __attribute__((packed)) FunctionMapEntry {
-    uint8_t function; ///< odh::Function
-    uint8_t channel;  ///< Output channel index (0-based)
+/// Channel migration – sent by a transmitter before switching channels.
+struct __attribute__((packed)) ChannelMigrationPacket {
+    uint8_t magic[2];
+    uint8_t version;
+    uint8_t type;        ///< PacketType::ChannelMigration
+    uint8_t mac[6];      ///< Transmitter's MAC address
+    uint8_t new_channel; ///< Target WiFi channel (1, 6, or 11)
+    uint8_t checksum;
 };
 
 // ── Compile-time packet size verification ───────────────────────────────
@@ -178,7 +219,10 @@ struct __attribute__((packed)) FunctionMapEntry {
 static_assert(sizeof(ControlPacket) <= 250, "Control packet exceeds ESP-NOW limit");
 static_assert(sizeof(TelemetryPacket) <= 250, "Telemetry packet exceeds ESP-NOW limit");
 static_assert(sizeof(BindPacket) <= 250, "Bind packet exceeds ESP-NOW limit");
-static_assert(sizeof(AnnouncePacket) <= 250, "Announce packet exceeds ESP-NOW limit");
+static_assert(sizeof(DiscoveryRequestPacket) <= 250, "DiscoveryRequest packet exceeds ESP-NOW limit");
+static_assert(sizeof(DiscoveryResponsePacket) <= 250, "DiscoveryResponse packet exceeds ESP-NOW limit");
+static_assert(sizeof(ReceiverPresencePacket) <= 250, "ReceiverPresence packet exceeds ESP-NOW limit");
+static_assert(sizeof(ChannelMigrationPacket) <= 250, "ChannelMigration packet exceeds ESP-NOW limit");
 
 // ── Utility: XOR checksum ───────────────────────────────────────────────
 
@@ -222,74 +266,17 @@ inline bool verifyPacket(const uint8_t *data, int len) {
     return data[len - 1] == expected;
 }
 
-} // namespace odh
+// ── Discovery helper types ──────────────────────────────────────────────
+
+/// A vehicle discovered via presence broadcasts (transmitter side).
+struct DiscoveredVehicle {
+    uint8_t mac[6]{};
+    uint8_t modelType = 0;
+    char name[kVehicleNameMax]{};
+    uint32_t lastSeenMs = 0; ///< millis() timestamp of last presence
+    int8_t rssi         = 0; ///< RSSI of last presence packet (dBm)
+    uint8_t channel     = 0; ///< WiFi channel where this vehicle was seen
+    bool valid          = false;
+};
 
-// ── Legacy compatibility aliases (for gradual migration) ────────────────
-// These allow existing code to compile while transitioning to odh:: namespace.
-
-using OdhFunctionValue_t    = odh::FunctionValue;
-using OdhControlPacket_t    = odh::ControlPacket;
-using OdhTelemetryPacket_t  = odh::TelemetryPacket;
-using OdhBindPacket_t       = odh::BindPacket;
-using OdhAnnouncePacket_t   = odh::AnnouncePacket;
-using OdhFunctionMapEntry_t = odh::FunctionMapEntry;
-
-// Legacy enum values as constexpr
-inline constexpr uint8_t ODH_MAGIC_0          = odh::kMagic0;
-inline constexpr uint8_t ODH_MAGIC_1          = odh::kMagic1;
-inline constexpr uint8_t ODH_PROTOCOL_VERSION = odh::kProtocolVersion;
-inline constexpr uint8_t ODH_MAX_CHANNELS     = odh::kMaxChannels;
-inline constexpr uint16_t ODH_CHANNEL_MIN     = odh::kChannelMin;
-inline constexpr uint16_t ODH_CHANNEL_MID     = odh::kChannelMid;
-inline constexpr uint16_t ODH_CHANNEL_MAX     = odh::kChannelMax;
-inline constexpr uint8_t ODH_MAX_SENSORS      = odh::kMaxSensors;
-inline constexpr uint8_t ODH_MAX_FUNCTIONS    = odh::kMaxFunctions;
-inline constexpr uint8_t ODH_MAX_DISCOVERED   = odh::kMaxDiscovered;
-inline constexpr uint8_t ODH_VEHICLE_NAME_MAX = odh::kVehicleNameMax;
-
-// Legacy packet type values
-inline constexpr uint8_t ODH_PKT_CONTROL    = static_cast<uint8_t>(odh::PacketType::Control);
-inline constexpr uint8_t ODH_PKT_TELEMETRY  = static_cast<uint8_t>(odh::PacketType::Telemetry);
-inline constexpr uint8_t ODH_PKT_BIND       = static_cast<uint8_t>(odh::PacketType::Bind);
-inline constexpr uint8_t ODH_PKT_ACK        = static_cast<uint8_t>(odh::PacketType::Ack);
-inline constexpr uint8_t ODH_PKT_ANNOUNCE   = static_cast<uint8_t>(odh::PacketType::Announce);
-inline constexpr uint8_t ODH_PKT_DISCONNECT = static_cast<uint8_t>(odh::PacketType::Disconnect);
-
-// Legacy model type values
-inline constexpr uint8_t ODH_MODEL_GENERIC    = static_cast<uint8_t>(odh::ModelType::Generic);
-inline constexpr uint8_t ODH_MODEL_DUMP_TRUCK = static_cast<uint8_t>(odh::ModelType::DumpTruck);
-inline constexpr uint8_t ODH_MODEL_EXCAVATOR  = static_cast<uint8_t>(odh::ModelType::Excavator);
-inline constexpr uint8_t ODH_MODEL_TRACTOR    = static_cast<uint8_t>(odh::ModelType::Tractor);
-inline constexpr uint8_t ODH_MODEL_CRANE      = static_cast<uint8_t>(odh::ModelType::Crane);
-inline constexpr uint8_t ODH_MODEL_COUNT      = static_cast<uint8_t>(odh::ModelType::Count);
-
-// Legacy function values
-inline constexpr uint8_t ODH_FUNC_DRIVE    = static_cast<uint8_t>(odh::Function::Drive);
-inline constexpr uint8_t ODH_FUNC_STEERING = static_cast<uint8_t>(odh::Function::Steering);
-inline constexpr uint8_t ODH_FUNC_AUX1     = static_cast<uint8_t>(odh::Function::Aux1);
-inline constexpr uint8_t ODH_FUNC_AUX2     = static_cast<uint8_t>(odh::Function::Aux2);
-inline constexpr uint8_t ODH_FUNC_AUX3     = static_cast<uint8_t>(odh::Function::Aux3);
-inline constexpr uint8_t ODH_FUNC_AUX4     = static_cast<uint8_t>(odh::Function::Aux4);
-inline constexpr uint8_t ODH_FUNC_BOOM_UD  = static_cast<uint8_t>(odh::Function::BoomUD);
-inline constexpr uint8_t ODH_FUNC_BOOM_LR  = static_cast<uint8_t>(odh::Function::BoomLR);
-inline constexpr uint8_t ODH_FUNC_BUCKET   = static_cast<uint8_t>(odh::Function::Bucket);
-inline constexpr uint8_t ODH_FUNC_SWING    = static_cast<uint8_t>(odh::Function::Swing);
-inline constexpr uint8_t ODH_FUNC_DUMP_BED = static_cast<uint8_t>(odh::Function::DumpBed);
-inline constexpr uint8_t ODH_FUNC_PTO      = static_cast<uint8_t>(odh::Function::Pto);
-inline constexpr uint8_t ODH_FUNC_HITCH    = static_cast<uint8_t>(odh::Function::Hitch);
-inline constexpr uint8_t ODH_FUNC_WINCH    = static_cast<uint8_t>(odh::Function::Winch);
-inline constexpr uint8_t ODH_FUNC_TRACK_L  = static_cast<uint8_t>(odh::Function::TrackL);
-inline constexpr uint8_t ODH_FUNC_TRACK_R  = static_cast<uint8_t>(odh::Function::TrackR);
-inline constexpr uint8_t ODH_FUNC_NONE     = static_cast<uint8_t>(odh::Function::None);
-
-// Legacy link state values
-inline constexpr uint8_t ODH_LINK_DISCONNECTED = static_cast<uint8_t>(odh::LinkState::Disconnected);
-inline constexpr uint8_t ODH_LINK_BINDING      = static_cast<uint8_t>(odh::LinkState::Binding);
-inline constexpr uint8_t ODH_LINK_CONNECTED    = static_cast<uint8_t>(odh::LinkState::Connected);
-inline constexpr uint8_t ODH_LINK_FAILSAFE     = static_cast<uint8_t>(odh::LinkState::Failsafe);
-inline constexpr uint8_t ODH_LINK_SCANNING     = static_cast<uint8_t>(odh::LinkState::Scanning);
-
-// Legacy checksum function
-inline uint8_t odh_checksum(const uint8_t *data, uint16_t len) {
-    return odh::checksum(data, len);
-}
+} // namespace odh
diff --git a/firmware/lib/odh-radio/IRadioLink.h b/firmware/lib/odh-radio/IRadioLink.h
index 75bf8aa..44ffa61 100644
--- a/firmware/lib/odh-radio/IRadioLink.h
+++ b/firmware/lib/odh-radio/IRadioLink.h
@@ -42,14 +42,13 @@ using ControlCallback = std::function<void(const ControlPacket &pkt)>;
 /// Callback type for received telemetry packets (transmitter side).
 using TelemetryCallback = std::function<void(const TelemetryPacket &pkt)>;
 
-/// A vehicle discovered via announce broadcasts (transmitter side).
-struct DiscoveredVehicle {
-    uint8_t mac[6]{};
-    uint8_t modelType = 0;
-    char name[kVehicleNameMax]{};
-    uint32_t lastSeenMs = 0; ///< millis() timestamp of last announce
-    int8_t rssi         = 0; ///< RSSI of last announce packet (dBm)
-    bool valid          = false;
-};
+/// Callback when a DiscoveryResponse is received.
+using DiscoveryResponseCallback = std::function<void(uint8_t channel, int8_t rssi, uint8_t deviceCount)>;
+
+/// Callback when a ChannelMigration is received.
+using ChannelMigrationCallback = std::function<void(uint8_t newChannel)>;
+
+/// Callback when a DiscoveryRequest is received (transmitter answers these).
+using DiscoveryRequestCallback = std::function<void(const uint8_t *mac, DeviceRole role)>;
 
 } // namespace odh
diff --git a/firmware/lib/odh-radio/ReceiverRadioLink.cpp b/firmware/lib/odh-radio/ReceiverRadioLink.cpp
index 84da2e8..108453e 100644
--- a/firmware/lib/odh-radio/ReceiverRadioLink.cpp
+++ b/firmware/lib/odh-radio/ReceiverRadioLink.cpp
@@ -36,13 +36,11 @@ namespace odh {
 
 static volatile int8_t sPromiscRssi = 0;
 
-#ifndef NATIVE_SIM
 // cppcheck-suppress constParameterCallback
 static void promiscRxCb(void *buf, wifi_promiscuous_pkt_type_t /*type*/) {
     const auto *pkt = static_cast<const wifi_promiscuous_pkt_t *>(buf);
     sPromiscRssi    = pkt->rx_ctrl.rssi;
 }
-#endif
 
 ReceiverRadioLink *ReceiverRadioLink::sInstance = nullptr;
 
@@ -54,8 +52,7 @@ ReceiverRadioLink::ReceiverRadioLink() = default;
 
 // ── Initialisation ──────────────────────────────────────────────────────
 
-bool ReceiverRadioLink::begin(uint8_t wifiChannel, ControlCallback callback) {
-    _wifiChannel     = wifiChannel;
+bool ReceiverRadioLink::begin(ControlCallback callback) {
     _controlCallback = std::move(callback);
     sInstance        = this;
 
@@ -69,44 +66,52 @@ bool ReceiverRadioLink::begin(uint8_t wifiChannel, ControlCallback callback) {
     esp_now_register_recv_cb(onReceive);
     esp_now_register_send_cb(onSent);
 
-#ifndef NATIVE_SIM
     esp_wifi_set_promiscuous(true);
     esp_wifi_set_promiscuous_rx_cb(promiscRxCb);
-#endif
 
     _ready = true;
     return true;
 }
 
-// ── Announcing ──────────────────────────────────────────────────────────
+// ── Channel management ──────────────────────────────────────────────────
 
-void ReceiverRadioLink::beginAnnouncing(const char *name, uint8_t modelType) {
-    if (!_ready)
-        return;
+bool ReceiverRadioLink::setChannel(uint8_t channel) {
+    _wifiChannel = channel;
+    esp_wifi_set_channel(channel, WIFI_SECOND_CHAN_NONE);
+    return true;
+}
 
+// ── Presence (replaces announcing) ──────────────────────────────────────
+
+void ReceiverRadioLink::configurePresence(const char *name, uint8_t modelType) {
     _modelType = modelType;
     std::memset(_vehicleName, 0, sizeof(_vehicleName));
     std::strncpy(_vehicleName, name, kVehicleNameMax - 1);
+}
+
+void ReceiverRadioLink::beginPresence() {
+    if (!_ready)
+        return;
 
     addPeer(kBroadcastMac);
-    _announcing     = true;
-    _lastAnnounceMs = 0;
+    _presencing     = true;
+    _lastPresenceMs = 0;
 }
 
-void ReceiverRadioLink::tickAnnounce(uint32_t intervalMs) {
-    if (!_announcing)
+void ReceiverRadioLink::tickPresence(uint32_t intervalMs) {
+    if (!_presencing)
         return;
 
     const uint32_t now = millis();
-    if ((now - _lastAnnounceMs) >= intervalMs) {
-        sendAnnounce();
-        _lastAnnounceMs = now;
+    if ((now - _lastPresenceMs) >= intervalMs) {
+        sendPresencePacket();
+        _lastPresenceMs = now;
     }
 }
 
-void ReceiverRadioLink::sendAnnounce() {
-    AnnouncePacket pkt{};
-    fillHeader(pkt, PacketType::Announce);
+void ReceiverRadioLink::sendPresencePacket() {
+    ReceiverPresencePacket pkt{};
+    fillHeader(pkt, PacketType::ReceiverPresence);
     pkt.model_type = _modelType;
     esp_read_mac(pkt.mac, ESP_MAC_WIFI_STA);
     std::strncpy(pkt.name, _vehicleName, kVehicleNameMax - 1);
@@ -116,15 +121,41 @@ void ReceiverRadioLink::sendAnnounce() {
     esp_now_send(kBroadcastMac, reinterpret_cast<uint8_t *>(&pkt), sizeof(pkt));
 }
 
-void ReceiverRadioLink::stopAnnouncing() {
-    _announcing = false;
+void ReceiverRadioLink::stopPresence() {
+    _presencing = false;
     delPeer(kBroadcastMac);
 }
 
-void ReceiverRadioLink::resumeAnnouncing() {
+void ReceiverRadioLink::resumePresence() {
     addPeer(kBroadcastMac);
-    _announcing     = true;
-    _lastAnnounceMs = 0;
+    _presencing     = true;
+    _lastPresenceMs = 0;
+}
+
+// ── Discovery ───────────────────────────────────────────────────────────
+
+bool ReceiverRadioLink::sendDiscoveryRequest() {
+    if (!_ready)
+        return false;
+
+    addPeer(kBroadcastMac);
+
+    DiscoveryRequestPacket pkt{};
+    fillHeader(pkt, PacketType::DiscoveryRequest);
+    esp_read_mac(pkt.mac, ESP_MAC_WIFI_STA);
+    pkt.role = static_cast<uint8_t>(DeviceRole::Receiver);
+    setChecksum(pkt);
+
+    auto rc = esp_now_send(kBroadcastMac, reinterpret_cast<uint8_t *>(&pkt), sizeof(pkt));
+    return rc == ESP_OK;
+}
+
+void ReceiverRadioLink::onDiscoveryResponse(DiscoveryResponseCallback cb) {
+    _discoveryResponseCallback = std::move(cb);
+}
+
+void ReceiverRadioLink::onChannelMigration(ChannelMigrationCallback cb) {
+    _channelMigrationCallback = std::move(cb);
 }
 
 // ── Telemetry ───────────────────────────────────────────────────────────
@@ -168,7 +199,7 @@ bool ReceiverRadioLink::checkLinkTimeout(uint32_t timeoutMs) {
         std::memset(_txMac, 0, sizeof(_txMac));
         _bound         = false;
         _lastControlMs = 0;
-        resumeAnnouncing();
+        resumePresence();
         return true;
     }
     return false;
@@ -195,7 +226,7 @@ void ReceiverRadioLink::handleReceive(const uint8_t * /*mac*/, const uint8_t *da
 
     const auto type = static_cast<PacketType>(data[3]);
 
-    // ── Bind request from transmitter (while announcing) ────────────
+    // ── Bind request from transmitter (while presencing) ────────────
     if (type == PacketType::Bind && !_bound) {
         if (len < static_cast<int>(sizeof(BindPacket)))
             return;
@@ -213,7 +244,7 @@ void ReceiverRadioLink::handleReceive(const uint8_t * /*mac*/, const uint8_t *da
         esp_now_send(_txMac, reinterpret_cast<uint8_t *>(&reply), sizeof(reply));
 
         _bound = true;
-        stopAnnouncing();
+        stopPresence();
         return;
     }
 
@@ -226,7 +257,7 @@ void ReceiverRadioLink::handleReceive(const uint8_t * /*mac*/, const uint8_t *da
         std::memset(_txMac, 0, sizeof(_txMac));
         _bound         = false;
         _lastControlMs = 0;
-        resumeAnnouncing();
+        resumePresence();
         return;
     }
 
@@ -243,6 +274,29 @@ void ReceiverRadioLink::handleReceive(const uint8_t * /*mac*/, const uint8_t *da
         if (_controlCallback) {
             _controlCallback(*cp);
         }
+        return;
+    }
+
+    // ── DiscoveryResponse (during channel scanning) ────────────
+    if (type == PacketType::DiscoveryResponse) {
+        if (len < static_cast<int>(sizeof(DiscoveryResponsePacket)))
+            return;
+        const auto *dp = reinterpret_cast<const DiscoveryResponsePacket *>(data);
+        if (_discoveryResponseCallback) {
+            _discoveryResponseCallback(dp->channel, sPromiscRssi, dp->device_count);
+        }
+        return;
+    }
+
+    // ── ChannelMigration (transmitter is switching channels) ───
+    if (type == PacketType::ChannelMigration) {
+        if (len < static_cast<int>(sizeof(ChannelMigrationPacket)))
+            return;
+        const auto *mp = reinterpret_cast<const ChannelMigrationPacket *>(data);
+        if (_channelMigrationCallback) {
+            _channelMigrationCallback(mp->new_channel);
+        }
+        return;
     }
 }
 
diff --git a/firmware/lib/odh-radio/ReceiverRadioLink.h b/firmware/lib/odh-radio/ReceiverRadioLink.h
index 31a5f1b..248b803 100644
--- a/firmware/lib/odh-radio/ReceiverRadioLink.h
+++ b/firmware/lib/odh-radio/ReceiverRadioLink.h
@@ -23,7 +23,7 @@
  * ReceiverRadioLink – ESP-NOW radio link for the receiver side.
  *
  * Discovery-based connection model (receiver side):
- *   1. Receiver broadcasts AnnouncePacket periodically.
+ *   1. Receiver broadcasts ReceiverPresencePacket periodically.
  *   2. Transmitter selects this receiver and sends BindPacket.
  *   3. Receiver replies with its own BindPacket and stops announcing.
  *   4. Subsequent communication is directed (TX MAC <-> RX MAC).
@@ -44,92 +44,87 @@ namespace odh {
 class ReceiverRadioLink {
 public:
     ReceiverRadioLink();
-    ~ReceiverRadioLink() = default;
-
-    // Non-copyable, non-movable.
+    ~ReceiverRadioLink()                                    = default;
     ReceiverRadioLink(const ReceiverRadioLink &)            = delete;
     ReceiverRadioLink &operator=(const ReceiverRadioLink &) = delete;
 
-    /**
-     * Initialise WiFi in STA mode and start ESP-NOW.
-     *
-     * @param wifiChannel  WiFi channel to listen on (must match the transmitter).
-     * @param callback     Called when a valid control packet arrives.
-     * @return true on success.
-     */
-    bool begin(uint8_t wifiChannel, ControlCallback callback);
-
-    /**
-     * Begin periodic announce broadcasts.
-     *
-     * @param name       Vehicle name (max kVehicleNameMax chars).
-     * @param modelType  ModelType identifying this vehicle.
-     */
-    void beginAnnouncing(const char *name, uint8_t modelType);
-
-    /**
-     * Send one announce broadcast if enough time has elapsed.
-     * Call periodically from a FreeRTOS task.
-     */
-    void tickAnnounce(uint32_t intervalMs);
-
-    /// True if the receiver is currently announcing.
-    bool isAnnouncing() const {
-        return _announcing;
+    /// Initialize WiFi and ESP-NOW. Does NOT set channel yet.
+    bool begin(ControlCallback controlCallback);
+
+    /// Switch to a different WiFi channel at runtime.
+    bool setChannel(uint8_t channel);
+
+    /// Get the current WiFi channel.
+    uint8_t currentChannel() const {
+        return _wifiChannel;
     }
 
-    /**
-     * Send a telemetry packet to the bound transmitter.
-     */
-    bool sendTelemetry(uint16_t batteryMv, int8_t rssi, uint8_t linkState, uint8_t modelType, uint8_t modelFlags, const uint16_t *sensors, uint8_t sensorCount);
+    // ── Presence mode (replaces old announcing) ──────────────────
+
+    /// Configure presence parameters (call before beginPresence).
+    void configurePresence(const char *name, uint8_t modelType);
+
+    /// Start periodic presence broadcasts on the current channel.
+    void beginPresence();
+
+    /// Send one presence broadcast if enough time has elapsed.
+    void tickPresence(uint32_t intervalMs);
+
+    /// True if currently broadcasting presence.
+    bool isPresencing() const {
+        return _presencing;
+    }
+
+    // ── Discovery ───────────────────────────────────────────────
+
+    /// Send a DiscoveryRequest broadcast on the current channel.
+    bool sendDiscoveryRequest();
 
-    /// True if a transmitter is currently connected.
+    /// Register callback for DiscoveryResponse packets.
+    void onDiscoveryResponse(DiscoveryResponseCallback cb);
+
+    /// Register callback for ChannelMigration packets.
+    void onChannelMigration(ChannelMigrationCallback cb);
+
+    // ── Telemetry & link state ──────────────────────────────────
+
+    bool sendTelemetry(uint16_t batteryMv, int8_t rssi, uint8_t linkState, uint8_t modelType, uint8_t modelFlags, const uint16_t *sensors, uint8_t sensorCount);
     bool isBound() const {
         return _bound;
     }
-
-    /// Milliseconds since the last control packet was received.
     uint32_t msSinceLastControl() const;
-
-    /// RSSI (dBm) of the last received control packet.
     int8_t lastRssi() const {
         return _lastRssi;
     }
-
-    /**
-     * Check link timeout.  If no control packet for @p timeoutMs,
-     * automatically disconnects and resumes announcing.
-     *
-     * @return true if the link was dropped.
-     */
     bool checkLinkTimeout(uint32_t timeoutMs);
 
 private:
     bool _ready                        = false;
     bool _bound                        = false;
-    bool _announcing                   = false;
+    bool _presencing                   = false;
     uint8_t _txMac[6]                  = {};
     uint16_t _txSequence               = 0;
     uint32_t _lastControlMs            = 0;
-    uint32_t _lastAnnounceMs           = 0;
-    uint8_t _wifiChannel               = 1;
+    uint32_t _lastPresenceMs           = 0;
+    uint8_t _wifiChannel               = 0;
     uint8_t _modelType                 = 0;
     char _vehicleName[kVehicleNameMax] = {};
+
     ControlCallback _controlCallback;
+    DiscoveryResponseCallback _discoveryResponseCallback;
+    ChannelMigrationCallback _channelMigrationCallback;
     volatile int8_t _lastRssi = 0;
 
-    // ESP-NOW static callbacks
     static void onReceive(const uint8_t *mac, const uint8_t *data, int len);
     static void onSent(const uint8_t *mac, esp_now_send_status_t status);
-
     void handleReceive(const uint8_t *mac, const uint8_t *data, int len);
+
     bool addPeer(const uint8_t mac[6]);
     void delPeer(const uint8_t mac[6]);
-    void sendAnnounce();
-    void stopAnnouncing();
-    void resumeAnnouncing();
+    void sendPresencePacket();
+    void stopPresence();
+    void resumePresence();
 
