Remove dead UINT32_MAX branch from searchedTooLong

Agent-Logs-Url: https://github.com/meshtastic/firmware/sessions/6dad5b56-902e-4d0e-90c1-038a9c2df364 Co-authored-by: thebentern <9000580+thebentern@users.noreply.github.com>
Merge branch 'master' into jp-bennett-patch-2
2026-10-05 03:38:32 +10:00 · 2026-04-25 11:50:18 +00:00 · 2026-04-25 06:39:45 -05:00 · 2026-04-25 06:39:36 -05:00 · 2026-04-25 06:10:45 -05:00 · 2026-04-25 06:08:07 -05:00
84 changed files with 5643 additions and 319 deletions
@@ -75,11 +75,11 @@ body:
  - type: checkboxes
    id: mui
    attributes:
-      label: Is this bug report about any UI component firmware like InkHUD or Meshtatic UI (MUI)?
+      label: Is this bug report about any UI (https://meshtastic.org/docs/configuration/device-uis/) component firmware?
      options:
-        - label: Meshtastic UI aka MUI colorTFT
-        - label: InkHUD ePaper
-        - label: OLED slide UI on any display
+        - label: Meshtastic UI aka MUI
+        - label: InkHUD
+        - label: BaseUI

  - type: input
    id: version
@@ -70,6 +70,70 @@ PKI (Public Key Infrastructure) messages have special handling:
 - Accepted on a special "PKI" channel
 - Allow encrypted DMs between nodes that discovered each other on downlink-enabled channels

+## Encryption & Key Management
+
+Meshtastic packets on the air are typically encrypted one of two ways: the **per-channel symmetric** layer (AES-CTR with a shared PSK) for broadcasts and channel traffic, and the **per-peer PKI** layer (X25519 ECDH → AES-256-CCM) for direct messages and remote admin. A channel with a 0-byte PSK (or Ham mode, which wipes PSKs) transmits cleartext — see the size table below. Both are implemented in `src/mesh/CryptoEngine.cpp`; the send/receive dispatch lives in `src/mesh/Router.cpp`; admin authorization lives in `src/modules/AdminModule.cpp`.
+
+### High-level model
+
+- **Channels** are symmetric rooms: anyone with the PSK can read any message on the channel. Channel 0 is the "primary" channel and ships with the short-form default PSK on factory devices, forming the public mesh most users join. (The LoRa modem preset `LONG_FAST` lives on `config.lora.modem_preset` and is an independent field — don't conflate "channel 0 default PSK" with the modem preset name.)
+- **DMs** addressed to a single node require PKI so that other holders of the channel PSK can't read them. Outside Ham mode, Meshtastic does not fall back to channel-symmetric encryption when the destination public key is unknown.
+- **Remote admin** is a DM carrying an `AdminMessage`. The receiver only acts on it if the sender's public key is on its allowlist (`config.security.admin_key[0..2]`).
+- **Ham mode** (`owner.is_licensed=true`, where `owner` is the local `meshtastic_User` record) disables PKI entirely and sends cleartext — FCC Part 97 prohibits encryption on amateur bands.
+- **No ratchet, no session.** Every packet is encrypted from scratch — a stateless design that matches the high-loss, store-and-forward nature of LoRa.
+
+### Symmetric channel encryption (AES-CTR)
+
+`CryptoEngine::encryptPacket` / `decrypt` / `encryptAESCtr` in `src/mesh/CryptoEngine.cpp`.
+
+- **Cipher**: AES-CTR, AES-128 or AES-256 depending on key length. Same routine in both directions (CTR is a stream cipher, so encrypt == decrypt).
+- **Key**: `ChannelSettings.psk` bytes. Size semantics:
+  - **0 bytes** → no encryption, cleartext on the air
+  - **1 byte** → short-form index into the well-known `defaultpsk[]` in `src/mesh/Channels.h`. Index 0 = cleartext; 1 = defaultpsk unchanged; 2..255 = defaultpsk with its last byte incremented by (index − 1). This is what the CLI's `--ch-set psk default` produces.
+  - **16 bytes** → raw AES-128 key
+  - **32 bytes** → raw AES-256 key
+  - **2..15 bytes** → zero-padded to 16 and used as AES-128 (with a warn log); **17..31 bytes** → zero-padded to 32 and used as AES-256 (with a warn log). Defensive fallback for malformed PSK input, not something to rely on.
+- **Nonce (128 bit)**: `packet_id` (u64 LE) ‖ `from_node` (u32 LE) ‖ `block_counter` (u32, starts at 0). Built in `CryptoEngine::initNonce`.
