* version 1.17.1

Merge pull request #3206 from meshcore-dev/nrf-combine-rng-entropy
combine radio's entropy with CC310 RNG
2026-08-14 22:19:19 +10:00 · 2026-08-14 22:09:26 +10:00 · 2026-08-14 17:46:43 +10:00 · 2026-08-14 16:44:59 +10:00 · 2026-08-14 16:42:54 +10:00 · 2026-08-14 16:30:12 +10:00
81 changed files with 2607 additions and 225 deletions
@@ -0,0 +1,43 @@
+{
+  "build": {
+    "arduino": {
+      "ldscript": "esp32s3_out.ld",
+      "partitions": "default_16MB.csv",
+      "memory_type": "qio_opi"
+      },
+    "core": "esp32",
+    "extra_flags": [
+      "-DBOARD_HAS_PSRAM",
+      "-DARDUINO_USB_CDC_ON_BOOT=1",
+      "-DARDUINO_USB_MODE=1",
+      "-DARDUINO_RUNNING_CORE=1",
+      "-DARDUINO_EVENT_RUNNING_CORE=1"
+    ],
+    "f_cpu": "240000000L",
+    "f_flash": "80000000L",
+    "flash_mode": "qio",
+    "psram_type": "opi",
+    "hwids": [["0x303A", "0x0002"], ["0x303A", "0x1001"]],
+    "mcu": "esp32s3",
+    "variant": "meshnology_w12"
+  },
+  "connectivity": ["wifi", "bluetooth", "lora"],
+  "debug": {
+    "default_tool": "esp-builtin",
+    "onboard_tools": ["esp-builtin"],
+    "openocd_target": "esp32s3.cfg"
+  },
+  "frameworks": ["arduino", "espidf"],
+  "name": "heltec_wifi_lora_32 v5 (16 MB FLASH, 8 MB PSRAM)",
+  "upload": {
+    "flash_size": "16MB",
+    "maximum_ram_size": 327680,
+    "maximum_size": 16777216,
+    "use_1200bps_touch": true,
+    "wait_for_upload_port": true,
+    "require_upload_port": true,
+    "speed": 921600
+  },
+  "url": "https://heltec.org/",
+  "vendor": "heltec"
+}
@@ -0,0 +1,60 @@
+{
+  "build": {
+    "arduino": {
+      "ldscript": "nrf52840_s140_v7.ld"
+    },
+    "core": "nRF5",
+    "cpu": "cortex-m4",
+    "extra_flags": "-DARDUINO_WIO_WM1110 -DNRF52840_XXAA",
+    "f_cpu": "64000000L",
+    "hwids": [
+      ["0x239A", "0x8029"],
+      ["0x239A", "0x0029"],
+      ["0x239A", "0x002A"],
+      ["0x239A", "0x802A"],
+      ["0x2886", "0x0057"]
+    ],
+    "usb_product": "X1-BOOT",
+    "mcu": "nrf52840",
+    "variant": "Seeed_Mesh-Tracker-X1",
+    "bsp": {
+      "name": "adafruit"
+    },
+    "softdevice": {
+      "sd_flags": "-DS140",
+      "sd_name": "s140",
+      "sd_version": "7.3.0",
+      "sd_fwid": "0x0123"
+    },
+    "bootloader": {
+      "settings_addr": "0xFF000"
+    }
+  },
+  "connectivity": ["bluetooth"],
+  "debug": {
+    "jlink_device": "nRF52840_xxAA",
+    "svd_path": "nrf52840.svd",
+    "openocd_target": "nrf52.cfg"
+  },
+  "frameworks": ["arduino"],
+  "name": "Seeed SenseCAP MeshTracker X1",
+  "upload": {
+    "maximum_ram_size": 248832,
+    "maximum_size": 815104,
+    "speed": 115200,
+    "protocol": "nrfutil",
+    "protocols": [
+      "jlink",
+      "nrfjprog",
+      "nrfutil",
+      "stlink",
+      "cmsis-dap",
+      "blackmagic"
+    ],
+    "use_1200bps_touch": true,
+    "require_upload_port": true,
+    "wait_for_upload_port": true
+  },
+  "url": "https://www.seeedstudio.com/SenseCAP-MeshTracker-X1-for-Meshtastic-p-6793.html",
+  "vendor": "Seeed Studio"
+}
@@ -34,6 +34,9 @@ $ sh build.sh build-repeater-firmwares
 Build all chat room server firmwares
 $ sh build.sh build-room-server-firmwares

+Build all kiss radio firmwares
+$ sh build.sh build-kiss-radio-firmwares
+
 Environment Variables:
  DISABLE_DEBUG=1: Disables all debug logging flags (MESH_DEBUG, MESH_PACKET_LOGGING, etc.)
                   If not set, debug flags from variant platformio.ini files are used.
@@ -242,6 +245,17 @@ build_room_server_firmwares() {

 }

+build_kiss_modem_firmwares() {
+
+#  # build specific kiss radio firmwares
+#  build_firmware "Heltec_v3_kiss_modem"
+#  build_firmware "RAK_4631_kiss_modem"
+
+  # build all room server firmwares
+  build_all_firmwares_by_suffix "_kiss_modem"
+
+}
+
 build_firmwares() {
  build_companion_firmwares
  build_repeater_firmwares
@@ -278,6 +292,8 @@ elif [[ $1 == "build-repeater-firmwares" ]]; then
  build_repeater_firmwares
 elif [[ $1 == "build-room-server-firmwares" ]]; then
  build_room_server_firmwares
+elif [[ $1 == "build-kiss-radio-firmwares" ]]; then
+  build_kiss_modem_firmwares
 elif [[ $1 == "get-companion-firmwares-to-build" ]]; then
  get_pio_envs_ending_with_string "_companion_radio_usb"
  get_pio_envs_ending_with_string "_companion_radio_ble"
@@ -291,6 +291,22 @@ This document provides an overview of CLI commands that can be sent to MeshCore

 ---

+#### View or change the LoRa FEM transmit-path gain state on supported boards
+**Usage:**
+- `get radio.fem.txgain`
+- `set radio.fem.txgain <state>`
+
+**Parameters:**
+- `state`: `on`|`off`
+
+**Notes:**
+- This controls a software-selectable external LoRa FEM transmit gain where the board supports it.
+- On Station G3, remove the PA PL1 jumper to allow software control. `on` selects PA PL1 high/short and `off` selects PA PL1 low/open. The PA PL2 hardware jumper determines whether this switches between power levels 1/3 or 2/4.
+- Select an operating level and SX1262 transmit power that comply with local RF limits and the Station G3 power-supply requirements.
+- The setting is saved immediately, but on Station G3 the level is applied to the hardware at the start of the next transmit, so that the PA supply rail is never re-targeted while the PA is being driven. `get` reports the configured state, which may lead the hardware until the node next transmits.
+
+---
+
 ### System

 #### View or change this node's name
@@ -440,6 +440,8 @@ Byte 0: 0x14
    - Uses a secret key derived from the channel name
    - It is the first 16 bytes of `sha256("#test")`
    - For example hashtag channel `#test` has the key: `9cd8fcf22a47333b591d96a2b848b73f`
+    - Traffic is encrypted on air, but anyone who knows or guesses the channel
+      name can derive the key. Hashtag channels should not be treated as private.
    - Used as a topic based public group chat, separate from the default public channel
 3. **Private Channels**
    - Uses a randomly generated 16-byte secret key
@@ -236,6 +236,9 @@ txt_type

 The plaintext contained in the ciphertext matches the format described in [plain text message](#plain-text-message). Specifically, it consists of a four byte timestamp, a flags byte, and the message. The flags byte will generally be `0x00` because it is a "plain text message". The message will be of the form `<sender name>: <message body>` (eg., `user123: I'm on my way`).

+The sender name is unverified message text. Group messages contain no sender
+signature, so any channel-key holder can choose any sender name.
+
 ## Group datagram

 | Field        | Size (bytes)    | Description                                  |
@@ -262,7 +262,7 @@ int MyMesh::getInterferenceThreshold() const {
  return 0; // disabled for now, until currentRSSI() problem is resolved
 }
 bool MyMesh::getCADEnabled() const {
-  return true; // hardware CAD before TX (no CLI toggle on companion; enabled by default)
+  return false; // hardware CAD before TX (disabled by default, until configurable)
 }

 int MyMesh::calcRxDelay(float score, uint32_t air_time) const {
@@ -885,6 +885,8 @@ MyMesh::MyMesh(mesh::Radio &radio, mesh::RNG &rng, mesh::RTCClock &rtc, SimpleMe
  _prefs.tx_power_dbm = LORA_TX_POWER;
  _prefs.gps_enabled = 0;       // GPS disabled by default
  _prefs.gps_interval = 0;      // No automatic GPS updates by default
+  _prefs.radio_fem_rxgain = 1;
+  _prefs.radio_fem_txgain = 0;
  //_prefs.rx_delay_base = 10.0f;  enable once new algo fixed
  _prefs.setRepeatEn(false);
 #if defined(USE_SX1262) || defined(USE_SX1268)
@@ -974,6 +976,8 @@ void MyMesh::begin(bool has_display) {
  radio_driver.setParams(_prefs.freq, _prefs.bw, _prefs.sf, _prefs.cr);
  radio_driver.setTxPower(_prefs.tx_power_dbm);
  radio_driver.setRxBoostedGainMode(_prefs.rx_boosted_gain);
+  board.setLoRaFemLnaEnabled(_prefs.radio_fem_rxgain);
+  board.setLoRaFemPaGainEnabled(_prefs.radio_fem_txgain);
  MESH_DEBUG_PRINTLN("RX Boosted Gain Mode: %s",
                     radio_driver.getRxBoostedGainMode() ? "Enabled" : "Disabled");
 }
@@ -8,11 +8,11 @@
 #define FIRMWARE_VER_CODE 13

 #ifndef FIRMWARE_BUILD_DATE
-#define FIRMWARE_BUILD_DATE "6 Jun 2026"
+#define FIRMWARE_BUILD_DATE "14 Aug 2026"
 #endif

 #ifndef FIRMWARE_VERSION
-#define FIRMWARE_VERSION "v1.16.0"
+#define FIRMWARE_VERSION "v1.17.1"
 #endif

 #if defined(NRF52_PLATFORM) || defined(STM32_PLATFORM)
@@ -28,10 +28,13 @@ public:
  uint32_t ble_pin = 0;
  uint8_t  advert_loc_policy = 0;
  uint8_t  buzzer_quiet = 0;
+  uint8_t  vibe_quiet = 0;
  uint8_t  gps_enabled = 0;      // GPS enabled flag (0=disabled, 1=enabled)
  uint32_t gps_interval = 0;     // GPS read interval in seconds
  uint8_t autoadd_config = 0;    // bitmask for auto-add contacts config
  uint8_t rx_boosted_gain = 0; // SX126x RX boosted gain mode (0=power saving, 1=boosted)
+  uint8_t radio_fem_rxgain = 0; // external LoRa FEM RX gain (LNA)
+  uint8_t radio_fem_txgain = 0; // external LoRa FEM TX gain (low by default)
  uint8_t _client_repeat = 0;  // DEPRECATED -> use repeat.disable_fwd
  uint8_t path_hash_mode = 0;    // which path mode to use when sending
  uint8_t autoadd_max_hops = 0;  // 0 = no limit, 1 = direct (0 hops), N = up to N-1 hops (max 64)
@@ -50,7 +53,12 @@ private:
      //def("cad", _parent->cad_enabled);
      //def("int_thr", _parent->interference_threshold);
      def("rxgain", _parent->rx_boosted_gain);
-      def("fem_rxgain", _parent->rx_boosted_gain);
+    #if 0
+      // NOTE: these cannot be set (yet) so don't load/save until we can.
+      //       also, fem_rxgain WAS mapped to wrong JSON property previously
+      def("fem_rxgain", _parent->radio_fem_rxgain);
+      def("fem_txgain", _parent->radio_fem_txgain);
+    #endif
      def("tx", _parent->tx_power_dbm);
      def("af", _parent->airtime_factor);
      def("rxdelay", _parent->rx_delay_base);
@@ -101,6 +109,7 @@ private:
      def("defs_key", (void *) _parent->default_scope_key, sizeof(_parent->default_scope_key));
      def("pin", _parent->ble_pin);
      def("buzz_q", _parent->buzzer_quiet);
+      def("vibe_q", _parent->vibe_quiet);
      def("auto_add", _parent->autoadd_config);    // bitmask for auto-add contacts config
      def("man_add", _parent->manual_add_contacts);
      def("tel_base", _parent->telemetry_mode_base);
@@ -133,4 +142,4 @@ public:
  // new accessor methods
  bool isRepeatEn() const { return repeat.disable_fwd == 0; }
  void setRepeatEn(bool en) { repeat.disable_fwd = en ? 0 : 1; }
-};
+};
@@ -6,12 +6,19 @@
 #define AUTO_OFF_MILLIS     15000   // 15 seconds
 #define BOOT_SCREEN_MILLIS   3000   // 3 seconds

-#ifdef PIN_STATUS_LED
+#if defined(PIN_STATUS_LED) || defined(PIN_STATUS_LED_R)
 #define LED_ON_MILLIS     20
 #define LED_ON_MSG_MILLIS 200
 #define LED_CYCLE_MILLIS  4000
 #endif

+#if defined(PIN_STATUS_LED_R) && defined(PIN_STATUS_LED_G) && defined(PIN_STATUS_LED_B)
+#define STATUS_LED_RGB 1
+#ifndef LOW_BATT_MILLIVOLTS
+#define LOW_BATT_MILLIVOLTS 3500
+#endif
+#endif
+
 #ifndef USER_BTN_PRESSED
 #define USER_BTN_PRESSED LOW
 #endif
@@ -60,6 +67,11 @@ void UITask::begin(DisplayDriver* display, SensorManager* sensors, NodePrefs* no
  buzzer.startup();
 #endif

+#ifdef HAS_DRV2605
+  vibration.begin();
+  vibration.quiet(_node_prefs->vibe_quiet);
+#endif
+
  // Initialize digital button if available
 #ifdef PIN_USER_BTN
  _userButton = new Button(PIN_USER_BTN, USER_BTN_PRESSED);
@@ -130,6 +142,10 @@ void UITask::clearMsgPreview() {
 void UITask::newMsg(uint8_t path_len, const char* from_name, const char* text, int msgcount) {
  _msgcount = msgcount;

+#ifdef HAS_DRV2605
+  vibration.trigger();   // vibrate even while the app is connected (honors quiet + cooldown)
+#endif
+
  if (path_len == 0xFF) {
    sprintf(_origin, "(F) %s", from_name);
  } else {
@@ -260,8 +276,114 @@ void UITask::renderCurrScreen() {
  _need_refresh = false;
 }

+#ifdef STATUS_LED_RGB
+static void statusLedWrite(uint8_t r, uint8_t g, uint8_t b) {
+  analogWrite(PIN_STATUS_LED_R, r);
+  analogWrite(PIN_STATUS_LED_G, g);
+  analogWrite(PIN_STATUS_LED_B, b);
+}
+
+static void statusLedWheel(uint8_t pos) {   // smooth hue sweep, 0..255
+  if (pos < 85) {
+    statusLedWrite(255 - pos * 3, pos * 3, 0);
+  } else if (pos < 170) {
+    pos -= 85;
+    statusLedWrite(0, 255 - pos * 3, pos * 3);
+  } else {
+    pos -= 170;
+    statusLedWrite(pos * 3, 0, 255 - pos * 3);
+  }
+}
+#endif
+
 void UITask::userLedHandler() {
-#ifdef PIN_STATUS_LED
+#ifdef STATUS_LED_RGB
+  static bool booted = false;
+  static bool flourish_active = false;
+  static unsigned long flourish_until = 0;
+  static int prev_msgcount = 0;
+  static int state = 0;
+  static unsigned long next_change = 0;
+  static int last_increment = 0;
+  static unsigned long next_batt_check = 0;
+  static bool low_batt = false;
+
+  unsigned long cur_time = millis();
+
+  if (!booted) {   // color sweep on boot
+    booted = true;
+    flourish_until = cur_time + 1200;
+    flourish_active = true;
+  }
+  if (_msgcount > prev_msgcount) {   // color sweep when a new message arrives
+    flourish_until = cur_time + 800;
+    flourish_active = true;
+  }
+  prev_msgcount = _msgcount;
+
+  if (flourish_active) {
+    if (cur_time < flourish_until) {
+      statusLedWheel((cur_time % 1200) * 255 / 1200);
+      return;
+    }
+    statusLedWrite(0, 0, 0);
+    flourish_active = false;
+    state = 0;
+    next_change = cur_time;
+  }
+
+  if (cur_time > next_batt_check) {   // battery reads are not free, keep them rare
+    low_batt = _board->getBattMilliVolts() < LOW_BATT_MILLIVOLTS;
+    next_batt_check = cur_time + 60000;
+  }
+
+#ifdef EXT_CHRG_DETECT
+  // charge status display while docked (skipped when messages are waiting,
+  // so the unread indication is never masked)
+  static unsigned long next_pwr_check = 0;
+  static bool ext_powered = false, ext_charging = false;
+  if (cur_time > next_pwr_check) {
+    ext_powered = _board->isExternalPowered();
+    ext_charging = ext_powered && digitalRead(EXT_CHRG_DETECT) == LOW;
+    next_pwr_check = cur_time + 1000;
+  }
+  if (ext_powered && _msgcount == 0) {
+    if (ext_charging) {
+      // amber breathing while charging
+      int ph = cur_time % 2000;
+      int v = ph < 1000 ? ph : 2000 - ph;
+      uint8_t lvl = (uint8_t)(v * 255 / 1000);
+      statusLedWrite(lvl, (uint8_t)(lvl * 35 / 100), 0);
+    } else {
+      statusLedWrite(0, 40, 0);   // dim solid green: charge complete
+    }
+    state = 0;
+    next_change = cur_time;
+    return;
+  }
+#endif
+
+  if (cur_time > next_change) {
+    if (state == 0) {
+      state = 1;
+      last_increment = (_msgcount > 0) ? LED_ON_MSG_MILLIS : LED_ON_MILLIS;
+      next_change = cur_time + last_increment;
+      if (low_batt) {
+        statusLedWrite(255, 0, 0);      // red: battery low
+      } else if (_msgcount > 0) {
+        statusLedWrite(255, 90, 0);     // amber: unread messages
+      } else if (_connected) {
+        statusLedWrite(0, 0, 255);      // blue: app connected
+      } else {
+        statusLedWrite(0, 255, 0);      // green: heartbeat
+      }
+    } else {
+      state = 0;
+      next_change = cur_time + LED_CYCLE_MILLIS - last_increment;
+      statusLedWrite(0, 0, 0);
+    }
+  }
+#elif defined(PIN_STATUS_LED)
  static int state = 0;
  static int next_change = 0;
  static int last_increment = 0;
@@ -406,8 +528,26 @@ void UITask::handleButtonDoublePress() {

 void UITask::handleButtonTriplePress() {
  MESH_DEBUG_PRINTLN("UITask: triple press triggered");
-  // Toggle buzzer quiet mode
-  #ifdef PIN_BUZZER
+#if defined(PIN_BUZZER) && defined(HAS_DRV2605)
+  // cycle alert modes: Buzz+Vibe -> Buzz only -> Vibe only -> Silent
+  int mode = (_node_prefs->buzzer_quiet ? 2 : 0) | (_node_prefs->vibe_quiet ? 1 : 0);
+  mode = (mode + 1) & 3;
+  _node_prefs->buzzer_quiet = (mode & 2) ? 1 : 0;
+  _node_prefs->vibe_quiet = (mode & 1) ? 1 : 0;
+  buzzer.quiet(_node_prefs->buzzer_quiet);
+  vibration.quiet(_node_prefs->vibe_quiet);
+  // audible/tactile confirmation of the new mode (no screen on some boards)
+  if (!_node_prefs->buzzer_quiet) notify(UIEventType::ack);
+  if (!_node_prefs->vibe_quiet) vibration.trigger(true);
+  switch (mode) {
+    case 0: sprintf(_alert, "Alerts: Buzz+Vibe"); break;
+    case 1: sprintf(_alert, "Alerts: Buzz only"); break;
+    case 2: sprintf(_alert, "Alerts: Vibe only"); break;
+    default: sprintf(_alert, "Alerts: Silent"); break;
+  }
+  the_mesh.savePrefs();
+  _need_refresh = true;
+#elif defined(PIN_BUZZER)
    if (buzzer.isQuiet()) {
      buzzer.quiet(false);
      notify(UIEventType::ack);
@@ -419,7 +559,7 @@ void UITask::handleButtonTriplePress() {
    _node_prefs->buzzer_quiet = buzzer.isQuiet();
    the_mesh.savePrefs();
    _need_refresh = true;
-  #endif
+#endif
 }

 void UITask::handleButtonQuadruplePress() {
@@ -14,11 +14,18 @@

 #include "Button.h"

+#ifdef HAS_DRV2605
+  #include <helpers/ui/DRV2605Vibration.h>
+#endif
+
 class UITask : public AbstractUITask {
  DisplayDriver* _display;
  SensorManager* _sensors;
 #ifdef PIN_BUZZER
  genericBuzzer buzzer;
+#endif
+#ifdef HAS_DRV2605
+  DRV2605Vibration vibration;
 #endif
  unsigned long _next_refresh, _auto_off;
  NodePrefs* _node_prefs;
@@ -147,11 +147,10 @@ uint8_t MyMesh::handleLoginReq(const mesh::Identity& sender, const uint8_t* secr
 uint8_t MyMesh::handleAnonRegionsReq(const mesh::Identity& sender, uint32_t sender_timestamp, const uint8_t* data) {
  if (anon_limiter.allow(rtc_clock.getCurrentTime())) {
    // request data has: {reply-path-len}{reply-path}
-    reply_path_len = *data & 63;
-    reply_path_hash_size = (*data >> 6) + 1;
-    data++;
+    reply_path_len = *data++;
+    if (!mesh::Packet::isValidPathLen(reply_path_len)) return 0;  // reject - bad encoding

-    memcpy(reply_path, data, ((uint8_t)reply_path_len) * reply_path_hash_size);
+    mesh::Packet::writePath(reply_path, data, reply_path_len);
    // data += (uint8_t)reply_path_len * reply_path_hash_size;

    memcpy(reply_data, &sender_timestamp, 4);   // prefix with sender_timestamp, like a tag
@@ -166,11 +165,10 @@ uint8_t MyMesh::handleAnonRegionsReq(const mesh::Identity& sender, uint32_t send
 uint8_t MyMesh::handleAnonOwnerReq(const mesh::Identity& sender, uint32_t sender_timestamp, const uint8_t* data) {
  if (anon_limiter.allow(rtc_clock.getCurrentTime())) {
    // request data has: {reply-path-len}{reply-path}
-    reply_path_len = *data & 63;
-    reply_path_hash_size = (*data >> 6) + 1;
-    data++;
+    reply_path_len = *data++;
+    if (!mesh::Packet::isValidPathLen(reply_path_len)) return 0;  // reject - bad encoding

-    memcpy(reply_path, data, ((uint8_t)reply_path_len) * reply_path_hash_size);
+    mesh::Packet::writePath(reply_path, data, reply_path_len);
    // data += (uint8_t)reply_path_len * reply_path_hash_size;

    memcpy(reply_data, &sender_timestamp, 4);   // prefix with sender_timestamp, like a tag
@@ -186,11 +184,10 @@ uint8_t MyMesh::handleAnonOwnerReq(const mesh::Identity& sender, uint32_t sender
 uint8_t MyMesh::handleAnonClockReq(const mesh::Identity& sender, uint32_t sender_timestamp, const uint8_t* data) {
  if (anon_limiter.allow(rtc_clock.getCurrentTime())) {
    // request data has: {reply-path-len}{reply-path}
-    reply_path_len = *data & 63;
-    reply_path_hash_size = (*data >> 6) + 1;
-    data++;
+    reply_path_len = *data++;
+    if (!mesh::Packet::isValidPathLen(reply_path_len)) return 0;  // reject - bad encoding