-    // Active instance for static callback forwarding.
     static ReceiverRadioLink *sInstance;
 };
 
diff --git a/firmware/lib/odh-radio/TransmitterRadioLink.cpp b/firmware/lib/odh-radio/TransmitterRadioLink.cpp
index 4f4b19f..98dff1d 100644
--- a/firmware/lib/odh-radio/TransmitterRadioLink.cpp
+++ b/firmware/lib/odh-radio/TransmitterRadioLink.cpp
@@ -27,6 +27,10 @@
 #include <algorithm>
 #include <cstring>
 
+#ifndef NATIVE_SIM
+#include <esp_wifi.h>
+#endif
+
 namespace odh {
 
 TransmitterRadioLink *TransmitterRadioLink::sInstance = nullptr;
@@ -39,8 +43,7 @@ TransmitterRadioLink::TransmitterRadioLink() = default;
 
 // ── Initialisation ──────────────────────────────────────────────────────
 
-bool TransmitterRadioLink::begin(uint8_t wifiChannel, TelemetryCallback callback) {
-    _wifiChannel       = wifiChannel;
+bool TransmitterRadioLink::begin(TelemetryCallback callback) {
     _telemetryCallback = std::move(callback);
     sInstance          = this;
 
@@ -58,6 +61,73 @@ bool TransmitterRadioLink::begin(uint8_t wifiChannel, TelemetryCallback callback
     return true;
 }
 
+// ── Channel management ──────────────────────────────────────────────────
+
+bool TransmitterRadioLink::setChannel(uint8_t channel) {
+    _wifiChannel = channel;
+    esp_wifi_set_channel(channel, WIFI_SECOND_CHAN_NONE);
+    return true;
+}
+
+// ── Discovery ───────────────────────────────────────────────────────────
+
+bool TransmitterRadioLink::sendDiscoveryRequest() {
+    if (!_ready)
+        return false;
+
+    addPeer(kBroadcastMac);
+
+    DiscoveryRequestPacket pkt{};
+    fillHeader(pkt, PacketType::DiscoveryRequest);
+    esp_read_mac(pkt.mac, ESP_MAC_WIFI_STA);
+    pkt.role = static_cast<uint8_t>(DeviceRole::Transmitter);
+    setChecksum(pkt);
+
+    auto rc = esp_now_send(kBroadcastMac, reinterpret_cast<uint8_t *>(&pkt), sizeof(pkt));
+    return rc == ESP_OK;
+}
+
+bool TransmitterRadioLink::sendDiscoveryResponse(uint8_t channel) {
+    if (!_ready)
+        return false;
+
+    addPeer(kBroadcastMac);
+
+    DiscoveryResponsePacket pkt{};
+    fillHeader(pkt, PacketType::DiscoveryResponse);
+    esp_read_mac(pkt.mac, ESP_MAC_WIFI_STA);
+    pkt.channel      = channel;
+    pkt.device_count = _discoveredCount;
+    setChecksum(pkt);
+
+    auto rc = esp_now_send(kBroadcastMac, reinterpret_cast<uint8_t *>(&pkt), sizeof(pkt));
+    return rc == ESP_OK;
+}
+
+bool TransmitterRadioLink::sendChannelMigration(uint8_t newChannel) {
+    if (!_ready)
+        return false;
+
+    addPeer(kBroadcastMac);
+
+    ChannelMigrationPacket pkt{};
+    fillHeader(pkt, PacketType::ChannelMigration);
+    esp_read_mac(pkt.mac, ESP_MAC_WIFI_STA);
+    pkt.new_channel = newChannel;
+    setChecksum(pkt);
+
+    auto rc = esp_now_send(kBroadcastMac, reinterpret_cast<uint8_t *>(&pkt), sizeof(pkt));
+    return rc == ESP_OK;
+}
+
+void TransmitterRadioLink::onDiscoveryResponse(DiscoveryResponseCallback cb) {
+    _discoveryResponseCallback = std::move(cb);
+}
+
+void TransmitterRadioLink::onDiscoveryRequest(DiscoveryRequestCallback cb) {
+    _discoveryRequestCallback = std::move(cb);
+}
+
 // ── Scanning ────────────────────────────────────────────────────────────
 
 void TransmitterRadioLink::startScanning() {
@@ -190,12 +260,36 @@ void TransmitterRadioLink::handleReceive(const uint8_t * /*mac*/, const uint8_t
 
     const auto type = static_cast<PacketType>(data[3]);
 
-    // ── Announce packets (while scanning) ───────────────────────────
-    if (type == PacketType::Announce && _scanning) {
-        if (len < static_cast<int>(sizeof(AnnouncePacket)))
+    // ── DiscoveryRequest (answer if we're an active transmitter) ─
+    if (type == PacketType::DiscoveryRequest) {
+        if (len < static_cast<int>(sizeof(DiscoveryRequestPacket)))
+            return;
+        const auto *rp = reinterpret_cast<const DiscoveryRequestPacket *>(data);
+        if (_discoveryRequestCallback) {
+            _discoveryRequestCallback(rp->mac, static_cast<DeviceRole>(rp->role));
+        }
+        // Auto-reply with DiscoveryResponse
+        sendDiscoveryResponse(_wifiChannel);
+        return;
+    }
+
+    // ── DiscoveryResponse (from another transmitter during scan) ─
+    if (type == PacketType::DiscoveryResponse) {
+        if (len < static_cast<int>(sizeof(DiscoveryResponsePacket)))
+            return;
+        const auto *dp = reinterpret_cast<const DiscoveryResponsePacket *>(data);
+        if (_discoveryResponseCallback) {
+            _discoveryResponseCallback(dp->channel, _lastRssi, dp->device_count);
+        }
+        return;
+    }
+
+    // ── Presence packets (while not bound) ────────────────────────
+    if (type == PacketType::ReceiverPresence && !_bound) {
+        if (len < static_cast<int>(sizeof(ReceiverPresencePacket)))
             return;
 
-        const auto *ap = reinterpret_cast<const AnnouncePacket *>(data);
+        const auto *ap = reinterpret_cast<const ReceiverPresencePacket *>(data);
 
         // Update existing entry or add new one.
         for (uint8_t i = 0; i < _discoveredCount; i++) {
@@ -203,6 +297,7 @@ void TransmitterRadioLink::handleReceive(const uint8_t * /*mac*/, const uint8_t
                 _discovered[i].modelType  = ap->model_type;
                 _discovered[i].lastSeenMs = millis();
                 _discovered[i].rssi       = _lastRssi;
+                _discovered[i].channel    = _wifiChannel;
                 std::memset(_discovered[i].name, 0, kVehicleNameMax);
                 std::strncpy(_discovered[i].name, ap->name, kVehicleNameMax - 1);
                 return;
@@ -215,6 +310,7 @@ void TransmitterRadioLink::handleReceive(const uint8_t * /*mac*/, const uint8_t
             v.modelType  = ap->model_type;
             v.lastSeenMs = millis();
             v.rssi       = _lastRssi;
+            v.channel    = _wifiChannel;
             v.valid      = true;
             std::memset(v.name, 0, kVehicleNameMax);
             std::strncpy(v.name, ap->name, kVehicleNameMax - 1);
diff --git a/firmware/lib/odh-radio/TransmitterRadioLink.h b/firmware/lib/odh-radio/TransmitterRadioLink.h
index 7038770..18130eb 100644
--- a/firmware/lib/odh-radio/TransmitterRadioLink.h
+++ b/firmware/lib/odh-radio/TransmitterRadioLink.h
@@ -40,84 +40,70 @@ namespace odh {
 class TransmitterRadioLink {
 public:
     TransmitterRadioLink();
-    ~TransmitterRadioLink() = default;
-
-    // Non-copyable, non-movable.
+    ~TransmitterRadioLink()                                       = default;
     TransmitterRadioLink(const TransmitterRadioLink &)            = delete;
     TransmitterRadioLink &operator=(const TransmitterRadioLink &) = delete;
 
-    /**
-     * Initialise WiFi in STA mode and start ESP-NOW.
-     *
-     * @param wifiChannel  WiFi channel to use (1-13).
-     * @param callback     Called when a telemetry packet arrives.
-     * @return true on success.
-     */
-    bool begin(uint8_t wifiChannel, TelemetryCallback callback);
+    /// Initialize WiFi and ESP-NOW. Does NOT set channel yet.
+    bool begin(TelemetryCallback callback);
 
-    /// Enter scanning mode – listen for receiver announces.
-    void startScanning();
+    /// Switch to a different WiFi channel at runtime.
+    bool setChannel(uint8_t channel);
+
+    /// Get the current WiFi channel.
+    uint8_t currentChannel() const {
+        return _wifiChannel;
+    }
+
+    // ── Discovery ───────────────────────────────────────────────
+
+    /// Send a DiscoveryRequest broadcast (for finding other transmitters).
+    bool sendDiscoveryRequest();
+
+    /// Send a DiscoveryResponse (called when a DiscoveryRequest is received).
+    bool sendDiscoveryResponse(uint8_t channel);
 
-    /// True if currently scanning.
+    /// Send ChannelMigration notification before switching channels.
+    bool sendChannelMigration(uint8_t newChannel);
+
+    /// Register callback for DiscoveryResponse packets (from other TXs).
+    void onDiscoveryResponse(DiscoveryResponseCallback cb);
+
+    /// Register callback for DiscoveryRequest packets (auto-reply).
+    void onDiscoveryRequest(DiscoveryRequestCallback cb);
+
+    // ── Scanning (listen for receiver presence) ─────────────────
+
+    void startScanning();
     bool isScanning() const {
         return _scanning;
     }
 
-    /**
-     * Connect to a discovered vehicle by index.
-     * Sends a bind packet and waits up to @p timeoutMs for a reply.
-     *
-     * @return true if the connection was established.
-     */
-    bool connectTo(uint8_t index, uint32_t timeoutMs = 5000);
+    // ── Connect / Disconnect ────────────────────────────────────
 
-    /// Disconnect from the current receiver and resume scanning.
+    bool connectTo(uint8_t index, uint32_t timeoutMs = 5000);
     void disconnect();
-
-    /**
-     * Send a control packet to the connected receiver.
-     *
-     * @param functions  Array of function-value pairs.
-     * @param count      Number of entries (≤ kMaxFunctions).
-     * @param flags      Packet flags.
-     * @return true if ESP-NOW accepted the packet.
-     */
     bool sendControl(const FunctionValue *functions, uint8_t count, uint8_t flags = 0);
-
-    /// True if a receiver is currently connected.
     bool isBound() const {
         return _bound;
     }
-
-    /// True if the last sendControl() was acknowledged.
     bool lastSendOk() const {
         return _lastSendOk;
     }
-
-    /// RSSI of the last received packet (dBm).
     int8_t lastRssi() const {
         return _lastRssi;
     }
-
-    /// Copy the bound receiver's MAC address into @p out.
     void boundMac(uint8_t out[6]) const;
-
-    /// Sequence counter for the next outgoing control packet.
     uint16_t txSequence() const {
         return _txSequence;
     }
 
-    // ── Discovered vehicle list ─────────────────────────────────────
+    // ── Discovered vehicle list ─────────────────────────────────
 
-    /// Number of currently discovered vehicles.
     uint8_t discoveredCount() const {
         return _discoveredCount;
     }
-
-    /// Access a discovered vehicle by index (nullptr if out of range).
     const DiscoveredVehicle *discoveredVehicle(uint8_t index) const;
-
-    /// Remove stale vehicles not seen for @p timeoutMs.
     void pruneStaleVehicles(uint32_t timeoutMs);
 
 private:
@@ -128,19 +114,19 @@ class TransmitterRadioLink {
     int8_t _lastRssi     = 0;
     uint8_t _peerMac[6]  = {};
     uint16_t _txSequence = 0;
+    uint8_t _wifiChannel = 0;
+
     TelemetryCallback _telemetryCallback;
-    uint8_t _wifiChannel = 1;
+    DiscoveryResponseCallback _discoveryResponseCallback;
+    DiscoveryRequestCallback _discoveryRequestCallback;
 
     DiscoveredVehicle _discovered[kMaxDiscovered] = {};
     uint8_t _discoveredCount                      = 0;
 
-    // ESP-NOW static callbacks
     static void onReceive(const uint8_t *mac, const uint8_t *data, int len);
     static void onSent(const uint8_t *mac, esp_now_send_status_t status);
-
     void handleReceive(const uint8_t *mac, const uint8_t *data, int len);
     void handleSent(esp_now_send_status_t status);
-
     bool addPeer(const uint8_t mac[6]);
     void delPeer(const uint8_t mac[6]);
 
diff --git a/firmware/lib/odh-shell/ShellHelpers.cpp b/firmware/lib/odh-shell/ShellHelpers.cpp
new file mode 100644
index 0000000..c11e6e6
--- /dev/null
+++ b/firmware/lib/odh-shell/ShellHelpers.cpp
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2026 Peter Buchegger
+ *
+ * This file is part of OpenDriveHub.
+ *
+ * OpenDriveHub is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * OpenDriveHub is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with OpenDriveHub. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
+#include "ShellHelpers.h"
+
+#ifndef NATIVE_TEST
+
+#include <Arduino.h>
+
+#include <FunctionMap.h>
+#include <Shell.h>
+#include <cstring>
+
+namespace odh {
+
+void shellPrintName(Shell &shell, const char *prefix, NameView name) {
+#ifdef ODH_HAS_STRING_VIEW
+    shell.println("%s%.*s", prefix, static_cast<int>(name.size()), name.data());
+#else
+    shell.println("%s%s", prefix, name);
+#endif
+}
+
+bool shellParseModel(const char *str, ModelType &out) {
+    for (uint8_t m = 0; m < static_cast<uint8_t>(ModelType::Count); ++m) {
+        auto mn = modelName(static_cast<ModelType>(m));
+#ifdef ODH_HAS_STRING_VIEW
+        if (mn.size() > 0) {
+            bool match    = true;
+            const char *s = str;
+            for (size_t i = 0; i < mn.size(); ++i) {
+                if (*s == '\0' || (*s | 0x20) != (mn[i] | 0x20)) {
+                    match = false;
+                    break;
+                }
+                ++s;
+            }
+            if (match && *s == '\0') {
+                out = static_cast<ModelType>(m);
+                return true;
+            }
+        }
+#else
+        if (strcasecmp(str, mn) == 0) {
+            out = static_cast<ModelType>(m);
+            return true;
+        }
+#endif
+    }
+    return false;
+}
+
+void shellListModels(Shell &shell) {
+    shell.println("Available models:");
+    for (uint8_t m = 0; m < static_cast<uint8_t>(ModelType::Count); ++m) {
+        shellPrintName(shell, "  ", modelName(static_cast<ModelType>(m)));
+    }
+}
+
+void shellListFunctions(Shell &shell) {
+    shell.println("Available functions:");
+    for (uint8_t f = 0; f <= static_cast<uint8_t>(Function::TrackR); ++f) {
+        shellPrintName(shell, "  ", functionName(f));
+    }
+}
+
+// cppcheck-suppress constParameterCallback
+int cmdReboot(Shell &shell, int, const char *const *, void *) {
+#ifdef NATIVE_SIM
+    shell.println("Reboot not available in simulation");
+    return 1;
+#else
+    shell.println("Rebooting...");
+    delay(100);
+    ESP.restart();
+    return 0; // unreachable
+#endif
+}
+
+} // namespace odh
+
+#endif // NATIVE_TEST
diff --git a/firmware/lib/odh-shell/ShellHelpers.h b/firmware/lib/odh-shell/ShellHelpers.h
new file mode 100644
index 0000000..4917f1f
--- /dev/null
+++ b/firmware/lib/odh-shell/ShellHelpers.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2026 Peter Buchegger
+ *
+ * This file is part of OpenDriveHub.
+ *
+ * OpenDriveHub is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * OpenDriveHub is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with OpenDriveHub. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
+/**
+ * ShellHelpers.h – Shared helper functions for shell command handlers.
+ *
+ * These utilities are used by both receiver and transmitter shell commands
+ * and are therefore kept in the shared odh-shell library.
+ */
+
+#pragma once
+
+#ifndef NATIVE_TEST
+
+#include <FunctionMap.h>
+
+namespace odh {
+
+class Shell;
+
+/// Print a NameView through the shell with an optional prefix.
+void shellPrintName(Shell &shell, const char *prefix, NameView name);
+
+/// Parse a model name string (case-insensitive) into a ModelType.
+/// Returns true on success.
+bool shellParseModel(const char *str, ModelType &out);
+
+/// Print the list of available model names.
+void shellListModels(Shell &shell);
+
+/// Print the list of available function names.
+void shellListFunctions(Shell &shell);
+
+/// Common ``reboot`` command handler (shared by RX and TX).
+int cmdReboot(Shell &shell, int argc, const char *const *argv, void *ctx);
+
+} // namespace odh
+
+#endif // NATIVE_TEST
diff --git a/firmware/lib/odh-shell/library.json b/firmware/lib/odh-shell/library.json
new file mode 100644
index 0000000..5489929
--- /dev/null
+++ b/firmware/lib/odh-shell/library.json
@@ -0,0 +1,10 @@
+{
+  "name": "odh-shell",
+  "version": "1.0.0",
+  "description": "OpenDriveHub interactive shell (command registration, line editing, helpers)",
+  "dependencies": [
+    {
+      "name": "odh-protocol"
+    }
+  ]
+}
diff --git a/firmware/sim/include/WiFi.h b/firmware/sim/include/WiFi.h
index 6ff84b6..f1ddd10 100644
--- a/firmware/sim/include/WiFi.h
+++ b/firmware/sim/include/WiFi.h
@@ -27,9 +27,12 @@
 #define SIM_WIFI_H
 
 #include "Arduino.h"
+#include "esp_now.h"
 
 #include <cstdint>
 
+/* ── esp_wifi types (matching ESP-IDF) ──────────────────────────────────── */
+
 typedef enum {
     WIFI_STA,
     WIFI_AP,
@@ -37,6 +40,34 @@ typedef enum {
     WIFI_OFF,
 } wifi_mode_t;
 
+typedef enum {
+    WIFI_SECOND_CHAN_NONE = 0,
+} wifi_second_chan_t;
+
+typedef struct {
+    int8_t rssi;
+} wifi_pkt_rx_ctrl_t;
+
+typedef struct {
+    wifi_pkt_rx_ctrl_t rx_ctrl;
+    uint8_t payload[0];
+} wifi_promiscuous_pkt_t;
+
+typedef enum {
+    WIFI_PKT_MGMT = 0,
+    WIFI_PKT_CTRL,
+    WIFI_PKT_DATA,
+    WIFI_PKT_MISC,
+} wifi_promiscuous_pkt_type_t;
+
+typedef void (*wifi_promiscuous_cb_t)(void *buf, wifi_promiscuous_pkt_type_t type);
+
+/* ── esp_wifi API shim ──────────────────────────────────────────────────── */
+
+void esp_wifi_set_channel(uint8_t channel, wifi_second_chan_t secondary);
+void esp_wifi_set_promiscuous(bool enable);
+void esp_wifi_set_promiscuous_rx_cb(wifi_promiscuous_cb_t cb);
+
 class IPAddress {
     uint32_t _addr;
 
@@ -60,6 +91,9 @@ class WiFiClass {
     IPAddress softAPIP() {
         return IPAddress();
     }
+    uint8_t channel() {
+        return sim_get_wifi_channel();
+    }
 };
 
 extern WiFiClass WiFi;
diff --git a/firmware/sim/include/esp_now.h b/firmware/sim/include/esp_now.h
index 1a79e2d..edd3e81 100644
--- a/firmware/sim/include/esp_now.h
+++ b/firmware/sim/include/esp_now.h
@@ -22,11 +22,9 @@
 /**
  * esp_now.h – Simulation shim using UDP sockets.
  *
- * ESP-NOW packets are sent/received over localhost UDP:
- *   - Transmitter listens on port 6001, sends to port 6002
- *   - Receiver   listens on port 6002, sends to port 6001
- *
- * Compile with -DSIM_TX for the transmitter role or -DSIM_RX for receiver.
+ * Each WiFi channel maps to a shared UDP port (port = 7000 + channel).
+ * All devices on the same channel listen and send on the same port.
+ * Self-packets are filtered by comparing the source MAC.
  */
 
 #ifndef SIM_ESP_NOW_H
@@ -66,12 +64,14 @@ bool esp_now_is_peer_exist(const uint8_t *peer_addr);
 
 /* ── Simulation control ─────────────────────────────────────────────────── */
 
-#ifdef SIM_TX
-#define SIM_LISTEN_PORT 6001
-#define SIM_SEND_PORT 6002
-#else
-#define SIM_LISTEN_PORT 6002
-#define SIM_SEND_PORT 6001
-#endif
+/// Set the simulated WiFi channel. Switches the underlying UDP port.
+void sim_set_wifi_channel(uint8_t channel);
+
+/// Get the current simulated WiFi channel.
+uint8_t sim_get_wifi_channel();
+
+/// Set the simulated RSSI (dBm) for a specific WiFi channel.
+/// Use this to influence which channel the scanner prefers.
+void sim_set_channel_rssi(uint8_t channel, int8_t rssi);
 
 #endif /* SIM_ESP_NOW_H */
diff --git a/firmware/sim/sim_build.py b/firmware/sim/sim_build.py
index ed3bf84..fb80bfd 100644
--- a/firmware/sim/sim_build.py
+++ b/firmware/sim/sim_build.py
@@ -29,10 +29,14 @@
 import os
 
 sim_dir = os.path.abspath(os.path.join(env.subst("$PROJECT_DIR"), "sim"))
+lib_dir = os.path.abspath(os.path.join(env.subst("$PROJECT_DIR"), "lib"))
 
 # Add shim headers to the include path (highest priority).
 env.Prepend(CPPPATH=[os.path.join(sim_dir, "include")])
 
+# Add shared library headers needed by shim sources.
+env.Append(CPPPATH=[os.path.join(lib_dir, "odh-channel")])
+
 # Compile the shim source files as part of the build.
 env.BuildSources(
     os.path.join(env.subst("$BUILD_DIR"), "sim_shim"),
diff --git a/firmware/sim/src/sim_arduino.cpp b/firmware/sim/src/sim_arduino.cpp
index 00ce06d..d31e660 100644
--- a/firmware/sim/src/sim_arduino.cpp
+++ b/firmware/sim/src/sim_arduino.cpp
@@ -23,11 +23,14 @@
  * sim_arduino.cpp – Arduino API implementation for Linux simulation.
  */
 
+#include <esp_now.h>
+
 #include "Arduino.h"
 
 #include <chrono>
 #include <cstdio>
 #include <cstdlib>
+#include <cstring>
 #include <thread>
 #include <unistd.h>
 
@@ -166,12 +169,29 @@ int analogRead(uint8_t) {
 
 /* ── MAC address ────────────────────────────────────────────────────────── */
 
+/// Generate a per-process unique MAC address so that multiple simulation
+/// instances of the same role (e.g. two sim_tx) are distinguishable.
+/// The last two bytes are derived from the process ID.
 void esp_read_mac(uint8_t *mac, esp_mac_type_t) {
+    static uint8_t fakeMac[6] = {};
+    static bool initialised   = false;
+    if (!initialised) {
+        uint16_t pid = static_cast<uint16_t>(getpid());
 #ifdef SIM_TX
-    static const uint8_t fakeMac[6] = {0xAA, 0xBB, 0xCC, 0xDD, 0x01, 0x01};
+        fakeMac[0] = 0xAA;
+        fakeMac[1] = 0xBB;
+        fakeMac[2] = 0xCC;
+        fakeMac[3] = 0xDD;
 #else
-    static const uint8_t fakeMac[6] = {0xAA, 0xBB, 0xCC, 0xDD, 0x02, 0x01};
+        fakeMac[0] = 0xAA;
+        fakeMac[1] = 0xBB;
+        fakeMac[2] = 0xCC;
+        fakeMac[3] = 0xDE;
 #endif
+        fakeMac[4]  = static_cast<uint8_t>(pid >> 8);
+        fakeMac[5]  = static_cast<uint8_t>(pid & 0xFF);
+        initialised = true;
+    }
     memcpy(mac, fakeMac, 6);
 }
 