+- **No AEAD**: channel packets carry no MAC, so the channel-hash byte is not an integrity or authenticity check. `Channels::getHash` is a 1-byte XOR-derived hint over the channel name bytes and PSK bytes that helps receivers pick a candidate channel/PSK for decryption. Because it is only a small hint and collisions are easy to find, it should be described purely as a PSK-selection aid, not as a security filter an attacker cannot bypass.
+- **Channel 0 is special in one way only**: it's the channel the Router attempts PKI decryption on before falling through to AES-CTR. Non-zero channels always go straight to AES-CTR.
+
+### PKI encryption for DMs (X25519 ECDH + AES-256-CCM)
+
+`CryptoEngine::encryptCurve25519` / `decryptCurve25519` in `src/mesh/CryptoEngine.cpp`.
+
+- **Keypair**: Curve25519 (aka X25519), 32-byte public + 32-byte private. Stored in `config.security.public_key` / `private_key`; the public half is mirrored into `owner.public_key` so it rides along in NodeInfo broadcasts and propagates through the mesh like any other identity field.
+- **Key generation** (`generateKeyPair`): stirs `HardwareRNG::fill()` (64 B from platform TRNG when available), the 16-byte `myNodeInfo.device_id`, and a call to `random()` into the rweather/Crypto library's software RNG, then `Curve25519::dh1`. `regeneratePublicKey` recomputes the public half from a known private (used when restoring from backup).
+- **Keygen entry points**: at boot, `NodeDB` calls `generateKeyPair` (or `regeneratePublicKey` when a stored private key is present and passes a low-entropy check) **directly** when `!owner.is_licensed` and `config.lora.region != UNSET`. `ensurePkiKeys` wraps the same logic for runtime/admin flows — it's the path `AdminModule::handleSetConfig` runs when first assigning a valid region or when security config is written; **do not assume it's the universal boot-time gate**, because the NodeDB path bypasses it.
+- **Handshake**: `Curve25519::dh2(local_private, remote_public) → 32-byte shared secret → SHA-256 → 32-byte AES-256 key`. Recomputed per packet. The SHA-256 step is effectively a KDF over the raw ECDH output.
+- **Cipher**: AES-256-CCM via `aes_ccm_ae` / `aes_ccm_ad` (`src/mesh/aes-ccm.cpp`). MAC length (the `M` parameter) is **8 bytes**. No AAD — the MAC covers ciphertext only.
+- **Nonce (13 bytes / 104 bit)**: `aes_ccm_ae`/`aes_ccm_ad` use a 13-byte CCM nonce (`L = 2` is hardcoded in `src/mesh/aes-ccm.cpp`), not a 16-byte nonce. For PKI packets, `CryptoEngine::initNonce(fromNode, packetNum, extraNonce)` starts from the usual packet-derived nonce material, then overwrites nonce bytes `4..7` with a fresh 32-bit `extraNonce = random()`. The effective nonce bytes are therefore: bytes `0..3` = `packet_id`, bytes `4..7` = transmitted `extraNonce`, bytes `8..11` = `from_node`, byte `12` = `0x00`. The receiver reconstructs the same 13-byte nonce from the packet metadata plus the appended `extraNonce`.
+- **Wire overhead**: 12 bytes appended to the ciphertext = 8-byte MAC ‖ 4-byte extraNonce. Defined as `MESHTASTIC_PKC_OVERHEAD = 12` in `src/mesh/RadioInterface.h`. Only the 4-byte `extraNonce` is sent; the rest of the 13-byte CCM nonce is reconstructed from packet fields as described above. The Router's send path checks this overhead against `MAX_LORA_PAYLOAD_LEN` before committing to PKI.
+- **Send selection** (`Router::send`): the sender enters the PKI path when **all** hold — we're the originator AND not Ham mode AND not Portduino simradio AND not on the `serial`/`gpio` channels (unless the packet is already marked `pki_encrypted`) AND `config.security.private_key.size == 32` AND destination is a single node (not broadcast) AND the portnum isn't infrastructure. `TRACEROUTE_APP`, `NODEINFO_APP`, `ROUTING_APP`, and `POSITION_APP` are routed through channel encryption even when DMed (these need to be readable by relaying peers). Once on the PKI path, if the destination's public key isn't in our NodeDB the send **fails** with `PKI_SEND_FAIL_PUBLIC_KEY` — it does not silently fall back to channel encryption. If the client explicitly set `pki_encrypted=true` and any condition blocks PKI, the send fails with `PKI_FAILED`.