-    memcpy(reply_path, data, ((uint8_t)reply_path_len) * reply_path_hash_size);
+    mesh::Packet::writePath(reply_path, data, reply_path_len);
    // data += (uint8_t)reply_path_len * reply_path_hash_size;

    memcpy(reply_data, &sender_timestamp, 4);   // prefix with sender_timestamp, like a tag
@@ -414,24 +411,31 @@ bool MyMesh::isLooped(const mesh::Packet* packet, const uint8_t max_counters[])
 }

 void MyMesh::sendFloodReply(mesh::Packet* packet, unsigned long delay_millis, uint8_t path_hash_size) {
-  if (recv_pkt_region && !recv_pkt_region->isWildcard()) {  // if _request_ packet scope is known, send reply with same scope
-    TransportKey scope;
-    if (region_map.getTransportKeysFor(*recv_pkt_region, &scope, 1) > 0) {
-      sendFloodScoped(scope, packet, delay_millis, path_hash_size);
-    } else {
+  TransportKey req_scope;
+  bool is_wildcard = recv_pkt_region != NULL && recv_pkt_region->isWildcard();
+  bool req_scope_known = recv_pkt_region != NULL && !is_wildcard
+                      && region_map.getTransportKeysFor(*recv_pkt_region, &req_scope, 1) > 0;
+
+  switch (mesh::chooseReplyScope(req_scope_known, is_wildcard, !default_scope.isNull())) {
+    case mesh::REPLY_SCOPE_REQUEST:
+      sendFloodScoped(req_scope, packet, delay_millis, path_hash_size);   // reply with same scope as request
+      break;
+    case mesh::REPLY_SCOPE_DEFAULT:
+      // requester's scope is unknown: DIRECT request (no transport codes), or code matched no Region.
+      // un-scoped would be dropped at hop 0 by repeaters running flood.max.unscoped=0
+      sendFloodScoped(default_scope, packet, delay_millis, path_hash_size);
+      break;
+    case mesh::REPLY_SCOPE_NONE:
      sendFlood(packet, delay_millis, path_hash_size);  // send un-scoped
-    }
-  } else {
-    sendFlood(packet, delay_millis, path_hash_size);  // send un-scoped
+      break;
  }
 }

 bool MyMesh::allowPacketForward(const mesh::Packet *packet) {
  if (_prefs.disable_fwd) return false;
-  if (packet->isRouteFlood()) {
-    if (packet->getPathHashCount() >= _prefs.flood_max) return false;
-    if (packet->getRouteType() == ROUTE_TYPE_FLOOD && packet->getPathHashCount() >= _prefs.flood_max_unscoped) return false;
-    if (packet->getPayloadType() == PAYLOAD_TYPE_ADVERT && packet->getPathHashCount() >= _prefs.flood_max_advert) return false;
+  if (packet->isRouteFlood()
+      && mesh::isFloodHopLimitExceeded(packet, _prefs.flood_max, _prefs.flood_max_unscoped, _prefs.flood_max_advert)) {
+    return false;
  }
  if (packet->isRouteFlood() && recv_pkt_region == NULL) {
    MESH_DEBUG_PRINTLN("allowPacketForward: unknown transport code, or wildcard not allowed for FLOOD packet");
@@ -574,7 +578,7 @@ void MyMesh::onAnonDataRecv(mesh::Packet *packet, const uint8_t *secret, const m
    data[len] = 0;  // ensure null terminator
    uint8_t reply_len;

-    reply_path_len = -1;
+    reply_path_len = 0xFF;
    if (data[4] == 0 || data[4] >= ' ') {   // is password, ie. a login request
      reply_len = handleLoginReq(sender, secret, timestamp, &data[4], packet->isRouteFlood());
    } else if (data[4] == ANON_REQ_TYPE_REGIONS && packet->isRouteDirect()) {
@@ -589,18 +593,29 @@ void MyMesh::onAnonDataRecv(mesh::Packet *packet, const uint8_t *secret, const m

    if (reply_len == 0) return;   // invalid request

-    if (packet->isRouteFlood()) {
+    // a DIRECT login can reply via the stored out_path, as onPeerDataRecv() does for REQ
+    ClientInfo* client = acl.getClient(sender.pub_key, PUB_KEY_SIZE);
+    bool have_out_path = client != NULL && client->out_path_len != OUT_PATH_UNKNOWN;
+
+    auto route = mesh::chooseReplyRoute(packet->isRouteFlood(), reply_path_len != 0xFF, have_out_path);
+
+    if (route == mesh::REPLY_ROUTE_PATH_RETURN) {
      // let this sender know path TO here, so they can use sendDirect(), and ALSO encode the response
      mesh::Packet* path = createPathReturn(sender, secret, packet->path, packet->path_len,
                                            PAYLOAD_TYPE_RESPONSE, reply_data, reply_len);
      if (path) sendFloodReply(path, SERVER_RESPONSE_DELAY, packet->getPathHashSize());
-    } else if (reply_path_len < 0) {
-      mesh::Packet* reply = createDatagram(PAYLOAD_TYPE_RESPONSE, sender, secret, reply_data, reply_len);
-      if (reply) sendFloodReply(reply, SERVER_RESPONSE_DELAY, packet->getPathHashSize());
+      return;
+    }
+
+    mesh::Packet* reply = createDatagram(PAYLOAD_TYPE_RESPONSE, sender, secret, reply_data, reply_len);
+    if (reply == NULL) return;
+
+    if (route == mesh::REPLY_ROUTE_DIRECT_SUPPLIED) {
+      sendDirect(reply, reply_path, reply_path_len, SERVER_RESPONSE_DELAY);
+    } else if (route == mesh::REPLY_ROUTE_DIRECT_OUT_PATH) {
+      sendDirect(reply, client->out_path, client->out_path_len, SERVER_RESPONSE_DELAY);
    } else {
-      mesh::Packet* reply = createDatagram(PAYLOAD_TYPE_RESPONSE, sender, secret, reply_data, reply_len);
-      uint8_t path_len = ((reply_path_hash_size - 1) << 6) | (reply_path_len & 63);
-      if (reply) sendDirect(reply, reply_path,  path_len, SERVER_RESPONSE_DELAY);
+      sendFloodReply(reply, SERVER_RESPONSE_DELAY, packet->getPathHashSize());
    }
  }
 }
@@ -917,6 +932,7 @@ MyMesh::MyMesh(mesh::MainBoard &board, mesh::Radio &radio, mesh::MillisecondCloc
 #endif
 #endif
  _prefs.radio_fem_rxgain = 1;
+  _prefs.radio_fem_txgain = 0;

  pending_discover_tag = 0;
  pending_discover_until = 0;
@@ -966,6 +982,7 @@ void MyMesh::begin(FILESYSTEM *fs) {
  MESH_DEBUG_PRINTLN("RX Boosted Gain Mode: %s",
                     radio_driver.getRxBoostedGainMode() ? "Enabled" : "Disabled");
  board.setLoRaFemLnaEnabled(_prefs.radio_fem_rxgain);
+  board.setLoRaFemPaGainEnabled(_prefs.radio_fem_txgain);

  updateAdvertTimer();
  updateFloodAdvertTimer();
@@ -1064,6 +1081,12 @@ bool MyMesh::setRxBoostedGain(bool enable) {
  return radio_driver.setRxBoostedGainMode(enable);
 }

+#if defined(USE_LR2021)
+bool MyMesh::configSideDetectors(const uint8_t sideDetSFs[], uint8_t num, float bw) {
+  return radio_driver.configSideDetectors(sideDetSFs, num, bw);
+}
+#endif
+
 void MyMesh::formatNeighborsReply(char *reply) {
  char *dp = reply;

@@ -34,6 +34,7 @@
 #include <helpers/StatsFormatHelper.h>
 #include <helpers/TxtDataHelpers.h>
 #include <helpers/RegionMap.h>
+#include <helpers/RoutingPolicy.h>
 #include "RateLimiter.h"

 #ifdef WITH_BRIDGE
@@ -70,11 +71,11 @@ struct NeighbourInfo {
 };

 #ifndef FIRMWARE_BUILD_DATE
-  #define FIRMWARE_BUILD_DATE   "6 Jun 2026"
+  #define FIRMWARE_BUILD_DATE   "14 Aug 2026"
 #endif

 #ifndef FIRMWARE_VERSION
-  #define FIRMWARE_VERSION   "v1.16.0"
+  #define FIRMWARE_VERSION   "v1.17.1"
 #endif

 #define FIRMWARE_ROLE "repeater"
@@ -92,8 +93,7 @@ class MyMesh : public mesh::Mesh, public CommonCLICallbacks {
  CommonCLI _cli;
  uint8_t reply_data[MAX_PACKET_PAYLOAD];
  uint8_t reply_path[MAX_PATH_SIZE];
-  int8_t  reply_path_len;
-  uint8_t reply_path_hash_size;
+  uint8_t reply_path_len;
  TransportKeyStore key_store;
  RegionMap region_map, temp_map;
  RegionEntry* load_stack[8];
@@ -255,4 +255,8 @@ public:

  bool setRxBoostedGain(bool enable) override;

+  #if defined(USE_LR2021)
+  virtual bool configSideDetectors(const uint8_t sideDetSFs[], uint8_t num, float bw) override;
+  #endif
+
 };
@@ -299,10 +299,9 @@ uint32_t MyMesh::getDirectRetransmitDelay(const mesh::Packet *packet) {

 bool MyMesh::allowPacketForward(const mesh::Packet *packet) {
  if (_prefs.disable_fwd) return false;
-  if (packet->isRouteFlood()) {
-    if (packet->getPathHashCount() >= _prefs.flood_max) return false;
-    if (packet->getRouteType() == ROUTE_TYPE_FLOOD && packet->getPathHashCount() >= _prefs.flood_max_unscoped) return false;
-    if (packet->getPayloadType() == PAYLOAD_TYPE_ADVERT && packet->getPathHashCount() >= _prefs.flood_max_advert) return false;
+  if (packet->isRouteFlood()
+      && mesh::isFloodHopLimitExceeded(packet, _prefs.flood_max, _prefs.flood_max_unscoped, _prefs.flood_max_advert)) {
+    return false;
  }
  return true;
 }
@@ -683,6 +682,7 @@ MyMesh::MyMesh(mesh::MainBoard &board, mesh::Radio &radio, mesh::MillisecondCloc
 #endif
 #endif
  _prefs.radio_fem_rxgain = 1;
+  _prefs.radio_fem_txgain = 0;

  next_post_idx = 0;
  next_client_idx = 0;
@@ -726,6 +726,7 @@ void MyMesh::begin(FILESYSTEM *fs) {
  radio_driver.setTxPower(_prefs.tx_power_dbm);
  radio_driver.setRxBoostedGainMode(_prefs.rx_boosted_gain);
  board.setLoRaFemLnaEnabled(_prefs.radio_fem_rxgain);
+  board.setLoRaFemPaGainEnabled(_prefs.radio_fem_txgain);

  updateAdvertTimer();
  updateFloodAdvertTimer();
@@ -749,15 +750,23 @@ void MyMesh::sendFloodScoped(const TransportKey& scope, mesh::Packet* pkt, uint3
 }

 void MyMesh::sendFloodReply(mesh::Packet* packet, unsigned long delay_millis, uint8_t path_hash_size) {
-  if (recv_pkt_region && !recv_pkt_region->isWildcard()) {  // if _request_ packet scope is known, send reply with same scope
-    TransportKey scope;
-    if (region_map.getTransportKeysFor(*recv_pkt_region, &scope, 1) > 0) {
-      sendFloodScoped(scope, packet, delay_millis, path_hash_size);
-    } else {
+  TransportKey req_scope;
+  bool is_wildcard = recv_pkt_region != NULL && recv_pkt_region->isWildcard();
+  bool req_scope_known = recv_pkt_region != NULL && !is_wildcard
+                      && region_map.getTransportKeysFor(*recv_pkt_region, &req_scope, 1) > 0;
+
+  switch (mesh::chooseReplyScope(req_scope_known, is_wildcard, !default_scope.isNull())) {
+    case mesh::REPLY_SCOPE_REQUEST:
+      sendFloodScoped(req_scope, packet, delay_millis, path_hash_size);   // reply with same scope as request
+      break;
+    case mesh::REPLY_SCOPE_DEFAULT:
+      // requester's scope is unknown: DIRECT request (no transport codes), or code matched no Region.
+      // un-scoped would be dropped at hop 0 by repeaters running flood.max.unscoped=0
+      sendFloodScoped(default_scope, packet, delay_millis, path_hash_size);
+      break;
+    case mesh::REPLY_SCOPE_NONE:
      sendFlood(packet, delay_millis, path_hash_size);   // send un-scoped
-    }
-  } else {
-    sendFlood(packet, delay_millis, path_hash_size);   // send un-scoped
+      break;
  }
 }

@@ -21,17 +21,18 @@
 #include <helpers/StatsFormatHelper.h>
 #include <helpers/ClientACL.h>
 #include <helpers/RegionMap.h>
+#include <helpers/RoutingPolicy.h>
 #include <RTClib.h>
 #include <target.h>

 /* ------------------------------ Config -------------------------------- */

 #ifndef FIRMWARE_BUILD_DATE
-  #define FIRMWARE_BUILD_DATE   "6 Jun 2026"
+  #define FIRMWARE_BUILD_DATE   "14 Aug 2026"
 #endif

 #ifndef FIRMWARE_VERSION
-  #define FIRMWARE_VERSION   "v1.16.0"
+  #define FIRMWARE_VERSION   "v1.17.1"
 #endif

 #ifndef LORA_FREQ
@@ -735,6 +735,7 @@ SensorMesh::SensorMesh(mesh::MainBoard& board, mesh::Radio& radio, mesh::Millise
  _prefs.gps_interval = 0;
  _prefs.advert_loc_policy = ADVERT_LOC_PREFS;
  _prefs.radio_fem_rxgain = 1;
+  _prefs.radio_fem_txgain = 0;

  memset(default_scope.key, 0, sizeof(default_scope.key));
 }
@@ -771,6 +772,7 @@ void SensorMesh::begin(FILESYSTEM* fs) {
  radio_driver.setParams(_prefs.freq, _prefs.bw, _prefs.sf, _prefs.cr);
  radio_driver.setTxPower(_prefs.tx_power_dbm);
  board.setLoRaFemLnaEnabled(_prefs.radio_fem_rxgain);
+  board.setLoRaFemPaGainEnabled(_prefs.radio_fem_txgain);

  updateAdvertTimer();
  updateFloodAdvertTimer();
@@ -34,11 +34,11 @@
 #define PERM_RECV_ALERTS_HI    (1 << 7)   // high priority alerts

 #ifndef FIRMWARE_BUILD_DATE
-  #define FIRMWARE_BUILD_DATE   "6 Jun 2026"
+  #define FIRMWARE_BUILD_DATE   "14 Aug 2026"
 #endif

 #ifndef FIRMWARE_VERSION
-  #define FIRMWARE_VERSION   "v1.16.0"
+  #define FIRMWARE_VERSION   "v1.17.1"
 #endif

 #define FIRMWARE_ROLE "sensor"
@@ -94,7 +94,7 @@ build_flags = ${arduino_base.build_flags}
  -D USE_CC310_HW_CRYPTO=1
 lib_deps =
  ${arduino_base.lib_deps}
-  https://github.com/oltaco/CustomLFS#0.2.2
+  https://github.com/oltaco/CustomLFS#0.2.3
 ; ----------------- RP2040 ---------------------

 [rp2040_base]
@@ -27,11 +27,9 @@ bool Identity::verify(const uint8_t* sig, const uint8_t* message, int msg_len) c
  // needs much less, around 600-700bytes. The CC310 workspace is static, faster,
  // should save power at scale as well.
  static CRYS_ECEDW_TempBuff_t cc310_tmp;
-  nRFCrypto.begin();
  CRYSError_t rc = CRYS_ECEDW_Verify((uint8_t*)sig, CRYS_ECEDW_SIGNATURE_BYTES,
                                     (uint8_t*)pub_key, CRYS_ECEDW_MOD_SIZE_IN_BYTES,
                                     (uint8_t*)message, (size_t)msg_len, &cc310_tmp);
-  nRFCrypto.end();
  return rc == CRYS_OK;
 #elif 0
  // NOTE:  memory corruption bug was found in this function!!
@@ -67,6 +67,10 @@ public:
  virtual bool setLoRaFemLnaEnabled(bool enable) { return false; }
  virtual bool canControlLoRaFemLna() const { return false; }
  virtual bool isLoRaFemLnaEnabled() const { return false; }
+  // Software-selectable external FEM transmit gain. This is not a PA power switch.
+  virtual bool setLoRaFemPaGainEnabled(bool enable) { return false; }
+  virtual bool canControlLoRaFemPaGain() const { return false; }
+  virtual bool isLoRaFemPaGainEnabled() const { return false; }

  // Power management interface (boards with power management override these)
  virtual bool isExternalPowered() { return false; }
@@ -24,9 +24,7 @@ uint32_t RNG::nextInt(uint32_t _min, uint32_t _max) {
 void Utils::sha256(uint8_t *hash, size_t hash_len, const uint8_t* msg, int msg_len) {
 #ifdef USE_CC310_HW_CRYPTO
  static CRYS_HASH_Result_t result;
-  nRFCrypto.begin();
  CRYS_HASH(CRYS_HASH_SHA256_mode, (uint8_t*)msg, (size_t)msg_len, result);
-  nRFCrypto.end();
  memcpy(hash, result, hash_len);
 #else
  SHA256 sha;
@@ -39,12 +37,10 @@ void Utils::sha256(uint8_t *hash, size_t hash_len, const uint8_t* frag1, int fra
 #ifdef USE_CC310_HW_CRYPTO
  static CRYS_HASHUserContext_t ctx;
  static CRYS_HASH_Result_t result;
-  nRFCrypto.begin();
  CRYS_HASH_Init(&ctx, CRYS_HASH_SHA256_mode);
  CRYS_HASH_Update(&ctx, (uint8_t*)frag1, (size_t)frag1_len);
  CRYS_HASH_Update(&ctx, (uint8_t*)frag2, (size_t)frag2_len);
  CRYS_HASH_Finish(&ctx, result);
-  nRFCrypto.end();
  memcpy(hash, result, hash_len);
 #else
  SHA256 sha;
@@ -62,7 +58,6 @@ int Utils::decrypt(const uint8_t* shared_secret, uint8_t* dest, const uint8_t* s
  const uint8_t* sp = src;
  size_t dummy_out = 0;

-  nRFCrypto.begin();
  SaSi_AesInit(&ctx, SASI_AES_DECRYPT, SASI_AES_MODE_ECB, SASI_AES_PADDING_NONE);
  SaSi_AesSetKey(&ctx, SASI_AES_USER_KEY, &keyData, sizeof(keyData));
  while (sp - src < src_len) {
@@ -71,7 +66,6 @@ int Utils::decrypt(const uint8_t* shared_secret, uint8_t* dest, const uint8_t* s
  }
  SaSi_AesFinish(&ctx, 0, NULL, 0, NULL, &dummy_out);
  SaSi_AesFree(&ctx);
-  nRFCrypto.end();
  return sp - src;
 #else
  AES128 aes;
@@ -95,7 +89,6 @@ int Utils::encrypt(const uint8_t* shared_secret, uint8_t* dest, const uint8_t* s
  uint8_t* dp = dest;
  size_t dummy_out = 0;

-  nRFCrypto.begin();
  SaSi_AesInit(&ctx, SASI_AES_ENCRYPT, SASI_AES_MODE_ECB, SASI_AES_PADDING_NONE);
  SaSi_AesSetKey(&ctx, SASI_AES_USER_KEY, &keyData, sizeof(keyData));
  while (src_len >= 16) {
@@ -110,7 +103,6 @@ int Utils::encrypt(const uint8_t* shared_secret, uint8_t* dest, const uint8_t* s
  }
  SaSi_AesFinish(&ctx, 0, NULL, 0, NULL, &dummy_out);
  SaSi_AesFree(&ctx);
-  nRFCrypto.end();
  return dp - dest;
 #else
  AES128 aes;
@@ -138,11 +130,9 @@ int Utils::encryptThenMAC(const uint8_t* shared_secret, uint8_t* dest, const uin
 #ifdef USE_CC310_HW_CRYPTO
  static CRYS_HMACUserContext_t hmac_ctx;
  static CRYS_HASH_Result_t hmac_result;
-  nRFCrypto.begin();
  CRYS_HMAC_Init(&hmac_ctx, CRYS_HASH_SHA256_mode, (uint8_t*)shared_secret, PUB_KEY_SIZE);
  CRYS_HMAC_Update(&hmac_ctx, dest + CIPHER_MAC_SIZE, enc_len);
  CRYS_HMAC_Finish(&hmac_ctx, hmac_result);
-  nRFCrypto.end();
  memcpy(dest, hmac_result, CIPHER_MAC_SIZE);
 #else
  SHA256 sha;
@@ -162,11 +152,9 @@ int Utils::MACThenDecrypt(const uint8_t* shared_secret, uint8_t* dest, const uin
  {
    static CRYS_HMACUserContext_t hmac_ctx;
    static CRYS_HASH_Result_t hmac_result;
-    nRFCrypto.begin();
    CRYS_HMAC_Init(&hmac_ctx, CRYS_HASH_SHA256_mode, (uint8_t*)shared_secret, PUB_KEY_SIZE);
    CRYS_HMAC_Update(&hmac_ctx, (uint8_t*)(src + CIPHER_MAC_SIZE), src_len - CIPHER_MAC_SIZE);
    CRYS_HMAC_Finish(&hmac_ctx, hmac_result);
-    nRFCrypto.end();
    memcpy(hmac, hmac_result, CIPHER_MAC_SIZE);
  }
 #else
@@ -133,6 +133,7 @@ void CommonCLI::loadPrefsInt(FILESYSTEM* fs, const char* filename) {  // Legacy
    // sanitise settings
    _prefs->rx_boosted_gain = constrain(_prefs->rx_boosted_gain, 0, 1); // boolean
    _prefs->radio_fem_rxgain = constrain(_prefs->radio_fem_rxgain, 0, 1); // boolean
+    _prefs->radio_fem_txgain = constrain(_prefs->radio_fem_txgain, 0, 1); // boolean
    _prefs->cad_enabled = constrain(_prefs->cad_enabled, 0, 1); // boolean