@@ -228,12 +248,36 @@ static void stdinReaderThread(int fd) {
     }
 }
 
-int main(int, char **) {
+/// Parse command-line arguments:
+///   --rssi <ch>:<dBm>[,<ch>:<dBm>]   Set simulated RSSI per channel
+static void parseArgs(int argc, char **argv) {
+    for (int i = 1; i < argc; ++i) {
+        if (std::strcmp(argv[i], "--rssi") == 0 && i + 1 < argc) {
+            ++i;
+            // Parse "ch:rssi" pairs, e.g. "6:-30" or "1:-45,6:-30,11:-70"
+            char *arg = argv[i];
+            while (arg && *arg) {
+                int ch = 0, rssi = 0;
+                if (std::sscanf(arg, "%d:%d", &ch, &rssi) == 2) {
+                    sim_set_channel_rssi(static_cast<uint8_t>(ch), static_cast<int8_t>(rssi));
+                    printf("[SIM] Channel %d RSSI set to %d dBm\n", ch, rssi);
+                }
+                // Advance to next comma-separated pair
+                char *comma = std::strchr(arg, ',');
+                arg         = comma ? comma + 1 : nullptr;
+            }
+        }
+    }
+}
+
+int main(int argc, char **argv) {
     /* Disable buffering on both stdout and stdin so the interactive shell
      * prompt, character echo and input are immediate. */
     setvbuf(stdout, nullptr, _IONBF, 0);
     setvbuf(stdin, nullptr, _IONBF, 0);
 
+    parseArgs(argc, argv);
+
     int inputFd = STDIN_FILENO;
 #ifdef HAS_TERMIOS
     inputFd = openTerminalInput();
diff --git a/firmware/sim/src/sim_espnow.cpp b/firmware/sim/src/sim_espnow.cpp
index 11777d7..3f0f815 100644
--- a/firmware/sim/src/sim_espnow.cpp
+++ b/firmware/sim/src/sim_espnow.cpp
@@ -20,15 +20,26 @@
  */
 
 /**
- * sim_espnow.cpp – ESP-NOW over UDP sockets.
+ * sim_espnow.cpp – ESP-NOW over UDP multicast sockets.
  *
- * Each simulated device listens on its own port (TX=6001, RX=6002) and
- * sends to the other's port.  Packets include a 6-byte source MAC header
- * prepended to the original payload so the receive callback gets the
- * sender's address.
+ * Each WiFi channel maps to a UDP multicast group and port:
+ *   channel 1  → 239.0.0.1:7001
+ *   channel 6  → 239.0.0.6:7006
+ *   channel 11 → 239.0.0.11:7011
+ *
+ * Using multicast ensures that every process on the same channel receives
+ * every packet (fan-out), unlike SO_REUSEPORT unicast which only delivers
+ * to one socket.  The receive thread is stopped and restarted whenever the
+ * channel changes so the socket is never accessed concurrently with rebind.
+ *
+ * Packets include a 6-byte source MAC header prepended to the original
+ * payload so the receive callback gets the sender's address.
+ * Self-packets are filtered by comparing the source MAC.
  */
 
 #include "Arduino.h"
+#include "Channel.h"
+#include "WiFi.h"
 #include "esp_now.h"
 
 #include <arpa/inet.h>
@@ -56,57 +67,112 @@ struct PeerEntry {
 static std::vector<PeerEntry> s_peers;
 static std::mutex s_peerMutex;
 
-static uint8_t s_localMac[6] = {};
+static uint8_t s_localMac[6]    = {};
+static uint8_t s_currentChannel = 1;
 
-/* ── Listener thread ────────────────────────────────────────────────────── */
+/// Per-channel simulated RSSI values (indexed by channel number).
+/// Default is -50 dBm for all channels.
+static int8_t s_channelRssi[16] = {-50, -50, -50, -50, -50, -50, -50, -50, -50, -50, -50, -50, -50, -50, -50, -50};
 
-static void *recvLoop(void *) {
-    uint8_t buf[6 + ESP_NOW_MAX_DATA_LEN]; /* [mac(6)] [payload] */
-    while (s_running) {
-        ssize_t n = recvfrom(s_sock, buf, sizeof(buf), 0, nullptr, nullptr);
-        if (n > 6 && s_recvCb) {
-            s_recvCb(buf, buf + 6, static_cast<int>(n - 6));
-        }
-    }
-    return nullptr;
+static wifi_promiscuous_cb_t s_promiscCb = nullptr;
+static bool s_promiscEnabled             = false;
+
+/* ── Multicast helper ───────────────────────────────────────────────────── */
+
+/// Returns the multicast group IPv4 address for the given channel in host
+/// byte order: channel ch → 239.0.0.ch.
+/// Valid input channels are 1, 6, and 11 (see channel::kCandidateChannels).
+static inline uint32_t channelMulticastIp(uint8_t ch) {
+    return (239u << 24) | static_cast<uint32_t>(ch);
 }
 
-/* ── ESP-NOW API ────────────────────────────────────────────────────────── */
+/* ── Socket helper ──────────────────────────────────────────────────────── */
+
+static void rebindSocket() {
+    if (s_sock >= 0) {
+        close(s_sock);
+        s_sock = -1;
+    }
 
-int esp_now_init() {
-    /* Create a UDP socket bound to the listen port. */
     s_sock = socket(AF_INET, SOCK_DGRAM, 0);
     if (s_sock < 0) {
         perror("[SIM] socket");
-        return ESP_FAIL;
+        return;
     }
 
     int opt = 1;
     setsockopt(s_sock, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt));
 
+    uint16_t port = odh::channel::channelToSimPort(s_currentChannel);
+
+    // Bind to INADDR_ANY so multicast packets addressed to the group are received.
     struct sockaddr_in addr{};
     addr.sin_family      = AF_INET;
-    addr.sin_port        = htons(SIM_LISTEN_PORT);
-    addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+    addr.sin_port        = htons(port);
+    addr.sin_addr.s_addr = htonl(INADDR_ANY);
 
     if (bind(s_sock, reinterpret_cast<sockaddr *>(&addr), sizeof(addr)) < 0) {
         perror("[SIM] bind");
         close(s_sock);
         s_sock = -1;
-        return ESP_FAIL;
+        return;
+    }
+
+    // Join the multicast group for this channel on the loopback interface.
+    struct ip_mreq mreq{};
+    mreq.imr_multiaddr.s_addr = htonl(channelMulticastIp(s_currentChannel));
+    mreq.imr_interface.s_addr = htonl(INADDR_LOOPBACK);
+    if (setsockopt(s_sock, IPPROTO_IP, IP_ADD_MEMBERSHIP, &mreq, sizeof(mreq)) < 0) {
+        perror("[SIM] IP_ADD_MEMBERSHIP");
     }
 
-    /* Set a receive timeout so the thread can check s_running. */
-    struct timeval tv{.tv_sec = 0, .tv_usec = 100000}; /* 100 ms */
+    // Ensure multicast packets are sent via the loopback interface.
+    struct in_addr iface{};
+    iface.s_addr = htonl(INADDR_LOOPBACK);
+    setsockopt(s_sock, IPPROTO_IP, IP_MULTICAST_IF, &iface, sizeof(iface));
+
+    struct timeval tv{.tv_sec = 0, .tv_usec = 100000};
     setsockopt(s_sock, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
 
+    printf("[SIM] Channel %u → UDP multicast 239.0.0.%u:%u\n", s_currentChannel, s_currentChannel, port);
+}
+
+/* ── Listener thread ────────────────────────────────────────────────────── */
+
+static void *recvLoop(void *) {
+    uint8_t buf[6 + ESP_NOW_MAX_DATA_LEN]; /* [mac(6)] [payload] */
+    while (s_running) {
+        ssize_t n = recvfrom(s_sock, buf, sizeof(buf), 0, nullptr, nullptr);
+        if (n > 6 && s_recvCb) {
+            if (memcmp(buf, s_localMac, 6) == 0)
+                continue;
+            // Fire the promiscuous callback before the ESP-NOW callback,
+            // exactly mirroring real ESP32 behaviour.  This lets the
+            // radio layer read RSSI via the normal promiscRxCb path.
+            if (s_promiscEnabled && s_promiscCb) {
+                wifi_promiscuous_pkt_t pkt{};
+                pkt.rx_ctrl.rssi = s_channelRssi[s_currentChannel];
+                s_promiscCb(&pkt, WIFI_PKT_DATA);
+            }
+            s_recvCb(buf, buf + 6, static_cast<int>(n - 6));
+        }
+    }
+    return nullptr;
+}
+
+/* ── ESP-NOW API ────────────────────────────────────────────────────────── */
+
+int esp_now_init() {
     esp_read_mac(s_localMac, ESP_MAC_WIFI_STA);
 
+    rebindSocket();
+    if (s_sock < 0)
+        return ESP_FAIL;
+
     /* Start the listener thread. */
     s_running = true;
     pthread_create(&s_recvThread, nullptr, recvLoop, nullptr);
 
-    printf("[SIM] ESP-NOW init OK – listening on port %d, sending to port %d\n", SIM_LISTEN_PORT, SIM_SEND_PORT);
     return ESP_OK;
 }
 
@@ -140,10 +206,11 @@ int esp_now_send(const uint8_t *peer_addr, const uint8_t *data, int len) {
     int copyLen = len < ESP_NOW_MAX_DATA_LEN ? len : ESP_NOW_MAX_DATA_LEN;
     memcpy(buf + 6, data, copyLen);
 
+    // Send to the multicast group for the current channel.
     struct sockaddr_in dest{};
     dest.sin_family      = AF_INET;
-    dest.sin_port        = htons(SIM_SEND_PORT);
-    dest.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+    dest.sin_port        = htons(odh::channel::channelToSimPort(s_currentChannel));
+    dest.sin_addr.s_addr = htonl(channelMulticastIp(s_currentChannel));
 
     ssize_t sent = sendto(s_sock, buf, 6 + copyLen, 0, reinterpret_cast<sockaddr *>(&dest), sizeof(dest));
 
@@ -191,3 +258,56 @@ bool esp_now_is_peer_exist(const uint8_t *peer_addr) {
     }
     return false;
 }
+
+/* ── Channel switching ──────────────────────────────────────────────────── */
+
+void sim_set_wifi_channel(uint8_t channel) {
+    if (s_currentChannel == channel)
+        return;
+
+    // If the recv thread is running, stop it before touching the socket.
+    // pthread_join guarantees the thread has exited before we rebind.
+    const bool wasRunning = s_running;
+    if (wasRunning) {
+        s_running = false;
+        if (pthread_join(s_recvThread, nullptr) != 0) {
+            perror("[SIM] pthread_join failed during channel switch");
+        }
+    }
+
+    s_currentChannel = channel;
+
+    if (wasRunning) {
+        rebindSocket();
+        if (s_sock >= 0) {
+            s_running = true;
+            pthread_create(&s_recvThread, nullptr, recvLoop, nullptr);
+        } else {
+            fprintf(stderr, "[SIM] rebindSocket failed during channel switch to %u\n", channel);
+        }
+    }
+}
+
+uint8_t sim_get_wifi_channel() {
+    return s_currentChannel;
+}
+
+void sim_set_channel_rssi(uint8_t channel, int8_t rssi) {
+    if (channel < 16) {
+        s_channelRssi[channel] = rssi;
+    }
+}
+
+/* ── esp_wifi API shim ───────────────────────────────────────────────────── */
+
+void esp_wifi_set_channel(uint8_t channel, wifi_second_chan_t /*secondary*/) {
+    sim_set_wifi_channel(channel);
+}
+
+void esp_wifi_set_promiscuous(bool enable) {
+    s_promiscEnabled = enable;
+}
+
+void esp_wifi_set_promiscuous_rx_cb(wifi_promiscuous_cb_t cb) {
+    s_promiscCb = cb;
+}
diff --git a/firmware/src/receiver/ReceiverApp.cpp b/firmware/src/receiver/ReceiverApp.cpp
index 61c624f..5944f66 100644
--- a/firmware/src/receiver/ReceiverApp.cpp
+++ b/firmware/src/receiver/ReceiverApp.cpp
@@ -23,6 +23,8 @@
 
 #include <Arduino.h>
 
+#include <Channel.h>
+#include <ChannelScanner.h>
 #include <Shell.h>
 #include <cstring>
 
@@ -92,20 +94,31 @@ void ReceiverApp::begin() {
     _channelsMux = xSemaphoreCreateMutex();
 
     // ── Radio ───────────────────────────────────────────────────────
-    {
-        NvsStore store("odh", true);
-        const uint8_t wifiCh = store.getU8("radio_ch", config::kRadioWifiChannel);
-
-        if (!_radio.begin(wifiCh, [this](const ControlPacket &pkt) { onControlReceived(pkt); })) {
-            Serial.println(F("[ODH-RX] Radio init failed – halting"));
-            while (true)
-                delay(1000);
-        }
+    if (!_radio.begin([this](const ControlPacket &pkt) { onControlReceived(pkt); })) {
+        Serial.println(F("[ODH-RX] Radio init failed – halting"));
+        while (true)
+            delay(1000);
     }
     Serial.println(F("[ODH-RX] Radio (ESP-NOW) OK"));
 
-    _radio.beginAnnouncing(_vehicleName, static_cast<uint8_t>(_output.modelType()));
-    Serial.print(F("[ODH-RX] Announcing vehicle: "));
+    // Register channel migration callback
+    _radio.onChannelMigration([this](uint8_t newChannel) { onChannelMigration(newChannel); });
+
+    // Configure presence parameters (but don't start yet)
+    _radio.configurePresence(_vehicleName, static_cast<uint8_t>(_output.modelType()));
+
+    // Run channel discovery to find an active transmitter
+    runChannelDiscovery();
+
+    // Re-register DiscoveryResponse callback for ongoing TX activity tracking
+    _radio.onDiscoveryResponse([this](uint8_t /*ch*/, int8_t /*rssi*/, uint8_t /*devCount*/) {
+        _lastTransmitterActivityMs = millis();
+        _discoveryComplete         = true;
+    });
+
+    Serial.print(F("[ODH-RX] Active on channel "));
+    Serial.println(_currentChannel);
+    Serial.print(F("[ODH-RX] Presence broadcast: "));
     Serial.println(_vehicleName);
 
     // ── Web server + API ────────────────────────────────────────────
@@ -186,7 +199,7 @@ void ReceiverApp::runTelemetryLoop() {
     for (;;) {
         if (_radio.isBound()) {
             if (_radio.checkLinkTimeout(config::kRadioLinkTimeoutMs)) {
-                Serial.println(F("[ODH-RX] Link timeout – resuming announce"));
+                Serial.println(F("[ODH-RX] Link timeout – resuming presence"));
             }
 
             _battery.sample();
@@ -195,7 +208,18 @@ void ReceiverApp::runTelemetryLoop() {
 
             _radio.sendTelemetry(_battery.voltageMv(), _radio.lastRssi(), linkState, static_cast<uint8_t>(_output.modelType()), 0, nullptr, 0);
         } else {
-            _radio.tickAnnounce(config::rx::kAnnounceIntervalMs);
+            _radio.tickPresence(channel::kPresenceIntervalMs);
+
+            // Periodically send a DiscoveryRequest as a heartbeat so the TX
+            // replies with DiscoveryResponse, keeping our activity tracker
+            // alive and preventing spurious transmitter-loss detection.
+            const uint32_t now = millis();
+            if (_discoveryComplete && (now - _lastHeartbeatMs) >= channel::kTransmitterLossTimeoutMs / 2) {
+                _radio.sendDiscoveryRequest();
+                _lastHeartbeatMs = now;
+            }
+
+            checkTransmitterLoss();
         }
 
         vTaskDelay(pdMS_TO_TICKS(config::rx::kTelemetrySendIntervalMs));
@@ -212,6 +236,122 @@ void ReceiverApp::runWebLoop() {
     }
 }
 
+// ── Channel discovery ───────────────────────────────────────────────────
+
+void ReceiverApp::runChannelDiscovery() {
+    // Wire up the ChannelScanner callbacks to our radio layer
+    ChannelScanner scanner([this](uint8_t ch) -> bool { return _radio.setChannel(ch); }, [this](uint8_t /*ch*/) -> bool { return _radio.sendDiscoveryRequest(); }, [](uint32_t ms) { delay(ms); });
+
+    // Forward DiscoveryResponse to the scanner.
+    // The RAII guard below clears this callback when the function returns,
+    // preventing a dangling reference to the stack-local scanner.
+    _radio.onDiscoveryResponse([&scanner](uint8_t ch, int8_t rssi, uint8_t devCount) { scanner.onDiscoveryResponse(ch, rssi, devCount); });
+    struct DiscoveryResponseGuard {
+        ReceiverRadioLink &radio;
+        ~DiscoveryResponseGuard() {
+            radio.onDiscoveryResponse(nullptr);
+        }
+    } cbGuard{_radio};
+
+    // Step 1: Try last known channel from NVS
+    uint8_t lastCh = loadChannel();
+    if (channel::isValidChannel(lastCh)) {
+        Serial.printf("[ODH-RX] Trying last known channel %u...\n", lastCh);
+        ScanResult result = scanner.scanChannel(lastCh);
+        if (result.foundTransmitter) {
+            _currentChannel = lastCh;
+            _radio.setChannel(lastCh);
+            _lastTransmitterActivityMs = millis();
+            _radio.beginPresence();
+            _discoveryComplete = true;
+            Serial.printf("[ODH-RX] Transmitter found on saved channel %u\n", lastCh);
+            return;
+        }
+    }
+
+    // Step 2: Scan all candidate channels
+    Serial.println(F("[ODH-RX] Scanning channels 1, 6, 11..."));
+    ScanResult results[channel::kCandidateChannelCount];
+    scanner.scanAllChannels(results);
+
+    for (uint8_t i = 0; i < channel::kCandidateChannelCount; ++i) {
+        if (results[i].foundTransmitter) {
+            _currentChannel = results[i].channel;
+            _radio.setChannel(results[i].channel);
+            saveChannel(results[i].channel);
+            _lastTransmitterActivityMs = millis();
+            _radio.beginPresence();
+            _discoveryComplete = true;
+            Serial.printf("[ODH-RX] Transmitter found on channel %u\n", results[i].channel);
+            return;
+        }
+    }
+
+    // Step 3: No transmitter found – stay on default channel and keep trying
+    _currentChannel = channel::kDefaultChannel;
+    _radio.setChannel(channel::kDefaultChannel);
+    _radio.beginPresence();
+    _discoveryComplete = false;
+    Serial.println(F("[ODH-RX] No transmitter found – will retry"));
+}
+
+uint8_t ReceiverApp::loadChannel() {
+    NvsStore store("odh", true);
+    uint8_t ch = store.getU8("radio_ch", 0);
+    if (channel::isValidChannel(ch))
+        return ch;
+    return channel::kDefaultChannel;
+}
+
+void ReceiverApp::saveChannel(uint8_t ch) {
+    if (!channel::isValidChannel(ch))
+        return;
+    NvsStore store("odh", false);
+    store.putU8("radio_ch", ch);
+}
+
+// ── Channel migration callback ─────────────────────────────────────────
+
+void ReceiverApp::onChannelMigration(uint8_t newChannel) {
+    if (!channel::isValidChannel(newChannel))
+        return;
+    Serial.printf("[ODH-RX] Channel migration → %u\n", newChannel);
+    _radio.setChannel(newChannel);
+    _currentChannel = newChannel;
+    saveChannel(newChannel);
+    _lastTransmitterActivityMs = millis();
+}
+
+// ── Transmitter loss detection ──────────────────────────────────────────
+
+void ReceiverApp::checkTransmitterLoss() {
+    // Only check if we've completed initial discovery and are not bound
+    if (_radio.isBound()) {
+        _lastTransmitterActivityMs = millis();
+        return;
+    }
+
+    // If we haven't heard from any transmitter in a while, re-enter discovery
+    if (_discoveryComplete && (millis() - _lastTransmitterActivityMs) > channel::kTransmitterLossTimeoutMs) {
+        Serial.println(F("[ODH-RX] Transmitter lost \xe2\x80\x93 re-entering discovery"));
+        _discoveryComplete = false;
+    }
+
+    // If not discovery complete, periodically retry discovery
+    if (!_discoveryComplete) {
+        runChannelDiscovery();
+
+        // runChannelDiscovery's RAII guard clears the onDiscoveryResponse
+        // callback (to avoid dangling references to the stack-local scanner).
+        // Re-register the persistent callback so TX activity continues to
+        // be tracked between discovery rounds.
+        _radio.onDiscoveryResponse([this](uint8_t /*ch*/, int8_t /*rssi*/, uint8_t /*devCount*/) {
+            _lastTransmitterActivityMs = millis();
+            _discoveryComplete         = true;
+        });
+    }
+}
+
 // ── Shell loop ──────────────────────────────────────────────────────────
 
 void ReceiverApp::runShellLoop() {
diff --git a/firmware/src/receiver/ReceiverApp.h b/firmware/src/receiver/ReceiverApp.h
index daac5a3..bfe3d9a 100644
--- a/firmware/src/receiver/ReceiverApp.h
+++ b/firmware/src/receiver/ReceiverApp.h
@@ -44,6 +44,7 @@
 #include "Shell.h"
 #include "web/ReceiverApi.h"
 
+#include <ChannelScanner.h>
 #include <freertos/FreeRTOS.h>
 #include <freertos/semphr.h>
 #include <freertos/task.h>
@@ -92,6 +93,12 @@ class ReceiverApp {
     bool _failsafeActive           = false;
     bool _webConfigMode            = false;
 
+    // Channel discovery state.
+    uint8_t _currentChannel             = 0;
+    bool _discoveryComplete             = false;
+    uint32_t _lastTransmitterActivityMs = 0;
+    uint32_t _lastHeartbeatMs           = 0;
+
     // Vehicle config (loaded from NVS).
     char _vehicleName[kVehicleNameMax] = {};
 
@@ -109,6 +116,17 @@ class ReceiverApp {
     void runWebLoop();
     void runShellLoop();
 
+    // Channel discovery methods.
+    void runChannelDiscovery();
+    void saveChannel(uint8_t channel);
+    uint8_t loadChannel();
+
+    // Transmitter loss detection + rediscovery.
+    void checkTransmitterLoss();
+
+    // Callback for channel migration notification.
+    void onChannelMigration(uint8_t newChannel);
+
     /// Load vehicle name from NVS.
     void loadVehicleName();
     void saveVehicleName();
diff --git a/firmware/src/receiver/shell/ReceiverShellCmds.h b/firmware/src/receiver/shell/ReceiverShellCmds.h
new file mode 100644
index 0000000..4c7a18b
--- /dev/null
+++ b/firmware/src/receiver/shell/ReceiverShellCmds.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2026 Peter Buchegger
+ *
+ * This file is part of OpenDriveHub.
+ *
+ * OpenDriveHub is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * OpenDriveHub is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with OpenDriveHub. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
+/**
+ * ReceiverShellCmds.h – Internal declarations for receiver shell command
+ * handler functions.  Each handler lives in its own translation unit
+ * (cmd_status.cpp, cmd_channel.cpp, cmd_config.cpp, cmd_output.cpp).
+ *
+ * This header is NOT part of the public API – only
+ * ReceiverShellCommands.cpp includes it.
+ */
+
+#pragma once
+
+#include <Shell.h>
+
+namespace odh {
+
+// cmd_status.cpp
+int rxCmdStatus(Shell &shell, int argc, const char *const *argv, void *ctx);
+
+// cmd_channel.cpp
+int rxCmdChannel(Shell &shell, int argc, const char *const *argv, void *ctx);
+int rxCmdVehicle(Shell &shell, int argc, const char *const *argv, void *ctx);
+
+// cmd_config.cpp
+int rxCmdConfig(Shell &shell, int argc, const char *const *argv, void *ctx);
+
+// cmd_output.cpp
+int rxCmdMapping(Shell &shell, int argc, const char *const *argv, void *ctx);
+int rxCmdFailsafe(Shell &shell, int argc, const char *const *argv, void *ctx);
+
+} // namespace odh
diff --git a/firmware/src/receiver/shell/ReceiverShellCommands.cpp b/firmware/src/receiver/shell/ReceiverShellCommands.cpp
index 220cc6f..b0f7963 100644
--- a/firmware/src/receiver/shell/ReceiverShellCommands.cpp
+++ b/firmware/src/receiver/shell/ReceiverShellCommands.cpp
@@ -19,174 +19,35 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  */
 
+/**
+ * ReceiverShellCommands – registration façade.
+ *
+ * The actual command handlers live in separate translation units:
+ *   cmd_status.cpp   – status
+ *   cmd_channel.cpp  – channel, vehicle
+ *   cmd_config.cpp   – config
+ *   cmd_output.cpp   – mapping, failsafe
+ *
+ * The shared ``reboot`` handler comes from ShellHelpers (lib/odh-shell).
+ */
+
 #include "ReceiverShellCommands.h"
 
-#include "../ReceiverApp.h"
+#include "ReceiverShellCmds.h"
 
