Remove unrelated ecosystem comparisons and software citations while retaining hardware links, measured model names, and required license notices.
Preserve stock-peer runners and tests in a verified local validation package. Keep shared Companion USB transport in the firmware repository for the raw-radio sweep and OTA seeder, with focused CI coverage. Restore missing hosted documentation links.
Share nRF52 checked-record reads and command-family lookups without changing
storage formats, error protection, fleet authorization, or delegated scopes.
Use the existing bounded Merkle proof workspace for qualified ESP32 repeaters
while retaining source capacity, wire format, and every enabled feature.
Restore advert tab/CRLF delimiters and expose nested qualification build logs.
Validation: all 1932 native CI test cases; exact canonical RAK4631 Full,
Wio-E5 Mini, Station G3 Full MQTT, and Wireless Tracker Full wrappers;
linked RAK crypto/workspace checks and retained Reader code equivalence;
focused persistence, authorization, source-proof, and RAM policy regressions.
Allow Auto, SSD1306 or SH1106 through display.controller on display-enabled RAK4631 and RAK3401 roles. Persist the choice before restart without changing the active screen policy, and let saved Auto override legacy build defaults.
Share checked settings I/O and the existing atomic writer to keep Full Companion within its flash boundary while retaining features and existing record formats. Cover save failures, backup recovery, startup selection and ambiguous OLED replies.
Validation: 35 targeted host tests passed. RAK4631 Full Companion and RAK3401 unified LoRa OTA repeater build and package checks passed with release-length version strings.
Use repeated status reads at screen initialization and preserve SSD1306 for ambiguous responses. Share the existing framebuffer, drawing, rotation and power handling; use SH1106 page transfers when detected.
Enable this for RAK4631 and RAK3401, including WisMesh Pocket v2/v3. Add controller overrides, protocol tests and CI coverage. Addresses meshcore-dev/MeshCore#3296.
Default fresh settings to sound off and vibration on, and keep existing saved choices. Apply changes immediately across all three UIs and make custom notification patterns respect the same mute controls.
Keep the Wio Mini Companion within its existing flash boundary by storing its LED switch in a reserved preference byte and shortening CLI help without removing commands. Add coverage for live output changes, persistence, and storage failures.
Adapted from https://github.com/meshcore-dev/MeshCore/pull/3603.
Co-authored-by: R0ck <develop@hectospark.co.uk>
Retain supported LR2021 bandwidths and reject frequency gaps. Enable LR1121 high-band bandwidth selection and account for its forced LDRO in profile and beacon airtime.
Cover all eight chip families with production-method regression tests.
Revoke fast-RX ownership before CRC, header and IQ setters, including failed writes. Cover normal RX rebuilds and unchanged defaults with production-method tests.
Add receive-only same-image display, SPI, modem/IQ-cache and scoped-priority experiments with checkpointed collectors. Keep rejected clock-phase correction and elevated-priority experiments out of production.
Publish sanitized timing data, Full Companion/Bluetooth/USB checks and redraw measurements with their limits. Wire the new behavioral checks into CI.
Reuse the confirmed LoRa modem only inside acknowledged warm continuous-RX hops and revoke that capability before modem initialization or after failures.
Opt the tested T-Deck into IQ workaround reuse and an exact 8,888,888 Hz SPI setting. Keep the existing BUSY, packet-ownership and recovery checks; other boards retain their modem-cache default.
Render into a PSRAM canvas and release the shared SPI bus between bounded TFT strips. Service only the radio driver at cooperative checkpoints and use the buffered radio HAL, preserving packet and transmit guards.
Cover pixel parity, transaction boundaries, allocation failure, partial updates and sleep/wake behavior with native tests.
Use the committed node credential for setup WiFi, WebConfig and browser OTA. Add persistent ESP32 WiFi Companion management credentials without changing preferences layouts, revoke stale browser sessions on rotation, retain scoped save receipts, and coordinate credential changes with flash uploads. Keep external-service credentials and trusted TCP protocol compatibility independent. Update live join QR codes, failure handling and documentation.
Validated 51 native cases, 158 related host and browser methods, and serial Full V4 Companion, Station G3 Repeater, ESP32-C6 Room Server and V4 Sensor firmware builds.
Integrate fractional Companion timezones and conditional Bluetooth pages while preserving the existing preference byte layout, transactional saves, and Full transport selector. Add migration, rollback, invalid-value, and UI profile regressions.