    file.close();
@@ -562,6 +563,28 @@ void CommonCLI::handleSetCmd(uint32_t sender_timestamp, char* command, char* rep
    } else {
      strcpy(reply, "Error: state must be on or off");
    }
+  } else if (memcmp(config, "radio.fem.txgain ", 17) == 0) {
+    if (!_board->canControlLoRaFemPaGain()) {
+      strcpy(reply, "Error: unsupported");
+    } else if (memcmp(&config[17], "on", 2) == 0) {
+      if (_board->setLoRaFemPaGainEnabled(true)) {
+        _prefs->radio_fem_txgain = 1;
+        savePrefs();
+        strcpy(reply, "OK - LoRa FEM TX gain on");
+      } else {
+        strcpy(reply, "Error: failed to apply LoRa FEM TX gain");
+      }
+    } else if (memcmp(&config[17], "off", 3) == 0) {
+      if (_board->setLoRaFemPaGainEnabled(false)) {
+        _prefs->radio_fem_txgain = 0;
+        savePrefs();
+        strcpy(reply, "OK - LoRa FEM TX gain off");
+      } else {
+        strcpy(reply, "Error: failed to apply LoRa FEM TX gain");
+      }
+    } else {
+      strcpy(reply, "Error: state must be on or off");
+    }
  } else if (memcmp(config, "radio ", 6) == 0) {
    strcpy(tmp, &config[6]);
    const char *parts[4];
@@ -753,6 +776,28 @@ void CommonCLI::handleSetCmd(uint32_t sender_timestamp, char* command, char* rep
      _prefs->adc_multiplier = 0.0f;
      strcpy(reply, "Error: unsupported");
    };
+  #if defined(USE_LR2021)
+  } else if (memcmp(config, "extra.sf ", 9) == 0) {
+    strcpy(tmp, &config[9]);
+    const char *parts[4];
+    uint8_t sideDetSFs[4];
+    int num = mesh::Utils::parseTextParts(tmp, parts, 4);
+    if (num > 3) {
+      sprintf(reply, "Invalid extra SF config");
+    } else {
+      for (int i = 0; i < num; i++) {
+        sideDetSFs[i] = atoi(parts[i]);
+      }
+      sideDetSFs[num] = 0;
+      if (_callbacks->configSideDetectors(sideDetSFs, num, _prefs->bw)) {
+        for (int i = 0; i <= num; i++) _prefs->extra_sf[i] = sideDetSFs[i];
+        savePrefs();
+        sprintf(reply, "OK - extra SFs set");
+      } else {
+        sprintf(reply, "Invalid extra SF config");
+      }
+    }
+  #endif
  } else {
    strcpy(reply, "unknown config: ");
    StrHelper::strncpy(&reply[16], config, 160-17);
@@ -805,6 +850,12 @@ void CommonCLI::handleGetCmd(uint32_t sender_timestamp, char* command, char* rep
    } else {
      sprintf(reply, "> %s", _board->isLoRaFemLnaEnabled() ? "on" : "off");
    }
+  } else if (memcmp(config, "radio.fem.txgain", 16) == 0) {
+    if (!_board->canControlLoRaFemPaGain()) {
+      strcpy(reply, "Error: unsupported");
+    } else {
+      sprintf(reply, "> %s", _board->isLoRaFemPaGainEnabled() ? "on" : "off");
+    }
  } else if (memcmp(config, "radio", 5) == 0) {
    char freq[16], bw[16];
    strcpy(freq, StrHelper::ftoa(_prefs->freq));
@@ -922,6 +973,14 @@ void CommonCLI::handleGetCmd(uint32_t sender_timestamp, char* command, char* rep
 #else
    strcpy(reply, "ERROR: Power management not supported");
 #endif
+  } else if (memcmp(config, "extra.sf", 8) == 0) {
+    char* tmp = reply;
+    for (int i = 0; i < 3 && _prefs->extra_sf[i] != 0; i++) {
+      tmp += sprintf(tmp, "%s%d", (i == 0) ? "" : ",", _prefs->extra_sf[i]);
+    } 
+    if (tmp == reply) {
+      sprintf(reply, "No extra SF configured");
+    }
  } else {
    sprintf(reply, "??: %s", config);
  }
@@ -65,9 +65,11 @@ public:
  char owner_info[120];
  uint8_t rx_boosted_gain = 0; // power settings
  uint8_t radio_fem_rxgain = 0; // LoRa FEM RX gain setting
+  uint8_t radio_fem_txgain = 0; // LoRa FEM TX gain setting
  uint8_t path_hash_mode = 0;   // which path mode to use when sending
  uint8_t loop_detect = 0;
  uint8_t cad_enabled = 0;      // hardware Channel Activity Detection before TX (boolean)
+  uint8_t extra_sf[4];

 private:
  class RadioPrefs : public ConfigSerializer {
@@ -81,7 +83,8 @@ private:
      def("cad", _parent->cad_enabled);
      def("int_thr", _parent->interference_threshold);
      def("rxgain", _parent->rx_boosted_gain);
-      def("fem_rxgain", _parent->rx_boosted_gain);
+      def("fem_rxgain", _parent->radio_fem_rxgain);
+      def("fem_txgain", _parent->radio_fem_txgain);
      def("tx", _parent->tx_power_dbm);
      def("af", _parent->airtime_factor);
      def("rxdelay", _parent->rx_delay_base);
@@ -238,6 +241,12 @@ public:
  virtual bool setRxBoostedGain(bool enable) {
    return false; // CommonCLI reports unsupported if not overridden by wrapper
  };
+
+  #if defined(USE_LR2021)
+  virtual bool configSideDetectors(const uint8_t sideDetSFs[], uint8_t num, float bw) {
+    return false; // Override in wrapper
+  } 
+  #endif
 };

 class CommonCLI {
@@ -5,6 +5,10 @@
 #include <bluefruit.h>
 #include <nrf_soc.h>

+#ifdef USE_CC310_HW_CRYPTO
+#include <Adafruit_nRFCrypto.h>
+#endif
+
 static BLEDfu bledfu;

 static void connect_callback(uint16_t conn_handle) {
@@ -21,6 +25,11 @@ static void disconnect_callback(uint16_t conn_handle, uint8_t reason) {

 void NRF52Board::begin() {
  startup_reason = BD_STARTUP_NORMAL;
+
+  #ifdef USE_CC310_HW_CRYPTO
+    // CC310 TRNG is higher quality and environment-independent vs radio RSSI noise.
+    nRFCrypto.begin();
+  #endif
 }

 #ifdef NRF52_POWER_MANAGEMENT
@@ -352,6 +361,10 @@ void NRF52Board::shutdownPeripherals() {
    sensors.getLocationProvider()->stop();
  }

+#ifdef USE_CC310_HW_CRYPTO
+    nRFCrypto.end();
+#endif
+
  // Flush serial buffers
  Serial.flush();
  delay(100);
@@ -0,0 +1,68 @@
+#pragma once
+
+#include <Packet.h>
+
+namespace mesh {
+
+/**
+ * \brief  Test a flood packet against the configured hop limits.
+ * \param  packet  inbound flood packet (caller has already checked isRouteFlood())
+ * \param  flood_max            max hops for any flood packet
+ * \param  flood_max_unscoped   max hops for ROUTE_TYPE_FLOOD (ie. un-scoped) packets
+ * \param  flood_max_advert     max hops for ADVERT packets
+ * \returns  true if the packet has exceeded a limit, and must not be forwarded
+ */
+inline bool isFloodHopLimitExceeded(const Packet* packet, uint8_t flood_max,
+                                    uint8_t flood_max_unscoped, uint8_t flood_max_advert) {
+  uint8_t hops = packet->getPathHashCount();
+  if (hops >= flood_max) return true;
+  if (packet->getRouteType() == ROUTE_TYPE_FLOOD && hops >= flood_max_unscoped) return true;
+  if (packet->getPayloadType() == PAYLOAD_TYPE_ADVERT && hops >= flood_max_advert) return true;
+  return false;
+}
+
+/**
+ * \brief  How a server routes a reply back to the requesting client.
+ */
+enum ReplyRoute : uint8_t {
+  REPLY_ROUTE_PATH_RETURN,       // request arrived by flood: reply with a PATH return, flooded back
+  REPLY_ROUTE_DIRECT_SUPPLIED,   // reply DIRECT, along the return path supplied in the request
+  REPLY_ROUTE_DIRECT_OUT_PATH,   // reply DIRECT, along the out_path already stored for this client
+  REPLY_ROUTE_FLOOD,             // no return path known: flood the reply
+};
+
+/**
+ * \param  inbound_is_flood    the request arrived as a flood packet
+ * \param  have_supplied_path  the request payload carried an explicit reply path
+ * \param  have_out_path       this server already has a stored out_path for the client
+ */
+inline ReplyRoute chooseReplyRoute(bool inbound_is_flood, bool have_supplied_path, bool have_out_path) {
+  if (inbound_is_flood) return REPLY_ROUTE_PATH_RETURN;
+  if (have_supplied_path) return REPLY_ROUTE_DIRECT_SUPPLIED;
+  if (have_out_path) return REPLY_ROUTE_DIRECT_OUT_PATH;
+  return REPLY_ROUTE_FLOOD;
+}
+
+/**
+ * \brief  Which transport scope a flooded reply should be sent with.
+ */
+enum ReplyScope : uint8_t {
+  REPLY_SCOPE_REQUEST,   // re-use the scope the request arrived on
+  REPLY_SCOPE_DEFAULT,   // fall back to this node's default region scope
+  REPLY_SCOPE_NONE,      // send un-scoped (ROUTE_TYPE_FLOOD)
+};
+
+/**
+ * \param  request_scope_known         request arrived scoped, and we resolved its Region's key
+ * \param  request_was_unscoped_flood  request arrived as an un-scoped flood
+ * \param  default_scope_known         this node has a default Region with a usable transport key
+ */
+inline ReplyScope chooseReplyScope(bool request_scope_known, bool request_was_unscoped_flood,
+                                   bool default_scope_known) {
+  if (request_scope_known) return REPLY_SCOPE_REQUEST;
+  if (request_was_unscoped_flood) return REPLY_SCOPE_NONE;  // requester chose un-scoped, so mirror it
+  if (default_scope_known) return REPLY_SCOPE_DEFAULT;      // scope unknowable: DIRECT, or unresolved Region
+  return REPLY_SCOPE_NONE;
+}
+
+}
@@ -19,7 +19,6 @@ public:
    ((CustomLR1110 *)_radio)->setMaxPayloadMillis(pm.payloadMillis);
  }

-  void doResetAGC() override { lr11x0ResetAGC((LR11x0 *)_radio, ((CustomLR1110 *)_radio)->getFreqMHz()); }
  bool isReceivingPacket() override {
    return ((CustomLR1110 *)_radio)->isReceiving();
  }
@@ -50,4 +49,6 @@ public:
  bool getRxBoostedGainMode() const override {
    return ((CustomLR1110 *)_radio)->getRxBoostedGainMode();
  }
+
+  void doResetAGC() override { lr11x0ResetAGC((LR11x0 *)_radio, ((CustomLR1110 *)_radio)->getFreqMHz(), getRxBoostedGainMode()); }
 };
@@ -0,0 +1,131 @@
+#pragma once
+
+#include <RadioLib.h>
+#include "MeshCore.h"
+
+class CustomLR2021 : public LR2021 {
+  uint32_t _preambleMillis = 66;
+  uint32_t _maxPayloadMillis = 3934;
+  uint32_t _activityAt = 0;
+  bool _headerSeen = false;
+  bool _rx_boosted = false;
+
+  public:
+    CustomLR2021(Module *mod) : LR2021(mod) { irqDioNum = LR2021_IRQ_DIO; }
+
+    bool std_init(SPIClass* spi = NULL)
+    {
+      
+  #ifdef LR2021_TCXO_VOLTAGE
+      float tcxo = LR2021_TCXO_VOLTAGE;
+  #else
+      float tcxo = 1.6f;
+  #endif
+
+  #ifdef LORA_CR
+      uint8_t cr = LORA_CR;
+  #else
+      uint8_t cr = 5;
+  #endif
+
+  #if defined(P_LORA_SCLK)
+    #ifdef NRF52_PLATFORM
+      if (spi) { spi->setPins(P_LORA_MISO, P_LORA_SCLK, P_LORA_MOSI); spi->begin(); }
+    #elif defined(RP2040_PLATFORM)
+      if (spi) {
+        spi->setMISO(P_LORA_MISO);
+        //spi->setCS(P_LORA_NSS); // Setting CS results in freeze
+        spi->setSCK(P_LORA_SCLK);
+        spi->setMOSI(P_LORA_MOSI);
+        spi->begin();
+      }
+    #else
+      if (spi) spi->begin(P_LORA_SCLK, P_LORA_MISO, P_LORA_MOSI);
+    #endif
+  #endif
+      int status = begin(LORA_FREQ, LORA_BW, LORA_SF, cr, RADIOLIB_LR2021_LORA_SYNC_WORD_PRIVATE, LORA_TX_POWER, 16, tcxo);
+      // if radio init fails with -707/-706, try again with tcxo voltage set to 0.0f
+      if (status == RADIOLIB_ERR_SPI_CMD_FAILED || status == RADIOLIB_ERR_SPI_CMD_INVALID) {
+        tcxo = 0.0f;
+        status = begin(LORA_FREQ, LORA_BW, LORA_SF, cr, RADIOLIB_LR2021_LORA_SYNC_WORD_PRIVATE, LORA_TX_POWER, 16, tcxo);
+      }
+      if (status != RADIOLIB_ERR_NONE) {
+        Serial.print("ERROR: radio init failed: ");
+        Serial.println(status);
+        return false;  // fail
+      }
+    
+      setCRC(2);
+      explicitHeader();
+
+      
+    #ifdef LR2021_RX_BOOSTED_GAIN
+      setRxBoostedGainMode(LR2021_RX_BOOSTED_GAIN);
+    #endif
+
+      return true;  // success
+    }
+    
+    float getFreqMHz() const { return freqMHz; }
+
+    bool getRxBoostedGainMode() const { return _rx_boosted; }
+
+    int16_t startReceive() override {
+      // include the PREAMBLE_DETECTED irq bit in reported flags
+      return LR2021::startReceive(RADIOLIB_LR2021_RX_TIMEOUT_INF, RADIOLIB_IRQ_RX_DEFAULT_FLAGS | (1UL << RADIOLIB_LR2021_IRQ_PREAMBLE_DETECTED), RADIOLIB_IRQ_RX_DEFAULT_MASK, 0);
+    }
+
+    bool isReceiving() {
+      uint32_t irq = getIrqStatus();
+      bool preamble = irq & RADIOLIB_LR2021_IRQ_PREAMBLE_DETECTED;  // bit 5
+      bool header   = irq & RADIOLIB_LR2021_IRQ_LORA_HEADER_VALID;  // bit 6
+      bool hdrErr   = irq & RADIOLIB_LR2021_IRQ_LORA_HDR_CRC_ERROR; // bit 9
+      uint32_t now  = millis();
+      if (hdrErr) {
+        clearIrqFlags(RADIOLIB_LR2021_IRQ_PREAMBLE_DETECTED | RADIOLIB_LR2021_IRQ_LORA_HEADER_VALID | RADIOLIB_LR2021_IRQ_LORA_HDR_CRC_ERROR);
+        _activityAt = 0;
+        _headerSeen = false;
+        return false;
+      }
+      if (!header && _headerSeen) {
+        // something cleared the header flag, reset our state.
+        _activityAt = 0; _headerSeen = false;
+        return false;
+      }
+
+      if (header) {
+        if (!_headerSeen) { _headerSeen = true; _activityAt = now; };
+        if (now - _activityAt > _maxPayloadMillis) {
+          MESH_DEBUG_PRINTLN("Clearing header IRQ after %ums", _maxPayloadMillis);
+          clearIrqFlags(RADIOLIB_LR2021_IRQ_PREAMBLE_DETECTED | RADIOLIB_LR2021_IRQ_LORA_HEADER_VALID | RADIOLIB_LR2021_IRQ_LORA_HDR_CRC_ERROR);
+          _activityAt = 0; _headerSeen = false;
+          return false;
+        }
+        return true;
+      }
+      if (preamble) {
+        if (_activityAt == 0) _activityAt = now;
+        if (now - _activityAt > _preambleMillis) {
+          clearIrqFlags(RADIOLIB_LR2021_IRQ_PREAMBLE_DETECTED);
+          _activityAt = 0;
+          MESH_DEBUG_PRINTLN("Clearing preamble IRQ after %ums", _preambleMillis);
+          return false;
+        }
+        return true;
+      }
+      _activityAt = 0; _headerSeen = false;
+      return false;
+    }
+    
+    void setPreambleMillis(uint32_t preambleMillis) {
+      _preambleMillis = preambleMillis;
+      MESH_DEBUG_PRINTLN("Set _preambleMillis=%u", _preambleMillis);
+    }
+    void setMaxPayloadMillis(uint32_t payloadMillis) {
+      _maxPayloadMillis = payloadMillis;
+      MESH_DEBUG_PRINTLN("Set _maxPayloadMillis=%u", _maxPayloadMillis);
+    }
+
+
+    uint8_t getSpreadingFactor() const { return spreadingFactor; }
+};
@@ -0,0 +1,111 @@
+#pragma once
+
+#include "CustomLR2021.h"
+#include "RadioLibWrappers.h"
+
+#ifndef USE_LR2021
+#define USE_LR2021
+#endif
+
+#ifndef LR2021_RX_BOOST_LEVEL
+#define LR2021_RX_BOOST_LEVEL 7
+#endif
+
+class CustomLR2021Wrapper : public RadioLibWrapper {
+public:
+  CustomLR2021Wrapper(CustomLR2021& radio, mesh::MainBoard& board) : RadioLibWrapper(radio, board) { }
+
+  void setParams(float freq, float bw, uint8_t sf, uint8_t cr) override {
+    ((CustomLR2021 *)_radio)->setFrequency(freq);
+    ((CustomLR2021 *)_radio)->setSpreadingFactor(sf);
+    ((CustomLR2021 *)_radio)->setBandwidth(bw);
+    ((CustomLR2021 *)_radio)->setCodingRate(cr);
+    updatePreamble(sf);
+    applySideDetectorConfig();
+    PacketMillis pm = calcMaxPacketMillis(sf, bw, cr, preambleLengthForSF(sf));
+    ((CustomLR2021 *)_radio)->setPreambleMillis(pm.preambleMillis);
+    ((CustomLR2021 *)_radio)->setMaxPayloadMillis(pm.payloadMillis);
+
+  }
+
+  bool configSideDetectors(const uint8_t* sideDetSFs, uint8_t num, float bw) override {
+    LR2021LoRaSideDetector_t tmp[3];
+    uint8_t sf = getSpreadingFactor();
+
+    if (sf >= 10 && num > 1) { return false; }  // only 1 side detector allowed when primary SF >= 10
+    for (int i = 0; i < num; i++) {
+      if (sideDetSFs[i] > 12 || sideDetSFs[i] < 5) { return false; }  // must be valid SF
+      if (sideDetSFs[i] <= sf) { return false; }  // must be < primary SF
+      if (sideDetSFs[i] > sf + 4) { return false; }  // span must not be > 4
+
+      tmp[i].sf = sideDetSFs[i];
+      float tSym = calcTsym(tmp[i].sf, bw);
+      if (tSym >= 16.0f) {
+        tmp[i].ldro = true;
+      } else {
+        tmp[i].ldro = false; 
+      }
+      tmp[i].invertIQ = false;
+      tmp[i].syncWord = 0x12;
+    }
+    int16_t status = ((CustomLR2021 *)_radio)->setSideDetector(tmp, num);
+    RadioLibWrapper::idle(); // trigger startReceive()
+    MESH_DEBUG_PRINTLN("setSideDetector() returned %d", status);
+
+    if (status == RADIOLIB_ERR_NONE) {
+      for (int i = 0; i < num; i++) { _sideDet[i] = tmp[i]; }
+      _numSideDet = num;
+    } else {
+      return false;
+    }
+    
+    return true;
+  }
+
+  int16_t applySideDetectorConfig() {
+    int16_t status = ((CustomLR2021 *)_radio)->setSideDetector(_sideDet, _numSideDet);
+    RadioLibWrapper::idle(); // trigger startReceive()
+    return status;
+  }
+
+  float calcTsym(uint8_t sf, float bw) {
+    float tSym = (float)(uint32_t(1) << sf) / (float)bw;
+    return tSym;
+  }
+
+  bool isReceivingPacket() override {
+    return ((CustomLR2021 *)_radio)->isReceiving();
+  }
+
+  float getCurrentRSSI() override {
+    float rssi = -110;
+    ((CustomLR2021 *)_radio)->getRssiInst(&rssi);
+    return rssi;
+  }
+
+  void onSendFinished() override {
+    RadioLibWrapper::onSendFinished();
+    _radio->setPreambleLength(preambleLengthForSF(getSpreadingFactor())); // overcomes weird issues with small and big pkts
+  }
+
+  float getLastRSSI() const override { return ((CustomLR2021 *)_radio)->getRSSI(); }
+  float getLastSNR() const override { return ((CustomLR2021 *)_radio)->getSNR(); }
+
+  uint8_t getSpreadingFactor() const override { return ((CustomLR2021 *)_radio)->getSpreadingFactor(); }
+  
+  bool setRxBoostedGainMode(bool en) override {
+    ((CustomLR2021 *)_radio)->standby(); // LR2021 must be in standby to accept setRxBoostedGainMode
+    int16_t status = ((CustomLR2021 *)_radio)->setRxBoostedGainMode(en ? LR2021_RX_BOOST_LEVEL: 0);
+    RadioLibWrapper::idle(); // trigger startReceive()
+    return status == RADIOLIB_ERR_NONE;
+  }
+
+  bool getRxBoostedGainMode() const override {
+    return ((CustomLR2021 *)_radio)->getRxBoostedGainMode();
+  }
+
+  protected:
+    LR2021LoRaSideDetector_t _sideDet[3];
+    size_t _numSideDet = 0;
+
+};
@@ -35,5 +35,5 @@ public:
  }
  uint8_t getSpreadingFactor() const override { return ((CustomSTM32WLx *)_radio)->spreadingFactor; }

-  void doResetAGC() override { sx126xResetAGC((SX126x *)_radio); }
+  void doResetAGC() override { sx126xResetAGC((SX126x *)_radio, getRxBoostedGainMode()); }
 };
@@ -41,12 +41,12 @@ public:
    ((CustomSX1262 *)_radio)->sleep(false);
  }

-  void doResetAGC() override { sx126xResetAGC((SX126x *)_radio); }
-
  bool setRxBoostedGainMode(bool en) override {
    return ((CustomSX1262 *)_radio)->setRxBoostedGainMode(en) == RADIOLIB_ERR_NONE;
  }
  bool getRxBoostedGainMode() const override {
    return ((CustomSX1262 *)_radio)->getRxBoostedGainMode();
  }
+
+  void doResetAGC() override { sx126xResetAGC((SX126x *)_radio, getRxBoostedGainMode()); }
 };
@@ -38,12 +38,12 @@ public:
  }
  uint8_t getSpreadingFactor() const override { return ((CustomSX1268 *)_radio)->spreadingFactor; }

-  void doResetAGC() override { sx126xResetAGC((SX126x *)_radio); }
-
  bool setRxBoostedGainMode(bool en) override {
    return ((CustomSX1268 *)_radio)->setRxBoostedGainMode(en) == RADIOLIB_ERR_NONE;
  }
  bool getRxBoostedGainMode() const override {
    return ((CustomSX1268 *)_radio)->getRxBoostedGainMode();
  }
+
+  void doResetAGC() override { sx126xResetAGC((SX126x *)_radio, getRxBoostedGainMode()); }
 };
@@ -5,7 +5,7 @@
 // Full receiver reset for LR11x0-family chips (LR1110, LR1120, LR1121).
 // Warm sleep powers down analog, calibrate(0x3F) refreshes all calibration blocks,
 // then re-applies RX settings that calibration may reset.
-inline void lr11x0ResetAGC(LR11x0* radio, float freqMHz) {
+inline void lr11x0ResetAGC(LR11x0* radio, float freqMHz, bool rx_boost_gain) {
  radio->sleep(true, 0);
  radio->standby(RADIOLIB_LR11X0_STANDBY_RC, true);

@@ -16,6 +16,6 @@ inline void lr11x0ResetAGC(LR11x0* radio, float freqMHz) {
  radio->calibrateImageRejection(freqMHz - 4.0f, freqMHz + 4.0f);

 #ifdef RX_BOOSTED_GAIN
-  radio->setRxBoostedGainMode(RX_BOOSTED_GAIN);
+  radio->setRxBoostedGainMode(rx_boost_gain);
 #endif
 }
@@ -15,7 +15,7 @@ static volatile uint8_t state = STATE_IDLE;

 // this function is called when a complete packet
 // is transmitted by the module
-static 
+static
 #if defined(ESP8266) || defined(ESP32)
  ICACHE_RAM_ATTR
 #endif
@@ -100,11 +100,16 @@ void RadioLibWrapper::loop() {
    }
    _floor_sample_sum = 0;

+    #ifdef MESH_DEBUG_NOISE_FLOOR
    MESH_DEBUG_PRINTLN("RadioLibWrapper: noise_floor = %d", (int)_noise_floor);
+    #endif
  }
 }

 void RadioLibWrapper::startRecv() {
+  #if defined(USE_LR2021)
+  _radio->standby(); // without this LR2021 can throw -706 when calling startReceive after hardware CAD when side detectors are enabled
+  #endif
  int err = _radio->startReceive();
  if (err == RADIOLIB_ERR_NONE) {
    state = STATE_RX;
@@ -133,7 +138,11 @@ int RadioLibWrapper::recvRaw(uint8_t* bytes, int sz) {
        n_recv++;
      }
    }
+    #if defined(USE_LR2021)
+    state = STATE_RX;     // LR2021 stays in Rx after readData, calling startReceive while still in Rx throws -706 errors
+    #else
    state = STATE_IDLE;   // need another startReceive()
+    #endif
  }

  if (state != STATE_RX) {
@@ -217,10 +226,10 @@ static float snr_threshold[] = {
    -17.5,// SF11 needs at least -17.5 dB SNR
    -20   // SF12 needs at least -20 dB SNR
 };
-  
+
 float RadioLibWrapper::packetScoreInt(float snr, int sf, int packet_len) {
  if (sf < 7) return 0.0f;
-  
+
  if (snr < snr_threshold[sf - 7]) return 0.0f;    // Below threshold, no chance of success

  auto success_rate_based_on_snr = (snr - snr_threshold[sf - 7]) / 10.0;
@@ -236,7 +245,7 @@ PacketMillis RadioLibWrapper::calcMaxPacketMillis(uint8_t sf, float bw, uint8_t