-#include <Config.h>
-#include <FunctionMap.h>
-#include <NvsStore.h>
 #include <Shell.h>
-#include <cstdlib>
-#include <cstring>
+#include <ShellHelpers.h>
 
 namespace odh {
 
-// ── status ──────────────────────────────────────────────────────────────
-
-static int cmdStatus(Shell &shell, int, const char *const *, void *ctx) {
-    auto &app = *static_cast<ReceiverApp *>(ctx);
-
-    const char *linkStr = app.radio().isBound() ? "connected" : "announcing";
-    shell.println("Link:     %s", linkStr);
-
-    if (app.radio().isBound()) {
-        shell.println("RSSI:     %d dBm", app.radio().lastRssi());
-        shell.println("Last pkt: %lu ms ago", static_cast<unsigned long>(app.radio().msSinceLastControl()));
-    }
-
-    shell.println("Battery:  %u mV (%uS)", app.battery().voltageMv(), app.battery().cells());
-
-    auto mn = modelName(app.output().modelType());
-#ifdef ODH_HAS_STRING_VIEW
-    shell.println("Model:    %.*s", static_cast<int>(mn.size()), mn.data());
-#else
-    shell.println("Model:    %s", mn);
-#endif
-
-    shell.println("Vehicle:  %s", app.vehicleName());
-    return 0;
-}
-
-// ── channel ─────────────────────────────────────────────────────────────
-
-static int cmdChannel(Shell &shell, int argc, const char *const *argv, void *ctx) {
-    auto &app = *static_cast<ReceiverApp *>(ctx);
-
-    if (argc < 2) {
-        shell.println("Usage: channel <list|set>");
-        return 1;
-    }
-
-    if (strcmp(argv[1], "list") == 0) {
-        const auto &vals = app.output().channelValues();
-        for (uint8_t i = 0; i < config::rx::kChannelCount; ++i) {
-            shell.println("  CH%u: %u us", i, vals[i]);
-        }
-        return 0;
-    }
-
-    if (strcmp(argv[1], "set") == 0) {
-        if (argc < 4) {
-            shell.println("Usage: channel set <ch> <us>");
-            return 1;
-        }
-        int ch = atoi(argv[2]);
-        int us = atoi(argv[3]);
-        if (ch < 0 || ch >= config::rx::kChannelCount) {
-            shell.println("Channel %d out of range (0-%d)", ch, config::rx::kChannelCount - 1);
-            return 1;
-        }
-        if (us < kChannelMin || us > kChannelMax) {
-            shell.println("Value %d out of range (%d-%d)", us, kChannelMin, kChannelMax);
-            return 1;
-        }
-        app.output().setChannel(static_cast<uint8_t>(ch), static_cast<uint16_t>(us));
-        shell.println("CH%d = %d us", ch, us);
-        return 0;
-    }
-
-    shell.println("Unknown sub-command: %s", argv[1]);
-    return 1;
-}
-
-// ── config ──────────────────────────────────────────────────────────────
-
-static int cmdConfig(Shell &shell, int argc, const char *const *argv, void *ctx) {
-    auto &app = *static_cast<ReceiverApp *>(ctx);
-
-    if (argc < 2) {
-        shell.println("Usage: config <get|set>");
-        return 1;
-    }
-
-    if (strcmp(argv[1], "get") == 0) {
-        NvsStore store("odh", true);
-        shell.println("  radio_ch:  %u", store.getU8("radio_ch", config::kRadioWifiChannel));
-
-        auto mn = modelName(app.output().modelType());
-#ifdef ODH_HAS_STRING_VIEW
-        shell.println("  model:     %.*s", static_cast<int>(mn.size()), mn.data());
-#else
-        shell.println("  model:     %s", mn);
-#endif
-
-        shell.println("  vehicle:   %s", app.vehicleName());
-        shell.println("  batt_cell: %u", app.battery().cells());
-        return 0;
-    }
-
-    if (strcmp(argv[1], "set") == 0) {
-        if (argc < 4) {
-            shell.println("Usage: config set <key> <value>");
-            shell.println("  Keys: radio_ch, model, batt_cell");
-            return 1;
-        }
-
-        if (strcmp(argv[2], "radio_ch") == 0) {
-            int ch = atoi(argv[3]);
-            if (ch < 1 || ch > 13) {
-                shell.println("Channel must be 1-13");
-                return 1;
-            }
-            NvsStore store("odh", false);
-            store.putU8("radio_ch", static_cast<uint8_t>(ch));
-            shell.println("radio_ch = %d (restart required)", ch);
-            return 0;
-        }
-
-        if (strcmp(argv[2], "batt_cell") == 0) {
-            int cells = atoi(argv[3]);
-            if (cells < 0 || cells > 6) {
-                shell.println("Cell count must be 0-6 (0 = auto)");
-                return 1;
-            }
-            NvsStore store("odh", false);
-            store.putU8("batt_cell", static_cast<uint8_t>(cells));
-            shell.println("batt_cell = %d", cells);
-            return 0;
-        }
-
-        shell.println("Unknown key: %s", argv[2]);
-        return 1;
-    }
-
-    shell.println("Unknown sub-command: %s", argv[1]);
-    return 1;
-}
-
-// ── vehicle ─────────────────────────────────────────────────────────────
-
-static int cmdVehicle(Shell &shell, int argc, const char *const *argv, void *ctx) {
-    auto &app = *static_cast<ReceiverApp *>(ctx);
-
-    if (argc < 2) {
-        shell.println("Vehicle: %s", app.vehicleName());
-        return 0;
-    }
-
-    app.setVehicleName(argv[1]);
-    shell.println("Vehicle name set to: %s", app.vehicleName());
-    return 0;
-}
-
-// ── Registration ────────────────────────────────────────────────────────
-
 void registerReceiverShellCommands(Shell &shell, ReceiverApp &app) {
-    shell.registerCommand("status", "Show link, battery and vehicle info", cmdStatus, &app);
-    shell.registerCommand("channel", "Channel ops: list, set <ch> <us>", cmdChannel, &app);
-    shell.registerCommand("config", "Config ops: get, set <key> <val>", cmdConfig, &app);
-    shell.registerCommand("vehicle", "Get/set vehicle name", cmdVehicle, &app);
+    shell.registerCommand("status", "Show link, battery and vehicle info", rxCmdStatus, &app);
+    shell.registerCommand("channel", "Channel ops: get, set <ch> <us>", rxCmdChannel, &app);
+    shell.registerCommand("config", "Config ops: get, set, help, reset", rxCmdConfig, &app);
+    shell.registerCommand("vehicle", "Get/set vehicle name", rxCmdVehicle, &app);
+    shell.registerCommand("mapping", "Function map: get, help, reset", rxCmdMapping, &app);
+    shell.registerCommand("failsafe", "Failsafe: get, set <ch> <us>", rxCmdFailsafe, &app);
+    shell.registerCommand("reboot", "Restart the device", cmdReboot, nullptr);
 }
 
 } // namespace odh
diff --git a/firmware/src/receiver/shell/cmd_channel.cpp b/firmware/src/receiver/shell/cmd_channel.cpp
new file mode 100644
index 0000000..b2b3a07
--- /dev/null
+++ b/firmware/src/receiver/shell/cmd_channel.cpp
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2026 Peter Buchegger
+ *
+ * This file is part of OpenDriveHub.
+ *
+ * OpenDriveHub is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * OpenDriveHub is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with OpenDriveHub. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
+/**
+ * cmd_channel – ``channel`` and ``vehicle`` command handlers for the receiver.
+ */
+
+#include "../ReceiverApp.h"
+#include "ReceiverShellCmds.h"
+
+#include <Config.h>
+#include <Protocol.h>
+#include <Shell.h>
+#include <cstdlib>
+#include <cstring>
+
+namespace odh {
+
+// ── channel ─────────────────────────────────────────────────────────────
+
+int rxCmdChannel(Shell &shell, int argc, const char *const *argv, void *ctx) {
+    auto &app = *static_cast<ReceiverApp *>(ctx);
+
+    if (argc < 2) {
+        shell.println("Usage: channel <get|set>");
+        return 1;
+    }
+
+    if (strcmp(argv[1], "get") == 0) {
+        const auto &vals = app.output().channelValues();
+        for (uint8_t i = 0; i < config::rx::kChannelCount; ++i) {
+            shell.println("  CH%u: %u us", i, vals[i]);
+        }
+        return 0;
+    }
+
+    if (strcmp(argv[1], "set") == 0) {
+        if (argc < 4) {
+            shell.println("Usage: channel set <ch> <us>");
+            return 1;
+        }
+        int ch = atoi(argv[2]);
+        int us = atoi(argv[3]);
+        if (ch < 0 || ch >= config::rx::kChannelCount) {
+            shell.println("Channel %d out of range (0-%d)", ch, config::rx::kChannelCount - 1);
+            return 1;
+        }
+        if (us < kChannelMin || us > kChannelMax) {
+            shell.println("Value %d out of range (%d-%d)", us, kChannelMin, kChannelMax);
+            return 1;
+        }
+        app.output().setChannel(static_cast<uint8_t>(ch), static_cast<uint16_t>(us));
+        shell.println("CH%d = %d us", ch, us);
+        return 0;
+    }
+
+    shell.println("Unknown sub-command: %s", argv[1]);
+    return 1;
+}
+
+// ── vehicle ─────────────────────────────────────────────────────────────
+
+int rxCmdVehicle(Shell &shell, int argc, const char *const *argv, void *ctx) {
+    auto &app = *static_cast<ReceiverApp *>(ctx);
+
+    if (argc < 2) {
+        shell.println("Vehicle: %s", app.vehicleName());
+        return 0;
+    }
+
+    app.setVehicleName(argv[1]);
+    shell.println("Vehicle name set to: %s", app.vehicleName());
+    return 0;
+}
+
+} // namespace odh
diff --git a/firmware/src/receiver/shell/cmd_config.cpp b/firmware/src/receiver/shell/cmd_config.cpp
new file mode 100644
index 0000000..fb31b9e
--- /dev/null
+++ b/firmware/src/receiver/shell/cmd_config.cpp
@@ -0,0 +1,141 @@
+/*
+ * Copyright (C) 2026 Peter Buchegger
+ *
+ * This file is part of OpenDriveHub.
+ *
+ * OpenDriveHub is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * OpenDriveHub is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with OpenDriveHub. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
+/**
+ * cmd_config – ``config`` command handler for the receiver.
+ */
+
+#include "../ReceiverApp.h"
+#include "ReceiverShellCmds.h"
+
+#include <Channel.h>
+#include <FunctionMap.h>
+#include <NvsStore.h>
+#include <Protocol.h>
+#include <Shell.h>
+#include <ShellHelpers.h>
+#include <cstdlib>
+#include <cstring>
+
+namespace odh {
+
+int rxCmdConfig(Shell &shell, int argc, const char *const *argv, void *ctx) {
+    auto &app = *static_cast<ReceiverApp *>(ctx);
+
+    if (argc < 2) {
+        shell.println("Usage: config <get|set|help|reset>");
+        return 1;
+    }
+
+    // ── config get ──
+    if (strcmp(argv[1], "get") == 0) {
+        NvsStore store("odh", true);
+        shell.println("  radio_ch:  %u", store.getU8("radio_ch", channel::kDefaultChannel));
+
+        shellPrintName(shell, "  model:     ", modelName(app.output().modelType()));
+
+        shell.println("  vehicle:   %s", app.vehicleName());
+        shell.println("  batt_cell: %u", app.battery().cells());
+        return 0;
+    }
+
+    // ── config help ──
+    if (strcmp(argv[1], "help") == 0) {
+        shell.println("Available config keys:");
+        shell.println("  radio_ch   WiFi channel (1, 6, 11)");
+        shell.println("  batt_cell  Battery cells (0-6, 0=auto)");
+        shell.println("  model      Model type:");
+        for (uint8_t m = 0; m < static_cast<uint8_t>(ModelType::Count); ++m) {
+            shellPrintName(shell, "               ", modelName(static_cast<ModelType>(m)));
+        }
+        shell.println("  vehicle    Vehicle name (max %u chars)", kVehicleNameMax - 1);
+        return 0;
+    }
+
+    // ── config reset ──
+    if (strcmp(argv[1], "reset") == 0) {
+        app.output().setModelType(app.output().modelType());
+        app.output().saveToNvs();
+        shell.println("Config reset to defaults");
+        return 0;
+    }
+
+    // ── config set ──
+    if (strcmp(argv[1], "set") == 0) {
+        if (argc < 4) {
+            shell.println("Usage: config set <key> <value>");
+            shell.println("  Use 'config help' to see available keys");
+            return 1;
+        }
+
+        if (strcmp(argv[2], "radio_ch") == 0) {
+            int ch = atoi(argv[3]);
+            if (!channel::isValidChannel(static_cast<uint8_t>(ch))) {
+                shell.println("Invalid channel (valid: 1, 6, 11)");
+                return 1;
+            }
+            NvsStore store("odh", false);
+            store.putU8("radio_ch", static_cast<uint8_t>(ch));
+            shell.println("radio_ch = %d (restart required)", ch);
+            return 0;
+        }
+
+        if (strcmp(argv[2], "batt_cell") == 0) {
+            int cells = atoi(argv[3]);
+            if (cells < 0 || cells > 6) {
+                shell.println("Cell count must be 0-6 (0 = auto)");
+                return 1;
+            }
+            NvsStore store("odh", false);
+            store.putU8("batt_cell", static_cast<uint8_t>(cells));
+            shell.println("batt_cell = %d", cells);
+            return 0;
+        }
+
+        if (strcmp(argv[2], "model") == 0) {
+            ModelType model;
+            if (!shellParseModel(argv[3], model)) {
+                shell.println("Unknown model: %s", argv[3]);
+                shellListModels(shell);
+                return 1;
+            }
+            app.output().setModelType(model);
+            app.output().saveToNvs();
+            shellPrintName(shell, "model = ", modelName(model));
+            return 0;
+        }
+
+        if (strcmp(argv[2], "vehicle") == 0) {
+            app.setVehicleName(argv[3]);
+            shell.println("vehicle = %s", app.vehicleName());
+            return 0;
+        }
+
+        shell.println("Unknown key: %s", argv[2]);
+        shell.println("  Use 'config help' to see available keys");
+        return 1;
+    }
+
+    shell.println("Unknown sub-command: %s", argv[1]);
+    return 1;
+}
+
+} // namespace odh
diff --git a/firmware/src/receiver/shell/cmd_output.cpp b/firmware/src/receiver/shell/cmd_output.cpp
new file mode 100644
index 0000000..9f1364e
--- /dev/null
+++ b/firmware/src/receiver/shell/cmd_output.cpp
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2026 Peter Buchegger
+ *
+ * This file is part of OpenDriveHub.
+ *
+ * OpenDriveHub is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * OpenDriveHub is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with OpenDriveHub. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
+/**
+ * cmd_output – ``mapping`` and ``failsafe`` command handlers for the receiver.
+ */
+
+#include "../ReceiverApp.h"
+#include "ReceiverShellCmds.h"
+
+#include <Config.h>
+#include <FunctionMap.h>
+#include <Protocol.h>
+#include <Shell.h>
+#include <ShellHelpers.h>
+#include <cstdlib>
+#include <cstring>
+
+namespace odh {
+
+// ── mapping ─────────────────────────────────────────────────────────────
+
+int rxCmdMapping(Shell &shell, int argc, const char *const *argv, void *ctx) {
+    auto &app = *static_cast<ReceiverApp *>(ctx);
+
+    if (argc < 2) {
+        shell.println("Usage: mapping <get|help|reset>");
+        return 1;
+    }
+
+    if (strcmp(argv[1], "get") == 0) {
+        const auto &map = app.output().functionMap();
+        for (uint8_t ch = 0; ch < config::rx::kChannelCount; ++ch) {
+            auto func = channelToFunction(map, ch);
+            if (func.has_value()) {
+                auto fn = functionName(*func);
+#ifdef ODH_HAS_STRING_VIEW
+                shell.println("  CH%u: %.*s", ch, static_cast<int>(fn.size()), fn.data());
+#else
+                shell.println("  CH%u: %s", ch, fn);
+#endif
+            } else {
+                shell.println("  CH%u: (unmapped)", ch);
+            }
+        }
+        return 0;
+    }
+
+    if (strcmp(argv[1], "help") == 0) {
+        shellListFunctions(shell);
+        return 0;
+    }
+
+    if (strcmp(argv[1], "reset") == 0) {
+        app.output().setModelType(app.output().modelType());
+        app.output().saveToNvs();
+        shell.println("Function map reset to defaults");
+        return 0;
+    }
+
+    shell.println("Unknown sub-command: %s", argv[1]);
+    return 1;
+}
+
+// ── failsafe ────────────────────────────────────────────────────────────
+
+int rxCmdFailsafe(Shell &shell, int argc, const char *const *argv, void *ctx) {
+    auto &app = *static_cast<ReceiverApp *>(ctx);
+
+    if (argc < 2) {
+        shell.println("Usage: failsafe <get|set <ch> <us>>");
+        return 1;
+    }
+
+    if (strcmp(argv[1], "get") == 0) {
+        for (uint8_t i = 0; i < config::rx::kChannelCount; ++i) {
+            shell.println("  CH%u: %u us", i, app.output().failsafeValue(i));
+        }
+        return 0;
+    }
+
+    if (strcmp(argv[1], "set") == 0) {
+        if (argc < 4) {
+            shell.println("Usage: failsafe set <ch> <us>");
+            return 1;
+        }
+        int ch = atoi(argv[2]);
+        int us = atoi(argv[3]);
+        if (ch < 0 || ch >= config::rx::kChannelCount) {
+            shell.println("Channel %d out of range (0-%d)", ch, config::rx::kChannelCount - 1);
+            return 1;
+        }
+        if (us < kChannelMin || us > kChannelMax) {
+            shell.println("Value %d out of range (%d-%d)", us, kChannelMin, kChannelMax);
+            return 1;
+        }
+        app.output().setFailsafeValue(static_cast<uint8_t>(ch), static_cast<uint16_t>(us));
+        app.output().saveToNvs();
+        shell.println("Failsafe CH%d = %d us", ch, us);
+        return 0;
+    }
+
+    shell.println("Unknown sub-command: %s", argv[1]);
+    return 1;
+}
+
+} // namespace odh
diff --git a/firmware/src/receiver/shell/cmd_status.cpp b/firmware/src/receiver/shell/cmd_status.cpp
new file mode 100644
index 0000000..497a3f6
--- /dev/null
+++ b/firmware/src/receiver/shell/cmd_status.cpp
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2026 Peter Buchegger
+ *
+ * This file is part of OpenDriveHub.
+ *
+ * OpenDriveHub is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * OpenDriveHub is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with OpenDriveHub. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
+/**
+ * cmd_status – ``status`` command handler for the receiver.
+ */
+
+#include "../ReceiverApp.h"
+#include "ReceiverShellCmds.h"
+
+#include <FunctionMap.h>
+#include <Shell.h>
+#include <ShellHelpers.h>
+
+namespace odh {
+
+int rxCmdStatus(Shell &shell, int, const char *const *, void *ctx) {
+    auto &app = *static_cast<ReceiverApp *>(ctx);
+
+    const char *linkStr = app.radio().isBound() ? "connected" : "announcing";
+    shell.println("Link:     %s", linkStr);
+
+    if (app.radio().isBound()) {
+        shell.println("RSSI:     %d dBm", app.radio().lastRssi());
+        shell.println("Last pkt: %lu ms ago", static_cast<unsigned long>(app.radio().msSinceLastControl()));
+    }
+
+    shell.println("Battery:  %u mV (%uS)", app.battery().voltageMv(), app.battery().cells());
+
+    shellPrintName(shell, "Model:    ", modelName(app.output().modelType()));
+
+    shell.println("Vehicle:  %s", app.vehicleName());
+    return 0;
+}
+
+} // namespace odh
diff --git a/firmware/src/receiver/web/ReceiverApi.cpp b/firmware/src/receiver/web/ReceiverApi.cpp
index 922e03d..172ece9 100644
--- a/firmware/src/receiver/web/ReceiverApi.cpp
+++ b/firmware/src/receiver/web/ReceiverApi.cpp
@@ -66,7 +66,7 @@ void ReceiverApi::handleGetStatus(AsyncWebServerRequest *request) {
     const char *state = "disconnected";
     if (_radio.isBound())
         state = "connected";
-    else if (_radio.isAnnouncing())
+    else if (_radio.isPresencing())
         state = "announcing";
     doc["link"]["state"] = state;
     doc["link"]["rssi"]  = _radio.lastRssi();
@@ -97,7 +97,7 @@ void ReceiverApi::handleGetStatus(AsyncWebServerRequest *request) {
 }
 
 void ReceiverApi::handleGetConfig(AsyncWebServerRequest *request) {
-    NvsStore nvs("odh_rx", true);
+    NvsStore nvs("odh", true);
     JsonDocument doc;
 
     doc["vehicle_name"] = nvs.getString("veh_name", "Receiver");
@@ -143,7 +143,7 @@ void ReceiverApi::handlePostConfig(AsyncWebServerRequest *request, const uint8_t
         return;
     }
 
-    NvsStore nvs("odh_rx", false);
+    NvsStore nvs("odh", false);
 
     // Update vehicle name if provided.
     if (doc["vehicle_name"].is<const char *>()) {
diff --git a/firmware/src/transmitter/TransmitterApp.cpp b/firmware/src/transmitter/TransmitterApp.cpp
index d96ec20..543cc87 100644
--- a/firmware/src/transmitter/TransmitterApp.cpp
+++ b/firmware/src/transmitter/TransmitterApp.cpp
@@ -29,11 +29,14 @@
 #include <Preferences.h>
 #include <Wire.h>
 
+#include <Channel.h>
+#include <ChannelScanner.h>
 #include <Config.h>
 #include <FunctionMap.h>
 #include <NvsStore.h>
 #include <Protocol.h>
 #include <Shell.h>
+#include <cstdlib>
 
 #ifdef NATIVE_SIM
 #include <WiFi.h>
@@ -156,8 +159,13 @@ void TransmitterApp::begin() {
 
     // Radio
     auto telCb = [this](const TelemetryPacket &pkt) { _telemetry.onPacketReceived(pkt); };
-    if (_radio.begin(config::kRadioWifiChannel, telCb)) {
+    if (_radio.begin(telCb)) {
         Serial.println(F("[ODH] Radio (ESP-NOW) OK"));
+
+        // Run channel acquisition (find or found a channel)
+        runChannelAcquisition();
+
+        Serial.printf("[ODH] Active on channel %u\n", _currentChannel);
         _radio.startScanning();
         Serial.println(F("[ODH] Scanning for vehicles..."));
     } else {
@@ -194,6 +202,134 @@ void TransmitterApp::begin() {
     Serial.println(F("[ODH] Setup complete"));
 }
 