Upstream MeshCore, and this fork up to v1.17.1.6 except ESP32 Full
builds, rewrote /contacts3 in place, one record after another. A reset
or a full volume during that save leaves whole records followed by part
of the next one. Upstream reads such a file up to the short read. Here
readableContactFile() treats any size that is not a multiple of 152
bytes as unreadable, and since 2311160a9 the bounded recovery then
deletes /contacts3. On the first boot after an upgrade, three whole
records plus one stray byte became zero contacts.
Invariant: on ESP32, RP2040 and STM32, when /contacts3 holds at least
one whole record followed by part of one, and /contacts3.bak does not
exist, the whole records load and nothing is written or deleted at
boot. The next ordinary save publishes only whole records through the
existing transaction. Unchanged: whole-record images; a backup still
wins over an incomplete primary, including a backup that is unreadable
or of unknown presence at boot, which keeps its retry at the recovery
boundary; read errors keep the bounded recovery; a file with no whole
record is still discarded; nRF52 is not touched.
selectContactFile() makes this check only after the strict checks of
both names fail, through a new partial_tail mode of
readableContactFile(). loadContacts() drops its own size check; its
whole-record loop bound already stops before the tail.
Add test_companion_contact_partial_tail.py, which runs the real load,
recovery and save paths on the uncached ESP32, RP2040 and STM32
harness and on the ESP32 Full cache harness under ASan/UBSan. On the
old code all four fail with zero contacts and /contacts3 deleted. It
catches 14 of 15 mutations of this change, including a full revert;
the other drops a guard whose value is read only when the file handle
is valid. Two cases in the uncached storage fixture used a one-byte
truncation as their unreadable image; they now use a file shorter than
one record, so they still exercise the discard path.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
/api/login locked every client for 30 s after five failures from anyone.
Anyone who could reach the login page could keep the owner locked out by
failing on purpose. If no login succeeded after a lockout, the lock also
returned from 2^31 to 2^32 ms (about 24.9 to 49.7 days) later, because the
deadline was never cleared and was compared as a signed difference.
Count failures per remote address instead. Five failures lock that address
for 30 s, as before. A shared budget caps failures from all addresses
together, so changing address does not add guesses: it holds six failures
and refills one every 6 s, the old global rate, so one failing address can
never empty it on its own. While it is empty every client waits, as before.
Lock times are measured as elapsed time.
The policy is a pure header, WebConfigLoginThrottle.h.
test_webconfig_login_throttle.py runs it directly (isolation, boundaries,
one-hour rate bounds, millis() half-wrap, saturation, eviction) and runs the
real handleLogin with ArduinoJson under ASan/UBSan. Putting every client on
one key, as the old code did, fails the handler test.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Wi-Fi, LoRa first-stage and Partition Expander bridges serve an
unauthenticated /update behind an AP whose password was fixed and published,
so anyone in range during a migration could upload firmware while the private
key is staged. Use the old node's saved admin password as the WPA2
passphrase, read from /com_prefs or /node_prefs at offset 56 as the firmware
loads it. The operator already used that password to start the old updater.
Fall back to the published password, with a serial warning, when the saved
admin password is missing, unreadable, shorter than 8 characters or not
printable ASCII, so no node becomes unreachable. The legacy filesystem is
mounted without formatting and the password is never printed. Migration
admission, flash sequencing, /update gating and the USB bridge are unchanged.
Update both guides and the package README.
Add a sanitizer-backed host test that compiles the bridge's actual Wi-Fi
block against fake SPIFFS and WiFi: both boots, file precedence, WPA2 length
and terminator bounds, printable characters, stock 1.10/1.11 file sizes,
truncated fields, and mount, seek and partial-read failures. It fails 8 of 8
on the previous code and catches 27 of 27 code mutations. Verified 13 related
host test files and the esp32_s3_4mb_partition_migrator build.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
On a room server the guest password grants Read/Write, which the login
replay store treats as a role that needs a durable record. Every new
guest-password identity therefore took one of the 128 permanent slots,
and once they were used up the store failed closed for every new
identity, including a new administrator device, until the filesystem was
erased. Rooms often publish the guest password.
A guest-password Read/Write session (one without explicitly assigned
permissions) now uses the policy public readers already use: it must
beat its in-boot timestamp and any record the identity already has,
which is still advanced, but it never creates a new record.
Administrator logins and explicitly assigned roles keep the durable
reservation and still fail closed on a full store.
Tests: test_room_login_replay_capacity.py runs the real room login
handler against the real ClientACL replay store with ASan/UBSan: guest
churn cannot lock out a new admin or assigned writer, a former admin's
record still binds guest-password logins, and a store full of privileged
records still refuses a new admin. It fails 2 of 3 on the previous code.
Two expectations in test_room_login_integration.py and the login profile
contract follow the new policy.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mikecarper
nullrouten0andClaude Opus 5.5