  // preamble + syncword + sfd + header
  uint32_t preamble_us = (((preambleSymbols + 8) * 4 + sfCoeff1_x4) * tsym_us) / 4;
-  
+
  // airtime for max packet at current radio settings
  uint32_t total_us   = _radio->getTimeOnAir(MAX_TRANS_UNIT);
  // airtime for payload only (no preamble, header or SOF)
@@ -77,6 +77,8 @@ public:

  virtual bool setRxBoostedGainMode(bool) { return false; }
  virtual bool getRxBoostedGainMode() const { return false; }
+  
+  virtual bool configSideDetectors(const uint8_t sideDetSFs[], uint8_t num, float bw) { return false; }
 };

 /**
@@ -90,10 +92,10 @@ public:

  void random(uint8_t* dest, size_t sz) override {
 #ifdef USE_CC310_HW_CRYPTO
-    // CC310 TRNG is higher quality and environment-independent vs radio RSSI noise.
-    nRFCrypto.begin();
    nRFCrypto.Random.generate(dest, (uint16_t)sz);
-    nRFCrypto.end();
+    for (int i = 0; i < sz; i++) {
+      dest[i] ^= _radio->randomByte() ^ (::random(0, 256) & 0xFF); // combine with Radio's entropy
+    }
 #else
    for (int i = 0; i < sz; i++) {
      dest[i] = _radio->randomByte() ^ (::random(0, 256) & 0xFF);
@@ -5,7 +5,7 @@
 // Full receiver reset for all SX126x-family chips (SX1262, SX1268, LLCC68, STM32WLx).
 // Warm sleep powers down analog, Calibrate(0x7F) refreshes ADC/PLL/image calibration,
 // then re-applies RX settings that calibration may reset.
-inline void sx126xResetAGC(SX126x* radio) {
+inline void sx126xResetAGC(SX126x* radio, bool rx_boost_gain) {
  radio->sleep(true);
  radio->standby(RADIOLIB_SX126X_STANDBY_RC, true);

@@ -26,7 +26,7 @@ inline void sx126xResetAGC(SX126x* radio) {
  radio->setDio2AsRfSwitch(SX126X_DIO2_AS_RF_SWITCH);
 #endif
 #ifdef SX126X_RX_BOOSTED_GAIN
-  radio->setRxBoostedGainMode(SX126X_RX_BOOSTED_GAIN);
+  radio->setRxBoostedGainMode(rx_boost_gain);
 #endif
 #ifdef SX126X_REGISTER_PATCH
  uint8_t r_data = 0;
@@ -0,0 +1,47 @@
+#ifdef HAS_DRV2605
+
+#include "DRV2605Vibration.h"
+#include <Wire.h>
+
+void DRV2605Vibration::begin() {
+#ifdef PIN_DRV_EN
+  pinMode(PIN_DRV_EN, OUTPUT);
+  digitalWrite(PIN_DRV_EN, HIGH);   // power up the haptic driver
+  delay(10);
+#endif
+  if (!drv.begin(&Wire)) {
+    return;   // no haptic driver found, stay silent
+  }
+#ifdef DRV2605_USE_LRA
+  // LRA mode: 4x brake factor, medium loop gain, back-EMF gain 2
+  drv.writeRegister8(DRV2605_REG_FEEDBACK, 0xB6);
+#endif
+  drv.selectLibrary(1);
+  drv.setMode(DRV2605_MODE_INTTRIG);
+  _ready = true;
+}
+
+void DRV2605Vibration::trigger(bool force) {
+  if (!_ready || _quiet) return;
+  unsigned long now = millis();
+  if (!force && _last_trigger != 0 && now - _last_trigger < VIBRATION_TIMEOUT) return;
+  _last_trigger = now;
+  drv.setWaveform(0, DRV2605_EFFECT);
+  drv.setWaveform(1, 0);   // pause
+  drv.setWaveform(2, DRV2605_EFFECT);
+  drv.setWaveform(3, 0);   // end of sequence
+  drv.go();
+}
+
+void DRV2605Vibration::loop() {
+}
+
+bool DRV2605Vibration::isVibrating() {
+  return false;   // effects are short, treat as instantaneous
+}
+
+void DRV2605Vibration::stop() {
+  if (_ready) drv.stop();
+}
+
+#endif // ifdef HAS_DRV2605
@@ -0,0 +1,39 @@
+#pragma once
+
+#ifdef HAS_DRV2605
+
+#include <Arduino.h>
+#include <Adafruit_DRV2605.h>
+
+/*
+ * Vibration control class for boards where the motor is behind a
+ * DRV2605 haptic driver on I2C (e.g. Seeed SenseCAP MeshTracker X1).
+ * Same interface as GenericVibration.
+ */
+
+#ifndef VIBRATION_TIMEOUT
+#define VIBRATION_TIMEOUT 5000 // cooldown between vibrations
+#endif
+
+#ifndef DRV2605_EFFECT
+#define DRV2605_EFFECT 16   // "1000 ms alert" from the DRV2605 effect library
+#endif
+
+class DRV2605Vibration {
+public:
+  void begin();       // power up and init the DRV2605
+  void trigger(bool force = false);   // trigger vibration; force skips the cooldown
+  void loop();        // no-op, the DRV2605 plays effects autonomously
+  bool isVibrating();
+  void stop();        // stop vibration immediately
+  void quiet(bool q) { _quiet = q; }
+  bool isQuiet() const { return _quiet; }
+
+private:
+  Adafruit_DRV2605 drv;
+  bool _ready = false;
+  bool _quiet = false;
+  unsigned long _last_trigger = 0;
+};
+
+#endif // ifdef HAS_DRV2605
@@ -24,8 +24,21 @@ bool SH1106Display::begin()
 {
  // Wire must already be initialised by board.begin() before this is called.
  // Boards with non-standard SH1106 addresses should define DISPLAY_ADDRESS
-  // in their variant/platformio configuration.
-  return i2c_probe(Wire, DISPLAY_ADDRESS) && display.begin(DISPLAY_ADDRESS, true);
+  // in their variant/platformio configuration. The SA0 strap selects 0x3C or
+  // 0x3D and differs between revisions of the same board (e.g. T-Beam
+  // Supreme), so fall back to the other address of the pair.
+  uint8_t addr = 0;
+  if (i2c_probe(Wire, DISPLAY_ADDRESS)) {
+    addr = DISPLAY_ADDRESS;
+  } else if (i2c_probe(Wire, DISPLAY_ADDRESS ^ 1)) {
+    addr = DISPLAY_ADDRESS ^ 1;
+  }
+  // Run the Adafruit init even when no panel answered: it is what allocates
+  // the frame buffer and the I2C device. Skipping it leaves i2c_dev and
+  // spi_dev NULL, and UITask::begin() calls turnOn() regardless of our
+  // return value, which then dereferences the null spi_dev.
+  bool ok = display.begin(addr ? addr : DISPLAY_ADDRESS, true);
+  return addr != 0 && ok;
 }

 void SH1106Display::turnOn()
@@ -0,0 +1,83 @@
+#include <gtest/gtest.h>
+
+#include <cstdio>
+#include <cstring>
+#include <string>
+
+#include "../../examples/companion_radio/NodePrefs.h"
+
+class ReplayStream : public Stream {
+  const char* _text;
+  int _pos = 0;
+  int _len;
+
+public:
+  explicit ReplayStream(const char* text) : _text(text), _len(strlen(text)) { }
+
+  int available() override { return _len - _pos; }
+  int read() override { return _pos < _len ? _text[_pos++] : -1; }
+  int peek() override { return _pos < _len ? _text[_pos] : -1; }
+};
+
+class CaptureStream : public Stream {
+  std::string _text;
+
+  size_t emit(long long value) {
+    char text[24];
+    int length = snprintf(text, sizeof(text), "%lld", value);
+    return write(reinterpret_cast<const uint8_t*>(text), length);
+  }
+
+public:
+  size_t write(uint8_t value) override {
+    _text.push_back(static_cast<char>(value));
+    return 1;
+  }
+
+  size_t write(const uint8_t* buffer, size_t size) override {
+    _text.append(reinterpret_cast<const char*>(buffer), size);
+    return size;
+  }
+
+  size_t print(unsigned char value, int = DEC) override { return emit(value); }
+  size_t print(int value, int = DEC) override { return emit(value); }
+  size_t print(unsigned int value, int = DEC) override { return emit(value); }
+  size_t print(long value, int = DEC) override { return emit(value); }
+  size_t print(unsigned long value, int = DEC) override { return emit(value); }
+  size_t print(long long value, int = DEC) override { return emit(value); }
+  size_t print(unsigned long long value, int = DEC) override { return emit(value); }
+
+  const std::string& text() const { return _text; }
+};
+
+#if 0
+// Re-enable test once we can SET fem_ values in companion
+TEST(CompanionNodePrefs, RxGainSettingsRoundTripIndependently) {
+  NodePrefs saved;
+  saved.rx_boosted_gain = 0;
+  saved.radio_fem_rxgain = 1;
+  saved.radio_fem_txgain = 0;
+
+  CaptureStream output;
+  ASSERT_TRUE(saved.saveSerial(output));
+  EXPECT_NE(std::string::npos, output.text().find("rxgain:0"));
+  EXPECT_NE(std::string::npos, output.text().find("fem_rxgain:1"));
+  EXPECT_NE(std::string::npos, output.text().find("fem_txgain:0"));
+
+  ReplayStream input("{radio:{rxgain:1,fem_rxgain:0,fem_txgain:1}}");
+  NodePrefs loaded;
+  loaded.rx_boosted_gain = 0;
+  loaded.radio_fem_rxgain = 1;
+  loaded.radio_fem_txgain = 0;
+
+  ASSERT_TRUE(loaded.loadSerial(input));
+  EXPECT_EQ(1, loaded.rx_boosted_gain);
+  EXPECT_EQ(0, loaded.radio_fem_rxgain);
+  EXPECT_EQ(1, loaded.radio_fem_txgain);
+}
+#endif
+
+int main(int argc, char** argv) {
+  ::testing::InitGoogleTest(&argc, argv);
+  return RUN_ALL_TESTS();
+}
@@ -1,6 +1,14 @@
 #include <gtest/gtest.h>
 #include "helpers/ConfigSerializer.h"

+class NativeFileSystem {
+public:
+    void mkdir(const char*) { }
+};
+#define FILESYSTEM NativeFileSystem
+#include "helpers/CommonCLI.h"
+#undef FILESYSTEM
+
 #define TEST_INT_S  "56"
 #define TEST_INT     56
 #define TEST_FLOAT_S  "-6.123"
@@ -21,6 +29,19 @@ public:
 class MockPrintStream : public Stream {
    int len = 0;
    uint8_t _buf[1024];
+
+    size_t printSigned(long long value) {
+        char text[24];
+        snprintf(text, sizeof(text), "%lld", value);
+        return Print::print(text);
+    }
+
+    size_t printUnsigned(unsigned long long value) {
+        char text[24];
+        snprintf(text, sizeof(text), "%llu", value);
+        return Print::print(text);
+    }
+
 public:
    size_t write(uint8_t b) override {
        if (len < sizeof(_buf)) {
@@ -30,17 +51,17 @@ public:
        return 0;
    }

-    size_t print(unsigned char b, int r) override { if (b == TEST_INT) return Print::print(TEST_INT_S); return 0; }
-    size_t print(int v, int r) override { if (v == TEST_INT) return Print::print(TEST_INT_S); return 0; }
-    size_t print(unsigned int v, int r) override { if (v == TEST_INT) return Print::print(TEST_INT_S); return 0; }
-    size_t print(long v, int r) override { if (v == TEST_INT) return Print::print(TEST_INT_S); return 0; }
-    size_t print(unsigned long v, int r) override { if (v == TEST_INT) return Print::print(TEST_INT_S); return 0; }
-    size_t print(long long v, int r) override { if (v == TEST_INT) return Print::print(TEST_INT_S); return 0; }
-    size_t print(unsigned long long v, int r) override { if (v == TEST_INT) return Print::print(TEST_INT_S); return 0; }
-    size_t print(double v, int p = 2) override { 
-        if (p == 6) return Print::print(TEST_DOUBLE_S);
-        if (p == 4) return Print::print(TEST_FLOAT_S);
-        return 0;
+    size_t print(unsigned char v, int r) override { return printUnsigned(v); }
+    size_t print(int v, int r) override { return printSigned(v); }
+    size_t print(unsigned int v, int r) override { return printUnsigned(v); }
+    size_t print(long v, int r) override { return printSigned(v); }
+    size_t print(unsigned long v, int r) override { return printUnsigned(v); }
+    size_t print(long long v, int r) override { return printSigned(v); }
+    size_t print(unsigned long long v, int r) override { return printUnsigned(v); }
+    size_t print(double v, int p = 2) override {
+        char text[32];
+        snprintf(text, sizeof(text), "%.*f", p, v);
+        return Print::print(text);
    }

    int getLength() const { return len; }
@@ -171,6 +192,28 @@ TEST(ConfigSerializer, LoadSerial_IgnoreUnknowns) {
    EXPECT_TRUE(match);
 }

+TEST(NodePrefs, FemGainSettingsRoundTrip) {
+    NodePrefs saved;
+    saved.radio_fem_rxgain = 0;
+    saved.radio_fem_txgain = 1;
+
+    MockPrintStream output;
+    ASSERT_TRUE(saved.saveSerial(output));
+
+    std::string serialised(reinterpret_cast<const char*>(output.getBytes()), output.getLength());
+    EXPECT_NE(std::string::npos, serialised.find("fem_rxgain:0"));
+    EXPECT_NE(std::string::npos, serialised.find("fem_txgain:1"));
+
+    MockInputStream input(serialised.c_str());
+    NodePrefs loaded;
+    loaded.radio_fem_rxgain = 1;
+    loaded.radio_fem_txgain = 0;
+
+    ASSERT_TRUE(loaded.loadSerial(input));
+    EXPECT_EQ(0, loaded.radio_fem_rxgain);
+    EXPECT_EQ(1, loaded.radio_fem_txgain);
+}
+

 // ── main ───────────────────────────────────────────────────────

@@ -0,0 +1,110 @@
+#include <gtest/gtest.h>
+#include "helpers/RoutingPolicy.h"
+
+using namespace mesh;
+
+static Packet makeFlood(uint8_t route_type, uint8_t payload_type, uint8_t hops) {
+    Packet p;
+    p.header = route_type | (payload_type << PH_TYPE_SHIFT);
+    p.setPathHashSizeAndCount(1, hops);
+    p.payload_len = 1;
+    return p;
+}
+
+TEST(FloodHopLimit, UnscopedFloodIsDroppedAtFirstHopWhenMaxUnscopedIsZero) {
+    auto pkt = makeFlood(ROUTE_TYPE_FLOOD, PAYLOAD_TYPE_RESPONSE, 0);
+    EXPECT_TRUE(isFloodHopLimitExceeded(&pkt, 64, 0, 8));
+}
+
+TEST(FloodHopLimit, ScopedFloodIsForwardedWhenMaxUnscopedIsZero) {
+    for (uint8_t hops = 0; hops < 4; hops++) {
+        auto pkt = makeFlood(ROUTE_TYPE_TRANSPORT_FLOOD, PAYLOAD_TYPE_RESPONSE, hops);
+        EXPECT_FALSE(isFloodHopLimitExceeded(&pkt, 64, 0, 8)) << "hops=" << (int)hops;
+    }
+}
+
+TEST(FloodHopLimit, UnscopedFloodSurvivesUpToMaxUnscopedHops) {
+    // matches the reported workaround: raising flood.max.unscoped to the expected hop count
+    auto ok = makeFlood(ROUTE_TYPE_FLOOD, PAYLOAD_TYPE_RESPONSE, 2);
+    EXPECT_FALSE(isFloodHopLimitExceeded(&ok, 64, 3, 8));
+
+    auto too_far = makeFlood(ROUTE_TYPE_FLOOD, PAYLOAD_TYPE_RESPONSE, 3);
+    EXPECT_TRUE(isFloodHopLimitExceeded(&too_far, 64, 3, 8));
+}
+
+TEST(FloodHopLimit, ScopedFloodStillHonoursFloodMaxAndAdvertMax) {
+    auto beyond_max = makeFlood(ROUTE_TYPE_TRANSPORT_FLOOD, PAYLOAD_TYPE_RESPONSE, 5);
+    EXPECT_TRUE(isFloodHopLimitExceeded(&beyond_max, 5, 64, 8));
+
+    auto advert = makeFlood(ROUTE_TYPE_TRANSPORT_FLOOD, PAYLOAD_TYPE_ADVERT, 8);
+    EXPECT_TRUE(isFloodHopLimitExceeded(&advert, 64, 64, 8));
+}
+
+// flood.max.unscoped=0 hits adverts too, well before flood_max_advert applies: a node
+// still advertising un-scoped is invisible past its immediate neighbours
+TEST(FloodHopLimit, UnscopedAdvertIsAlsoDroppedAtHopZero) {
+    auto advert = makeFlood(ROUTE_TYPE_FLOOD, PAYLOAD_TYPE_ADVERT, 0);
+    EXPECT_TRUE(isFloodHopLimitExceeded(&advert, 64, 0, 8));
+
+    auto scoped = makeFlood(ROUTE_TYPE_TRANSPORT_FLOOD, PAYLOAD_TYPE_ADVERT, 0);
+    EXPECT_FALSE(isFloodHopLimitExceeded(&scoped, 64, 0, 8));
+}
+
+TEST(ReplyRoute, FloodRequestGetsAPathReturn) {
+    EXPECT_EQ(REPLY_ROUTE_PATH_RETURN,
+              chooseReplyRoute(true, false, false));
+    EXPECT_EQ(REPLY_ROUTE_PATH_RETURN,
+              chooseReplyRoute(true, false, true));
+}
+
+TEST(ReplyRoute, DirectRequestWithSuppliedPathRepliesDirect) {
+    EXPECT_EQ(REPLY_ROUTE_DIRECT_SUPPLIED, chooseReplyRoute(false, true, false));
+}
+
+// the reported bug: a DIRECT login (app already has a path) was answered by flooding, even
+// with an out_path stored. Under flood.max.unscoped=0 that reply never arrives.
+TEST(ReplyRoute, DirectRequestWithKnownOutPathRepliesDirect) {
+    EXPECT_EQ(REPLY_ROUTE_DIRECT_OUT_PATH,
+              chooseReplyRoute(false, false, true));
+}
+
+TEST(ReplyRoute, SuppliedPathWinsOverStoredOutPath) {
+    EXPECT_EQ(REPLY_ROUTE_DIRECT_SUPPLIED, chooseReplyRoute(false, true, true));
+}
+
+TEST(ReplyRoute, DirectRequestWithNoReturnPathFallsBackToFlood) {
+    EXPECT_EQ(REPLY_ROUTE_FLOOD, chooseReplyRoute(false, false, false));
+}
+
+TEST(ReplyScope, MirrorsTheRequestScopeWhenKnown) {
+    EXPECT_EQ(REPLY_SCOPE_REQUEST, chooseReplyScope(true,
+                                                    false,
+                                                    false));
+    EXPECT_EQ(REPLY_SCOPE_REQUEST, chooseReplyScope(true, false, true));
+}
+
+// un-scoped is itself a known scope, so mirror it. Replying scoped would change a path that
+// works today, and repeaters not holding our default Region would drop it anyway.
+TEST(ReplyScope, RepliesUnscopedToAnUnscopedFloodEvenWhenADefaultScopeExists) {
+    EXPECT_EQ(REPLY_SCOPE_NONE, chooseReplyScope(false,
+                                                 true,
+                                                 true));
+}
+
+// second half of the bug: a DIRECT request carries no transport codes, so recv_pkt_region is
+// always NULL. Un-scoped is dropped under flood.max.unscoped=0, and floods the mesh otherwise.
+TEST(ReplyScope, FallsBackToDefaultScopeWhenRequestScopeUnknown) {
+    EXPECT_EQ(REPLY_SCOPE_DEFAULT, chooseReplyScope(false,
+                                                    false,
+                                                    true));
+}
+
+TEST(ReplyScope, SendsUnscopedOnlyWhenNoScopeIsAvailableAtAll) {
+    EXPECT_EQ(REPLY_SCOPE_NONE, chooseReplyScope(false, false, false));
+    EXPECT_EQ(REPLY_SCOPE_NONE, chooseReplyScope(false, true, false));
+}
+
+int main(int argc, char** argv) {
+    ::testing::InitGoogleTest(&argc, argv);
+    return RUN_ALL_TESTS();
+}
@@ -104,7 +104,7 @@
 #define PIN_SPI_SCK             (32 + 8)
 #define PIN_SPI_NSS             LORA_CS

-#define PIN_SPI1_MISO           (-1)
+#define PIN_SPI1_MISO           (0)
 #define PIN_SPI1_MOSI           (0+17)
 #define PIN_SPI1_SCK            (0+20)

@@ -25,8 +25,8 @@
 #define ST7735_SDA              (0 + 24)
 #define ST7735_SCK              (32 + 0)
 #define ST7735_RESET            (0 + 20)
-#define ST7735_MISO             (-1)
-#define ST7735_BUSY             (-1)
+#define ST7735_MISO             (0) // 0 maps to 0xff on this device which is NRFX_SPIM_PIN_NOT_USED
+#define ST7735_BUSY             (0) // 0 maps to 0xff on this device which is NRFX_SPIM_PIN_NOT_USED
 #define ST7735_BL               (0 + 15)
 #define VTFT_CTRL               (0 + 13)

@@ -66,8 +66,7 @@
 // UART

 // No longer populated on PCB.
-#define PIN_SERIAL2_RX          (-1)
-#define PIN_SERIAL2_TX          (-1)
+// Removed the pin definitions to avoid potential issues with Uart.