+/* ── NVS channel helpers ──────────────────────────────────────────────────── */
+
+uint8_t TransmitterApp::loadChannel() {
+    NvsStore nvs("odh", true);
+    uint8_t ch = nvs.getU8("radio_ch", 0);
+    if (channel::isValidChannel(ch))
+        return ch;
+    return channel::kDefaultChannel;
+}
+
+void TransmitterApp::saveChannel(uint8_t ch) {
+    if (!channel::isValidChannel(ch))
+        return;
+    NvsStore nvs("odh", false);
+    nvs.putU8("radio_ch", ch);
+}
+
+/* ── Channel acquisition ─────────────────────────────────────────────────── */
+
+void TransmitterApp::activateChannel(uint8_t ch) {
+    _currentChannel = ch;
+    _radio.setChannel(ch);
+    saveChannel(ch);
+    _channelActive = true;
+    setupActiveTransmitter();
+}
+
+void TransmitterApp::runChannelAcquisition() {
+    // Wire up the ChannelScanner callbacks
+    ChannelScanner scanner([this](uint8_t ch) -> bool { return _radio.setChannel(ch); }, [this](uint8_t /*ch*/) -> bool { return _radio.sendDiscoveryRequest(); }, [](uint32_t ms) { delay(ms); });
+
+    // Forward DiscoveryResponse to the scanner
+    _radio.onDiscoveryResponse([&scanner](uint8_t ch, int8_t rssi, uint8_t devCount) { scanner.onDiscoveryResponse(ch, rssi, devCount); });
+
+    uint8_t lastCh = loadChannel();
+
+    // Step 1: Quick-check the last known channel from NVS
+    if (channel::isValidChannel(lastCh)) {
+        Serial.printf("[ODH] Trying last known channel %u...\n", lastCh);
+        if (scanner.scanChannel(lastCh).foundTransmitter) {
+            Serial.printf("[ODH] Joined existing transmitter on channel %u\n", lastCh);
+            activateChannel(lastCh);
+            return;
+        }
+    }
+
+    // Step 2: Scan all candidate channels
+    Serial.println(F("[ODH] Scanning channels 1, 6, 11..."));
+    ScanResult results[channel::kCandidateChannelCount];
+    scanner.scanAllChannels(results);
+
+    uint8_t bestCh = ChannelScanner::bestChannel(results);
+
+    if (ChannelScanner::anyTransmitterFound(results)) {
+        Serial.printf("[ODH] Joined existing transmitter on channel %u\n", bestCh);
+        activateChannel(bestCh);
+        return;
+    }
+
+    // Step 3: No other transmitter found – prefer stored channel, then
+    // back off before claiming.
+    if (channel::isValidChannel(lastCh))
+        bestCh = lastCh;
+
+    uint32_t backoff = channel::kFoundingBackoffMinMs + (std::rand() % (channel::kFoundingBackoffMaxMs - channel::kFoundingBackoffMinMs));
+    Serial.printf("[ODH] No TX found – backing off %lu ms before claiming channel %u\n", static_cast<unsigned long>(backoff), bestCh);
+    delay(backoff);
+
+    // One final discovery pass after backoff
+    if (scanner.scanChannel(bestCh).foundTransmitter) {
+        Serial.printf("[ODH] Late discovery – joined transmitter on channel %u\n", bestCh);
+    } else {
+        Serial.printf("[ODH] Founded channel %u\n", bestCh);
+    }
+    activateChannel(bestCh);
+}
+
+void TransmitterApp::setupActiveTransmitter() {
+    // Register DiscoveryRequest callback – auto-reply is handled by radio layer
+    _radio.onDiscoveryRequest([](const uint8_t * /*mac*/, DeviceRole /*role*/) {});
+
+    // Register DiscoveryResponse callback for ongoing awareness
+    _radio.onDiscoveryResponse([](uint8_t /*ch*/, int8_t /*rssi*/, uint8_t /*devCount*/) {});
+}
+
+/* ── rescan() ────────────────────────────────────────────────────────────── */
+
+void TransmitterApp::rescan() {
+    if (_radio.isBound()) {
+        Serial.println(F("[ODH] Cannot rescan while bound"));
+        return;
+    }
+
+    Serial.println(F("[ODH] Rescanning channels..."));
+
+    ChannelScanner scanner([this](uint8_t ch) -> bool { return _radio.setChannel(ch); }, [this](uint8_t /*ch*/) -> bool { return _radio.sendDiscoveryRequest(); }, [](uint32_t ms) { delay(ms); });
+
+    _radio.onDiscoveryResponse([&scanner](uint8_t ch, int8_t rssi, uint8_t devCount) { scanner.onDiscoveryResponse(ch, rssi, devCount); });
+
+    ScanResult results[channel::kCandidateChannelCount];
+    scanner.scanAllChannels(results);
+
+    for (uint8_t i = 0; i < channel::kCandidateChannelCount; ++i) {
+        if (results[i].foundTransmitter) {
+            uint8_t oldCh   = _currentChannel;
+            _currentChannel = results[i].channel;
+
+            if (oldCh != results[i].channel) {
+                // Send migration notification on old channel before switching
+                _radio.setChannel(oldCh);
+                _radio.sendChannelMigration(results[i].channel);
+                delay(10);
+            }
+
+            _radio.setChannel(results[i].channel);
+            saveChannel(results[i].channel);
+            Serial.printf("[ODH] Switched to channel %u (found other TX)\n", results[i].channel);
+            setupActiveTransmitter();
+            return;
+        }
+    }
+
+    // No other TX found – stay on current channel
+    _radio.setChannel(_currentChannel);
+    Serial.println(F("[ODH] No other TX found – staying on current channel"));
+    setupActiveTransmitter();
+}
+
 /* ── taskControl – 50 Hz ─────────────────────────────────────────────────── */
 
 void TransmitterApp::taskControl(void *param) {
diff --git a/firmware/src/transmitter/TransmitterApp.h b/firmware/src/transmitter/TransmitterApp.h
index 6fedd89..748aeae 100644
--- a/firmware/src/transmitter/TransmitterApp.h
+++ b/firmware/src/transmitter/TransmitterApp.h
@@ -43,6 +43,7 @@
 #include "web/TransmitterApi.h"
 
 #include <BatteryMonitor.h>
+#include <ChannelScanner.h>
 #include <Config.h>
 #include <OdhWebServer.h>
 #include <Shell.h>
@@ -58,6 +59,9 @@ class TransmitterApp {
 public:
     void begin();
 
+    /// Rescan channels for other transmitters. Only callable when not bound.
+    void rescan();
+
     // ── Accessors for shell commands ────────────────────────────────
 
     TransmitterRadioLink &radio() {
@@ -116,9 +120,20 @@ class TransmitterApp {
     SemaphoreHandle_t _i2cMutex = nullptr;
     SemaphoreHandle_t _funcMux  = nullptr;
 
+    // Channel state
+    uint8_t _currentChannel = 0;
+    bool _channelActive     = false;
+
     // NVS helpers
     void loadInputMap(uint8_t model);
 
+    // Channel discovery
+    void runChannelAcquisition();
+    void activateChannel(uint8_t ch);
+    void setupActiveTransmitter();
+    void saveChannel(uint8_t channel);
+    uint8_t loadChannel();
+
     // FreeRTOS task bodies
     static void taskControl(void *param);
 #ifndef ODH_HEADLESS
diff --git a/firmware/src/transmitter/shell/TransmitterShellCmds.h b/firmware/src/transmitter/shell/TransmitterShellCmds.h
new file mode 100644
index 0000000..de54ddd
--- /dev/null
+++ b/firmware/src/transmitter/shell/TransmitterShellCmds.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2026 Peter Buchegger
+ *
+ * This file is part of OpenDriveHub.
+ *
+ * OpenDriveHub is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * OpenDriveHub is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with OpenDriveHub. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
+/**
+ * TransmitterShellCmds.h – Internal declarations for transmitter shell
+ * command handler functions.  Each handler lives in its own translation unit
+ * (cmd_status.cpp, cmd_bind.cpp, cmd_channel.cpp, cmd_io.cpp, cmd_config.cpp).
+ *
+ * This header is NOT part of the public API – only
+ * TransmitterShellCommands.cpp includes it.
+ */
+
+#pragma once
+
+#include <Shell.h>
+
+namespace odh {
+
+// cmd_status.cpp
+int txCmdStatus(Shell &shell, int argc, const char *const *argv, void *ctx);
+
+// cmd_bind.cpp
+int txCmdBind(Shell &shell, int argc, const char *const *argv, void *ctx);
+int txCmdDisconnect(Shell &shell, int argc, const char *const *argv, void *ctx);
+
+// cmd_channel.cpp
+int txCmdChannel(Shell &shell, int argc, const char *const *argv, void *ctx);
+
+// cmd_io.cpp
+int txCmdTrim(Shell &shell, int argc, const char *const *argv, void *ctx);
+int txCmdModule(Shell &shell, int argc, const char *const *argv, void *ctx);
+int txCmdInput(Shell &shell, int argc, const char *const *argv, void *ctx);
+int txCmdRescan(Shell &shell, int argc, const char *const *argv, void *ctx);
+
+// cmd_config.cpp
+int txCmdConfig(Shell &shell, int argc, const char *const *argv, void *ctx);
+
+} // namespace odh
diff --git a/firmware/src/transmitter/shell/TransmitterShellCommands.cpp b/firmware/src/transmitter/shell/TransmitterShellCommands.cpp
index c05a479..596fbd4 100644
--- a/firmware/src/transmitter/shell/TransmitterShellCommands.cpp
+++ b/firmware/src/transmitter/shell/TransmitterShellCommands.cpp
@@ -19,346 +19,39 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  */
 
+/**
+ * TransmitterShellCommands – registration façade.
+ *
+ * The actual command handlers live in separate translation units:
+ *   cmd_status.cpp   – status
+ *   cmd_bind.cpp     – bind, disconnect
+ *   cmd_channel.cpp  – channel
+ *   cmd_io.cpp       – trim, module, input, rescan
+ *   cmd_config.cpp   – config
+ *
+ * The shared ``reboot`` handler comes from ShellHelpers (lib/odh-shell).
+ */
+
 #include "TransmitterShellCommands.h"
 
-#include "../TransmitterApp.h"
+#include "TransmitterShellCmds.h"
 
-#include <Config.h>
-#include <FunctionMap.h>
-#include <NvsStore.h>
-#include <Protocol.h>
 #include <Shell.h>
-
-#ifdef NATIVE_SIM
-#include <sim_keyboard.h>
-#endif
-
-#include <cstdlib>
-#include <cstring>
+#include <ShellHelpers.h>
 
 namespace odh {
 
-// ── status ──────────────────────────────────────────────────────────────
-
-static int cmdStatus(Shell &shell, int, const char *const *, void *ctx) {
-    auto &app = *static_cast<TransmitterApp *>(ctx);
-
-    const char *linkStr = app.radio().isBound() ? "connected" : (app.radio().isScanning() ? "scanning" : "idle");
-    shell.println("Link:      %s", linkStr);
-
-    if (app.radio().isBound()) {
-        shell.println("RSSI:      %d dBm", app.radio().lastRssi());
-    }
-
-    shell.println("TX Batt:   %u mV (%uS)", app.battery().voltageMv(), app.battery().cells());
-
-    if (app.telemetry().hasData()) {
-        shell.println("RX Batt:   %u mV (%uS)", app.telemetry().rxBatteryMv(), app.telemetry().rxCells());
-        shell.println("RX RSSI:   %d dBm", app.telemetry().rssi());
-        shell.println("Pkts/s:    %.1f", static_cast<double>(app.telemetry().packetsPerSecond()));
-        shell.println("Uptime:    %lu ms", static_cast<unsigned long>(app.telemetry().connectionUptimeMs()));
-    }
-
-    return 0;
-}
-
-// ── bind ─────────────────────────────────────────────────────────────────
-
-static int cmdBind(Shell &shell, int argc, const char *const *argv, void *ctx) {
-    auto &app = *static_cast<TransmitterApp *>(ctx);
-
-    if (argc < 2) {
-        shell.println("Usage: bind <scan|list|connect <n>>");
-        return 1;
-    }
-
-    if (strcmp(argv[1], "scan") == 0) {
-        if (app.radio().isBound()) {
-            shell.println("Already connected – disconnect first");
-            return 1;
-        }
-        app.radio().startScanning();
-        shell.println("Scanning for vehicles...");
-        return 0;
-    }
-
-    if (strcmp(argv[1], "list") == 0) {
-        uint8_t count = app.radio().discoveredCount();
-        if (count == 0) {
-            shell.println("No vehicles discovered");
-            return 0;
-        }
-        for (uint8_t i = 0; i < count; ++i) {
-            const auto *v = app.radio().discoveredVehicle(i);
-            if (v && v->valid) {
-                auto mn = modelName(v->modelType);
-#ifdef ODH_HAS_STRING_VIEW
-                shell.println("  [%u] %-15s  %.*s  RSSI %d", i, v->name, static_cast<int>(mn.size()), mn.data(), v->rssi);
-#else
-                shell.println("  [%u] %-15s  %s  RSSI %d", i, v->name, mn, v->rssi);
-#endif
-            }
-        }
-        return 0;
-    }
-
-    if (strcmp(argv[1], "connect") == 0) {
-        if (argc < 3) {
-            shell.println("Usage: bind connect <index>");
-            return 1;
-        }
-        int idx = atoi(argv[2]);
-        if (idx < 0 || idx >= app.radio().discoveredCount()) {
-            shell.println("Index %d out of range (0-%d)", idx, app.radio().discoveredCount() - 1);
-            return 1;
-        }
-        const auto *veh = app.radio().discoveredVehicle(static_cast<uint8_t>(idx));
-        if (veh && veh->valid) {
-            app.loadInputMapForModel(veh->modelType);
-        }
-        if (app.radio().connectTo(static_cast<uint8_t>(idx))) {
-            shell.println("Connected to vehicle %d", idx);
-            app.telemetry().reset();
-        } else {
-            shell.println("Connection failed");
-        }
-        return 0;
-    }
-
-    shell.println("Unknown sub-command: %s", argv[1]);
-    return 1;
-}
-
-// ── disconnect ──────────────────────────────────────────────────────────
-
-static int cmdDisconnect(Shell &shell, int, const char *const *, void *ctx) {
-    auto &app = *static_cast<TransmitterApp *>(ctx);
-    if (!app.radio().isBound()) {
-        shell.println("Not connected");
-        return 1;
-    }
-    app.radio().disconnect();
-    shell.println("Disconnected – scanning");
-    return 0;
-}
-
-// ── channel ─────────────────────────────────────────────────────────────
-
-static int cmdChannel(Shell &shell, int argc, const char *const *argv, void *ctx) {
-    auto &app = *static_cast<TransmitterApp *>(ctx);
-
-    if (argc < 2) {
-        shell.println("Usage: channel <list|set <idx> <us>>");
-        return 1;
-    }
-
-    if (strcmp(argv[1], "list") == 0) {
-        auto snap = app.snapshotFuncValues();
-        for (uint8_t i = 0; i < snap.second; ++i) {
-            auto fn = functionName(snap.first[i].function);
-#ifdef ODH_HAS_STRING_VIEW
-            shell.println("  [%u] %-10.*s %4u us  trim %+d", i, static_cast<int>(fn.size()), fn.data(), snap.first[i].value, snap.first[i].trim);
-#else
-            shell.println("  [%u] %-10s %4u us  trim %+d", i, fn, snap.first[i].value, snap.first[i].trim);
-#endif
-        }
-        return 0;
-    }
-
-    if (strcmp(argv[1], "set") == 0) {
-#ifdef NATIVE_SIM
-        if (argc < 4) {
-            shell.println("Usage: channel set <idx> <us>");
-            return 1;
-        }
-        int idx = atoi(argv[2]);
-        int us  = atoi(argv[3]);
-        if (idx < 0 || idx >= 16) {
-            shell.println("Index must be 0-15");
-            return 1;
-        }
-        if (us < kChannelMin || us > kChannelMax) {
-            shell.println("Value must be %d-%d", kChannelMin, kChannelMax);
-            return 1;
-        }
-        {
-            std::lock_guard<std::mutex> lock(g_simKeyboard.mtx);
-            g_simKeyboard.channels[idx] = static_cast<uint16_t>(us);
-        }
-        shell.println("Channel %d = %d us", idx, us);
-        return 0;
-#else
-        shell.println("channel set is only available in simulation");
-        return 1;
-#endif
-    }
-
-    shell.println("Unknown sub-command: %s", argv[1]);
-    return 1;
-}
-
-// ── trim ─────────────────────────────────────────────────────────────────
-
-static int cmdTrim(Shell &shell, int argc, const char *const *argv, void *ctx) {
-    auto &app = *static_cast<TransmitterApp *>(ctx);
-
-    if (argc < 2) {
-        shell.println("Usage: trim <list|set <idx> <val>>");
-        return 1;
-    }
-
-    if (strcmp(argv[1], "list") == 0) {
-        auto snap = app.snapshotFuncValues();
-        for (uint8_t i = 0; i < snap.second; ++i) {
-            auto fn = functionName(snap.first[i].function);
-#ifdef ODH_HAS_STRING_VIEW
-            shell.println("  [%u] %-10.*s trim %+d", i, static_cast<int>(fn.size()), fn.data(), snap.first[i].trim);
-#else
-            shell.println("  [%u] %-10s trim %+d", i, fn, snap.first[i].trim);
-#endif
-        }
-        return 0;
-    }
-
-    if (strcmp(argv[1], "set") == 0) {
-        if (argc < 4) {
-            shell.println("Usage: trim set <idx> <value>");
-            return 1;
-        }
-        int idx = atoi(argv[2]);
-        int val = atoi(argv[3]);
-        if (val < -100 || val > 100) {
-            shell.println("Trim must be -100 to +100");
-            return 1;
-        }
-        if (!app.setTrim(static_cast<uint8_t>(idx), static_cast<int8_t>(val))) {
-            shell.println("Index %d out of range", idx);
-            return 1;
-        }
-        shell.println("Trim[%d] = %+d", idx, val);
-        return 0;
-    }
-
-    shell.println("Unknown sub-command: %s", argv[1]);
-    return 1;
-}
-
-// ── module ──────────────────────────────────────────────────────────────
-
-// cppcheck-suppress constParameterCallback
-static int cmdModule(Shell &shell, int, const char *const *, void *ctx) {
-    const auto &app = *static_cast<const TransmitterApp *>(ctx);
-
-    for (uint8_t s = 0; s < app.modules().slotCount(); ++s) {
-        const char *typeStr = "empty";
-        switch (app.modules().typeAt(s)) {
-        case ModuleType::Switch:
-            typeStr = "Switch";
-            break;
-        case ModuleType::Button:
-            typeStr = "Button";
-            break;
-        case ModuleType::Potentiometer:
-            typeStr = "Pot";
-            break;
-        case ModuleType::Encoder:
-            typeStr = "Encoder";
-            break;
-        default:
-            break;
-        }
-        shell.println("  Slot %u: %s (%u inputs)", s, typeStr, app.modules().inputCount(s));
-    }
-    return 0;
-}
-
-// ── config ──────────────────────────────────────────────────────────────
-
-static int cmdConfig(Shell &shell, int argc, const char *const *argv, void *ctx) {
-    (void)ctx;
-
-    if (argc < 2) {
-        shell.println("Usage: config <get|set>");
-        return 1;
-    }
-
-    if (strcmp(argv[1], "get") == 0) {
-        NvsStore nvs("odh", true);
-        shell.println("  radio_ch:  %u", nvs.getU8("radio_ch", config::kRadioWifiChannel));
-        shell.println("  model:     %u", nvs.getU8("model_type", static_cast<uint8_t>(ModelType::Generic)));
-        shell.println("  tx_cells:  %u", nvs.getU8("tx_cells", 0));
-        shell.println("  rx_cells:  %u", nvs.getU8("rx_cells", 0));
-        String dn = nvs.getString("dev_name", "TX");
-        shell.println("  dev_name:  %s", dn.c_str());
-        return 0;
-    }
-
-    if (strcmp(argv[1], "set") == 0) {
-        if (argc < 4) {
-            shell.println("Usage: config set <key> <value>");
-            shell.println("  Keys: radio_ch, tx_cells, rx_cells, dev_name");
-            return 1;
-        }
-
-        NvsStore nvs("odh", false);
-
-        if (strcmp(argv[2], "radio_ch") == 0) {
-            int ch = atoi(argv[3]);
-            if (ch < 1 || ch > 13) {
-                shell.println("Channel must be 1-13");
-                return 1;
-            }
-            nvs.putU8("radio_ch", static_cast<uint8_t>(ch));
-            shell.println("radio_ch = %d (restart required)", ch);
-            return 0;
-        }
-
-        if (strcmp(argv[2], "tx_cells") == 0) {
-            int c = atoi(argv[3]);
-            if (c < 0 || c > 6) {
-                shell.println("Must be 0-6 (0 = auto)");
-                return 1;
-            }
-            nvs.putU8("tx_cells", static_cast<uint8_t>(c));
-            shell.println("tx_cells = %d", c);
-            return 0;
-        }
-
-        if (strcmp(argv[2], "rx_cells") == 0) {
-            int c = atoi(argv[3]);
-            if (c < 0 || c > 6) {
-                shell.println("Must be 0-6 (0 = auto)");
-                return 1;
-            }
-            nvs.putU8("rx_cells", static_cast<uint8_t>(c));
-            shell.println("rx_cells = %d", c);
-            return 0;
-        }
-
-        if (strcmp(argv[2], "dev_name") == 0) {
-            nvs.putString("dev_name", argv[3]);
-            shell.println("dev_name = %s", argv[3]);
-            return 0;
-        }
-
-        shell.println("Unknown key: %s", argv[2]);
-        return 1;
-    }
-
-    shell.println("Unknown sub-command: %s", argv[1]);
-    return 1;
-}
-
-// ── Registration ────────────────────────────────────────────────────────
-
 void registerTransmitterShellCommands(Shell &shell, TransmitterApp &app) {
-    shell.registerCommand("status", "Show link, battery and telemetry", cmdStatus, &app);
-    shell.registerCommand("bind", "Bind ops: scan, list, connect <n>", cmdBind, &app);
-    shell.registerCommand("disconnect", "Disconnect from vehicle", cmdDisconnect, &app);
-    shell.registerCommand("channel", "Channel ops: list, set <idx> <us>", cmdChannel, &app);
-    shell.registerCommand("trim", "Trim ops: list, set <idx> <val>", cmdTrim, &app);
-    shell.registerCommand("module", "List detected input modules", cmdModule, &app);
-    shell.registerCommand("config", "Config ops: get, set <key> <val>", cmdConfig, &app);
+    shell.registerCommand("status", "Show link, battery and telemetry", txCmdStatus, &app);
+    shell.registerCommand("bind", "Bind: scan, list, connect <n>, help", txCmdBind, &app);
+    shell.registerCommand("disconnect", "Disconnect from vehicle", txCmdDisconnect, &app);
+    shell.registerCommand("channel", "Channel: get, set <idx> <us>", txCmdChannel, &app);
+    shell.registerCommand("trim", "Trim: get, set <idx> <val>", txCmdTrim, &app);
+    shell.registerCommand("module", "Module: list", txCmdModule, &app);
+    shell.registerCommand("input", "Input map: get, help, reset", txCmdInput, &app);
+    shell.registerCommand("config", "Config: get, set, help, reset", txCmdConfig, &app);
+    shell.registerCommand("rescan", "Rescan WiFi channels", txCmdRescan, &app);
+    shell.registerCommand("reboot", "Restart the device", cmdReboot, nullptr);
 }
 