+- **Receive selection** (`Router::perhapsDecode`): try PKI decrypt first when `channel == 0` AND `isToUs(p)` AND not broadcast AND both peers have public keys in NodeDB AND `rawSize > MESHTASTIC_PKC_OVERHEAD`. On success the packet gets `pki_encrypted=true` stamped and the sender's public key copied into `p->public_key` for downstream authorization.
+
+### Remote admin authorization
+
+Implemented in `src/modules/AdminModule.cpp` → `handleReceivedProtobuf`. The authorization check runs in this order:
+
+1. **Response messages** — if `messageIsResponse(r)` is true (the payload is a response to one of our earlier admin requests), it's accepted without any further check. The in-file comment flags this as a known-untightened gap: a stricter implementation would remember which `public_key` we last queried and reject responses that don't match.
+2. **Local admin** — `mp.from == 0` (phone app over BLE, serial CLI, internal module); never travels over the air. **Rejected** if `config.security.is_managed` is true, because managed devices expect admin to arrive over the air through an authorized remote path.
+3. **Legacy admin channel (deprecated)** — the packet arrived on a channel named literally `"admin"`. Gated by `config.security.admin_channel_enabled`; returns `NOT_AUTHORIZED` if the flag is false. Kept for backward compatibility; new deployments should use PKI admin.
+4. **PKI admin (preferred for remote)** — `mp.pki_encrypted == true` AND `mp.public_key` matches one of `config.security.admin_key[0..2]` (up to three authorized 32-byte Curve25519 public keys, typically copied from the admin node's own `user.public_key`).
+5. **Fallthrough** → `NOT_AUTHORIZED`.
+
+On top of authorization, any remote admin message that **mutates** state (not a request, not a response) also has to pass a session-key check (`checkPassKey`): the client must first pull a fresh 8-byte `session_passkey` via `get_admin_session_key_request`, then echo that passkey back in the mutating message. The device rotates the passkey after 150 s and rejects values older than 300 s — a narrow anti-replay window on top of the PKI layer.
+
+`config.security.is_managed = true` disables **local** admin writes (`mp.from == 0` is rejected). It does not by itself force every admin action through PKI — the legacy `"admin"` channel still authorizes remote admin when `config.security.admin_channel_enabled == true`. The AdminModule refuses to persist `is_managed=true` unless at least one `admin_key` is populated — a deliberate guard against operators locking themselves out.
+
+### Key-rotation hazards (actions that invalidate peers)
+
+- **`factory_reset_device`** (the "full" variant, calls `NodeDB::factoryReset(eraseBleBonds=true)`) → **wipes** the X25519 private key; a fresh keypair is generated on the next region-set. Every existing peer holds the old public key, so DMs to this node silently fail PKI decrypt until every peer re-exchanges NodeInfo.
+- **`factory_reset_config`** (the "partial" variant, calls `NodeDB::factoryReset()` with `eraseBleBonds=false`) → **preserves** the X25519 private key in `installDefaultConfig(preserveKey=true)`; the public key is zeroed and gets rebuilt from the preserved private key on the next boot via the NodeDB path's `regeneratePublicKey` call. Identity is preserved and the mesh does not need to re-exchange keys.
+- **`region=UNSET → valid region`** → `ensurePkiKeys` runs inside the same `handleSetConfig` path; missing keys get generated at that moment.
+- **Ham mode transitions** — entering Ham mode (`user.is_licensed=true`) runs `Channels::ensureLicensedOperation`, which **wipes every channel PSK** (all traffic becomes cleartext) and disables the legacy admin channel. The X25519 private key is preserved on the device but not used because `Router::send` skips PKI when `owner.is_licensed` is true. Leaving Ham mode re-enables PKI with the preserved keypair but does not restore the wiped channel PSKs — the operator has to re-set them.
+- **Channel 0 PSK change** → every peer must re-learn the channel hash; cached NodeInfo becomes temporarily unreachable until the next broadcast.
+- **`security.private_key` blanked via admin** → regenerates both halves (unless in Ham mode) and propagates the new public key via NodeInfo.