 ////////////////////////////////////////////////////////////////////////////////
 // I2C
@@ -119,3 +119,8 @@ lib_deps =
  ${LilyGo_T-Echo_Card.lib_deps}
  end2endzone/NonBlockingRTTTL@^1.3.0
  densaugeo/base64 @ ~1.4.0
+
+[env:LilyGo_T-Echo_Card_kiss_modem]
+extends = LilyGo_T-Echo_Card
+build_src_filter = ${LilyGo_T-Echo_Card.build_src_filter}
+  +<../examples/kiss_modem/>
@@ -107,7 +107,7 @@
 #define  P_LORA_NSS                (11)  // P0.11
 #define  SX126X_RXEN               (33)  // P1.01
 #define  SX126X_TXEN               (27)  // P0.27
-#define  SX126X_DIO3_TCXO_VOLTAGE  (1.8f)
+#define  SX126X_DIO3_TCXO_VOLTAGE  (3.0f)


 ////////////////////////////////////////////////////////////////////////////////
@@ -12,10 +12,9 @@ build_flags = ${nrf52_base.build_flags}
  -D WRAPPER_CLASS=CustomSX1262Wrapper
  -D LORA_TX_POWER=22
  -D SX126X_POWER_EN=30
-  -D SX126X_DIO3_TCXO_VOLTAGE=1.8
+  -D SX126X_DIO3_TCXO_VOLTAGE=3.0
  -D SX126X_CURRENT_LIMIT=140
  -D SX126X_RX_BOOSTED_GAIN=1
-  -D SX126X_USE_REGULATOR_LDO=1
  -D P_LORA_TX_LED=LED_GREEN
  -D DISABLE_DIAGNOSTIC_OUTPUT
  -D ENV_INCLUDE_GPS=1
@@ -117,7 +116,7 @@ build_flags =
  -D WRAPPER_CLASS=CustomSX1262Wrapper
  -D LORA_TX_POWER=22
  -D SX126X_POWER_EN=30
-  -D SX126X_DIO3_TCXO_VOLTAGE=1.8
+  -D SX126X_DIO3_TCXO_VOLTAGE=3.0
  -D SX126X_CURRENT_LIMIT=140
  -D SX126X_RX_BOOSTED_GAIN=1
  -D P_LORA_TX_LED=LED_GREEN
@@ -162,6 +161,7 @@ build_flags =
  -D WRAPPER_CLASS=CustomSX1262Wrapper
  -D LORA_TX_POWER=22
  -D SX126X_POWER_EN=30
+  -D SX126X_DIO3_TCXO_VOLTAGE=3.0
  -D SX126X_CURRENT_LIMIT=140
  -D SX126X_RX_BOOSTED_GAIN=1
  -D P_LORA_TX_LED=LED_GREEN
@@ -58,7 +58,7 @@
 #define PIN_SPI_MISO            _PINNUM(0, 17) // (MISO)
 #define PIN_SPI_MOSI            _PINNUM(0, 15) // (MOSI)
 #define PIN_SPI_SCK             _PINNUM(0, 13) // (SCK)
-#define PIN_SPI_NSS             (-1)
+#define PIN_SPI_NSS             (0)

 ////////////////////////////////////////////////////////////////////////////////
 // QSPI FLASH
@@ -105,12 +105,14 @@
 #define LORA_CS                 _PINNUM(0, 11)
 #define SX126X_POWER_EN         _PINNUM(0, 30)
 #define SX126X_DIO1             _PINNUM(1, 8)
+#define SX126X_DIO2             _PINNUM(0, 5)
 #define SX126X_BUSY             _PINNUM(0, 14)
 #define SX126X_RESET            _PINNUM(0, 7)
 #define SX126X_RXEN             _PINNUM(1, 1)
 #define SX126X_TXEN             _PINNUM(0, 27)

 #define P_LORA_DIO_1            SX126X_DIO1
+#define P_LORA_DIO_2            SX126X_DIO2
 #define P_LORA_NSS              LORA_CS
 #define P_LORA_RESET            SX126X_RESET
 #define P_LORA_BUSY             SX126X_BUSY
@@ -121,7 +123,7 @@
 ////////////////////////////////////////////////////////////////////////////////
 // SPI1

-#define PIN_SPI1_MISO           (-1)            // Not used for Display
+#define PIN_SPI1_MISO           (0)            // Not used for Display, 0 maps to 0xff on this device which is NRFX_SPIM_PIN_NOT_USED
 #define PIN_SPI1_MOSI           _PINNUM(0, 20)
 #define PIN_SPI1_SCK            _PINNUM(0, 19)

@@ -133,7 +135,7 @@ extern const int SCK;
 ////////////////////////////////////////////////////////////////////////////////
 // Display

-// #define DISP_MISO               (-1)         // Not used for Display
+// #define DISP_MISO               (0)         // Not used for Display, 0 maps to 0xff on this device which is NRFX_SPIM_PIN_NOT_USED
 #define DISP_MOSI               _PINNUM(0, 20)
 #define DISP_SCLK               _PINNUM(0, 19)
 #define DISP_CS                 _PINNUM(0, 22)
@@ -141,7 +143,7 @@ extern const int SCK;
 #define DISP_RST                _PINNUM(0, 28)
 #define DISP_BUSY               _PINNUM(0, 3)
 #define DISP_POWER              _PINNUM(1, 12)
-// #define DISP_BACKLIGHT          (-1)         // Display has no backlight
+// #define DISP_BACKLIGHT          (0)         // Display has no backlight, 0 maps to 0xff on this device which is NRFX_SPIM_PIN_NOT_USED

 #define PIN_DISPLAY_CS          DISP_CS
 #define PIN_DISPLAY_DC          DISP_DC
@@ -98,3 +98,8 @@ build_src_filter = ${LilyGo_TETH_Elite_sx1262.build_src_filter}
 lib_deps =
  ${LilyGo_TETH_Elite_sx1262.lib_deps}
  densaugeo/base64 @ ~1.4.0
+
+[env:LilyGo_TETH_Elite_sx1262_kiss_modem]
+extends = LilyGo_TETH_Elite_sx1262
+build_src_filter = ${LilyGo_TETH_Elite_sx1262.build_src_filter}
+  +<../examples/kiss_modem/>
@@ -108,7 +108,7 @@
 #define PIN_DISPLAY_DC                 (31)
 #define PIN_DISPLAY_RST                (32 + 4)

-#define PIN_SPI1_MISO           (-1)
+#define PIN_SPI1_MISO           (0)  // 0 maps to 0xff on this device which is NRFX_SPIM_PIN_NOT_USED
 #define PIN_SPI1_MOSI           (20)
 #define PIN_SPI1_SCK            (22)