 } // namespace odh
diff --git a/firmware/src/transmitter/shell/cmd_bind.cpp b/firmware/src/transmitter/shell/cmd_bind.cpp
new file mode 100644
index 0000000..c4d1aaa
--- /dev/null
+++ b/firmware/src/transmitter/shell/cmd_bind.cpp
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2026 Peter Buchegger
+ *
+ * This file is part of OpenDriveHub.
+ *
+ * OpenDriveHub is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * OpenDriveHub is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with OpenDriveHub. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
+/**
+ * cmd_bind – ``bind`` and ``disconnect`` command handlers for the transmitter.
+ */
+
+#include "../TransmitterApp.h"
+#include "TransmitterShellCmds.h"
+
+#include <FunctionMap.h>
+#include <Shell.h>
+#include <ShellHelpers.h>
+#include <cstdlib>
+#include <cstring>
+
+namespace odh {
+
+// ── bind ─────────────────────────────────────────────────────────────────
+
+int txCmdBind(Shell &shell, int argc, const char *const *argv, void *ctx) {
+    auto &app = *static_cast<TransmitterApp *>(ctx);
+
+    if (argc < 2) {
+        shell.println("Usage: bind <scan|list|connect <n>|help>");
+        return 1;
+    }
+
+    if (strcmp(argv[1], "help") == 0) {
+        shell.println("bind sub-commands:");
+        shell.println("  scan        Start scanning for vehicles");
+        shell.println("  list        List discovered vehicles");
+        shell.println("  connect <n> Connect to vehicle by index");
+        return 0;
+    }
+
+    if (strcmp(argv[1], "scan") == 0) {
+        if (app.radio().isBound()) {
+            shell.println("Already connected – disconnect first");
+            return 1;
+        }
+        app.radio().startScanning();
+        shell.println("Scanning for vehicles...");
+        return 0;
+    }
+
+    if (strcmp(argv[1], "list") == 0) {
+        uint8_t count = app.radio().discoveredCount();
+        if (count == 0) {
+            shell.println("No vehicles discovered");
+            return 0;
+        }
+        for (uint8_t i = 0; i < count; ++i) {
+            const auto *v = app.radio().discoveredVehicle(i);
+            if (v && v->valid) {
+                auto mn = modelName(v->modelType);
+#ifdef ODH_HAS_STRING_VIEW
+                shell.println("  [%u] %-15s  %.*s  RSSI %d", i, v->name, static_cast<int>(mn.size()), mn.data(), v->rssi);
+#else
+                shell.println("  [%u] %-15s  %s  RSSI %d", i, v->name, mn, v->rssi);
+#endif
+            }
+        }
+        return 0;
+    }
+
+    if (strcmp(argv[1], "connect") == 0) {
+        if (argc < 3) {
+            shell.println("Usage: bind connect <index>");
+            return 1;
+        }
+        int idx = atoi(argv[2]);
+        if (idx < 0 || idx >= app.radio().discoveredCount()) {
+            shell.println("Index %d out of range (0-%d)", idx, app.radio().discoveredCount() - 1);
+            return 1;
+        }
+        const auto *veh = app.radio().discoveredVehicle(static_cast<uint8_t>(idx));
+        if (veh && veh->valid) {
+            app.loadInputMapForModel(veh->modelType);
+        }
+        if (app.radio().connectTo(static_cast<uint8_t>(idx))) {
+            shell.println("Connected to vehicle %d", idx);
+            app.telemetry().reset();
+        } else {
+            shell.println("Connection failed");
+        }
+        return 0;
+    }
+
+    shell.println("Unknown sub-command: %s", argv[1]);
+    return 1;
+}
+
+// ── disconnect ──────────────────────────────────────────────────────────
+
+int txCmdDisconnect(Shell &shell, int, const char *const *, void *ctx) {
+    auto &app = *static_cast<TransmitterApp *>(ctx);
+    if (!app.radio().isBound()) {
+        shell.println("Not connected");
+        return 1;
+    }
+    app.radio().disconnect();
+    shell.println("Disconnected – scanning");
+    return 0;
+}
+
+} // namespace odh
diff --git a/firmware/src/transmitter/shell/cmd_channel.cpp b/firmware/src/transmitter/shell/cmd_channel.cpp
new file mode 100644
index 0000000..445b163
--- /dev/null
+++ b/firmware/src/transmitter/shell/cmd_channel.cpp
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2026 Peter Buchegger
+ *
+ * This file is part of OpenDriveHub.
+ *
+ * OpenDriveHub is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * OpenDriveHub is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with OpenDriveHub. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
+/**
+ * cmd_channel – ``channel`` command handler for the transmitter.
+ */
+
+#include "../TransmitterApp.h"
+#include "TransmitterShellCmds.h"
+
+#include <FunctionMap.h>
+#include <Protocol.h>
+#include <Shell.h>
+
+#ifdef NATIVE_SIM
+#include <sim_keyboard.h>
+#endif
+
+#include <cstdlib>
+#include <cstring>
+
+namespace odh {
+
+int txCmdChannel(Shell &shell, int argc, const char *const *argv, void *ctx) {
+    auto &app = *static_cast<TransmitterApp *>(ctx);
+
+    if (argc < 2) {
+        shell.println("Usage: channel <get|set <idx> <us>>");
+        return 1;
+    }
+
+    if (strcmp(argv[1], "get") == 0) {
+        auto snap = app.snapshotFuncValues();
+        for (uint8_t i = 0; i < snap.second; ++i) {
+            auto fn = functionName(snap.first[i].function);
+#ifdef ODH_HAS_STRING_VIEW
+            shell.println("  [%u] %-10.*s %4u us  trim %+d", i, static_cast<int>(fn.size()), fn.data(), snap.first[i].value, snap.first[i].trim);
+#else
+            shell.println("  [%u] %-10s %4u us  trim %+d", i, fn, snap.first[i].value, snap.first[i].trim);
+#endif
+        }
+        return 0;
+    }
+
+    if (strcmp(argv[1], "set") == 0) {
+#ifdef NATIVE_SIM
+        if (argc < 4) {
+            shell.println("Usage: channel set <idx> <us>");
+            return 1;
+        }
+        int idx = atoi(argv[2]);
+        int us  = atoi(argv[3]);
+        if (idx < 0 || idx >= 16) {
+            shell.println("Index must be 0-15");
+            return 1;
+        }
+        if (us < kChannelMin || us > kChannelMax) {
+            shell.println("Value must be %d-%d", kChannelMin, kChannelMax);
+            return 1;
+        }
+        {
+            std::lock_guard<std::mutex> lock(g_simKeyboard.mtx);
+            g_simKeyboard.channels[idx] = static_cast<uint16_t>(us);
+        }
+        shell.println("Channel %d = %d us", idx, us);
+        return 0;
+#else
+        shell.println("channel set is only available in simulation");
+        return 1;
+#endif
+    }
+
+    shell.println("Unknown sub-command: %s", argv[1]);
+    return 1;
+}
+
+} // namespace odh
diff --git a/firmware/src/transmitter/shell/cmd_config.cpp b/firmware/src/transmitter/shell/cmd_config.cpp
new file mode 100644
index 0000000..385e7ad
--- /dev/null
+++ b/firmware/src/transmitter/shell/cmd_config.cpp
@@ -0,0 +1,156 @@
+/*
+ * Copyright (C) 2026 Peter Buchegger
+ *
+ * This file is part of OpenDriveHub.
+ *
+ * OpenDriveHub is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * OpenDriveHub is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with OpenDriveHub. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
+/**
+ * cmd_config – ``config`` command handler for the transmitter.
+ */
+
+#include "../TransmitterApp.h"
+#include "TransmitterShellCmds.h"
+
+#include <Channel.h>
+#include <Config.h>
+#include <FunctionMap.h>
+#include <NvsStore.h>
+#include <Protocol.h>
+#include <Shell.h>
+#include <ShellHelpers.h>
+#include <cstdlib>
+#include <cstring>
+
+namespace odh {
+
+int txCmdConfig(Shell &shell, int argc, const char *const *argv, void *ctx) {
+    if (argc < 2) {
+        shell.println("Usage: config <get|set|help|reset>");
+        return 1;
+    }
+
+    // ── config get ──
+    if (strcmp(argv[1], "get") == 0) {
+        NvsStore nvs("odh", true);
+        shell.println("  radio_ch:  %u", nvs.getU8("radio_ch", channel::kDefaultChannel));
+
+        uint8_t modelRaw = nvs.getU8("model_type", static_cast<uint8_t>(ModelType::Generic));
+        shellPrintName(shell, "  model:     ", modelName(modelRaw));
+
+        shell.println("  tx_cells:  %u", nvs.getU8("tx_cells", 0));
+        shell.println("  rx_cells:  %u", nvs.getU8("rx_cells", 0));
+        String dn = nvs.getString("dev_name", "TX");
+        shell.println("  dev_name:  %s", dn.c_str());
+        return 0;
+    }
+
+    // ── config help ──
+    if (strcmp(argv[1], "help") == 0) {
+        shell.println("Available config keys:");
+        shell.println("  radio_ch   WiFi channel (1, 6, 11)");
+        shell.println("  model      Model type:");
+        for (uint8_t m = 0; m < static_cast<uint8_t>(ModelType::Count); ++m) {
+            shellPrintName(shell, "               ", modelName(static_cast<ModelType>(m)));
+        }
+        shell.println("  tx_cells   TX battery cells (0-6, 0=auto)");
+        shell.println("  rx_cells   RX battery cells (0-6, 0=auto)");
+        shell.println("  dev_name   Device name (max %u chars)", kVehicleNameMax - 1);
+        return 0;
+    }
+
+    // ── config reset ──
+    if (strcmp(argv[1], "reset") == 0) {
+        NvsStore nvs("odh", false);
+        nvs.raw().clear();
+        shell.println("Config reset – restart required");
+        return 0;
+    }
+
+    // ── config set ──
+    if (strcmp(argv[1], "set") == 0) {
+        if (argc < 4) {
+            shell.println("Usage: config set <key> <value>");
+            shell.println("  Use 'config help' to see available keys");
+            return 1;
+        }
+
+        NvsStore nvs("odh", false);
+
+        if (strcmp(argv[2], "radio_ch") == 0) {
+            int ch = atoi(argv[3]);
+            if (!channel::isValidChannel(static_cast<uint8_t>(ch))) {
+                shell.println("Invalid channel (valid: 1, 6, 11)");
+                return 1;
+            }
+            nvs.putU8("radio_ch", static_cast<uint8_t>(ch));
+            shell.println("radio_ch = %d (restart required)", ch);
+            return 0;
+        }
+
+        if (strcmp(argv[2], "model") == 0) {
+            ModelType model;
+            if (!shellParseModel(argv[3], model)) {
+                shell.println("Unknown model: %s", argv[3]);
+                shellListModels(shell);
+                return 1;
+            }
+            nvs.putU8("model_type", static_cast<uint8_t>(model));
+            auto &app = *static_cast<TransmitterApp *>(ctx);
+            app.loadInputMapForModel(static_cast<uint8_t>(model));
+            shellPrintName(shell, "model = ", modelName(model));
+            return 0;
+        }
+
+        if (strcmp(argv[2], "tx_cells") == 0) {
+            int c = atoi(argv[3]);
+            if (c < 0 || c > 6) {
+                shell.println("Must be 0-6 (0 = auto)");
+                return 1;
+            }
+            nvs.putU8("tx_cells", static_cast<uint8_t>(c));
+            shell.println("tx_cells = %d", c);
+            return 0;
+        }
+
+        if (strcmp(argv[2], "rx_cells") == 0) {
+            int c = atoi(argv[3]);
+            if (c < 0 || c > 6) {
+                shell.println("Must be 0-6 (0 = auto)");
+                return 1;
+            }
+            nvs.putU8("rx_cells", static_cast<uint8_t>(c));
+            shell.println("rx_cells = %d", c);
+            return 0;
+        }
+
+        if (strcmp(argv[2], "dev_name") == 0) {
+            nvs.putString("dev_name", argv[3]);
+            shell.println("dev_name = %s", argv[3]);
+            return 0;
+        }
+
+        shell.println("Unknown key: %s", argv[2]);
+        shell.println("  Use 'config help' to see available keys");
+        return 1;
+    }
+
+    shell.println("Unknown sub-command: %s", argv[1]);
+    return 1;
+}
+
+} // namespace odh
diff --git a/firmware/src/transmitter/shell/cmd_io.cpp b/firmware/src/transmitter/shell/cmd_io.cpp
new file mode 100644
index 0000000..48514c7
--- /dev/null
+++ b/firmware/src/transmitter/shell/cmd_io.cpp
@@ -0,0 +1,182 @@
+/*
+ * Copyright (C) 2026 Peter Buchegger
+ *
+ * This file is part of OpenDriveHub.
+ *
+ * OpenDriveHub is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * OpenDriveHub is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with OpenDriveHub. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
+/**
+ * cmd_io – ``trim``, ``module``, ``input`` and ``rescan`` command handlers
+ * for the transmitter.
+ */
+
+#include "../TransmitterApp.h"
+#include "TransmitterShellCmds.h"
+
+#include <FunctionMap.h>
+#include <NvsStore.h>
+#include <Protocol.h>
+#include <Shell.h>
+#include <ShellHelpers.h>
+#include <cstdlib>
+#include <cstring>
+
+namespace odh {
+
+// ── trim ─────────────────────────────────────────────────────────────────
+
+int txCmdTrim(Shell &shell, int argc, const char *const *argv, void *ctx) {
+    auto &app = *static_cast<TransmitterApp *>(ctx);
+
+    if (argc < 2) {
+        shell.println("Usage: trim <get|set <idx> <val>>");
+        return 1;
+    }
+
+    if (strcmp(argv[1], "get") == 0) {
+        auto snap = app.snapshotFuncValues();
+        for (uint8_t i = 0; i < snap.second; ++i) {
+            auto fn = functionName(snap.first[i].function);
+#ifdef ODH_HAS_STRING_VIEW
+            shell.println("  [%u] %-10.*s trim %+d", i, static_cast<int>(fn.size()), fn.data(), snap.first[i].trim);
+#else
+            shell.println("  [%u] %-10s trim %+d", i, fn, snap.first[i].trim);
+#endif
+        }
+        return 0;
+    }
+
+    if (strcmp(argv[1], "set") == 0) {
+        if (argc < 4) {
+            shell.println("Usage: trim set <idx> <value>");
+            return 1;
+        }
+        int idx = atoi(argv[2]);
+        int val = atoi(argv[3]);
+        if (val < -100 || val > 100) {
+            shell.println("Trim must be -100 to +100");
+            return 1;
+        }
+        if (!app.setTrim(static_cast<uint8_t>(idx), static_cast<int8_t>(val))) {
+            shell.println("Index %d out of range", idx);
+            return 1;
+        }
+        shell.println("Trim[%d] = %+d", idx, val);
+        return 0;
+    }
+
+    shell.println("Unknown sub-command: %s", argv[1]);
+    return 1;
+}
+
+// ── module ──────────────────────────────────────────────────────────────
+
+// cppcheck-suppress constParameterPointer
+int txCmdModule(Shell &shell, int argc, const char *const *argv, void *ctx) {
+    if (argc < 2) {
+        shell.println("Usage: module <list>");
+        return 1;
+    }
+
+    if (strcmp(argv[1], "list") == 0) {
+        const auto &app = *static_cast<const TransmitterApp *>(ctx);
+        for (uint8_t s = 0; s < app.modules().slotCount(); ++s) {
+            const char *typeStr = "empty";
+            switch (app.modules().typeAt(s)) {
+            case ModuleType::Switch:
+                typeStr = "Switch";
+                break;
+            case ModuleType::Button:
+                typeStr = "Button";
+                break;
+            case ModuleType::Potentiometer:
+                typeStr = "Pot";
+                break;
+            case ModuleType::Encoder:
+                typeStr = "Encoder";
+                break;
+            default:
+                break;
+            }
+            shell.println("  Slot %u: %s (%u inputs)", s, typeStr, app.modules().inputCount(s));
+        }
+        return 0;
+    }
+
+    shell.println("Unknown sub-command: %s", argv[1]);
+    return 1;
+}
+
+// ── input ───────────────────────────────────────────────────────────────
+
+int txCmdInput(Shell &shell, int argc, const char *const *argv, void *ctx) {
+    auto &app = *static_cast<TransmitterApp *>(ctx);
+
+    if (argc < 2) {
+        shell.println("Usage: input <get|help|reset>");
+        return 1;
+    }
+
+    if (strcmp(argv[1], "get") == 0) {
+        auto snap = app.snapshotFuncValues();
+        if (snap.second == 0) {
+            shell.println("No input map configured");
+            return 0;
+        }
+        for (uint8_t i = 0; i < snap.second; ++i) {
+            auto fn = functionName(snap.first[i].function);
+#ifdef ODH_HAS_STRING_VIEW
+            shell.println("  [%u] %.*s  value %u us  trim %+d", i, static_cast<int>(fn.size()), fn.data(), snap.first[i].value, snap.first[i].trim);
+#else
+            shell.println("  [%u] %s  value %u us  trim %+d", i, fn, snap.first[i].value, snap.first[i].trim);
+#endif
+        }
+        return 0;
+    }
+
+    if (strcmp(argv[1], "help") == 0) {
+        shellListFunctions(shell);
+        return 0;
+    }
+
+    if (strcmp(argv[1], "reset") == 0) {
+        NvsStore nvs("odh", true);
+        uint8_t model = nvs.getU8("model_type", static_cast<uint8_t>(ModelType::Generic));
+        app.loadInputMapForModel(model);
+        shell.println("Input map reset to defaults");
+        return 0;
+    }
+
+    shell.println("Unknown sub-command: %s", argv[1]);
+    return 1;
+}
+
+// ── rescan ──────────────────────────────────────────────────────────────
+
+// cppcheck-suppress constParameterCallback
+int txCmdRescan(Shell &shell, int, const char *const *, void *ctx) {
+    auto &app = *static_cast<TransmitterApp *>(ctx);
+    if (app.radio().isBound()) {
+        shell.println("Cannot rescan while connected – disconnect first");
+        return 1;
+    }
+    app.rescan();
+    shell.println("Channel rescan initiated");
+    return 0;
+}
+
+} // namespace odh
diff --git a/firmware/src/transmitter/shell/cmd_status.cpp b/firmware/src/transmitter/shell/cmd_status.cpp
new file mode 100644
index 0000000..bedee26
--- /dev/null
+++ b/firmware/src/transmitter/shell/cmd_status.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2026 Peter Buchegger
+ *
+ * This file is part of OpenDriveHub.
+ *
+ * OpenDriveHub is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * OpenDriveHub is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with OpenDriveHub. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
+/**
+ * cmd_status – ``status`` command handler for the transmitter.
+ */
+
+#include "../TransmitterApp.h"
+#include "TransmitterShellCmds.h"
+
+#include <Shell.h>
+
+namespace odh {
+
+int txCmdStatus(Shell &shell, int, const char *const *, void *ctx) {
+    auto &app = *static_cast<TransmitterApp *>(ctx);
+
+    const char *linkStr = app.radio().isBound() ? "connected" : (app.radio().isScanning() ? "scanning" : "idle");
+    shell.println("Link:      %s", linkStr);
+
+    if (app.radio().isBound()) {
+        shell.println("RSSI:      %d dBm", app.radio().lastRssi());
+    }
+
+    shell.println("TX Batt:   %u mV (%uS)", app.battery().voltageMv(), app.battery().cells());
+
+    if (app.telemetry().hasData()) {
+        shell.println("RX Batt:   %u mV (%uS)", app.telemetry().rxBatteryMv(), app.telemetry().rxCells());
+        shell.println("RX RSSI:   %d dBm", app.telemetry().rssi());
+        shell.println("Pkts/s:    %.1f", static_cast<double>(app.telemetry().packetsPerSecond()));
+        shell.println("Uptime:    %lu ms", static_cast<unsigned long>(app.telemetry().connectionUptimeMs()));
+    }
+
+    return 0;
+}
+
+} // namespace odh
diff --git a/firmware/src/transmitter/web/TransmitterApi.cpp b/firmware/src/transmitter/web/TransmitterApi.cpp
index b4854ab..dd47480 100644
--- a/firmware/src/transmitter/web/TransmitterApi.cpp
+++ b/firmware/src/transmitter/web/TransmitterApi.cpp
@@ -108,8 +108,7 @@ void TransmitterApi::handleGetConfig(AsyncWebServerRequest *req) {
     NvsStore nvs("odh", true);
     JsonDocument doc;
 
-    doc["device_name"]   = nvs.getString("dev_name", "TX");
-    doc["radio_channel"] = nvs.getU8("radio_ch", 1);
+    doc["device_name"] = nvs.getString("dev_name", "TX");
 