+
 ## Project Structure

 ```
@@ -80,7 +144,7 @@ firmware/
 │   │   ├── NodeDB.*       # Node database management
 │   │   ├── Router.*       # Packet routing
 │   │   ├── Channels.*     # Channel management
-│   │   ├── CryptoEngine.* # AES-CCM encryption
+│   │   ├── CryptoEngine.* # AES-CTR (channels) + X25519 ECDH→AES-256-CCM (PKI for DMs/admin)
 │   │   ├── *Interface.*   # Radio interface implementations
 │   │   ├── api/           # WiFi/Ethernet server APIs (ServerAPI, PacketAPI)
 │   │   ├── http/          # HTTP server (WebServer, ContentHandler)
@@ -296,6 +360,23 @@ Key defines in variant.h:

 ## Build System

+## Agent Tooling Baseline
+
+Mirror counterpart: `AGENTS.md` under **Agent Tooling Baseline**.
+
+To reduce avoidable agent mistakes, assume these tools are available (or install them before significant repo work):
+
+- **Required CLI basics**: `bash`, `git`, `find`, `grep`, `sed`, `awk`, `xargs`
+- **Strongly recommended**: `rg` (ripgrep) for fast file/text search, `jq` for JSON processing
+- **Build/test tools**: `python3`, `pip`, virtualenv (`python3 -m venv`), `platformio` (`pio`)
+- **Containerized native testing**: `docker` (especially important on macOS / non-Linux hosts)
+
+Fallback expectations for agents:
+
+- If `rg` is unavailable, use `find` + `grep` instead of failing.
+- For native tests on hosts without Linux deps, prefer `./bin/test-native-docker.sh`.
+- The simulator helper script is `./bin/test-simulator.sh`.
+
 Uses **PlatformIO** with custom scripts:

 - `bin/platformio-pre.py` - Pre-build script
@@ -448,6 +529,8 @@ Run with: `pio test -e native`

 Simulation testing: `bin/test-simulator.sh`

+Quick entry point for new test modules: `test/README.md` (native unit-test authoring guide, skeleton, pitfalls, and setup checklist).
+
 ### Hardware-in-the-loop tests (`mcp-server/tests/`)

 Separate pytest suite that exercises real USB-connected Meshtastic devices. See the **MCP Server & Hardware Test Harness** section below for invocation, tier layout, and agent usage rules.
@@ -118,7 +118,7 @@ CallbackObserver<MyModule, const meshtastic::Status *> statusObserver =

 Add test suite in `test/test_mymodule/`:

-```
+```text
 test/
 └── test_mymodule/
    └── test_main.cpp
@@ -6,7 +6,7 @@ Guide for adding a new Meshtastic hardware variant to the firmware.

 Create under `variants/<arch>/<name>/`:

-```
+```text
 variants/
 ├── esp32/          # ESP32
 ├── esp32s3/        # ESP32-S3
@@ -9,9 +9,9 @@ plugins:
 lint:
  enabled:
    - checkov@3.2.524
-    - renovate@43.132.1
+    - renovate@43.141.0
    - prettier@3.8.3
-    - trufflehog@3.94.3
+    - trufflehog@3.95.2
    - yamllint@1.38.0
    - bandit@1.9.4
    - trivy@0.70.0
@@ -19,7 +19,7 @@ lint:
    - ruff@0.15.11
    - isort@8.0.1
    - markdownlint@0.48.0
-    - oxipng@10.1.0
+    - oxipng@10.1.1
    - svgo@4.0.1
    - actionlint@1.7.12
    - flake8@7.3.0
@@ -48,6 +48,15 @@ Three test-and-diagnose workflows exist as slash commands:

 Bodies live in `.claude/commands/` and `.github/prompts/` respectively. `.claude/commands/README.md` is the index.

+## Encryption at a glance
+
+Two layers, both in `src/mesh/CryptoEngine.cpp`:
+
+- **Channel (symmetric)** — **AES-CTR** with a channel-wide PSK (AES-128 or AES-256). Nonce = packet_id ‖ from_node ‖ block_counter. No AEAD; integrity is soft (channel-hash filter). The well-known default PSK lives in `src/mesh/Channels.h`; a 1-byte PSK is a short-form index into it.
+- **Per-peer PKI** — **X25519 ECDH** (Curve25519, 32-byte keys) → SHA-256 → **AES-256-CCM** with an 8-byte MAC. Fresh 32-bit `extraNonce` per packet, sent in the clear alongside the MAC. 12-byte wire overhead (`MESHTASTIC_PKC_OVERHEAD`). Used for DMs. Also used for remote admin (`src/modules/AdminModule.cpp`), where AdminMessage authorization is gated by `config.security.admin_key[0..2]`. Disabled entirely in Ham mode (`user.is_licensed=true`).