@@ -0,0 +1,83 @@
+#include "MeshnologyW12Board.h"
+
+void MeshnologyW12Board::begin() {
+    ESP32Board::begin();
+
+    pinMode(PIN_ADC_CTRL, OUTPUT);
+    digitalWrite(PIN_ADC_CTRL, LOW); // Disable battery sense until required
+
+    pinMode(P_LORA_LF_PA_POWER, OUTPUT);
+    digitalWrite(P_LORA_LF_PA_POWER, HIGH);   // PA_EN_M — power the GC1109 FEM
+
+    pinMode(P_LORA_HF_PA_POWER, OUTPUT);
+    digitalWrite(P_LORA_HF_PA_POWER, LOW);   // PA_EN_G — disable the 2.4GHz FEM
+
+    delay(100); // give the GC1109 some time to start
+
+    periph_power.begin();
+    esp_reset_reason_t reason = esp_reset_reason();
+    if (reason == ESP_RST_DEEPSLEEP) {
+      long wakeup_source = esp_sleep_get_ext1_wakeup_status();
+      if (wakeup_source & (1 << P_LORA_DIO_1)) {  // received a LoRa packet (while in deep sleep)
+        startup_reason = BD_STARTUP_RX_PACKET;
+    }
+
+      rtc_gpio_hold_dis((gpio_num_t)P_LORA_NSS);
+      rtc_gpio_deinit((gpio_num_t)P_LORA_DIO_1);
+    }
+  }
+
+  void MeshnologyW12Board::onBeforeTransmit(void) {
+    neopixelWrite(NEOPIXEL_LED, NEOPIXEL_BRIGHTNESS, NEOPIXEL_BRIGHTNESS, NEOPIXEL_BRIGHTNESS);   // turn TX neopixel on (White)
+  }
+
+  void MeshnologyW12Board::onAfterTransmit(void) {
+    neopixelWrite(NEOPIXEL_LED, 0, 0, 0);   // turn TX neopixel off
+  }
+
+  void MeshnologyW12Board::enterDeepSleep(uint32_t secs, int pin_wake_btn) {
+    esp_sleep_pd_config(ESP_PD_DOMAIN_RTC_PERIPH, ESP_PD_OPTION_ON);
+
+    // Make sure the DIO1 and NSS GPIOs are hold on required levels during deep sleep
+    rtc_gpio_set_direction((gpio_num_t)P_LORA_DIO_1, RTC_GPIO_MODE_INPUT_ONLY);
+    rtc_gpio_pulldown_en((gpio_num_t)P_LORA_DIO_1);
+
+    rtc_gpio_hold_en((gpio_num_t)P_LORA_NSS);
+
+    if (pin_wake_btn < 0) {
+      esp_sleep_enable_ext1_wakeup( (1L << P_LORA_DIO_1), ESP_EXT1_WAKEUP_ANY_HIGH);  // wake up on: recv LoRa packet
+    } else {
+      esp_sleep_enable_ext1_wakeup( (1L << P_LORA_DIO_1) | (1L << pin_wake_btn), ESP_EXT1_WAKEUP_ANY_HIGH);  // wake up on: recv LoRa packet OR wake btn
+    }
+
+    if (secs > 0) {
+      esp_sleep_enable_timer_wakeup(secs * 1000000);
+    }
+
+    // Finally set ESP32 into sleep
+    esp_deep_sleep_start();   // CPU halts here and never returns!
+  }
+
+  void MeshnologyW12Board::powerOff()  {
+    enterDeepSleep(0);
+  }
+
+  uint16_t MeshnologyW12Board::getBattMilliVolts()  {
+    analogReadResolution(12);
+    analogSetAttenuation(ADC_11db);
+    digitalWrite(PIN_ADC_CTRL, HIGH);
+    delay(10);
+    uint32_t raw = 0;
+    for (int i = 0; i < 8; i++) {
+      raw += analogRead(PIN_VBAT_READ);
+    }
+    raw = raw / 8;
+
+    digitalWrite(PIN_ADC_CTRL, LOW);
+
+    return (adc_mult * (3.3 / 4096.0) * raw) * 1000;
+  }
+
+  const char* MeshnologyW12Board::getManufacturerName() const {
+    return "Meshnology W12";
+  }
@@ -0,0 +1,37 @@
+#pragma once
+
+#include <Arduino.h>
+#include <helpers/RefCountedDigitalPin.h>
+#include <helpers/ESP32Board.h>
+#include <driver/rtc_io.h>
+
+#ifndef ADC_MULTIPLIER
+  #define ADC_MULTIPLIER 5.42
+#endif
+
+class MeshnologyW12Board : public ESP32Board {
+
+protected:
+  float adc_mult = ADC_MULTIPLIER;
+
+public:
+  RefCountedDigitalPin periph_power;
+  MeshnologyW12Board() : periph_power(PIN_VEXT_EN, PIN_VEXT_EN_ACTIVE) { }
+
+  void begin();
+  void onBeforeTransmit(void) override;
+  void onAfterTransmit(void) override;
+  void enterDeepSleep(uint32_t secs, int pin_wake_btn = -1);
+  void powerOff() override;
+  uint16_t getBattMilliVolts() override;
+  bool setAdcMultiplier(float multiplier) override {
+    if (multiplier == 0.0f) {
+      adc_mult = ADC_MULTIPLIER;
+    } else {
+      adc_mult = multiplier;
+    }
+    return true;
+  }
+  float getAdcMultiplier() const override { return adc_mult; }
+  const char* getManufacturerName() const override;
+};
@@ -0,0 +1,69 @@
+#ifndef Pins_Arduino_h
+#define Pins_Arduino_h
+
+#include <stdint.h>
+
+static const uint8_t LED_BUILTIN = -1;
+#define BUILTIN_LED  LED_BUILTIN // backward compatibility
+#define LED_BUILTIN LED_BUILTIN  // allow testing #ifdef LED_BUILTIN
+
+static const uint8_t TX = 43;
+static const uint8_t RX = 44;
+
+static const uint8_t SDA = 3;
+static const uint8_t SCL = 4;
+
+static const uint8_t SS    = 8;
+static const uint8_t MOSI  = 10;
+static const uint8_t MISO  = 11;
+static const uint8_t SCK   = 9;
+
+static const uint8_t A0 = 1;
+static const uint8_t A1 = 2;
+static const uint8_t A2 = 3;
+static const uint8_t A3 = 4;
+static const uint8_t A4 = 5;
+static const uint8_t A5 = 6;
+static const uint8_t A6 = 7;
+static const uint8_t A7 = 8;
+static const uint8_t A8 = 9;
+static const uint8_t A9 = 10;
+static const uint8_t A10 = 11;
+static const uint8_t A11 = 12;
+static const uint8_t A12 = 13;
+static const uint8_t A13 = 14;
+static const uint8_t A14 = 15;
+static const uint8_t A15 = 16;
+static const uint8_t A16 = 17;
+static const uint8_t A17 = 18;
+static const uint8_t A18 = 19;
+static const uint8_t A19 = 20;
+
+static const uint8_t T1 = 1;
+static const uint8_t T2 = 2;
+static const uint8_t T3 = 3;
+static const uint8_t T4 = 4;
+static const uint8_t T5 = 5;
+static const uint8_t T6 = 6;
+static const uint8_t T7 = 7;
+static const uint8_t T8 = 8;
+static const uint8_t T9 = 9;
+static const uint8_t T10 = 10;
+static const uint8_t T11 = 11;
+static const uint8_t T12 = 12;
+static const uint8_t T13 = 13;
+static const uint8_t T14 = 14;
+
+static const uint8_t Vext = 45;
+static const uint8_t LED  = -1;
+static const uint8_t RST_OLED = 21;
+static const uint8_t SCL_OLED = 18;
+static const uint8_t SDA_OLED = 17;
+
+static const uint8_t RST_LoRa = 12;
+static const uint8_t BUSY_LoRa = 13;
+static const uint8_t DIO0 = 14;
+
+
+
+#endif /* Pins_Arduino_h */
@@ -0,0 +1,216 @@
+[meshnology_w12]
+extends = esp32_base
+board = meshnology_w12
+build_flags =
+  ${esp32_base.build_flags}
+  ${sensor_base.build_flags}
+  -I variants/meshnology_w12
+  -D MESHNOLOGY_W12
+  -D ESP32_CPU_FREQ=80
+  -D RADIO_CLASS=CustomLR2021
+  -D WRAPPER_CLASS=CustomLR2021Wrapper
+  -D USE_LR2021
+  -D NEOPIXEL_LED=46
+  -D NEOPIXEL_BRIGHTNESS=64
+  -D P_LORA_DIO_1=14
+  -D LR2021_IRQ_DIO=8         ; GPIO14 is connected to LR2021 DIO8
+  -D P_LORA_NSS=8
+  -D P_LORA_SCLK=9
+  -D P_LORA_MOSI=10
+  -D P_LORA_MISO=11
+  -D P_LORA_RESET=12
+  -D P_LORA_BUSY=13
+  -D LR2021_TCXO_VOLTAGE=0.0f ; this board has no tcxo 
+  -D RF_SWITCH_TABLE          ; used below in commented code for the RF switch table.
+  -D P_LORA_LF_PA_POWER=4     ; PA_EN_M - power enable for the GC1109 868/915 PA
+  -D P_LORA_HF_PA_POWER=3     ; PA_EN_G - power enable for RFX2402E 2.4G PA
+  -D PIN_USER_BTN=0
+  -D PIN_VEXT_EN=45
+  -D PIN_VEXT_EN_ACTIVE=HIGH
+  -D LORA_TX_POWER=4
+  -D MAX_LORA_TX_POWER=4      ; GC1109 datasheet says max input at TX port is +5dbm, confirmed full saturation seems to occur at around 3-4dbm
+  -D PIN_GPS_RX=38
+  -D PIN_GPS_TX=39
+  -D PIN_GPS_RESET=42
+  -D PIN_GPS_RESET_ACTIVE=LOW
+  -D PIN_GPS_EN=48
+  -D PIN_GPS_EN_ACTIVE=LOW
+  ; -D ENV_INCLUDE_GPS=1
+  -D PIN_VBAT_READ=1
+  -D PIN_ADC_CTRL=2
+  -D PIN_BOARD_SDA=17
+  -D PIN_BOARD_SCL=18
+  -D PIN_RESET=47
+build_src_filter = ${esp32_base.build_src_filter}
+  +<../variants/meshnology_w12>
+  +<helpers/sensors>
+lib_deps =
+  ${esp32_base.lib_deps}
+  ${sensor_base.lib_deps}
+
+[env:meshnology_w12_repeater]
+extends = meshnology_w12
+build_flags =
+  ${meshnology_w12.build_flags}
+  -D DISPLAY_CLASS=SSD1306Display
+  -D ADVERT_NAME='"Meshnology W12 Repeater"'
+  -D ADVERT_LAT=0.0
+  -D ADVERT_LON=0.0
+  -D ADMIN_PASSWORD='"password"'
+  -D MAX_NEIGHBOURS=50
+  ; -D MESH_PACKET_LOGGING=1
+  ; -D MESH_DEBUG=1
+build_src_filter = ${meshnology_w12.build_src_filter}
+  +<helpers/ui/SSD1306Display.cpp>
+  +<../examples/simple_repeater>
+lib_deps =
+  ${meshnology_w12.lib_deps}
+  ${esp32_ota.lib_deps}
+  bakercp/CRC32 @ ^2.0.0
+
+[env:meshnology_w12_repeater_bridge_espnow]
+extends = meshnology_w12
+build_flags =
+  ${meshnology_w12.build_flags}
+  -D DISPLAY_CLASS=SSD1306Display
+  -D ADVERT_NAME='"ESPNow Bridge"'
+  -D ADVERT_LAT=0.0
+  -D ADVERT_LON=0.0
+  -D ADMIN_PASSWORD='"password"'
+  -D MAX_NEIGHBOURS=50
+  -D WITH_ESPNOW_BRIDGE=1
+  ; -D BRIDGE_DEBUG=1
+  ; -D MESH_PACKET_LOGGING=1
+  ; -D MESH_DEBUG=1
+build_src_filter = ${meshnology_w12.build_src_filter}
+  +<helpers/bridges/ESPNowBridge.cpp>
+  +<helpers/ui/SSD1306Display.cpp>
+  +<../examples/simple_repeater>
+lib_deps =
+  ${meshnology_w12.lib_deps}
+  ${esp32_ota.lib_deps}
+
+[env:meshnology_w12_room_server]
+extends = meshnology_w12
+build_flags =
+  ${meshnology_w12.build_flags}
+  -D DISPLAY_CLASS=SSD1306Display
+  -D ADVERT_NAME='"Meshnology W12 Room"'
+  -D ADVERT_LAT=0.0
+  -D ADVERT_LON=0.0
+  -D ADMIN_PASSWORD='"password"'
+  -D ROOM_PASSWORD='"hello"'
+  ; -D MESH_PACKET_LOGGING=1
+  ; -D MESH_DEBUG=1
+build_src_filter = ${meshnology_w12.build_src_filter}
+  +<helpers/ui/SSD1306Display.cpp>
+  +<../examples/simple_room_server>
+lib_deps =
+  ${meshnology_w12.lib_deps}
+  ${esp32_ota.lib_deps}
+
+[env:meshnology_w12_terminal_chat]
+extends = meshnology_w12
+build_flags =
+  ${meshnology_w12.build_flags}
+  -D MAX_CONTACTS=350
+  -D MAX_GROUP_CHANNELS=1
+  ; -D MESH_PACKET_LOGGING=1
+  ; -D MESH_DEBUG=1
+build_src_filter = ${meshnology_w12.build_src_filter}
+  +<../examples/simple_secure_chat/main.cpp>
+lib_deps =
+  ${meshnology_w12.lib_deps}
+  densaugeo/base64 @ ~1.4.0
+
+[env:meshnology_w12_companion_radio_usb]
+extends = meshnology_w12
+build_flags =
+  ${meshnology_w12.build_flags}
+  -I examples/companion_radio/ui-new
+  -D MAX_CONTACTS=350
+  -D MAX_GROUP_CHANNELS=40
+  -D DISPLAY_CLASS=SSD1306Display
+; NOTE: DO NOT ENABLE -->  -D MESH_PACKET_LOGGING=1
+; NOTE: DO NOT ENABLE -->  -D MESH_DEBUG=1
+build_src_filter = ${meshnology_w12.build_src_filter}
+  +<helpers/ui/SSD1306Display.cpp>
+  +<helpers/ui/MomentaryButton.cpp>
+  +<../examples/companion_radio/*.cpp>
+  +<../examples/companion_radio/ui-new/*.cpp>
+lib_deps =
+  ${meshnology_w12.lib_deps}
+  densaugeo/base64 @ ~1.4.0
+
+[env:meshnology_w12_companion_radio_ble]
+extends = meshnology_w12
+build_flags =
+  ${meshnology_w12.build_flags}
+  -I examples/companion_radio/ui-new
+  -D MAX_CONTACTS=350
+  -D MAX_GROUP_CHANNELS=40
+  -D DISPLAY_CLASS=SSD1306Display
+  -D BLE_PIN_CODE=123456   ; dynamic, random PIN
+  ; -D AUTO_SHUTDOWN_MILLIVOLTS=3400  ; disabled by default, otherwise reading bounce causes shutdown when there's no battery connected.
+  ; -D BLE_DEBUG_LOGGING=1
+  -D OFFLINE_QUEUE_SIZE=256
+  ; -D MESH_PACKET_LOGGING=1
+  ; -D MESH_DEBUG=1
+build_src_filter = ${meshnology_w12.build_src_filter}
+  +<helpers/ui/SSD1306Display.cpp>
+  +<helpers/ui/MomentaryButton.cpp>
+  +<helpers/esp32/*.cpp>
+  +<../examples/companion_radio/*.cpp>
+  +<../examples/companion_radio/ui-new/*.cpp>
+lib_deps =
+  ${meshnology_w12.lib_deps}
+  densaugeo/base64 @ ~1.4.0
+
+[env:meshnology_w12_companion_radio_wifi]
+extends = meshnology_w12
+build_flags =
+  ${meshnology_w12.build_flags}
+  -I examples/companion_radio/ui-new
+  -D MAX_CONTACTS=350
+  -D MAX_GROUP_CHANNELS=40
+  -D OFFLINE_QUEUE_SIZE=256
+  -D DISPLAY_CLASS=SSD1306Display
+  ; -D WIFI_DEBUG_LOGGING=1
+  -D WIFI_SSID='"myssid"'
+  -D WIFI_PWD='"mypwd"'
+  ; -D MESH_PACKET_LOGGING=1
+  ; -D MESH_DEBUG=1
+build_src_filter = ${meshnology_w12.build_src_filter}
+  +<helpers/ui/SSD1306Display.cpp>
+  +<helpers/ui/MomentaryButton.cpp>
+  +<helpers/esp32/*.cpp>
+  +<../examples/companion_radio/*.cpp>
+  +<../examples/companion_radio/ui-new/*.cpp>
+lib_deps =
+  ${meshnology_w12.lib_deps}
+  densaugeo/base64 @ ~1.4.0
+
+[env:meshnology_w12_sensor]
+extends = meshnology_w12
+build_flags =
+  ${meshnology_w12.build_flags}
+  -D ADVERT_NAME='"Meshnology W12 Sensor"'
+  -D ADVERT_LAT=0.0
+  -D ADVERT_LON=0.0
+  -D ADMIN_PASSWORD='"password"'
+  -D ENV_PIN_SDA=3
+  -D ENV_PIN_SCL=4
+  -D DISPLAY_CLASS=SSD1306Display
+  ; -D MESH_PACKET_LOGGING=1
+  ; -D MESH_DEBUG=1
+build_src_filter = ${meshnology_w12.build_src_filter}
+  +<helpers/ui/SSD1306Display.cpp>
+  +<../examples/simple_sensor>
+lib_deps =
+  ${meshnology_w12.lib_deps}
+  ${esp32_ota.lib_deps}
+
+[env:meshnology_w12_kiss_modem]
+extends = meshnology_w12
+build_src_filter = ${meshnology_w12.build_src_filter}
+  +<../examples/kiss_modem/>
@@ -0,0 +1,73 @@
+#include <Arduino.h>
+#include "target.h"
+
+MeshnologyW12Board board;
+
+#if defined(P_LORA_SCLK)
+  static SPIClass spi;
+  RADIO_CLASS radio = new Module(P_LORA_NSS, P_LORA_DIO_1, P_LORA_RESET, P_LORA_BUSY, spi);
+#else
+  RADIO_CLASS radio = new Module(P_LORA_NSS, P_LORA_DIO_1, P_LORA_RESET, P_LORA_BUSY);
+#endif
+
+WRAPPER_CLASS radio_driver(radio, board);
+
+ESP32RTCClock fallback_clock;
+AutoDiscoverRTCClock rtc_clock(fallback_clock);
+
+#if ENV_INCLUDE_GPS
+  #include <helpers/sensors/MicroNMEALocationProvider.h>
+  MicroNMEALocationProvider nmea = MicroNMEALocationProvider(Serial1, &rtc_clock);
+  EnvironmentSensorManager sensors = EnvironmentSensorManager(nmea);
+#else
+  EnvironmentSensorManager sensors;
+#endif
+
+#ifdef DISPLAY_CLASS
+  DISPLAY_CLASS display(NULL);
+  MomentaryButton user_btn(PIN_USER_BTN, 1000, true);
+#endif
+
+const uint32_t rfswitch_dios[] = {
+  RADIOLIB_LR2021_DIO5,   // RFX2402E 2.4G_TX_EN
+  RADIOLIB_LR2021_DIO6,   // RFX2402E 2.4G_RX_EN
+  RADIOLIB_LR2021_DIO9,   // GC1109 CTX (Transmit mode)
+  RADIOLIB_LR2021_DIO10,  // GC1109 CPS (Bypass mode)
+  RADIOLIB_LR2021_DIO11,  // GC1109 CSD (Shutdown)
+};
+
+static const Module::RfSwitchMode_t rfswitch_table[] = {
+  //                    DIO5   DIO6  DIO9  DIO10  DIO11
+  { LR2021::MODE_STBY,  { LOW,  LOW,  LOW,  LOW,  LOW  } },  // everything off
+  { LR2021::MODE_RX,    { LOW,  LOW,  LOW,  LOW,  HIGH } },  // rx_lf: GC1109 LNA
+  { LR2021::MODE_TX,    { LOW,  LOW,  HIGH, HIGH, HIGH } },  // tx_lf: GC1109 full PA
+  { LR2021::MODE_RX_HF, { LOW,  HIGH, LOW,  LOW,  LOW  } },  // rx_hf: 2G4 LNA, GC1109 off
+  { LR2021::MODE_TX_HF, { HIGH, LOW,  LOW,  LOW,  LOW  } },  // tx_hf: 2G4 PA,  GC1109 off
+  END_OF_MODE_TABLE,
+};
+
+
+bool radio_init() {
+  fallback_clock.begin();
+  rtc_clock.begin(Wire);
+
+#if defined(P_LORA_SCLK)
+  int err = radio.std_init(&spi);
+  if (err != 1) return err;
+#else
+  int err = radio.std_init();
+  if (err != 1) return err;
+#endif
+
+#ifdef RF_SWITCH_TABLE 
+  radio.setRfSwitchTable(rfswitch_dios, rfswitch_table);
+#endif
+
+  return true;
+}
+
+mesh::LocalIdentity radio_new_identity() {
+  RadioNoiseListener rng(radio);
+  return mesh::LocalIdentity(&rng);  // create new random identity
+}
+
@@ -0,0 +1,28 @@
+#pragma once
+
+#define RADIOLIB_STATIC_ONLY 1
+#include <RadioLib.h>
+#include <helpers/radiolib/RadioLibWrappers.h>
+#include <MeshnologyW12Board.h>
+#include <helpers/radiolib/CustomLR2021Wrapper.h>
+#include <helpers/AutoDiscoverRTCClock.h>
+#include <helpers/SensorManager.h>
+#include <helpers/sensors/EnvironmentSensorManager.h>
+#ifdef DISPLAY_CLASS
+ #include <helpers/ui/SSD1306Display.h>
+  #include <helpers/ui/MomentaryButton.h>
+#endif
+
+extern MeshnologyW12Board board;
+extern WRAPPER_CLASS radio_driver;
+extern AutoDiscoverRTCClock rtc_clock;
+extern EnvironmentSensorManager sensors;
+
+#ifdef DISPLAY_CLASS
+  extern DISPLAY_CLASS display;
+  extern MomentaryButton user_btn;
+#endif
+
+bool radio_init();
+mesh::LocalIdentity radio_new_identity();
+
@@ -0,0 +1,23 @@
+#include <Arduino.h>
+#include <Wire.h>
+
+#include "MeshTrackerX1Board.h"
+
+void MeshTrackerX1Board::begin() {
+  NRF52BoardDCDC::begin();
+  btn_prev_state = LOW;   // button is active HIGH
+
+#ifdef BUTTON_PIN
+  pinMode(BATTERY_PIN, INPUT);
+  pinMode(BUTTON_PIN, INPUT_PULLDOWN);
+  pinMode(LED_PIN, OUTPUT);
+#endif
+
+#if defined(PIN_BOARD_SDA) && defined(PIN_BOARD_SCL)
+  Wire.setPins(PIN_BOARD_SDA, PIN_BOARD_SCL);
+#endif
+
+  Wire.begin();
+
+  delay(10);   // give lr2021 some time to power up
+}
@@ -0,0 +1,87 @@
+#pragma once
+
+#include <MeshCore.h>
+#include <Arduino.h>
+#include <helpers/NRF52Board.h>
+
+class MeshTrackerX1Board : public NRF52BoardDCDC {
+protected:
+  uint8_t btn_prev_state;
+
+public:
+  MeshTrackerX1Board() : NRF52Board("X1_OTA") {}
+  void begin();
+
+  uint16_t getBattMilliVolts() override {
+  #ifdef BATTERY_PIN
+   #ifdef PIN_BAT_ADC_EN
+    digitalWrite(PIN_BAT_ADC_EN, HIGH);
+   #endif
+    analogReference(AR_INTERNAL_3_0);
+    analogReadResolution(12);
+    delay(10);
+    float volts = (analogRead(BATTERY_PIN) * ADC_MULTIPLIER * AREF_VOLTAGE) / 4096;
+
+    analogReference(AR_DEFAULT);  // put back to default
+    analogReadResolution(10);
+
+    return volts * 1000;
+  #else
+    return 0;
+  #endif
+  }
+
+  const char* getManufacturerName() const override {
+    return "Seeed SenseCAP MeshTracker X1";
+  }
+
+  int buttonStateChanged() {
+  #ifdef BUTTON_PIN
+    uint8_t v = digitalRead(BUTTON_PIN);
+    if (v != btn_prev_state) {
+      btn_prev_state = v;
+      return (v == USER_BTN_PRESSED) ? 1 : -1;
+    }
+  #endif
+    return 0;
+  }
+
+  void powerOff() override {
+    #ifdef HAS_GPS
+        digitalWrite(GPS_VRTC_EN, LOW);
+        digitalWrite(GPS_RESET, LOW);
+        digitalWrite(GPS_SLEEP_INT, LOW);
+        digitalWrite(GPS_RTC_INT, LOW);
+        digitalWrite(GPS_EN, LOW);
+    #endif
+
+    #ifdef PIN_DRV_EN
+        digitalWrite(PIN_DRV_EN, LOW);
+    #endif
+
+    #ifdef PIN_BAT_ADC_EN
+        digitalWrite(PIN_BAT_ADC_EN, LOW);
+    #endif
+
+    #ifdef PIN_3V3_EN
+        digitalWrite(PIN_3V3_EN, LOW);
+    #endif
+
+    // set led on and wait for button release before poweroff
+    #ifdef LED_PIN
+    digitalWrite(LED_PIN, HIGH);
+    #endif
+    #ifdef BUTTON_PIN
+    while(digitalRead(BUTTON_PIN));
+    #endif
+    #ifdef LED_PIN
+    digitalWrite(LED_PIN, LOW);
+    #endif
+
+    #ifdef BUTTON_PIN
+    nrf_gpio_cfg_sense_input(BUTTON_PIN, NRF_GPIO_PIN_PULLDOWN, NRF_GPIO_PIN_SENSE_HIGH);
+    #endif
+
+    sd_power_system_off();
+  }
+};
@@ -0,0 +1,137 @@
+[MeshTracker_X1]
+extends = nrf52_base
+board = seeed-mesh-tracker-x1
+board_build.ldscript = boards/nrf52840_s140_v7.ld
+build_flags = ${nrf52_base.build_flags}
+  -I src/helpers/nrf52
+  -I lib/nrf52/s140_nrf52_7.3.0_API/include
+  -I lib/nrf52/s140_nrf52_7.3.0_API/include/nrf52
+  -I variants/meshtracker_x1
+  -I src/helpers/ui
+  -D MESH_TRACKER_X1
+  -D PIN_USER_BTN=6
+  -D USER_BTN_PRESSED=HIGH
+  -D PIN_STATUS_LED=24
+  -D PIN_STATUS_LED_R=3 ; P0.3 red
+  -D PIN_STATUS_LED_G=24 ; P0.24 green
+  -D PIN_STATUS_LED_B=28 ; P0.28 blue
+  -D RADIO_CLASS=CustomLR2021
+  -D USE_LR2021
+  -D WRAPPER_CLASS=CustomLR2021Wrapper
+  -D LORA_TX_POWER=22
+  -D P_LORA_BUSY=7 ; P0.7
+  -D P_LORA_SCLK=11 ; P0.11
+  -D P_LORA_NSS=12 ; P0.12
+  -D P_LORA_DIO_1=33 ; P1.1
+  -D P_LORA_MISO=40 ; P1.8
+  -D P_LORA_MOSI=41 ; P1.9
+  -D P_LORA_RESET=42 ; P1.10
+  -D LR2021_IRQ_DIO=8         ; P1.1 is connected to LR2021 DIO8
+  -D LR2021_TCXO_VOLTAGE=1.6f
+  -D ENV_INCLUDE_GPS=1
+build_src_filter = ${nrf52_base.build_src_filter}
+  +<helpers/*.cpp>
+  +<../variants/meshtracker_x1>
+lib_deps = ${nrf52_base.lib_deps}
+  https://github.com/adafruit/Adafruit_SPA06_003/archive/refs/tags/1.0.2.zip
+debug_tool = jlink
+upload_protocol = nrfutil
+
+[env:MeshTracker_X1_repeater]
+extends = MeshTracker_X1
+build_flags = ${MeshTracker_X1.build_flags}
+  -I examples/companion_radio/ui-orig
+  -D ADVERT_NAME='"MeshTracker X1 Repeater"'
+  -D ADVERT_LAT=0.0
+  -D ADVERT_LON=0.0
+  -D ADMIN_PASSWORD='"password"'
+  -D MAX_NEIGHBOURS=50
+;  -D MESH_PACKET_LOGGING=1
+;  -D MESH_DEBUG=1
+build_src_filter = ${MeshTracker_X1.build_src_filter}
+  +<../examples/simple_repeater>
+lib_deps = ${MeshTracker_X1.lib_deps}
+  stevemarple/MicroNMEA @ ^2.0.6
+
+[env:MeshTracker_X1_room_server]
+extends = MeshTracker_X1
+build_flags = ${MeshTracker_X1.build_flags}
+  -I examples/companion_radio/ui-orig
+  -D ADVERT_NAME='"MeshTracker X1 Room"'
+  -D ADVERT_LAT=0.0
+  -D ADVERT_LON=0.0
+  -D ADMIN_PASSWORD='"password"'
+  -D ROOM_PASSWORD='"hello"'
+;  -D MESH_PACKET_LOGGING=1
+;  -D MESH_DEBUG=1
+build_src_filter = ${MeshTracker_X1.build_src_filter}
+  +<../examples/simple_room_server>
+lib_deps = ${MeshTracker_X1.lib_deps}
+  stevemarple/MicroNMEA @ ^2.0.6
+
+[env:MeshTracker_X1_companion_radio_usb]
+extends = MeshTracker_X1
+board_build.ldscript = boards/nrf52840_s140_v7_extrafs.ld
+board_upload.maximum_size = 708608
+build_flags = ${MeshTracker_X1.build_flags}
+  -I examples/companion_radio/ui-orig
+  -D QSPIFLASH=1
+  -D MAX_CONTACTS=350
+  -D MAX_GROUP_CHANNELS=40
+;  -D MESH_PACKET_LOGGING=1
+;  -D MESH_DEBUG=1
+  -D OFFLINE_QUEUE_SIZE=256
+  -D DISPLAY_CLASS=NullDisplayDriver
+  -D PIN_BUZZER=25
+  -D HAS_DRV2605=1
+  -D DRV2605_USE_LRA=1
+  -D ENABLE_USB_INTERFACE
+build_src_filter = ${MeshTracker_X1.build_src_filter}
+  +<helpers/ui/buzzer.cpp>
+  +<helpers/ui/NullDisplayDriver.cpp>
+  +<helpers/ui/DRV2605Vibration.cpp>
+  +<../examples/companion_radio/*.cpp>
+  +<../examples/companion_radio/ui-orig/*.cpp>
+lib_deps = ${MeshTracker_X1.lib_deps}
+  densaugeo/base64 @ ~1.4.0
+  stevemarple/MicroNMEA @ ^2.0.6
+  end2endzone/NonBlockingRTTTL@^1.3.0
+  adafruit/Adafruit DRV2605 Library @ ^1.2.4
+
+[env:MeshTracker_X1_companion_radio_ble]
+extends = MeshTracker_X1
+board_build.ldscript = boards/nrf52840_s140_v7_extrafs.ld
+board_upload.maximum_size = 708608
+build_flags = ${MeshTracker_X1.build_flags}
+  -I examples/companion_radio/ui-orig
+  -D QSPIFLASH=1
+  -D MAX_CONTACTS=350
+  -D MAX_GROUP_CHANNELS=40
+  -D BLE_PIN_CODE=123456
+  -D BLE_TX_POWER=0
+;  -D BLE_DEBUG_LOGGING=1
+;  -D MESH_PACKET_LOGGING=1
+;  -D MESH_DEBUG=1
+  -D OFFLINE_QUEUE_SIZE=256
+  -D DISPLAY_CLASS=NullDisplayDriver
+  -D PIN_BUZZER=25
+  -D HAS_DRV2605=1
+  -D DRV2605_USE_LRA=1
+  -D ADVERT_NAME='"@@MAC"'
+build_src_filter = ${MeshTracker_X1.build_src_filter}
+  +<helpers/nrf52/SerialBLEInterface.cpp>
+  +<helpers/ui/buzzer.cpp>
+  +<helpers/ui/NullDisplayDriver.cpp>
+  +<helpers/ui/DRV2605Vibration.cpp>
+  +<../examples/companion_radio/*.cpp>
+  +<../examples/companion_radio/ui-orig/*.cpp>
+lib_deps = ${MeshTracker_X1.lib_deps}
+  densaugeo/base64 @ ~1.4.0
+  stevemarple/MicroNMEA @ ^2.0.6
+  end2endzone/NonBlockingRTTTL@^1.3.0
+  adafruit/Adafruit DRV2605 Library @ ^1.2.4
+
+[env:MeshTracker_X1_kiss_modem]
+extends = MeshTracker_X1
+build_src_filter = ${MeshTracker_X1.build_src_filter}
+  +<../examples/kiss_modem/>
@@ -0,0 +1,132 @@
+#include <Arduino.h>
+#include "target.h"
+#include <helpers/sensors/MicroNMEALocationProvider.h>
+
+MeshTrackerX1Board board;
+
+RADIO_CLASS radio = new Module(P_LORA_NSS, P_LORA_DIO_1, P_LORA_RESET, P_LORA_BUSY, SPI);
+
+WRAPPER_CLASS radio_driver(radio, board);
+
+VolatileRTCClock rtc_clock;
+MicroNMEALocationProvider nmea = MicroNMEALocationProvider(Serial1, &rtc_clock);
+MeshTrackerX1SensorManager sensors = MeshTrackerX1SensorManager(nmea);
+
+#ifdef DISPLAY_CLASS
+  NullDisplayDriver display;
+#endif
+
+bool radio_init() {
+  return radio.std_init(&SPI);
+}
+
+mesh::LocalIdentity radio_new_identity() {
+  RadioNoiseListener rng(radio);
+  return mesh::LocalIdentity(&rng);  // create new random identity
+}
+
+void MeshTrackerX1SensorManager::start_gps() {
+  gps_active = true;
+  // this init sequence comes from seeed examples and deals with all gps pins
+  pinMode(GPS_EN, OUTPUT);
+  digitalWrite(GPS_EN, HIGH);
+  delay(10);
+  pinMode(GPS_VRTC_EN, OUTPUT);
+  digitalWrite(GPS_VRTC_EN, HIGH);
+  delay(10);
+
+  pinMode(GPS_RESET, OUTPUT);
+  digitalWrite(GPS_RESET, HIGH);
+  delay(10);
+  digitalWrite(GPS_RESET, LOW);
+
+  pinMode(GPS_SLEEP_INT, OUTPUT);
+  digitalWrite(GPS_SLEEP_INT, HIGH);
+  pinMode(GPS_RTC_INT, OUTPUT);
+  digitalWrite(GPS_RTC_INT, LOW);
+}
+
+void MeshTrackerX1SensorManager::sleep_gps() {
+  gps_active = false;
+  digitalWrite(GPS_VRTC_EN, HIGH);   // keep RTC alive for faster fix on wake
+  digitalWrite(GPS_EN, LOW);
+  digitalWrite(GPS_RESET, LOW);
+  digitalWrite(GPS_SLEEP_INT, HIGH);
+  digitalWrite(GPS_RTC_INT, LOW);
+}
+
+void MeshTrackerX1SensorManager::stop_gps() {
+  gps_active = false;
+  digitalWrite(GPS_VRTC_EN, LOW);
+  digitalWrite(GPS_EN, LOW);
+  digitalWrite(GPS_RESET, LOW);
+  digitalWrite(GPS_SLEEP_INT, HIGH);
+  digitalWrite(GPS_RTC_INT, LOW);
+}
+
+bool MeshTrackerX1SensorManager::begin() {
+  // init GPS
+  Serial1.begin(GPS_BAUD_RATE);
+
+  // init SPA06-003 barometer
+  baro_ok = spa06.begin(SPA06_003_DEFAULT_ADDR, &Wire) || spa06.begin(0x76, &Wire);
+  if (baro_ok) {
+    spa06.setPressureOversampling(SPA06_003_OVERSAMPLE_8);
+    spa06.setTemperatureOversampling(SPA06_003_OVERSAMPLE_8);
+    // 1 Hz continuous keeps reads non-blocking at minimal power cost
+    spa06.setPressureMeasureRate(SPA06_003_RATE_1);
+    spa06.setTemperatureMeasureRate(SPA06_003_RATE_1);
+    spa06.setMeasurementMode(SPA06_003_MEAS_CONTINUOUS_BOTH);
+  }
+  return true;
+}
+
+bool MeshTrackerX1SensorManager::querySensors(uint8_t requester_permissions, CayenneLPP& telemetry) {
+  if (requester_permissions & TELEM_PERM_LOCATION) {   // does requester have permission?
+    telemetry.addGPS(TELEM_CHANNEL_SELF, node_lat, node_lon, node_altitude);
+  }
+  if (requester_permissions & TELEM_PERM_ENVIRONMENT && baro_ok) {
+    telemetry.addTemperature(TELEM_CHANNEL_SELF, spa06.readTemperature());
+    telemetry.addBarometricPressure(TELEM_CHANNEL_SELF, spa06.readPressure());
+  }
+  return true;
+}
+
+void MeshTrackerX1SensorManager::loop() {
+  static long next_gps_update = 0;
+
+
+  _nmea->loop();
+
+  if (millis() > next_gps_update) {
+    if (gps_active && _nmea->isValid()) {
+      node_lat = ((double)_nmea->getLatitude())/1000000.;
+      node_lon = ((double)_nmea->getLongitude())/1000000.;
+      node_altitude = ((double)_nmea->getAltitude()) / 1000.0;
+    }
+    next_gps_update = millis() + 1000;
+  }
+}
+
+int MeshTrackerX1SensorManager::getNumSettings() const { return 1; }  // just one supported: "gps" (power switch)
+
+const char* MeshTrackerX1SensorManager::getSettingName(int i) const {
+  return i == 0 ? "gps" : NULL;
+}
+const char* MeshTrackerX1SensorManager::getSettingValue(int i) const {
+  if (i == 0) {
+    return gps_active ? "1" : "0";
+  }
+  return NULL;
+}
+bool MeshTrackerX1SensorManager::setSettingValue(const char* name, const char* value) {
+  if (strcmp(name, "gps") == 0) {
+    if (strcmp(value, "0") == 0) {
+      sleep_gps(); // sleep for faster fix !
+    } else {
+      start_gps();
+    }
+    return true;
+  }
+  return false;  // not supported
+}
@@ -0,0 +1,47 @@
+#pragma once
+
+#define RADIOLIB_STATIC_ONLY 1
+#include <RadioLib.h>
+#include <helpers/radiolib/RadioLibWrappers.h>
+#include "MeshTrackerX1Board.h"
+#include <helpers/radiolib/CustomLR2021Wrapper.h>
+#include <helpers/ArduinoHelpers.h>
+#include <helpers/SensorManager.h>
+#include <helpers/sensors/LocationProvider.h>
+#include <Adafruit_SPA06_003.h>
+#ifdef DISPLAY_CLASS
+  #include "NullDisplayDriver.h"
+#endif
+
+class MeshTrackerX1SensorManager: public SensorManager {
+  bool gps_active = false;
+  bool baro_ok = false;
+  Adafruit_SPA06_003 spa06;
+  LocationProvider * _nmea;
+
+  void start_gps();
+  void sleep_gps();
+  void stop_gps();
+public:
+  MeshTrackerX1SensorManager(LocationProvider &nmea): _nmea(&nmea) { }
+  bool begin() override;
+  bool querySensors(uint8_t requester_permissions, CayenneLPP& telemetry) override;
+  void loop() override;
+  int getNumSettings() const override;
+  const char* getSettingName(int i) const override;
+  const char* getSettingValue(int i) const override;
+  bool setSettingValue(const char* name, const char* value) override;
+  LocationProvider* getLocationProvider() { return _nmea; }
+};
+
+#ifdef DISPLAY_CLASS
+  extern NullDisplayDriver display;
+#endif
+
+extern MeshTrackerX1Board board;
+extern WRAPPER_CLASS radio_driver;
+extern VolatileRTCClock rtc_clock;
+extern MeshTrackerX1SensorManager sensors;
+
+bool radio_init();
+mesh::LocalIdentity radio_new_identity();
@@ -0,0 +1,109 @@
+/*
+ * variant.cpp - Seeed SenseCAP MeshTracker X1 (nRF52840 + Semtech LR2021)
+ */
+
+#include "variant.h"
+#include "wiring_constants.h"
+#include "wiring_digital.h"
+
+const uint32_t g_ADigitalPinMap[PINS_COUNT + 1] =
+{
+  0,  // P0.00
+  1,  // P0.01
+  2,  // P0.02, AIN0 BATTERY_PIN
+  3,  // P0.03, LED_RED
+  4,  // P0.04, AIN2 VCC_ADC
+  5,  // P0.05, AIN3 EXT_PWR_DETECT
+  6,  // P0.06, PIN_BUTTON1
+  7,  // P0.07, LORA_BUSY
+  8,  // P0.08, GPS_RESET
+  9,  // P0.09, PIN_RTC_EN
+  10, // P0.10
+  11, // P0.11, PIN_SPI_SCK
+  12, // P0.12, PIN_SPI_NSS
+  13, // P0.13, PIN_SERIAL1_TX
+  14, // P0.14, PIN_SERIAL1_RX
+  15, // P0.15
+  16, // P0.16, PIN_SERIAL2_TX
+  17, // P0.17, PIN_SERIAL2_RX
+  18, // P0.18
+  19, // P0.19
+  20, // P0.20
+  21, // P0.21
+  22, // P0.22
+  23, // P0.23
+  24, // P0.24, LED_GREEN
+  25, // P0.25, BUZZER_PIN
+  26, // P0.26
+  27, // P0.27
+  28, // P0.28, LED_BLUE
+  29, // P0.29, GPS_RTC_INT
+  30, // P0.30, GPS_SLEEP_INT
+  31, // P0.31
+  32, // P1.00
+  33, // P1.01, LORA_DIO_1 (LR2021 DIO8 IRQ)
+  34, // P1.02
+  35, // P1.03, EXT_CHRG_DETECT
+  36, // P1.04, CHARGE_DONE
+  37, // P1.05, PIN_DRV_EN
+  38, // P1.06, PIN_BAT_ADC_EN
+  39, // P1.07, PIN_3V3_EN
+  40, // P1.08, PIN_SPI_MISO
+  41, // P1.09, PIN_SPI_MOSI
+  42, // P1.10, LORA_RESET
+  43, // P1.11, GPS_EN
+  44, // P1.12
+  45, // P1.13, GPS_VRTC_EN
+  46, // P1.14, PIN_WIRE_SCL
+  47, // P1.15, PIN_WIRE_SDA
+  255,  // NRFX_SPIM_PIN_NOT_USED
+};
+
+void initVariant()
+{
+  pinMode(BATTERY_PIN, INPUT);
+  pinMode(EXT_CHRG_DETECT, INPUT_PULLUP);
+  pinMode(EXT_PWR_DETECT, INPUT);
+  pinMode(PIN_BUTTON1, INPUT_PULLDOWN);
+
+  pinMode(PIN_3V3_EN, OUTPUT);
+  digitalWrite(PIN_3V3_EN, HIGH);
+
+  pinMode(PIN_FLASH_EN, OUTPUT);
+  digitalWrite(PIN_FLASH_EN, HIGH);
+
+  pinMode(PIN_BAT_ADC_EN, OUTPUT);
+  digitalWrite(PIN_BAT_ADC_EN, HIGH);
+
+  pinMode(PIN_RTC_EN, OUTPUT);
+  digitalWrite(PIN_RTC_EN, LOW);
+
+  pinMode(PIN_DRV_EN, OUTPUT);
+  digitalWrite(PIN_DRV_EN, LOW);
+
+  pinMode(LED_RED, OUTPUT);
+  digitalWrite(LED_RED, LOW);
+
+  pinMode(LED_GREEN, OUTPUT);
+  digitalWrite(LED_GREEN, LOW);
+
+  pinMode(LED_BLUE, OUTPUT);
+  digitalWrite(LED_BLUE, LOW);
+
+  pinMode(GPS_EN, OUTPUT);
+  digitalWrite(GPS_EN, LOW);
+
+  pinMode(GPS_VRTC_EN, OUTPUT);
+  digitalWrite(GPS_VRTC_EN, HIGH);
+
+  pinMode(GPS_RESET, OUTPUT);
+  digitalWrite(GPS_RESET, LOW);
+
+  pinMode(GPS_SLEEP_INT, OUTPUT);
+  digitalWrite(GPS_SLEEP_INT, HIGH);
+
+  pinMode(GPS_RTC_INT, OUTPUT);
+  digitalWrite(GPS_RTC_INT, LOW);
+
+  pinMode(BUZZER_PIN, INPUT_PULLDOWN);
+}
@@ -0,0 +1,139 @@
+/*
+ * variant.h - Seeed SenseCAP MeshTracker X1 (nRF52840 + Semtech LR2021)
+ */
+
+#pragma once
+
+#include "WVariant.h"
+
+////////////////////////////////////////////////////////////////////////////////
+// Low frequency clock source
+
+#define USE_LFXO    // 32.768 kHz crystal oscillator
+#define VARIANT_MCK (64000000ul)
+
+////////////////////////////////////////////////////////////////////////////////
+// Power
+
+#define NRF_APM                                 // detect usb power
+#define PIN_3V3_EN              (39)            // P1.7 Power to sensors
+#define PIN_BAT_ADC_EN          (38)            // P1.6 Power to battery ADC divider
+#define PIN_RTC_EN              (9)             // P0.9 Power to RTC
+
+#define BATTERY_PIN             (2)             // P0.2/AIN0
+#define BATTERY_IMMUTABLE
+#define ADC_MULTIPLIER          (2.0F)
+
+#define EXT_CHRG_DETECT         (35)            // P1.3, LOW while charging
+// P1.4 is the charger's second status line, but it reads LOW regardless of
+// charge state on this board, so it is not used (Meshtastic leaves it out too)
+#define EXT_PWR_DETECT          (5)             // P0.5
+
+#define ADC_RESOLUTION          (14)
+#define BATTERY_SENSE_RES       (12)
+
+#define AREF_VOLTAGE            (3.0)
+
+////////////////////////////////////////////////////////////////////////////////
+// Number of pins
+
+#define PINS_COUNT              (48)
+#define NUM_DIGITAL_PINS        (48)
+#define NUM_ANALOG_INPUTS       (6)
+#define NUM_ANALOG_OUTPUTS      (0)
+
+////////////////////////////////////////////////////////////////////////////////
+// UART pin definition
+
+#define PIN_SERIAL1_RX          (14)            // P0.14 (GPS)
+#define PIN_SERIAL1_TX          (13)            // P0.13 (GPS)
+
+#define PIN_SERIAL2_RX          (17)            // P0.17
+#define PIN_SERIAL2_TX          (16)            // P0.16
+
+////////////////////////////////////////////////////////////////////////////////
+// I2C pin definition
+
+#define HAS_WIRE                (1)
+#define WIRE_INTERFACES_COUNT   (1)
+
+#define PIN_WIRE_SDA            (47)            // P1.15
+#define PIN_WIRE_SCL            (46)            // P1.14
+#define I2C_NO_RESCAN
+
+////////////////////////////////////////////////////////////////////////////////
+// SPI pin definition
+
+#define SPI_INTERFACES_COUNT    (1)
+
+#define PIN_SPI_MISO            (40)            // P1.8
+#define PIN_SPI_MOSI            (41)            // P1.9
+#define PIN_SPI_SCK             (11)            // P0.11
+#define PIN_SPI_NSS             (12)            // P0.12
+
+////////////////////////////////////////////////////////////////////////////////
+// Builtin LEDs (RGB)
+
+#define LED_BUILTIN             (-1)
+#define LED_RED                 (3)             // P0.3
+#define LED_GREEN               (24)            // P0.24
+#define LED_BLUE                (28)            // P0.28
+#define LED_PIN                 LED_GREEN
+
+#define LED_STATE_ON            HIGH
+
+////////////////////////////////////////////////////////////////////////////////
+// Builtin buttons
+
+#define PIN_BUTTON1             (6)             // P0.6, active HIGH (internal pull-down)
+#define BUTTON_PIN              PIN_BUTTON1
+
+////////////////////////////////////////////////////////////////////////////////
+// LR2021
+
+#define LORA_DIO_1              (33)            // P1.1, IRQ line (LR2021 DIO8)
+#define LORA_NSS                (PIN_SPI_NSS)   // P0.12
+#define LORA_RESET              (42)            // P1.10
+#define LORA_BUSY               (7)             // P0.7
+#define LORA_SCLK               (PIN_SPI_SCK)   // P0.11
+#define LORA_MISO               (PIN_SPI_MISO)  // P1.8
+#define LORA_MOSI               (PIN_SPI_MOSI)  // P1.9
+
+////////////////////////////////////////////////////////////////////////////////
+// GPS (Airoha, dual-band L1+L5)
+
+#define HAS_GPS                 1
+#define GPS_RX_PIN              PIN_SERIAL1_RX
+#define GPS_TX_PIN              PIN_SERIAL1_TX
+#define GPS_BAUD_RATE           (115200)
+
+#define GPS_EN                  (43)            // P1.11, active HIGH
+#define GPS_RESET               (8)             // P0.8, active HIGH
+
+#define GPS_VRTC_EN             (45)            // P1.13
+#define GPS_SLEEP_INT           (30)            // P0.30
+#define GPS_RTC_INT             (29)            // P0.29
+
+////////////////////////////////////////////////////////////////////////////////
+// Haptic driver (DRV2605 on I2C)
+
+#define PIN_DRV_EN              (37)            // P1.5, power to haptic driver
+
+////////////////////////////////////////////////////////////////////////////////
+// Buzzer
+
+#define BUZZER_PIN              (25)            // P0.25, pwm output
+
+////////////////////////////////////////////////////////////////////////////////
+// QSPI Flash
+
+#define PIN_FLASH_EN           (15)             // P0.15 (Flash power enable)
+
+#define PIN_QSPI_SCK           (19)             // P0.19
+#define PIN_QSPI_CS            (20)             // P0.20
+#define PIN_QSPI_IO0           (21)             // P0.21
+#define PIN_QSPI_IO1           (22)             // P0.22
+#define PIN_QSPI_IO2           (23)             // P0.23
+#define PIN_QSPI_IO3           (32)             // P1.00
+
+#define EXTERNAL_FLASH_DEVICES  GD25Q64C
@@ -21,6 +21,7 @@ build_flags = ${nrf52_base.build_flags}
  -D ENV_INCLUDE_INA219=1
 build_src_filter = ${nrf52_base.build_src_filter}
  +<helpers/*.cpp>
+  +<helpers/ui/NullDisplayDriver.cpp>
  +<../variants/minewsemi_me25ls01>
  +<helpers/sensors>
 debug_tool = jlink
@@ -55,7 +56,6 @@ build_flags = ${me25ls01.build_flags}
  ;-D PIN_BUZZER=25
  ;-D PIN_BUZZER_EN=37
 build_src_filter = ${me25ls01.build_src_filter}
-  +<helpers/ui/NullDisplayDriver.cpp>
  +<helpers/nrf52/SerialBLEInterface.cpp>
  +<../examples/companion_radio/*.cpp>
  +<../examples/companion_radio/ui-orig/*.cpp>
@@ -63,10 +63,6 @@ build_src_filter = ${me25ls01.build_src_filter}
 [env:Minewsemi_me25ls01_repeater]
 extends = me25ls01
 build_flags = ${me25ls01.build_flags}
-  -D MAX_CONTACTS=100
-  -D MAX_GROUP_CHANNELS=8
-  -D BLE_PIN_CODE=123456
-;  -D BLE_DEBUG_LOGGING=1
 ;  -D MESH_PACKET_LOGGING=1
 ;  -D MESH_DEBUG=1
  -D OFFLINE_QUEUE_SIZE=256
@@ -85,10 +81,6 @@ build_src_filter = ${me25ls01.build_src_filter}
 [env:Minewsemi_me25ls01_room_server]
 extends = me25ls01
 build_flags = ${me25ls01.build_flags}
-  -D MAX_CONTACTS=100
-  -D MAX_GROUP_CHANNELS=8
-;  -D BLE_PIN_CODE=123456
-;  -D BLE_DEBUG_LOGGING=1
 ;  -D MESH_PACKET_LOGGING=1
 ;  -D MESH_DEBUG=1
  -D OFFLINE_QUEUE_SIZE=256
@@ -103,15 +95,10 @@ build_flags = ${me25ls01.build_flags}
  -D DISPLAY_CLASS=NullDisplayDriver
 build_src_filter = ${me25ls01.build_src_filter}
  +<../examples/simple_room_server>
-  +<helpers/ui/NullDisplayDriver.cpp>