     uint8_t model          = nvs.getU8("model_type", static_cast<uint8_t>(ModelType::Generic));
     doc["model_type"]      = model;
@@ -193,11 +192,6 @@ void TransmitterApi::handlePostConfig(AsyncWebServerRequest *req, const uint8_t
     if (doc["device_name"].is<const char *>()) {
         nvs.putString("dev_name", doc["device_name"].as<const char *>());
     }
-    if (doc["radio_channel"].is<uint8_t>()) {
-        uint8_t ch = doc["radio_channel"].as<uint8_t>();
-        if (ch >= 1 && ch <= 13)
-            nvs.putU8("radio_ch", ch);
-    }
     if (doc["model_type"].is<uint8_t>()) {
         uint8_t m = doc["model_type"].as<uint8_t>();
         if (m < static_cast<uint8_t>(ModelType::Count))
diff --git a/firmware/test/test_console/__pycache__/conftest.cpython-313-pytest-9.0.2.pyc b/firmware/test/test_console/__pycache__/conftest.cpython-313-pytest-9.0.2.pyc
deleted file mode 100644
index 0168a34..0000000
Binary files a/firmware/test/test_console/__pycache__/conftest.cpython-313-pytest-9.0.2.pyc and /dev/null differ
diff --git a/firmware/test/test_console/__pycache__/console.cpython-313.pyc b/firmware/test/test_console/__pycache__/console.cpython-313.pyc
deleted file mode 100644
index 6dae39c..0000000
Binary files a/firmware/test/test_console/__pycache__/console.cpython-313.pyc and /dev/null differ
diff --git a/firmware/test/test_console/__pycache__/test_commands_common.cpython-313-pytest-9.0.2.pyc b/firmware/test/test_console/__pycache__/test_commands_common.cpython-313-pytest-9.0.2.pyc
deleted file mode 100644
index 75fa3cf..0000000
Binary files a/firmware/test/test_console/__pycache__/test_commands_common.cpython-313-pytest-9.0.2.pyc and /dev/null differ
diff --git a/firmware/test/test_console/__pycache__/test_commands_rx.cpython-313-pytest-9.0.2.pyc b/firmware/test/test_console/__pycache__/test_commands_rx.cpython-313-pytest-9.0.2.pyc
deleted file mode 100644
index 6ab8cdd..0000000
Binary files a/firmware/test/test_console/__pycache__/test_commands_rx.cpython-313-pytest-9.0.2.pyc and /dev/null differ
diff --git a/firmware/test/test_console/__pycache__/test_commands_tx.cpython-313-pytest-9.0.2.pyc b/firmware/test/test_console/__pycache__/test_commands_tx.cpython-313-pytest-9.0.2.pyc
deleted file mode 100644
index a5f0074..0000000
Binary files a/firmware/test/test_console/__pycache__/test_commands_tx.cpython-313-pytest-9.0.2.pyc and /dev/null differ
diff --git a/firmware/test/test_console/__pycache__/test_help.cpython-313-pytest-9.0.2.pyc b/firmware/test/test_console/__pycache__/test_help.cpython-313-pytest-9.0.2.pyc
deleted file mode 100644
index 2e470b3..0000000
Binary files a/firmware/test/test_console/__pycache__/test_help.cpython-313-pytest-9.0.2.pyc and /dev/null differ
diff --git a/firmware/test/test_console/__pycache__/test_startup.cpython-313-pytest-9.0.2.pyc b/firmware/test/test_console/__pycache__/test_startup.cpython-313-pytest-9.0.2.pyc
deleted file mode 100644
index 9214bbb..0000000
Binary files a/firmware/test/test_console/__pycache__/test_startup.cpython-313-pytest-9.0.2.pyc and /dev/null differ
diff --git a/firmware/test/test_console/__pycache__/transport.cpython-313.pyc b/firmware/test/test_console/__pycache__/transport.cpython-313.pyc
deleted file mode 100644
index 3c29058..0000000
Binary files a/firmware/test/test_console/__pycache__/transport.cpython-313.pyc and /dev/null differ
diff --git a/firmware/test/test_console/common/__init__.py b/firmware/test/test_console/common/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/firmware/test/test_console/common/test_basics.py b/firmware/test/test_console/common/test_basics.py
new file mode 100644
index 0000000..e4548b8
--- /dev/null
+++ b/firmware/test/test_console/common/test_basics.py
@@ -0,0 +1,70 @@
+# Copyright (C) 2026 Peter Buchegger
+#
+# This file is part of OpenDriveHub.
+#
+# OpenDriveHub is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# OpenDriveHub is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with OpenDriveHub. If not, see <https://www.gnu.org/licenses/>.
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+"""Basic shell interaction tests (unknown command, empty line, sequential)."""
+
+from __future__ import annotations
+
+from console import Console
+
+
+class TestUnknownCommand:
+    """Verify behaviour when the user enters an unrecognised command."""
+
+    def test_unknown_command_error_message(self, console: Console) -> None:
+        output = console.send_command("foobar_nonexistent")
+        assert "unknown command" in output.lower(), (
+            f"Expected 'Unknown command' error, got:\n{output}"
+        )
+
+    def test_unknown_command_suggests_help(self, console: Console) -> None:
+        output = console.send_command("notacommand")
+        assert "help" in output.lower(), (
+            f"Expected suggestion to type 'help', got:\n{output}"
+        )
+
+
+class TestEmptyLine:
+    """Verify that pressing Enter without a command does nothing harmful."""
+
+    def test_empty_line_no_error(self, console: Console) -> None:
+        """An empty line should just produce a new prompt (no error)."""
+        output = console.send_command("")
+        assert "error" not in output.lower(), (
+            f"Empty line produced an error:\n{output}"
+        )
+        assert "unknown" not in output.lower(), (
+            f"Empty line triggered 'unknown command':\n{output}"
+        )
+
+
+class TestMultipleCommands:
+    """Verify that running several commands in sequence works."""
+
+    def test_sequential_commands(self, console: Console) -> None:
+        """Run 5 different commands and ensure all return valid output."""
+        commands = ["help", "status", "config get", "channel get", "help"]
+        for cmd in commands:
+            output = console.send_command(cmd)
+            assert len(output.strip()) > 0, (
+                f"Command {cmd!r} returned empty output"
+            )
+            assert "error" not in output.lower() or cmd == "config set", (
+                f"Command {cmd!r} produced error:\n{output}"
+            )
diff --git a/firmware/test/test_console/common/test_channel.py b/firmware/test/test_console/common/test_channel.py
new file mode 100644
index 0000000..5334c72
--- /dev/null
+++ b/firmware/test/test_console/common/test_channel.py
@@ -0,0 +1,43 @@
+# Copyright (C) 2026 Peter Buchegger
+#
+# This file is part of OpenDriveHub.
+#
+# OpenDriveHub is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# OpenDriveHub is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with OpenDriveHub. If not, see <https://www.gnu.org/licenses/>.
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+"""Tests for the ``channel`` command (shared by RX and TX)."""
+
+from __future__ import annotations
+
+from console import Console
+
+
+class TestChannelGet:
+    """Verify ``channel get`` shows channel information."""
+
+    def test_channel_get_returns_output(self, console: Console) -> None:
+        output = console.send_command("channel get")
+        assert len(output.strip()) > 0, "channel get returned empty output"
+
+
+class TestChannelGetNotList:
+    """Verify old ``channel list`` syntax is rejected."""
+
+    def test_channel_list_rejected(self, console: Console) -> None:
+        output = console.send_command("channel list")
+        out_lower = output.lower()
+        assert "unknown" in out_lower or "usage" in out_lower or "error" in out_lower, (
+            f"Expected error for old 'channel list' syntax:\n{output}"
+        )
diff --git a/firmware/test/test_console/common/test_config.py b/firmware/test/test_console/common/test_config.py
new file mode 100644
index 0000000..2f5e462
--- /dev/null
+++ b/firmware/test/test_console/common/test_config.py
@@ -0,0 +1,147 @@
+# Copyright (C) 2026 Peter Buchegger
+#
+# This file is part of OpenDriveHub.
+#
+# OpenDriveHub is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# OpenDriveHub is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with OpenDriveHub. If not, see <https://www.gnu.org/licenses/>.
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+"""Tests for the ``config`` command (shared by RX and TX)."""
+
+from __future__ import annotations
+
+import pytest
+
+from console import Console
+
+
+class TestConfigGet:
+    """Verify ``config get`` returns key-value data."""
+
+    def test_config_get_returns_output(self, console: Console) -> None:
+        output = console.send_command("config get")
+        assert len(output.strip()) > 0, "config get returned empty output"
+
+    def test_config_get_contains_radio_ch(self, console: Console) -> None:
+        output = console.send_command("config get")
+        assert "radio_ch" in output, (
+            f"config get missing radio_ch:\n{output}"
+        )
+
+    def test_config_set_invalid_key(self, console: Console) -> None:
+        """Setting an invalid key must produce an error."""
+        output = console.send_command("config set totally_invalid_key 42")
+        out_lower = output.lower()
+        assert "error" in out_lower or "unknown" in out_lower or "invalid" in out_lower, (
+            f"Expected error for invalid key, got:\n{output}"
+        )
+
+
+class TestConfigHelp:
+    """Verify ``config help`` lists available keys with value ranges."""
+
+    def test_config_help_returns_output(self, console: Console) -> None:
+        output = console.send_command("config help")
+        assert len(output.strip()) > 0, "config help returned empty output"
+
+    def test_config_help_lists_radio_ch(self, console: Console) -> None:
+        output = console.send_command("config help")
+        assert "radio_ch" in output, (
+            f"config help missing radio_ch:\n{output}"
+        )
+
+    def test_config_help_lists_model(self, console: Console) -> None:
+        output = console.send_command("config help")
+        assert "model" in output.lower(), (
+            f"config help missing model:\n{output}"
+        )
+
+    def test_config_help_shows_valid_channels(self, console: Console) -> None:
+        """``config help`` must mention valid WiFi channels."""
+        output = console.send_command("config help")
+        assert "1" in output and "6" in output and "11" in output, (
+            f"config help missing valid channel values:\n{output}"
+        )
+
+
+class TestConfigReset:
+    """Verify ``config reset`` works without error."""
+
+    def test_config_reset(self, console: Console) -> None:
+        output = console.send_command("config reset")
+        out_lower = output.lower()
+        assert "error" not in out_lower and "unknown" not in out_lower, (
+            f"config reset failed:\n{output}"
+        )
+
+
+class TestConfigSetRadioCh:
+    """Verify ``config set radio_ch`` validates channels."""
+
+    def test_config_set_radio_ch_invalid(self, console: Console) -> None:
+        """Setting radio_ch to 3 (not 1/6/11) must fail."""
+        output = console.send_command("config set radio_ch 3")
+        out_lower = output.lower()
+        assert "invalid" in out_lower or "error" in out_lower, (
+            f"Expected error for invalid channel 3:\n{output}"
+        )
+
+    def test_config_set_radio_ch_valid(self, console: Console) -> None:
+        """Setting radio_ch to 6 must succeed."""
+        output = console.send_command("config set radio_ch 6")
+        out_lower = output.lower()
+        assert "error" not in out_lower and "invalid" not in out_lower, (
+            f"Valid channel 6 was rejected:\n{output}"
+        )
+        result = console.send_command("config get")
+        assert "6" in result, (
+            f"radio_ch not set to 6:\n{result}"
+        )
+        # Reset to default
+        console.send_command("config set radio_ch 1")
+
+
+class TestConfigSetModel:
+    """Verify ``config set model`` works."""
+
+    def test_config_set_model_valid(self, console: Console) -> None:
+        """Setting model to a valid type must succeed."""
+        output = console.send_command("config set model Generic")
+        out_lower = output.lower()
+        assert "error" not in out_lower and "unknown" not in out_lower, (
+            f"Valid model was rejected:\n{output}"
+        )
+
+    def test_config_set_model_invalid(self, console: Console) -> None:
+        """Setting an invalid model must fail and list available models."""
+        output = console.send_command("config set model spaceship")
+        out_lower = output.lower()
+        assert "unknown" in out_lower or "invalid" in out_lower or "error" in out_lower, (
+            f"Expected error for invalid model:\n{output}"
+        )
+        assert "generic" in out_lower, (
+            f"Expected available models to be listed:\n{output}"
+        )
+
+
+class TestReboot:
+    """Verify ``reboot`` in simulation."""
+
+    @pytest.mark.sim_only
+    def test_reboot_not_available_in_sim(self, console: Console) -> None:
+        output = console.send_command("reboot")
+        out_lower = output.lower()
+        assert "not available" in out_lower or "simulation" in out_lower, (
+            f"Expected 'not available in simulation':\n{output}"
+        )
diff --git a/firmware/test/test_console/common/test_status.py b/firmware/test/test_console/common/test_status.py
new file mode 100644
index 0000000..8bc5673
--- /dev/null
+++ b/firmware/test/test_console/common/test_status.py
@@ -0,0 +1,54 @@
+# Copyright (C) 2026 Peter Buchegger
+#
+# This file is part of OpenDriveHub.
+#
+# OpenDriveHub is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# OpenDriveHub is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with OpenDriveHub. If not, see <https://www.gnu.org/licenses/>.
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+"""Tests for the ``status`` command (shared by RX and TX)."""
+
+from __future__ import annotations
+
+from console import Console
+
+
+class TestStatus:
+    """Verify the ``status`` command produces valid output."""
+
+    def test_status_returns_output(self, console: Console) -> None:
+        output = console.send_command("status")
+        assert len(output.strip()) > 0, "status returned empty output"
+
+    def test_status_contains_link_info(self, console: Console) -> None:
+        """``status`` must mention some kind of link/connection state."""
+        output = console.send_command("status").lower()
+        has_link_info = any(
+            kw in output
+            for kw in ("link", "connected", "disconnected", "scanning",
+                        "announcing", "idle", "state")
+        )
+        assert has_link_info, (
+            f"status output missing link info:\n{output}"
+        )
+
+    def test_status_contains_battery(self, console: Console) -> None:
+        """``status`` must mention battery information."""
+        output = console.send_command("status").lower()
+        has_battery = any(
+            kw in output for kw in ("battery", "batt", "voltage", "cell")
+        )
+        assert has_battery, (
+            f"status output missing battery info:\n{output}"
+        )
diff --git a/firmware/test/test_console/rx/__init__.py b/firmware/test/test_console/rx/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/firmware/test/test_console/test_commands_rx.py b/firmware/test/test_console/rx/test_channel.py
similarity index 71%
rename from firmware/test/test_console/test_commands_rx.py
rename to firmware/test/test_console/rx/test_channel.py
index e800ddb..e8f701f 100644
--- a/firmware/test/test_console/test_commands_rx.py
+++ b/firmware/test/test_console/rx/test_channel.py
@@ -17,7 +17,7 @@
 #
 # SPDX-License-Identifier: GPL-3.0-or-later
 
-"""Receiver-specific console command tests."""
+"""Receiver-specific tests for ``channel``, ``vehicle`` and config roundtrip."""
 
 from __future__ import annotations
 
@@ -38,7 +38,6 @@ def test_vehicle_get(self, console: Console) -> None:
 
     def test_vehicle_set_get_roundtrip(self, console: Console) -> None:
         """Set vehicle name, then read it back."""
-        # Save original
         original = console.send_command("vehicle").strip()
 
         console.send_command('vehicle "TestCar"')
@@ -47,7 +46,6 @@ def test_vehicle_set_get_roundtrip(self, console: Console) -> None:
             f"Vehicle name not updated to TestCar:\n{output}"
         )
 
-        # Restore original
         if original:
             console.send_command(f'vehicle "{original}"')
 
@@ -56,7 +54,7 @@ class TestChannelSetRx:
     """Verify ``channel set`` on the receiver."""
 
     def test_channel_set_valid(self, console: Console) -> None:
-        """Setting channel 0 to 1500µs must succeed."""
+        """Setting channel 0 to 1500us must succeed."""
         output = console.send_command("channel set 0 1500")
         out_lower = output.lower()
         assert "error" not in out_lower and "invalid" not in out_lower, (
@@ -78,3 +76,29 @@ def test_channel_set_invalid_value(self, console: Console) -> None:
         assert "error" in out_lower or "invalid" in out_lower or "range" in out_lower or "must be" in out_lower, (
             f"Expected error for invalid PWM value:\n{output}"
         )
+
+
+class TestConfigSetVehicle:
+    """Verify ``config set vehicle`` on the receiver."""
+
+    def test_config_set_vehicle(self, console: Console) -> None:
+        """Setting vehicle via config set must update vehicle name."""
+        console.send_command('config set vehicle "TestTruck"')
+        output = console.send_command("vehicle")
+        assert "TestTruck" in output, (
+            f"Vehicle not set to TestTruck:\n{output}"
+        )
+        console.send_command('config set vehicle "RX"')
+
+
+class TestConfigRoundtripRx:
+    """Verify ``config set`` followed by ``config get`` persists values."""
+
+    def test_config_set_get_batt_cell_rx(self, console: Console) -> None:
+        """RX: set batt_cell, read it back."""
+        console.send_command("config set batt_cell 3")
+        output = console.send_command("config get")
+        assert "3" in output, (
+            f"batt_cell not set to 3 in config get:\n{output}"
+        )
+        console.send_command("config set batt_cell 0")
diff --git a/firmware/test/test_console/rx/test_output.py b/firmware/test/test_console/rx/test_output.py
new file mode 100644
index 0000000..085c8dc
--- /dev/null
+++ b/firmware/test/test_console/rx/test_output.py
@@ -0,0 +1,124 @@
+# Copyright (C) 2026 Peter Buchegger
+#
+# This file is part of OpenDriveHub.
+#
+# OpenDriveHub is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# OpenDriveHub is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with OpenDriveHub. If not, see <https://www.gnu.org/licenses/>.
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+"""Receiver-specific tests for ``mapping`` and ``failsafe`` commands."""
+
+from __future__ import annotations
+
+import pytest
+
+from console import Console
+
+pytestmark = pytest.mark.rx
+
+
+class TestMapping:
+    """Verify the ``mapping`` command for function-to-channel mapping."""
+
+    def test_mapping_get(self, console: Console) -> None:
+        """``mapping get`` must show channel-to-function assignments."""
+        output = console.send_command("mapping get")
+        assert len(output.strip()) > 0, "mapping get returned empty output"
+        assert "ch" in output.lower(), (
+            f"mapping get missing channel info:\n{output}"
+        )
+
+    def test_mapping_help(self, console: Console) -> None:
+        """``mapping help`` must list available function names."""
+        output = console.send_command("mapping help")
+        out_lower = output.lower()
+        assert "drive" in out_lower, (
+            f"mapping help missing 'Drive' function:\n{output}"
+        )
+        assert "steering" in out_lower, (
+            f"mapping help missing 'Steering' function:\n{output}"
+        )
+
+    def test_mapping_reset(self, console: Console) -> None:
+        """``mapping reset`` must succeed without error."""
+        output = console.send_command("mapping reset")
+        out_lower = output.lower()
+        assert "error" not in out_lower and "unknown" not in out_lower, (
+            f"mapping reset failed:\n{output}"
+        )
+
+    def test_mapping_no_subcommand(self, console: Console) -> None:
+        """``mapping`` without subcommand must show usage."""
+        output = console.send_command("mapping")
+        out_lower = output.lower()
+        assert "usage" in out_lower or "get" in out_lower, (
+            f"Expected usage hint:\n{output}"
+        )
+
+    def test_mapping_reset_roundtrip(self, console: Console) -> None:
+        """Set model to Excavator, reset mapping, verify defaults."""
+        console.send_command("config set model Excavator")
+        console.send_command("mapping reset")
+        output = console.send_command("mapping get")
+        out_lower = output.lower()
+        assert "boom" in out_lower or "bucket" in out_lower or "track" in out_lower, (
+            f"Excavator mapping not applied:\n{output}"
+        )
+        console.send_command("config set model Generic")
+        console.send_command("mapping reset")
+
+
+class TestFailsafe:
+    """Verify the ``failsafe`` command."""
+
+    def test_failsafe_get(self, console: Console) -> None:
+        """``failsafe get`` must show failsafe values per channel."""
+        output = console.send_command("failsafe get")
+        assert len(output.strip()) > 0, "failsafe get returned empty output"
+        assert "ch" in output.lower(), (
+            f"failsafe get missing channel info:\n{output}"
+        )
+
+    def test_failsafe_set(self, console: Console) -> None:
+        """Set failsafe value and verify it sticks."""
+        console.send_command("failsafe set 0 1200")
+        output = console.send_command("failsafe get")
+        assert "1200" in output, (
+            f"Failsafe value 1200 not found:\n{output}"
+        )
+        console.send_command("failsafe set 0 1500")
+
+    def test_failsafe_set_invalid_channel(self, console: Console) -> None:
+        """Setting failsafe on invalid channel must fail."""
+        output = console.send_command("failsafe set 99 1500")
+        out_lower = output.lower()
+        assert "error" in out_lower or "range" in out_lower or "invalid" in out_lower, (
+            f"Expected error for invalid channel:\n{output}"
+        )
+
+    def test_failsafe_set_invalid_value(self, console: Console) -> None:
+        """Setting failsafe to out-of-range value must fail."""
+        output = console.send_command("failsafe set 0 500")
+        out_lower = output.lower()
+        assert "error" in out_lower or "range" in out_lower or "invalid" in out_lower, (
+            f"Expected error for invalid value:\n{output}"
+        )
+
+    def test_failsafe_no_subcommand(self, console: Console) -> None:
+        """``failsafe`` without subcommand must show usage."""
+        output = console.send_command("failsafe")
+        out_lower = output.lower()
+        assert "usage" in out_lower or "get" in out_lower, (
+            f"Expected usage hint:\n{output}"
+        )
diff --git a/firmware/test/test_console/test_commands_common.py b/firmware/test/test_console/test_commands_common.py
deleted file mode 100644
index dc6ae8f..0000000
--- a/firmware/test/test_console/test_commands_common.py
+++ /dev/null
@@ -1,159 +0,0 @@
-# Copyright (C) 2026 Peter Buchegger
-#
-# This file is part of OpenDriveHub.
-#
-# OpenDriveHub is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# OpenDriveHub is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with OpenDriveHub. If not, see <https://www.gnu.org/licenses/>.
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-"""Tests for commands shared by both receiver and transmitter."""
-
-from __future__ import annotations
-
-import pytest
-
-from console import Console
-
-
-class TestUnknownCommand:
-    """Verify behaviour when the user enters an unrecognised command."""
-
-    def test_unknown_command_error_message(self, console: Console) -> None:
-        output = console.send_command("foobar_nonexistent")
-        assert "unknown command" in output.lower(), (
-            f"Expected 'Unknown command' error, got:\n{output}"
-        )
-
-    def test_unknown_command_suggests_help(self, console: Console) -> None:
-        output = console.send_command("notacommand")
-        assert "help" in output.lower(), (
-            f"Expected suggestion to type 'help', got:\n{output}"
-        )
-
-
-class TestEmptyLine:
-    """Verify that pressing Enter without a command does nothing harmful."""
-
-    def test_empty_line_no_error(self, console: Console) -> None:
-        """An empty line should just produce a new prompt (no error)."""
-        output = console.send_command("")
-        # Empty line should produce no output or just whitespace
-        assert "error" not in output.lower(), (
-            f"Empty line produced an error:\n{output}"
-        )
-        assert "unknown" not in output.lower(), (
-            f"Empty line triggered 'unknown command':\n{output}"
-        )
-
-
-class TestStatus:
-    """Verify the ``status`` command produces valid output."""
-
-    def test_status_returns_output(self, console: Console) -> None:
-        output = console.send_command("status")
-        assert len(output.strip()) > 0, "status returned empty output"
-
-    def test_status_contains_link_info(self, console: Console) -> None:
-        """``status`` must mention some kind of link/connection state."""
-        output = console.send_command("status").lower()
-        has_link_info = any(
-            kw in output
-            for kw in ("link", "connected", "disconnected", "scanning",
-                        "announcing", "idle", "state")
-        )
-        assert has_link_info, (
-            f"status output missing link info:\n{output}"
-        )
-
-    def test_status_contains_battery(self, console: Console) -> None:
-        """``status`` must mention battery information."""
-        output = console.send_command("status").lower()
-        has_battery = any(
-            kw in output for kw in ("battery", "batt", "voltage", "cell")
-        )
-        assert has_battery, (
-            f"status output missing battery info:\n{output}"
-        )
-
-
-class TestConfigGet:
-    """Verify ``config get`` returns key-value data."""
-
-    def test_config_get_returns_output(self, console: Console) -> None:
-        output = console.send_command("config get")
-        assert len(output.strip()) > 0, "config get returned empty output"
-
-    def test_config_get_contains_radio_ch(self, console: Console) -> None:
-        output = console.send_command("config get")
-        assert "radio_ch" in output, (
-            f"config get missing radio_ch:\n{output}"
-        )
-
-    def test_config_set_invalid_key(self, console: Console) -> None:
-        """Setting an invalid key must produce an error."""
-        output = console.send_command("config set totally_invalid_key 42")
-        out_lower = output.lower()
-        assert "error" in out_lower or "unknown" in out_lower or "invalid" in out_lower, (
-            f"Expected error for invalid key, got:\n{output}"
-        )
-
-
-class TestConfigRoundtrip:
-    """Verify ``config set`` followed by ``config get`` persists values."""
-
-    @pytest.mark.rx
-    def test_config_set_get_batt_cell_rx(self, console: Console) -> None:
-        """RX: set batt_cell, read it back."""
-        console.send_command("config set batt_cell 3")
-        output = console.send_command("config get")
-        assert "3" in output, (
-            f"batt_cell not set to 3 in config get:\n{output}"
-        )
-        # Reset to auto
-        console.send_command("config set batt_cell 0")
-
-    @pytest.mark.tx
-    def test_config_set_get_tx_cells(self, console: Console) -> None:
-        """TX: set tx_cells, read it back."""
-        console.send_command("config set tx_cells 3")
-        output = console.send_command("config get")
-        assert "3" in output, (
-            f"tx_cells not set to 3 in config get:\n{output}"
-        )
-        # Reset to auto
-        console.send_command("config set tx_cells 0")
-
-
-class TestChannelList:
-    """Verify ``channel list`` shows channel information."""
-
-    def test_channel_list_returns_output(self, console: Console) -> None:
-        output = console.send_command("channel list")
-        assert len(output.strip()) > 0, "channel list returned empty output"
-
-
-class TestMultipleCommands:
-    """Verify that running several commands in sequence works."""
-
-    def test_sequential_commands(self, console: Console) -> None:
-        """Run 5 different commands and ensure all return valid output."""
-        commands = ["help", "status", "config get", "channel list", "help"]
-        for cmd in commands:
-            output = console.send_command(cmd)
-            assert len(output.strip()) > 0, (
-                f"Command {cmd!r} returned empty output"
-            )
-            assert "error" not in output.lower() or cmd == "config set", (
-                f"Command {cmd!r} produced error:\n{output}"
-            )
diff --git a/firmware/test/test_console/test_help.py b/firmware/test/test_console/test_help.py
index 190dd47..d562020 100644
--- a/firmware/test/test_console/test_help.py
+++ b/firmware/test/test_console/test_help.py
@@ -56,6 +56,24 @@ def test_help_lists_vehicle(self, console: Console) -> None:
         output = console.send_command("help")
         assert "vehicle" in output.lower()
 
+    @pytest.mark.rx
+    def test_help_lists_mapping(self, console: Console) -> None:
+        """RX ``help`` must list the ``mapping`` command."""
+        output = console.send_command("help")
+        assert "mapping" in output.lower()
+
+    @pytest.mark.rx
+    def test_help_lists_failsafe(self, console: Console) -> None:
+        """RX ``help`` must list the ``failsafe`` command."""
+        output = console.send_command("help")
+        assert "failsafe" in output.lower()
+
+    @pytest.mark.rx
+    def test_help_lists_reboot_rx(self, console: Console) -> None:
+        """RX ``help`` must list the ``reboot`` command."""
+        output = console.send_command("help")
+        assert "reboot" in output.lower()
+
     @pytest.mark.tx
     def test_help_lists_bind(self, console: Console) -> None:
         """TX ``help`` must list the ``bind`` command."""
@@ -79,3 +97,21 @@ def test_help_lists_disconnect(self, console: Console) -> None:
         """TX ``help`` must list the ``disconnect`` command."""
         output = console.send_command("help")
         assert "disconnect" in output.lower()
+
+    @pytest.mark.tx
+    def test_help_lists_input(self, console: Console) -> None:
+        """TX ``help`` must list the ``input`` command."""
+        output = console.send_command("help")
+        assert "input" in output.lower()
+
+    @pytest.mark.tx
+    def test_help_lists_rescan(self, console: Console) -> None:
+        """TX ``help`` must list the ``rescan`` command."""
+        output = console.send_command("help")
+        assert "rescan" in output.lower()
+
+    @pytest.mark.tx
+    def test_help_lists_reboot_tx(self, console: Console) -> None:
+        """TX ``help`` must list the ``reboot`` command."""
+        output = console.send_command("help")
+        assert "reboot" in output.lower()
diff --git a/firmware/test/test_console/tx/__init__.py b/firmware/test/test_console/tx/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/firmware/test/test_console/test_commands_tx.py b/firmware/test/test_console/tx/test_bind.py
similarity index 56%
rename from firmware/test/test_console/test_commands_tx.py
rename to firmware/test/test_console/tx/test_bind.py
index 193dc09..d02d439 100644
--- a/firmware/test/test_console/test_commands_tx.py
+++ b/firmware/test/test_console/tx/test_bind.py
@@ -17,7 +17,7 @@
 #
 # SPDX-License-Identifier: GPL-3.0-or-later
 
-"""Transmitter-specific console command tests."""
+"""Transmitter-specific tests for ``bind`` and ``disconnect`` commands."""
 
 from __future__ import annotations
 
@@ -42,57 +42,34 @@ def test_bind_scan(self, console: Console) -> None:
     def test_bind_list(self, console: Console) -> None:
         """``bind list`` must return output (may be empty list)."""
         output = console.send_command("bind list")
-        # Might say "no vehicles" or list entries – both are fine
         assert "error" not in output.lower(), (
             f"bind list returned error:\n{output}"
         )
 
 
+class TestBindHelp:
+    """Verify ``bind help`` shows sub-commands."""
+
+    def test_bind_help(self, console: Console) -> None:
+        output = console.send_command("bind help")
+        out_lower = output.lower()
+        assert "scan" in out_lower, (
+            f"bind help missing 'scan':\n{output}"
+        )
+        assert "list" in out_lower, (
+            f"bind help missing 'list':\n{output}"
+        )
+        assert "connect" in out_lower, (
+            f"bind help missing 'connect':\n{output}"
+        )
+
+
 class TestDisconnect:
     """Verify ``disconnect`` when not connected."""
 
     def test_disconnect_when_idle(self, console: Console) -> None:
         """``disconnect`` when not connected must not crash."""
         output = console.send_command("disconnect")
-        # May say "not connected" or similar – that's fine
         assert "error" not in output.lower() or "not connected" in output.lower(), (
             f"disconnect produced unexpected error:\n{output}"
         )
-
-
-class TestTrim:
-    """Verify ``trim`` subcommands."""
-
-    def test_trim_list(self, console: Console) -> None:
-        """``trim list`` must return formatted output."""
-        output = console.send_command("trim list")
-        assert len(output.strip()) > 0, "trim list returned empty output"
-
-    def test_trim_set_get_roundtrip(self, console: Console) -> None:
-        """Set trim, verify it appears in ``trim list``."""
-        console.send_command("trim set 0 50")
-        output = console.send_command("trim list")
-        assert "50" in output, (
-            f"trim value 50 not found in trim list:\n{output}"
-        )
-        # Reset trim
-        console.send_command("trim set 0 0")
-
-    def test_trim_set_invalid_range(self, console: Console) -> None:
-        """Setting trim outside -100..+100 must fail."""
-        output = console.send_command("trim set 0 200")
-        out_lower = output.lower()
-        assert "error" in out_lower or "invalid" in out_lower or "range" in out_lower or "must be" in out_lower, (
-            f"Expected error for out-of-range trim:\n{output}"
-        )
-
-
-class TestModule:
-    """Verify ``module`` command."""
-
-    def test_module_list(self, console: Console) -> None:
-        """``module`` must return output (may report no modules in sim)."""
-        output = console.send_command("module")
-        assert "error" not in output.lower(), (
-            f"module returned error:\n{output}"
-        )
diff --git a/firmware/test/test_console/tx/test_config.py b/firmware/test/test_console/tx/test_config.py
new file mode 100644
index 0000000..10f58fe
--- /dev/null
+++ b/firmware/test/test_console/tx/test_config.py
@@ -0,0 +1,41 @@
+# Copyright (C) 2026 Peter Buchegger
+#
+# This file is part of OpenDriveHub.
+#
+# OpenDriveHub is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# OpenDriveHub is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with OpenDriveHub. If not, see <https://www.gnu.org/licenses/>.
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+"""Transmitter-specific config roundtrip tests."""
+
+from __future__ import annotations
+
+import pytest
+
+from console import Console
+
+pytestmark = pytest.mark.tx
+
+
+class TestConfigRoundtripTx:
+    """Verify ``config set`` followed by ``config get`` persists values."""
+
+    def test_config_set_get_tx_cells(self, console: Console) -> None:
+        """TX: set tx_cells, read it back."""
+        console.send_command("config set tx_cells 3")
+        output = console.send_command("config get")
+        assert "3" in output, (
+            f"tx_cells not set to 3 in config get:\n{output}"
+        )
+        console.send_command("config set tx_cells 0")
diff --git a/firmware/test/test_console/tx/test_io.py b/firmware/test/test_console/tx/test_io.py
new file mode 100644
index 0000000..17df4cc
--- /dev/null
+++ b/firmware/test/test_console/tx/test_io.py
@@ -0,0 +1,133 @@
+# Copyright (C) 2026 Peter Buchegger
+#
+# This file is part of OpenDriveHub.
+#
+# OpenDriveHub is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# OpenDriveHub is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with OpenDriveHub. If not, see <https://www.gnu.org/licenses/>.
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+"""Transmitter-specific tests for ``trim``, ``module``, ``input`` and ``rescan``."""
+
+from __future__ import annotations
+
+import pytest
+
+from console import Console
+
+pytestmark = pytest.mark.tx
+
+
+class TestTrim:
+    """Verify ``trim`` subcommands."""
+
+    def test_trim_get(self, console: Console) -> None:
+        """``trim get`` must return formatted output."""
+        output = console.send_command("trim get")
+        assert len(output.strip()) > 0, "trim get returned empty output"
+
+    def test_trim_set_get_roundtrip(self, console: Console) -> None:
+        """Set trim, verify it appears in ``trim get``."""
+        console.send_command("trim set 0 50")
+        output = console.send_command("trim get")
+        assert "50" in output, (
+            f"trim value 50 not found in trim get:\n{output}"
+        )
+        console.send_command("trim set 0 0")
+
+    def test_trim_set_invalid_range(self, console: Console) -> None:
+        """Setting trim outside -100..+100 must fail."""
+        output = console.send_command("trim set 0 200")
+        out_lower = output.lower()
+        assert "error" in out_lower or "invalid" in out_lower or "range" in out_lower or "must be" in out_lower, (
+            f"Expected error for out-of-range trim:\n{output}"
+        )
+
+
+class TestTrimGetNotList:
+    """Verify old ``trim list`` syntax is rejected."""
+
+    def test_trim_list_rejected(self, console: Console) -> None:
+        output = console.send_command("trim list")
+        out_lower = output.lower()
+        assert "unknown" in out_lower or "usage" in out_lower or "error" in out_lower, (
+            f"Expected error for old 'trim list' syntax:\n{output}"
+        )
+
+
+class TestModule:
+    """Verify ``module list`` command."""
+
+    def test_module_list(self, console: Console) -> None:
+        """``module list`` must return output (may report no modules in sim)."""
+        output = console.send_command("module list")
+        assert "error" not in output.lower(), (
+            f"module list returned error:\n{output}"
+        )
+
+    def test_module_no_subcommand(self, console: Console) -> None:
+        """``module`` without subcommand must show usage."""
+        output = console.send_command("module")
+        out_lower = output.lower()
+        assert "usage" in out_lower or "list" in out_lower, (
+            f"Expected usage hint for module without subcommand:\n{output}"
+        )
+
+
+class TestInput:
+    """Verify ``input`` command for input map management."""
+
+    def test_input_get(self, console: Console) -> None:
+        """``input get`` must not crash (may be empty if no map)."""
+        output = console.send_command("input get")
+        assert "error" not in output.lower(), (
+            f"input get returned error:\n{output}"
+        )
+
+    def test_input_help(self, console: Console) -> None:
+        """``input help`` must list available functions."""
+        output = console.send_command("input help")
+        out_lower = output.lower()
+        assert "drive" in out_lower, (
+            f"input help missing 'Drive' function:\n{output}"
+        )
+        assert "steering" in out_lower, (
+            f"input help missing 'Steering' function:\n{output}"
+        )
+
+    def test_input_reset(self, console: Console) -> None:
+        """``input reset`` must succeed without error."""
+        output = console.send_command("input reset")
+        out_lower = output.lower()
+        assert "error" not in out_lower and "unknown" not in out_lower, (
+            f"input reset failed:\n{output}"
+        )
+
+    def test_input_no_subcommand(self, console: Console) -> None:
+        """``input`` without subcommand must show usage."""
+        output = console.send_command("input")
+        out_lower = output.lower()
+        assert "usage" in out_lower or "get" in out_lower, (
+            f"Expected usage hint:\n{output}"
+        )
+
+
+class TestRescan:
+    """Verify ``rescan`` command."""
+
+    def test_rescan(self, console: Console) -> None:
+        """``rescan`` must not crash."""
+        output = console.send_command("rescan")
+        assert "error" not in output.lower(), (
+            f"rescan returned error:\n{output}"
+        )
diff --git a/firmware/test/test_native/test_channel.cpp b/firmware/test/test_native/test_channel.cpp
new file mode 100644
index 0000000..abbb6cb
--- /dev/null
+++ b/firmware/test/test_native/test_channel.cpp
@@ -0,0 +1,291 @@
+/*
+ * Copyright (C) 2026 Peter Buchegger
+ *
+ * This file is part of OpenDriveHub.
+ *
+ * OpenDriveHub is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * OpenDriveHub is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with OpenDriveHub. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
+/**
+ * Native unit tests for the ODH channel / discovery module.
+ *
+ * Covers channel validation, timing constants, discovery packet
+ * construction, and the ChannelScanner logic.
+ */
+
+#include <Channel.h>
+#include <ChannelScanner.h>
+#include <Protocol.h>
+#include <cstdint>
+#include <cstring>
+#include <unity.h>
+
+using namespace odh;
+
+/* ── Channel validation ─────────────────────────────────────────────────── */
+
+void test_channel_valid_1(void) {
+    TEST_ASSERT_TRUE(channel::isValidChannel(1));
+}
+
+void test_channel_valid_6(void) {
+    TEST_ASSERT_TRUE(channel::isValidChannel(6));
+}
+
+void test_channel_valid_11(void) {
+    TEST_ASSERT_TRUE(channel::isValidChannel(11));
+}
+
+void test_channel_invalid_0(void) {
+    TEST_ASSERT_FALSE(channel::isValidChannel(0));
+}
+
+void test_channel_invalid_2(void) {
+    TEST_ASSERT_FALSE(channel::isValidChannel(2));
+}
+
+void test_channel_invalid_5(void) {
+    TEST_ASSERT_FALSE(channel::isValidChannel(5));
+}
+
+void test_channel_invalid_7(void) {
+    TEST_ASSERT_FALSE(channel::isValidChannel(7));
+}
+
+void test_channel_invalid_12(void) {
+    TEST_ASSERT_FALSE(channel::isValidChannel(12));
+}
+
+void test_channel_invalid_13(void) {
+    TEST_ASSERT_FALSE(channel::isValidChannel(13));
+}
+
+void test_channel_invalid_255(void) {
+    TEST_ASSERT_FALSE(channel::isValidChannel(255));
+}
+
+/* ── Channel constants ──────────────────────────────────────────────────── */
+
+void test_candidate_channel_count(void) {
+    TEST_ASSERT_EQUAL_UINT8(3, channel::kCandidateChannelCount);
+}
+
+void test_candidate_channel_0_is_1(void) {
+    TEST_ASSERT_EQUAL_UINT8(1, channel::kCandidateChannels[0]);
+}
+
+void test_candidate_channel_1_is_6(void) {
+    TEST_ASSERT_EQUAL_UINT8(6, channel::kCandidateChannels[1]);
+}
+
+void test_candidate_channel_2_is_11(void) {
+    TEST_ASSERT_EQUAL_UINT8(11, channel::kCandidateChannels[2]);
+}
+
+void test_default_channel(void) {
+    TEST_ASSERT_EQUAL_UINT8(1, channel::kDefaultChannel);
+}
+
+/* ── Sim port mapping ───────────────────────────────────────────────────── */
+
+void test_sim_port_channel_1(void) {
+    TEST_ASSERT_EQUAL_UINT16(7001, channel::channelToSimPort(1));
+}
+
+void test_sim_port_channel_6(void) {
+    TEST_ASSERT_EQUAL_UINT16(7006, channel::channelToSimPort(6));
+}
+
+void test_sim_port_channel_11(void) {
+    TEST_ASSERT_EQUAL_UINT16(7011, channel::channelToSimPort(11));
+}
+
+void test_sim_port_invalid_fallback(void) {
+    TEST_ASSERT_EQUAL_UINT16(7001, channel::channelToSimPort(3));
+}
+
+/* ── Timing constants sanity checks ─────────────────────────────────────── */
+
+void test_channel_settle_positive(void) {
+    TEST_ASSERT_GREATER_THAN(0u, channel::kChannelSettleMs);
+}
+
+void test_discovery_wait_positive(void) {
+    TEST_ASSERT_GREATER_THAN(0u, channel::kDiscoveryWaitMs);
+}
+
+void test_discovery_retries_at_least_one(void) {
+    TEST_ASSERT_GREATER_OR_EQUAL(1, channel::kDiscoveryRetries);
+}
+
+void test_presence_interval_positive(void) {
+    TEST_ASSERT_GREATER_THAN(0u, channel::kPresenceIntervalMs);
+}
+
+void test_transmitter_loss_exceeds_presence(void) {
+    TEST_ASSERT_GREATER_THAN(channel::kPresenceIntervalMs, channel::kTransmitterLossTimeoutMs);
+}
+
+void test_founding_backoff_max_exceeds_min(void) {
+    TEST_ASSERT_GREATER_THAN(channel::kFoundingBackoffMinMs, channel::kFoundingBackoffMaxMs);
+}
+
+/* ── Discovery packet sizes ─────────────────────────────────────────────── */
+
+void test_discovery_request_packet_size(void) {
+    TEST_ASSERT_LESS_OR_EQUAL(250, static_cast<int>(sizeof(DiscoveryRequestPacket)));
+}
+
+void test_discovery_response_packet_size(void) {
+    TEST_ASSERT_LESS_OR_EQUAL(250, static_cast<int>(sizeof(DiscoveryResponsePacket)));
+}
+
+void test_receiver_presence_packet_size(void) {
+    TEST_ASSERT_LESS_OR_EQUAL(250, static_cast<int>(sizeof(ReceiverPresencePacket)));
+}
+
+void test_channel_migration_packet_size(void) {
+    TEST_ASSERT_LESS_OR_EQUAL(250, static_cast<int>(sizeof(ChannelMigrationPacket)));
+}
+
+/* ── Discovery packet construction & checksum ───────────────────────────── */
+
+void test_discovery_request_checksum(void) {
+    DiscoveryRequestPacket pkt{};
+    fillHeader(pkt, PacketType::DiscoveryRequest);
+    pkt.mac[0] = 0xAA;
+    pkt.mac[5] = 0xBB;
+    pkt.role   = static_cast<uint8_t>(DeviceRole::Receiver);
+    setChecksum(pkt);
+
+    auto *raw      = reinterpret_cast<uint8_t *>(&pkt);
+    uint8_t recomp = checksum(raw, sizeof(pkt) - 1);
+    TEST_ASSERT_EQUAL_UINT8(pkt.checksum, recomp);
+}
+
+void test_discovery_response_checksum(void) {
+    DiscoveryResponsePacket pkt{};
+    fillHeader(pkt, PacketType::DiscoveryResponse);
+    pkt.mac[0]       = 0x11;
+    pkt.mac[5]       = 0x22;
+    pkt.channel      = 6;
+    pkt.device_count = 3;
+    setChecksum(pkt);
+
+    auto *raw      = reinterpret_cast<uint8_t *>(&pkt);
+    uint8_t recomp = checksum(raw, sizeof(pkt) - 1);
+    TEST_ASSERT_EQUAL_UINT8(pkt.checksum, recomp);
+}
+
+void test_receiver_presence_checksum(void) {
+    ReceiverPresencePacket pkt{};
+    fillHeader(pkt, PacketType::ReceiverPresence);
+    pkt.mac[0]     = 0xCC;
+    pkt.model_type = static_cast<uint8_t>(ModelType::DumpTruck);
+    std::strncpy(pkt.name, "TestRx", kVehicleNameMax - 1);
+    setChecksum(pkt);
+
+    auto *raw      = reinterpret_cast<uint8_t *>(&pkt);
+    uint8_t recomp = checksum(raw, sizeof(pkt) - 1);
+    TEST_ASSERT_EQUAL_UINT8(pkt.checksum, recomp);
+}
+
+void test_channel_migration_checksum(void) {
+    ChannelMigrationPacket pkt{};
+    fillHeader(pkt, PacketType::ChannelMigration);
+    pkt.mac[0]      = 0xDD;
+    pkt.mac[5]      = 0xEE;
+    pkt.new_channel = 11;
+    setChecksum(pkt);
+
+    auto *raw      = reinterpret_cast<uint8_t *>(&pkt);
+    uint8_t recomp = checksum(raw, sizeof(pkt) - 1);
+    TEST_ASSERT_EQUAL_UINT8(pkt.checksum, recomp);
+}
+
+/* ── ChannelScanner basic tests ─────────────────────────────────────────── */
+
+void test_scanner_no_response(void) {
+    // Mock callbacks: setChannel and sendDiscovery succeed, delay is a no-op
+    auto setChannel    = [](uint8_t) { return true; };
+    auto sendDiscovery = [](uint8_t) { return true; };
+    auto delayMs       = [](uint32_t) {};
+
+    ChannelScanner scanner(setChannel, sendDiscovery, delayMs);
+    ScanResult result = scanner.scanChannel(1);
+
+    TEST_ASSERT_EQUAL_UINT8(1, result.channel);
+    TEST_ASSERT_FALSE(result.foundTransmitter);
+}
+
+void test_scanner_with_response(void) {
+    ChannelScanner *scannerPtr = nullptr;
+
+    auto setChannel    = [](uint8_t) { return true; };
+    auto sendDiscovery = [&scannerPtr](uint8_t ch) {
+        // Simulate receiving a discovery response during the scan
+        if (scannerPtr) {
+            scannerPtr->onDiscoveryResponse(ch, -45, 2);
+        }
+        return true;
+    };
+    auto delayMs = [](uint32_t) {};
+
+    ChannelScanner scanner(setChannel, sendDiscovery, delayMs);
+    scannerPtr = &scanner;
+
+    ScanResult result = scanner.scanChannel(6);
+
+    TEST_ASSERT_EQUAL_UINT8(6, result.channel);
+    TEST_ASSERT_TRUE(result.foundTransmitter);
+    TEST_ASSERT_EQUAL_INT8(-45, result.rssi);
+    TEST_ASSERT_EQUAL_UINT8(2, result.deviceCount);
+}
+
+void test_scanner_best_channel_with_transmitter(void) {
+    ScanResult results[channel::kCandidateChannelCount];
+
+    results[0].channel          = 1;
+    results[0].foundTransmitter = false;
+    results[0].rssi             = -127;
+
+    results[1].channel          = 6;
+    results[1].foundTransmitter = true;
+    results[1].rssi             = -50;
+
+    results[2].channel          = 11;
+    results[2].foundTransmitter = true;
+    results[2].rssi             = -30;
+
+    // Should pick channel 11 (best RSSI among transmitter channels)
+    TEST_ASSERT_EQUAL_UINT8(11, ChannelScanner::bestChannel(results));
+}
+
+void test_scanner_best_channel_no_transmitter(void) {
+    ScanResult results[channel::kCandidateChannelCount];
+
+    results[0].channel          = 1;
+    results[0].foundTransmitter = false;
+
+    results[1].channel          = 6;
+    results[1].foundTransmitter = false;
+
+    results[2].channel          = 11;
+    results[2].foundTransmitter = false;
+
+    // No transmitter → returns first candidate channel
+    TEST_ASSERT_EQUAL_UINT8(1, ChannelScanner::bestChannel(results));
+}
diff --git a/firmware/test/test_native/test_protocol.cpp b/firmware/test/test_native/test_protocol.cpp
index 472c65e..0e72dc7 100644
--- a/firmware/test/test_native/test_protocol.cpp
+++ b/firmware/test/test_native/test_protocol.cpp
@@ -118,28 +118,28 @@ void test_bind_packet_size(void) {
 }
 
 void test_announce_packet_size(void) {
-    TEST_ASSERT_LESS_OR_EQUAL(250, static_cast<int>(sizeof(AnnouncePacket)));
+    TEST_ASSERT_LESS_OR_EQUAL(250, static_cast<int>(sizeof(ReceiverPresencePacket)));
 }
 
-/* ── Announce packet ─────────────────────────────────────────────────────── */
+/* ── ReceiverPresence packet ─────────────────────────────────────────────── */
 
 void test_announce_packet_fields(void) {
-    AnnouncePacket pkt{};
-    fillHeader(pkt, PacketType::Announce);
+    ReceiverPresencePacket pkt{};
+    fillHeader(pkt, PacketType::ReceiverPresence);
     pkt.model_type = static_cast<uint8_t>(ModelType::Excavator);
 
     const char *name = "TestVehicle";
     std::memcpy(pkt.name, name, std::strlen(name) + 1);
 
     TEST_ASSERT_EQUAL_UINT8(kMagic0, pkt.magic[0]);
-    TEST_ASSERT_EQUAL_UINT8(static_cast<uint8_t>(PacketType::Announce), pkt.type);
+    TEST_ASSERT_EQUAL_UINT8(static_cast<uint8_t>(PacketType::ReceiverPresence), pkt.type);
     TEST_ASSERT_EQUAL_UINT8(static_cast<uint8_t>(ModelType::Excavator), pkt.model_type);
     TEST_ASSERT_EQUAL_STRING("TestVehicle", pkt.name);
 }
 
 void test_announce_packet_checksum(void) {
-    AnnouncePacket pkt{};
-    fillHeader(pkt, PacketType::Announce);
+    ReceiverPresencePacket pkt{};
+    fillHeader(pkt, PacketType::ReceiverPresence);
     pkt.model_type = static_cast<uint8_t>(ModelType::Crane);
     std::strncpy(pkt.name, "MyCrane", kVehicleNameMax - 1);
     pkt.mac[0] = 0xAA;
@@ -152,8 +152,8 @@ void test_announce_packet_checksum(void) {
 }
 
 void test_announce_packet_checksum_detects_corruption(void) {
-    AnnouncePacket pkt{};
-    fillHeader(pkt, PacketType::Announce);
+    ReceiverPresencePacket pkt{};
+    fillHeader(pkt, PacketType::ReceiverPresence);
     pkt.model_type = static_cast<uint8_t>(ModelType::Generic);
     setChecksum(pkt);
 
@@ -330,6 +330,44 @@ extern void test_model_name_excavator(void);
 extern void test_model_name_unknown(void);
 extern void test_channel_assignments_unique(void);
 
+/* Forward-declarations – channel / discovery tests (test_channel.cpp). */
+extern void test_channel_valid_1(void);
+extern void test_channel_valid_6(void);
+extern void test_channel_valid_11(void);
+extern void test_channel_invalid_0(void);
+extern void test_channel_invalid_2(void);
+extern void test_channel_invalid_5(void);
+extern void test_channel_invalid_7(void);
+extern void test_channel_invalid_12(void);
+extern void test_channel_invalid_13(void);
+extern void test_channel_invalid_255(void);
+extern void test_candidate_channel_count(void);
+extern void test_candidate_channel_0_is_1(void);
+extern void test_candidate_channel_1_is_6(void);
+extern void test_candidate_channel_2_is_11(void);
+extern void test_default_channel(void);
+extern void test_sim_port_channel_1(void);
+extern void test_sim_port_channel_6(void);
+extern void test_sim_port_channel_11(void);
+extern void test_sim_port_invalid_fallback(void);
+extern void test_channel_settle_positive(void);
+extern void test_discovery_wait_positive(void);
+extern void test_discovery_retries_at_least_one(void);
+extern void test_presence_interval_positive(void);
+extern void test_transmitter_loss_exceeds_presence(void);
+extern void test_founding_backoff_max_exceeds_min(void);
+extern void test_discovery_request_packet_size(void);
+extern void test_discovery_response_packet_size(void);
+extern void test_receiver_presence_packet_size(void);
+extern void test_channel_migration_packet_size(void);
+extern void test_discovery_request_checksum(void);
+extern void test_discovery_response_checksum(void);
+extern void test_receiver_presence_checksum(void);
+extern void test_channel_migration_checksum(void);
+extern void test_scanner_no_response(void);
+extern void test_scanner_with_response(void);
+extern void test_scanner_best_channel_with_transmitter(void);
+extern void test_scanner_best_channel_no_transmitter(void);
 /* Shell tokenizer tests (test_shell.cpp) */
 extern void test_tokenize_single_word(void);
 extern void test_tokenize_two_words(void);
@@ -460,6 +498,50 @@ int main(int argc, char **argv) {
     RUN_TEST(test_model_name_unknown);
     RUN_TEST(test_channel_assignments_unique);
 
+    /* Channel / discovery tests */
+    RUN_TEST(test_channel_valid_1);
+    RUN_TEST(test_channel_valid_6);
+    RUN_TEST(test_channel_valid_11);
+    RUN_TEST(test_channel_invalid_0);
+    RUN_TEST(test_channel_invalid_2);
+    RUN_TEST(test_channel_invalid_5);
+    RUN_TEST(test_channel_invalid_7);
+    RUN_TEST(test_channel_invalid_12);
+    RUN_TEST(test_channel_invalid_13);
+    RUN_TEST(test_channel_invalid_255);
+
+    RUN_TEST(test_candidate_channel_count);
+    RUN_TEST(test_candidate_channel_0_is_1);
+    RUN_TEST(test_candidate_channel_1_is_6);
+    RUN_TEST(test_candidate_channel_2_is_11);
+    RUN_TEST(test_default_channel);
+
+    RUN_TEST(test_sim_port_channel_1);
+    RUN_TEST(test_sim_port_channel_6);
+    RUN_TEST(test_sim_port_channel_11);
+    RUN_TEST(test_sim_port_invalid_fallback);
+
+    RUN_TEST(test_channel_settle_positive);
+    RUN_TEST(test_discovery_wait_positive);
+    RUN_TEST(test_discovery_retries_at_least_one);
+    RUN_TEST(test_presence_interval_positive);
+    RUN_TEST(test_transmitter_loss_exceeds_presence);
+    RUN_TEST(test_founding_backoff_max_exceeds_min);
+
+    RUN_TEST(test_discovery_request_packet_size);
+    RUN_TEST(test_discovery_response_packet_size);
+    RUN_TEST(test_receiver_presence_packet_size);
+    RUN_TEST(test_channel_migration_packet_size);
+
+    RUN_TEST(test_discovery_request_checksum);
+    RUN_TEST(test_discovery_response_checksum);
+    RUN_TEST(test_receiver_presence_checksum);
+    RUN_TEST(test_channel_migration_checksum);
+
+    RUN_TEST(test_scanner_no_response);
+    RUN_TEST(test_scanner_with_response);
+    RUN_TEST(test_scanner_best_channel_with_transmitter);
+    RUN_TEST(test_scanner_best_channel_no_transmitter);
     /* Shell tokenizer tests */
     RUN_TEST(test_tokenize_single_word);
     RUN_TEST(test_tokenize_two_words);