 [env:Minewsemi_me25ls01_terminal_chat]
 extends = me25ls01
 build_flags = ${me25ls01.build_flags}
-  -D MAX_CONTACTS=100
-  -D MAX_GROUP_CHANNELS=8
-  -D BLE_PIN_CODE=123456
-;  -D BLE_DEBUG_LOGGING=1
 ;  -D MESH_PACKET_LOGGING=1
 ;  -D MESH_DEBUG=1
  -D OFFLINE_QUEUE_SIZE=256
@@ -126,7 +113,6 @@ build_flags = ${me25ls01.build_flags}
  -D DISPLAY_CLASS=NullDisplayDriver
 build_src_filter = ${me25ls01.build_src_filter}
  +<../examples/simple_secure_chat/main.cpp>
-  +<helpers/ui/NullDisplayDriver.cpp>

 [env:Minewsemi_me25ls01_companion_radio_usb]
 extends = me25ls01
@@ -137,7 +123,6 @@ build_flags = ${me25ls01.build_flags}
  -D MAX_CONTACTS=350
  -D MAX_GROUP_CHANNELS=40
  ;-D BLE_PIN_CODE=123456
-;  -D BLE_DEBUG_LOGGING=1
 ;  -D MESH_PACKET_LOGGING=1
 ;  -D MESH_DEBUG=1
  -D OFFLINE_QUEUE_SIZE=256
@@ -147,7 +132,6 @@ build_flags = ${me25ls01.build_flags}
  -D ENABLE_USB_INTERFACE
 build_src_filter = ${me25ls01.build_src_filter}
  +<helpers/nrf52/*.cpp>
-  +<helpers/ui/NullDisplayDriver.cpp>
  +<../examples/companion_radio/*.cpp>
  +<../examples/companion_radio/ui-orig/*.cpp>

@@ -4,7 +4,6 @@
 MinewsemiME25LS01Board board;

 RADIO_CLASS radio = new Module(P_LORA_NSS, P_LORA_DIO_1, P_LORA_RESET, P_LORA_BUSY, SPI);
-
 WRAPPER_CLASS radio_driver(radio, board);

 VolatileRTCClock rtc_clock;
@@ -18,7 +17,8 @@ extern EnvironmentSensorManager sensors;
 #endif

 #ifdef DISPLAY_CLASS
-  NullDisplayDriver display;
+  DISPLAY_CLASS display;
+  MomentaryButton user_btn(PIN_USER_BTN, 1000, true);
 #endif

 #ifndef LORA_CR
@@ -11,16 +11,17 @@
 #include <helpers/sensors/EnvironmentSensorManager.h>
 #ifdef DISPLAY_CLASS
  #include <helpers/ui/NullDisplayDriver.h>
-#endif
-
-#ifdef DISPLAY_CLASS
-  extern NullDisplayDriver display;
+  #include <helpers/ui/MomentaryButton.h>
 #endif

 extern MinewsemiME25LS01Board board;
 extern WRAPPER_CLASS radio_driver;
 extern VolatileRTCClock rtc_clock;
 extern EnvironmentSensorManager sensors;
+#ifdef DISPLAY_CLASS
+  extern DISPLAY_CLASS display;
+  extern MomentaryButton user_btn;
+#endif

 bool radio_init();
 mesh::LocalIdentity radio_new_identity();
@@ -10,6 +10,7 @@ build_flags = ${nrf52_base.build_flags}
  -D NRF52_POWER_MANAGEMENT
  -D RADIO_CLASS=CustomSX1262
  -D WRAPPER_CLASS=CustomSX1262Wrapper
+  -D DISPLAY_CLASS=NullDisplayDriver
  -D LORA_TX_POWER=22
  -D SX126X_CURRENT_LIMIT=140
  -D SX126X_RX_BOOSTED_GAIN=1
@@ -100,7 +101,6 @@ build_src_filter = ${R1Neo.build_src_filter}
  +<../examples/companion_radio/ui-orig/*.cpp>
 lib_deps =
  ${R1Neo.lib_deps}
-  ${rak4631.lib_deps}
  densaugeo/base64 @ ~1.4.0
  end2endzone/NonBlockingRTTTL@^1.3.0

@@ -4,12 +4,17 @@

 R1NeoBoard board;

-DISPLAY_CLASS display;
-
 RADIO_CLASS radio = new Module(P_LORA_NSS, P_LORA_DIO_1, P_LORA_RESET, P_LORA_BUSY, SPI);
-
 WRAPPER_CLASS radio_driver(radio, board);

+#ifdef DISPLAY_CLASS
+  NullDisplayDriver display;
+#endif
+
+#ifdef PIN_USER_BTN 
+MomentaryButton user_btn(PIN_USER_BTN, 1000, true);
+#endif
+
 VolatileRTCClock fallback_clock;
 AutoDiscoverRTCClock rtc_clock(fallback_clock);

@@ -4,19 +4,6 @@
 #include <Arduino.h>
 #include <helpers/NRF52Board.h>

-#define P_LORA_NSS 13 //P1.13 45
-#define P_LORA_DIO_1 11 //P0.10 10
-#define P_LORA_RESET 10 //P0.09 9
-#define P_LORA_BUSY  16 //P0.29 29
-#define P_LORA_MISO  15 //P0.02 2
-#define P_LORA_SCLK  12 //P1.11 43
-#define P_LORA_MOSI  14 //P1.15 47
-#define SX126X_POWER_EN 21 //P0.13 13
-#define SX126X_RXEN 2 //P0.17
-#define SX126X_TXEN RADIOLIB_NC
-#define SX126X_DIO2_AS_RF_SWITCH  true
-#define SX126X_DIO3_TCXO_VOLTAGE (1.8f)
-
 #define  PIN_VBAT_READ 17
 #define  ADC_MULTIPLIER   (1.815f) // dependent on voltage divider resistors. TODO: more accurate battery tracking

@@ -3,13 +3,29 @@
 #include "wiring_digital.h"

 const uint32_t g_ADigitalPinMap[] = {
-  8, 6, 17, 20, 22, 24, 32, 11, 36, 38,
-  9, 10, 43, 45, 47, 2, 29, 31,
-  33, 34, 37,
-  13, 15
+  8,  // P0.08 = 0
+  6,  // P0.06 = 1
+  17, // P0.17 = 2
+  20, // P0.20 = 3
+  22, // P0.22 = 4
+  24, // P0.24 = 5
+  32, // P1.00 = 6
+  11, // P0.11 = 7
+  36, // P1.04 = 8
+  38, // P1.06 = 9
+  9,  // P0.09 = 10
+  10, // P0.10 = 11
+  43, // P1.11 = 12
+  45, // P1.13 = 13
+  47, // P1.15 = 14
+  2,  // P0.02 = 15
+  29, // P0.29 = 16
+  31, // P0.31 = 17
+  33, // P1.01 = 18
+  34, // P1.02 = 19
+  37, // P1.05 = 20
+  13, // P0.13 = 21
+  15  // P0.15 = 22
 };

-void initVariant()
-{
-}
-
+void initVariant() {}
@@ -7,9 +7,9 @@
 #pragma once

 #include "WVariant.h"
- 
+
 ////////////////////////////////////////////////////////////////////////////////
- // Low frequency clock source 
+ // Low frequency clock source

 #define VARIANT_MCK       (64000000ul)

@@ -79,4 +79,18 @@
 #define PIN_BUTTON1          (6)
 #define BUTTON_PIN           PIN_BUTTON1

+//////////////////////////////////////////////////////////////////////////////
+// LoRa

+#define P_LORA_NSS                (13)
+#define P_LORA_DIO_1              (11)
+#define P_LORA_RESET              (10)
+#define P_LORA_BUSY               (16)
+#define P_LORA_MISO               (15)
+#define P_LORA_SCLK               (12)
+#define P_LORA_MOSI               (14)
+#define SX126X_POWER_EN           (21)
+#define SX126X_RXEN               (2)
+#define SX126X_TXEN               (-1)
+#define SX126X_DIO2_AS_RF_SWITCH  true
+#define SX126X_DIO3_TCXO_VOLTAGE  (1.8f)
@@ -33,7 +33,7 @@ lib_deps=${esp32_base.lib_deps}
  lovyan03/LovyanGFX @ ^1.2.7

 [env:SenseCapIndicator-ESPNow_comp_radio_usb]
-extends =SenseCapIndicator-ESPNow
+extends = SenseCapIndicator-ESPNow
 build_flags =
  ${SenseCapIndicator-ESPNow.build_flags}
  -I examples/companion_radio/ui-new
@@ -47,4 +47,4 @@ build_src_filter = ${SenseCapIndicator-ESPNow.build_src_filter}
  +<../examples/companion_radio/*.cpp>
 lib_deps =
  ${SenseCapIndicator-ESPNow.lib_deps}
-  densaugeo/base64 @ ~1.4.0
+  densaugeo/base64 @ ~1.4.0
@@ -101,3 +101,8 @@ build_src_filter = ${SenseCap_Solar.build_src_filter}
 lib_deps =
  ${SenseCap_Solar.lib_deps}
  densaugeo/base64 @ ~1.4.0
+
+[env:SenseCap_Solar_kiss_modem]
+extends = SenseCap_Solar
+build_src_filter = ${SenseCap_Solar.build_src_filter}
+  +<../examples/kiss_modem/>
@@ -229,7 +229,7 @@ build_flags =
  -D WIFI_DEBUG_LOGGING=1
  -D WIFI_SSID='"myssid"'
  -D WIFI_PWD='"mypwd"'
-  -D OFFLINE_QUEUE_SIZE=256  
+  -D OFFLINE_QUEUE_SIZE=256
 ; -D MESH_PACKET_LOGGING=1
 ; -D MESH_DEBUG=1
 build_src_filter = ${Station_G2.build_src_filter}
@@ -242,10 +242,8 @@ lib_deps =

 [env:Station_G2_kiss_modem]
 extends = Station_G2
-build_unflags =
-  -DARDUINO_USB_MODE=0
 build_flags =
  ${Station_G2.build_flags}
-  -DARDUINO_USB_MODE=1
+  -D ARDUINO_USB_MODE=1
 build_src_filter = ${Station_G2.build_src_filter}
  +<../examples/kiss_modem/>
@@ -0,0 +1,79 @@
+#include "LoRaFEMControl.h"
+
+#include <Arduino.h>
+#include <driver/rtc_io.h>
+
+void LoRaFEMControl::init() {
+#ifdef P_PA1_EN
+  rtc_gpio_hold_dis((gpio_num_t)P_PA1_EN);
+  pinMode(P_PA1_EN, OUTPUT);
+  applyPAGain();
+#endif
+
+#ifdef P_PRIMARY_LNA_EN
+  rtc_gpio_hold_dis((gpio_num_t)P_PRIMARY_LNA_EN);
+  pinMode(P_PRIMARY_LNA_EN, OUTPUT);
+  setRxModeEnable();
+#endif
+}
+
+void LoRaFEMControl::setSleepModeEnable() {
+#ifdef P_PA1_EN
+  // PA PL1 low/open selects the lower of the two hardware-jumper-selected levels.
+  digitalWrite(P_PA1_EN, !P_PA1_EN_ACTIVE);
+#endif
+#ifdef P_PRIMARY_LNA_EN
+  // Preserve the existing Station G3 power-off state.
+  digitalWrite(P_PRIMARY_LNA_EN, P_PRIMARY_LNA_EN_ACTIVE);
+#endif
+}
+
+void LoRaFEMControl::setTxModeEnable() {
+  // Latch the requested PA level here, before the SX1262 starts driving the PA. PA PL1
+  // retargets the PA's DC-DC rail, so moving it mid-transmit collapses the supply while
+  // the PA is still driven at full input power.
+  applyPAGain();
+#ifdef P_PRIMARY_LNA_EN
+  digitalWrite(P_PRIMARY_LNA_EN, !P_PRIMARY_LNA_EN_ACTIVE);
+#endif
+}
+
+void LoRaFEMControl::setRxModeEnable() {
+#ifdef P_PRIMARY_LNA_EN
+  digitalWrite(P_PRIMARY_LNA_EN, lna_enabled ? P_PRIMARY_LNA_EN_ACTIVE : !P_PRIMARY_LNA_EN_ACTIVE);
+#endif
+}
+
+void LoRaFEMControl::setLNAEnable(bool enabled) {
+  lna_enabled = enabled;
+  setRxModeEnable();
+}
+
+void LoRaFEMControl::setPAGainEnable(bool enabled) {
+  // Recorded only -- the pin is driven from setTxModeEnable(). The PA level only matters
+  // while transmitting, so deferring costs nothing and keeps the rail change out of an
+  // in-flight transmit (the CLI runs on every main-loop pass, including mid-TX).
+  pa_gain_enabled = enabled;
+}
+
+void LoRaFEMControl::applyPAGain() {
+#ifdef P_PA1_EN
+  digitalWrite(P_PA1_EN, pa_gain_enabled ? P_PA1_EN_ACTIVE : !P_PA1_EN_ACTIVE);
+#endif
+}
+
+bool LoRaFEMControl::canControlLNA() const {
+#ifdef P_PRIMARY_LNA_EN
+  return true;
+#else
+  return false;
+#endif
+}
+
+bool LoRaFEMControl::canControlPAGain() const {
+#ifdef P_PA1_EN
+  return true;
+#else
+  return false;
+#endif
+}
@@ -0,0 +1,22 @@
+#pragma once
+
+class LoRaFEMControl {
+public:
+  void init();
+  void setSleepModeEnable();
+  void setTxModeEnable();
+  void setRxModeEnable();
+  void setLNAEnable(bool enabled);
+  void setPAGainEnable(bool enabled);
+
+  bool canControlLNA() const;
+  bool canControlPAGain() const;
+  bool isLNAEnabled() const { return lna_enabled; }
+  bool isPAGainEnabled() const { return pa_gain_enabled; }
+
+private:
+  void applyPAGain();
+
+  bool lna_enabled = true;
+  bool pa_gain_enabled = false;
+};
@@ -1,15 +1,46 @@
 #include "StationG3Board.h"

 void StationG3Board::powerOff() {
+  loRaFEMControl.setSleepModeEnable();
 #ifdef P_PA1_EN
-  setPAModeHigh(false);
  rtc_gpio_hold_en((gpio_num_t)P_PA1_EN);
 #endif

 #ifdef P_PRIMARY_LNA_EN
-  setPrimaryLNAControl(true);
  rtc_gpio_hold_en((gpio_num_t)P_PRIMARY_LNA_EN);
 #endif

  ESP32Board::powerOff();
 }
+
+bool StationG3Board::setLoRaFemLnaEnabled(bool enable) {
+  if (!loRaFEMControl.canControlLNA()) {
+    return false;
+  }
+  loRaFEMControl.setLNAEnable(enable);
+  return true;
+}
+
+bool StationG3Board::canControlLoRaFemLna() const {
+  return loRaFEMControl.canControlLNA();
+}
+
+bool StationG3Board::isLoRaFemLnaEnabled() const {
+  return loRaFEMControl.isLNAEnabled();
+}
+
+bool StationG3Board::setLoRaFemPaGainEnabled(bool enable) {
+  if (!loRaFEMControl.canControlPAGain()) {
+    return false;
+  }
+  loRaFEMControl.setPAGainEnable(enable);
+  return true;
+}
+
+bool StationG3Board::canControlLoRaFemPaGain() const {
+  return loRaFEMControl.canControlPAGain();
+}
+
+bool StationG3Board::isLoRaFemPaGainEnabled() const {
+  return loRaFEMControl.isPAGainEnabled();
+}
@@ -3,45 +3,15 @@
 #include <Arduino.h>
 #include <helpers/ESP32Board.h>
 #include <driver/rtc_io.h>
-
-#ifndef P_PRIMARY_LNA_EN_ACTIVE
-#define P_PRIMARY_LNA_EN_ACTIVE LOW
-#endif
-
-#ifndef P_PA1_EN_ACTIVE
-#define P_PA1_EN_ACTIVE HIGH
-#endif
+#include "LoRaFEMControl.h"

 class StationG3Board : public ESP32Board {
-  void setPAModeHigh(bool enabled) {
-#ifdef P_PA1_EN
-    // Station G3 PA PL1 mode: LOW/open is PA low, HIGH/short is PA high.
-    digitalWrite(P_PA1_EN, enabled ? P_PA1_EN_ACTIVE : !P_PA1_EN_ACTIVE);
-#endif
-  }
-
-  void setPrimaryLNAControl(bool enabled) {
-#ifdef P_PRIMARY_LNA_EN
-    // Station G3 primary LNA mode is active-low: LOW/open is LNA on, HIGH/short is LNA off.
-    digitalWrite(P_PRIMARY_LNA_EN, enabled ? P_PRIMARY_LNA_EN_ACTIVE : !P_PRIMARY_LNA_EN_ACTIVE);
-#endif
-  }
-
 public:
+  LoRaFEMControl loRaFEMControl;
+
  void begin() {
    ESP32Board::begin();
-
-#ifdef P_PA1_EN
-    rtc_gpio_hold_dis((gpio_num_t)P_PA1_EN);
-    pinMode(P_PA1_EN, OUTPUT);
-    setPAModeHigh(false);
-#endif
-
-#ifdef P_PRIMARY_LNA_EN
-    rtc_gpio_hold_dis((gpio_num_t)P_PRIMARY_LNA_EN);
-    pinMode(P_PRIMARY_LNA_EN, OUTPUT);
-    setPrimaryLNAControl(true);
-#endif
+    loRaFEMControl.init();

    esp_reset_reason_t reason = esp_reset_reason();
    if (reason == ESP_RST_DEEPSLEEP) {
@@ -56,23 +26,30 @@ public:
  }

  void setPrimaryLNAEnable(bool enabled) {
-    setPrimaryLNAControl(enabled);
+    loRaFEMControl.setLNAEnable(enabled);
  }

  void setPrimaryPAHighPower(bool enabled) {
-    setPAModeHigh(enabled);
+    loRaFEMControl.setPAGainEnable(enabled);
  }

  void onBeforeTransmit() override {
    ESP32Board::onBeforeTransmit();
-    setPrimaryLNAControl(false);
+    loRaFEMControl.setTxModeEnable();
  }

  void onAfterTransmit() override {
    ESP32Board::onAfterTransmit();
-    setPrimaryLNAControl(true);
+    loRaFEMControl.setRxModeEnable();
  }

+  bool setLoRaFemLnaEnabled(bool enable) override;
+  bool canControlLoRaFemLna() const override;
+  bool isLoRaFemLnaEnabled() const override;
+  bool setLoRaFemPaGainEnabled(bool enable) override;
+  bool canControlLoRaFemPaGain() const override;
+  bool isLoRaFemPaGainEnabled() const override;
+
  void powerOff() override;

  uint16_t getBattMilliVolts() override {
@@ -17,11 +17,11 @@ build_flags =
  -D P_LORA_SCLK=12
  -D P_LORA_MISO=14
  -D P_LORA_MOSI=13
-  -D P_PA1_EN=9 ; PA PL1 Mode: LOW/open is PA low, HIGH/short is PA high.
+  -D P_PA1_EN=9 ; PA PL1 Mode: LOW/open selects low level, HIGH/short selects high level.
  -D P_PA1_EN_ACTIVE=HIGH
  -D P_PRIMARY_LNA_EN=10 ; Primary Slot LNA Mode: LOW/open is LNA on, HIGH/short is LNA off.
  -D P_PRIMARY_LNA_EN_ACTIVE=LOW
-  -D LORA_TX_POWER=7 ; configured as 7dbm, because the final output will be ~27dbm (~0.5w) if the PA is enabled.
+  -D LORA_TX_POWER=7 ; SX1262 input power to the Station G3 PA; final output depends on PA PL1/PL2 level.
  -D MAX_LORA_TX_POWER=22
 ;  -D P_LORA_TX_LED=35
  -D PIN_BOARD_SDA=5
@@ -85,7 +85,6 @@ build_flags =
  -D BLE_DEBUG_LOGGING=1
  -D OFFLINE_QUEUE_SIZE=256
  -D AUTO_SHUTDOWN_MILLIVOLTS=3300
-  -D QSPIFLASH=1
 ;  -D MESH_PACKET_LOGGING=1
 ;  -D MESH_DEBUG=1
 build_src_filter = ${ThinkNode_M6.build_src_filter}
@@ -107,7 +106,6 @@ build_flags =
  -I examples/companion_radio/ui-new
  -D MAX_CONTACTS=350
  -D MAX_GROUP_CHANNELS=40
-  -D QSPIFLASH=1
  -D OFFLINE_QUEUE_SIZE=256
  -D AUTO_SHUTDOWN_MILLIVOLTS=3300
  -D ENABLE_USB_INTERFACE
@@ -30,6 +30,8 @@ void initVariant() {
  digitalWrite(PIN_GPS_STANDBY, HIGH);
  pinMode(PIN_GPS_EN, OUTPUT);
  digitalWrite(PIN_GPS_EN, HIGH);
-  pinMode(PIN_GPS_RESET, OUTPUT);
-  digitalWrite(PIN_GPS_RESET, HIGH);
+  // PIN_GPS_RESET (pin 29 / REINIT) is intentionally left floating (input).
+  // Driving it HIGH holds the L76K silent, so it never streams NMEA and the
+  // firmware reports "no GPS". Letting it float lets the module run, matching
+  // the Meshtastic M6 variant. See GPS_RESET (-1) in variant.h.
 }
@@ -102,7 +102,12 @@
 #define PIN_GPS_RX              (2)
 #define PIN_GPS_TX              (3)
 #define PIN_GPS_EN              (6)    // EN
-#define PIN_GPS_RESET           (29)
+#define PIN_GPS_RESET           (29)   // REINIT - must FLOAT; driving it (esp. HIGH) silences the L76K
+// The M6's L76K streams NMEA on its own and must not have its REINIT pin driven.
+// Tell the location provider there is no reset pin so it never touches pin 29
+// (driving it HIGH holds the module silent). Matches Meshtastic, which leaves
+// this pin as an input. See variant.cpp (pin 29 is intentionally not configured).
+#define GPS_RESET               (-1)
 #define PIN_GPS_STANDBY         (30)   // STANDBY
 #define PIN_GPS_PPS             (31)
 #define GPS_BAUD_RATE           9600
Author	SHA1	Message	Date
Scott Powell	d929643524	* version 1.17.1 Firmware Builder / create-release (push) Canceled after 0s Details Firmware Builder / build (push) Canceled after 0s Details Firmware Builder / generate-build-matrix (push) Canceled after 0s Details Build Companion Firmwares / build-companion-firmwares (push) Canceled after 0s Details Firmware Builder / create-release (push) Canceled after 0s Details Firmware Builder / build (push) Canceled after 0s Details Firmware Builder / generate-build-matrix (push) Canceled after 0s Details Build Repeater Firmwares / build-repeater-firmwares (push) Canceled after 0s Details Firmware Builder / create-release (push) Canceled after 0s Details Firmware Builder / build (push) Canceled after 0s Details Firmware Builder / generate-build-matrix (push) Canceled after 0s Details Build Room Server Firmwares / build-room-server-firmwares (push) Canceled after 0s Details	2026-08-14 22:19:19 +10:00
Huw Duddy	24bdc24b39	Merge pull request #3206 from meshcore-dev/nrf-combine-rng-entropy combine radio's entropy with CC310 RNG	2026-08-14 22:09:26 +10:00
Scott Powell	fcb9bdf209	* combine radio's entropy with CC310 RNG	2026-08-14 17:46:43 +10:00
Huw Duddy	50a51a6479	Merge pull request #3203 from meshcore-dev/companion-fem-pref-fix commenting out the load/save of the fem_ properties	2026-08-14 16:44:59 +10:00
Scott Powell	e78bff0041	* unit test no longer valid	2026-08-14 16:42:54 +10:00
Scott Powell	890a2e2cff	* commenting out the load/save of the fem_ properties, until they can be set	2026-08-14 16:30:12 +10:00
ripplebiz	b09cb27a1f	Merge pull request #3106 from ViezeVingertjes/fix/scoped-reply-routing Fix replies dropped when flood.max.unscoped is low	2026-08-13 15:00:37 +10:00
ripplebiz	abd3546d75	Merge pull request #3189 from oltaco/nrf52-unused-pin-sweep Fix unused pin definitions on some NRF52 boards	2026-08-13 13:48:59 +10:00
taco	7cd1d207af	Fix LilyGo T-Echo Lite SPI pins	2026-08-13 00:53:58 +10:00
taco	c2a4ef082f	Fix Heltec MeshPocket SPI pins	2026-08-13 00:15:34 +10:00
taco	3ea541f1f2	Fix Heltec T1 pin definitions SPI pins that are set to -1 cause OOB reads on NRF52. The unused Serial2 pin definitions were removed to avoid potential issues with the Uart framework.	2026-08-13 00:12:37 +10:00
ripplebiz	e9edfc8e1a	Merge pull request #3188 from oltaco/heltec-t096-pin-fix Fix Heltec T096 Tx issue	2026-08-12 23:00:31 +10:00
taco	49d9f9a839	Heltec T096: fix PIN_SPI1_MISO Setting SPI pins to values that are OOB of the g_ADigitalPinMap[] array causes OOB reads. This variant.h has pin 0 as 0xFF which passes through as NRFX_SPIM_PIN_NOT_USED.	2026-08-12 22:31:57 +10:00
taco	f43e1cde89	Revert "t096 compiler layout workaround" This reverts commit `9c60f9696e`.	2026-08-12 22:28:36 +10:00
taco	264d778168	Revert "T096 PA_CTX pin direction workaround" This reverts commit `82de18fb0e`.	2026-08-12 22:28:05 +10:00
ripplebiz	956094b271	Merge pull request #3185 from oltaco/fix-techo-card-txco-voltage Set T-Echo Card TCXO voltage to 3.0	2026-08-12 18:13:44 +10:00
ripplebiz	a4ab7f0e59	Merge pull request #3137 from agessaman/feat/station-g3-fem-prefs Station G3: Expose, persist, and apply FEM gain preferences	2026-08-12 16:11:23 +10:00
taco	9d6dcc673e	set T-Echo Card TCXO voltage to 3.0 as per https://github.com/meshcore-dev/MeshCore/pull/3140 and https://github.com/Xinyuan-LilyGO/T-Echo-Lite/issues/14	2026-08-12 16:08:05 +10:00
ripplebiz	1cb308b694	Merge pull request #3182 from oltaco/t096-tx-workaround Workaround for Heltec T096 transmit issue	2026-08-12 14:49:32 +10:00
taco	82de18fb0e	T096 PA_CTX pin direction workaround	2026-08-12 14:07:31 +10:00
taco	9c60f9696e	t096 compiler layout workaround see https://github.com/meshcore-dev/MeshCore/issues/3151	2026-08-12 14:04:50 +10:00
ripplebiz	e027263d1e	Merge pull request #3154 from fdlamotte/nrf52_hwcrypto_init nrf52: call nRFCrypto.begin()/end() only once	2026-08-12 12:14:21 +10:00
Huw Duddy	34ad059afb	Merge pull request #3170 from recrof/promicro-pin-tidy-up [promicro] make pinmap more tidy, move the LoRa pins to variant.h	2026-08-11 18:43:20 +10:00
Rastislav Vysoky	5cce5cfe97	removed misleading 'GPIO' from pin numbers	2026-08-11 10:37:20 +02:00
ripplebiz	fbef2ff0dc	Merge pull request #3164 from weebl2000/fix-tbeam-s3-display Fix display issues on T-beam Supreme S3	2026-08-11 14:39:39 +10:00
agessaman	e2aa7b98f9	feat(companion_radio): add external FEM gain preferences for RX and TX for companions Introduced consistent preferences for external LoRa FEM RX and TX gain settings in NodePrefs. Updated companion MyMesh to apply these settings during initialization and transmission. Added unit tests to verify the round-trip serialization of these new preferences.	2026-08-10 11:59:26 -07:00
Rastislav Vysoky	a82dc1b9da	make promicro pinmap more tidy, move the LoRa pins to variant.h	2026-08-10 20:13:59 +02:00
Liam Cottle	9d8894e166	Merge pull request #3166 from recrof/debug-noise-floor-flag move RadioLibWrapper noise_floor level message under special debug flag	2026-08-11 03:07:31 +12:00
Rastislav Vysoky	3138ad99ba	move RadioLibWrapper noise_floor level message under special debug flag	2026-08-10 16:56:56 +02:00
Wessel Nieboer	32bd6d48d6	Fix T-beam Supreme S3 display	2026-08-10 13:39:16 +02:00
Huw Duddy	f6c25e6a25	Merge pull request #3158 from mepholic/bug/fix-rxgain-setting-post-agc-reset Fix RX Boosted Gain setting after AGC reset is triggered	2026-08-10 17:31:38 +10:00
ripplebiz	9941669fd5	Merge pull request #3142 from oltaco/buildfix-userbtn Build fix for R1 Neo and Minewsemi repeater	2026-08-10 13:30:24 +10:00
ripplebiz	0d60de6fa6	Merge pull request #3146 from oltaco/lr2021-preamble-and-irq-timeout LR2021: add PREAMBLE_DETECTED bit and IRQ timeout logic	2026-08-10 13:29:12 +10:00
Dan Theisen	6f491f3033	RX Boosted Gain was set back to the compiled in value rather than the current/flash value set by the user when the ACG reset is triggered. This commit fixes this.	2026-08-09 18:11:35 -07:00
Florent	ecb8c94560	nrf52: call nRFCrypto.begin()/end() only once	2026-08-09 14:46:23 -04:00
Huw Duddy	a1c50e15dd	Merge pull request #3148 from recrof/add-missing-kiss-radio add missing kiss radio roles, add kiss radio build to build.sh	2026-08-09 22:22:08 +10:00
Rastislav Vysoky	c2d57f08c8	add missing kiss radio roles, add kiss radio build to build.sh	2026-08-09 14:17:18 +02:00
Huw Duddy	f310afb5e5	Merge pull request #3140 from entr0p1/fix/techo-lite-pins Lilygo T-Echo Lite Pin Fixes	2026-08-09 22:06:21 +10:00
taco	ce62c8b5d7	LR2021: add PREAMBLE_DETECTED bit and IRQ timeout logic	2026-08-09 21:41:22 +10:00
taco	39934d6999	minewsemi: build fix and platformio.ini tidy up fixes minewsemi repeater failing build due to user_btn missing.	2026-08-09 18:33:27 +10:00
taco	e8bbcd4580	R1 neo: remove stray lib_deps entry	2026-08-09 16:51:45 +10:00
taco	b75a548d7f	build fix for R1 Neo repeater added missing declarations for user_btn and NullDisplayDriver	2026-08-09 16:50:44 +10:00
Scott Powell	727fc0512c	Merge branch 'dev' Firmware Builder / create-release (push) Canceled after 0s Details Firmware Builder / build (push) Canceled after 0s Details Firmware Builder / generate-build-matrix (push) Canceled after 0s Details Build Repeater Firmwares / build-repeater-firmwares (push) Canceled after 0s Details Firmware Builder / create-release (push) Canceled after 0s Details Firmware Builder / build (push) Canceled after 0s Details Firmware Builder / generate-build-matrix (push) Canceled after 0s Details Build Room Server Firmwares / build-room-server-firmwares (push) Canceled after 0s Details Firmware Builder / create-release (push) Canceled after 0s Details Firmware Builder / build (push) Canceled after 0s Details Firmware Builder / generate-build-matrix (push) Canceled after 0s Details Build Companion Firmwares / build-companion-firmwares (push) Canceled after 0s Details # Conflicts: # docs/payloads.md	2026-08-09 15:16:48 +10:00
Scott Powell	93b2db63de	* version 1.17.0	2026-08-09 15:14:46 +10:00
entr0p1	5732b2edd8	Lilygo T-Echo Lite Pin Fixes - Aligned to Lilygo's updated schematic and pin map as per https://github.com/Xinyuan-LilyGO/T-Echo-Lite/issues/14	2026-08-09 14:09:35 +10:00
ripplebiz	48df179e36	Merge pull request #3139 from oltaco/x1-flash Add QSPIFlash support for Seeed MeshTracker X1	2026-08-09 13:52:56 +10:00
Huw Duddy	58ebff82c0	Merge pull request #3125 from Hacuchino-hash/fix-x1-charge-status Fix X1 charge status LED always showing charged	2026-08-09 12:54:29 +10:00
taco	9420195626	bump CustomLFS version for GD25Q64C support	2026-08-09 11:45:35 +10:00
taco	02ec123eb8	add QSPIFlash support for Seeed MeshTracker X1	2026-08-09 11:41:09 +10:00
Adam Gessaman	c58c9b2f31	fix(station-g3): apply FEM PA level at TX start PA PL1 re-targets the PA's DC-DC supply rail rather than selecting a logic-level gain, and the serial CLI is serviced on every main-loop pass regardless of whether a transmit is in flight. A `set radio.fem.txgain` write could therefore move the rail mid-transmit, while the SX1262 was still driving the PA at full input power. Record the requested level in setPAGainEnable() and drive the pin from setTxModeEnable(), which runs from onBeforeTransmit() ahead of startTransmit(). The level only matters while transmitting, so deferring costs nothing. Document that the pref is saved immediately but applied at the next transmit, so `get radio.fem.txgain` can lead the hardware until then.	2026-08-08 14:53:57 -07:00
Hacuchino-hash	2af4b3c14a	Fix X1 charge status LED always showing charged	2026-08-07 08:08:08 -05:00
ripplebiz	47154f02cb	Merge pull request #3122 from Hacuchino-hash/x1-notifications Add RGB LED and haptic notifications for SenseCAP MeshTracker X1	2026-08-07 15:26:33 +10:00
agessaman	23066573e5	fix(station-g3): expose FEM gain preferences	2026-08-06 15:29:14 -07:00
Huw Duddy	623422694b	Merge pull request #3121 from liamcottle/config/disable-companion-cad Disable CAD on Companion Firmware until it's configurable	2026-08-06 22:40:37 +10:00
Hacuchino-hash	335ebf546d	Add SPA06 barometer telemetry and charge status LED for MeshTracker X1	2026-08-06 07:27:05 -05:00
Hacuchino-hash	3abe415cf7	Add RGB LED and haptic notifications for SenseCAP MeshTracker X1	2026-08-06 07:27:05 -05:00
liamcottle	dee133d647	disable cad on companion until it's configurable	2026-08-07 00:19:18 +12:00
Liam Cottle	9b4a591ec4	Merge pull request #3120 from recrof/patch-2 ThinkNode M6: Remove QSPIFLASH=1 build flag to fix companion roles	2026-08-06 22:54:24 +12:00
Rastislav Vysoky	e4fbd386af	ThinkNode M6: Remove QSPIFLASH=1 build flag to fix companion roles M6 doesn't have flash chip available, so companion roles fail to start.	2026-08-06 12:37:21 +02:00
ripplebiz	f4ec1d48b1	Merge pull request #3112 from Hacuchino-hash/add-meshtracker-x1 Add support for Seeed SenseCAP MeshTracker X1 (LR2021)	2026-08-06 16:04:18 +10:00
Hacuchino-hash	3d6a891586	Add support for Seeed SenseCAP MeshTracker X1 (LR2021)	2026-08-05 05:50:21 -05:00
ripplebiz	84e3a67bd7	Merge pull request #3115 from oltaco/meshnology_w12 Add support for Meshnology W12 and LR2021 Wrapper	2026-08-05 15:04:00 +10:00
taco	9d4f93806d	LR2021: auto-LDRO for side detectors	2026-08-05 14:23:32 +10:00
taco	36e77671a2	LR2021: fix for hardware cad and side detectors	2026-08-05 14:23:32 +10:00
taco	696a82d7c2	LR2021 multi-SF support (side detectors)	2026-08-05 14:23:32 +10:00
taco	7cc16366cb	add Meshnology W12 support and LR2021 wrapper	2026-08-05 14:23:29 +10:00
ViezeVingertjes	b155081882	Merge remote-tracking branch 'upstream/dev' into fix/scoped-reply-routing # Conflicts: # examples/simple_repeater/MyMesh.cpp	2026-08-04 11:49:58 +02:00
Liam Cottle	8b9bee3bb7	Merge pull request #3107 from meshcore-dev/anon-req-fix bounds check added for anon_req reply_path_len	2026-08-04 13:34:18 +12:00
fdlamotte	d6c2da98aa	Merge pull request #2863 from benskigomez/fix/m6-gps-reset-pin thinknode_m6: don't drive GPS REINIT pin so the L76K is detected	2026-08-03 21:16:59 -04:00
ViezeVingertjes	fad11c90f3	Fix replies dropped when flood.max.unscoped is low	2026-08-03 22:57:12 +02:00
Scott Powell	0fd11ed223	* bounds check added for anon_req reply_path_len	2026-08-04 01:00:31 +10:00
Liam Cottle	03b6ef4b0d	Merge pull request #3047 from dg1tal/codex/docs-3044-group-privacy Clarify hashtag privacy and group sender identity	2026-07-28 15:41:48 +12:00
DG1TAL	84ceabfd0d	Clarify hashtag privacy and group sender identity	2026-07-27 20:07:08 +02:00
Jody Bentley	5c534c4399	thinknode_m6: don't drive GPS REINIT pin (fixes GPS never detected) The M6's L76K GPS streams NMEA at 9600 baud on its own, but the firmware reported no GPS. Root cause: pin 29 (PIN_GPS_RESET / the module's REINIT line) was driven HIGH, which holds the L76K silent so it never emits any sentences and detection fails. variant.cpp drove pin 29 HIGH at boot, and because PIN_GPS_RESET was defined, MicroNMEALocationProvider also drove it HIGH in begin(). Bench testing on a sealed M6 (passive NMEA capture, no logic analyzer) confirmed: pin 29 driven HIGH = 0 bytes; pin 29 floating = full NMEA stream. Define GPS_RESET (-1) so the location provider never touches pin 29, and stop driving it in initVariant. This matches the Meshtastic M6 variant, which leaves the same pin as a floating input.	2026-06-29 14:49:11 -04:00