+
+Key rotation to never trigger casually: only the **full** factory reset (`factory_reset_device`, `eraseBleBonds=true`) wipes `security.private_key` and regenerates the keypair — every peer holds the old public key, so DMs silently fail PKI decrypt until NodeInfo re-exchanges. The **partial** config reset (`factory_reset_config`) preserves the private key and doesn't invalidate peer relationships. Explicitly blanking `security.private_key` via admin also triggers regen. See the **Encryption & Key Management** section of `.github/copilot-instructions.md` for the full spec (nonce layout, send/receive selection logic including infrastructure-portnum exceptions, admin-key + session-passkey authorization, `is_managed` scope, key-rotation hazards).
+
 ## House rules

 - **No destructive device operations without operator approval.** `factory_reset`, `erase_and_flash`, `reboot`, `shutdown`, history-rewriting git ops — describe the action and stop. Operator authorizes.
@@ -0,0 +1,31 @@
+# For use with Armbian luckfox-pico-max
+# Waveshare LoRa HAT for Raspberry Pi Pico
+# https://www.waveshare.com/wiki/Pico-LoRa-SX1262
+
+Meta:
+  name: luckfox-pico-max-ws-raspberry-pi-pico-hat
+  support: community
+  compatible:
+    - luckfox-pico-max # Armbian
+
+Lora:
+  Module: sx1262
+  DIO2_AS_RF_SWITCH: true
+  DIO3_TCXO_VOLTAGE: true
+  spidev: spidev0.0
+  Busy: # GPIO1_C7 / GP2
+    pin: 55
+    gpiochip: 1
+    line: 23
+  CS: # GPIO1_C6 / GP3
+    pin: 54
+    gpiochip: 1
+    line: 22
+  Reset: # GPIO1_D1 / GP15
+    pin: 57
+    gpiochip: 1
+    line: 25
+  IRQ: # GPIO2_A2 / GP20
+    pin: 66
+    gpiochip: 2
+    line: 2
@@ -0,0 +1,118 @@
+#!/bin/bash
+
+# Script to show commits in develop that are not in master
+# with their associated PR info and commit hashes
+# 
+# Usage:
+#   ./show-unmerged-prs.sh            # Show all unmerged commits
+#   ./show-unmerged-prs.sh --bugfix   # Show only bugfix-labeled PRs
+
+set -e
+
+REPO="firmware"
+OWNER="meshtastic"
+BASE_BRANCH="master"
+HEAD_BRANCH="develop"
+LIMIT=100
+FILTER_LABEL=""
+
+# Parse arguments
+for arg in "$@"; do
+    case $arg in
+        --bugfix)
+            FILTER_LABEL="bugfix"
+            shift
+            ;;
+        --feature)
+            FILTER_LABEL="feature"
+            shift
+            ;;
+        --help)
+            echo "Usage: $0 [OPTIONS]"
+            echo "Options:"
+            echo "  --bugfix     Show only PRs labeled with 'bugfix'"
+            echo "  --feature    Show only PRs labeled with 'feature'"
+            echo "  --help       Show this help message"
+            exit 0
+            ;;
+    esac
+done
+
+if [ -n "$FILTER_LABEL" ]; then
+    echo "Fetching commits in $HEAD_BRANCH that are not in $BASE_BRANCH (filtered by label: $FILTER_LABEL)..."
+else
+    echo "Fetching commits in $HEAD_BRANCH that are not in $BASE_BRANCH..."
+fi
+echo ""
+
+# Check if gh CLI is available
+if ! command -v gh &> /dev/null; then
+    echo "ERROR: GitHub CLI (gh) not found. Please install it first."
+    echo "Visit: https://cli.github.com/"
+    exit 1
+fi
+
+# Get commits in develop that are not in master
+# For each commit, try to find associated PR
+git fetch origin develop master 2>/dev/null || true
+
+# Use git to get the list of commits
+commits=$(git log --pretty=format:"%H|%s" origin/master..origin/develop | head -n $LIMIT)
+
+count=0
+displayed=0
+echo "Commits in $HEAD_BRANCH not in $BASE_BRANCH:"
+echo "=============================================="
+echo ""
+
+while IFS='|' read -r hash subject; do
+    ((count++))
+    
+    # Try to find the PR for this commit
+    # Extract PR number, title, description, and labels
+    pr_response=$(gh api -X GET "/repos/$OWNER/$REPO/commits/$hash/pulls" \
+        -H "Accept: application/vnd.github.v3+json" 2>/dev/null | \
+        jq -r '.[0] | "\(.number)|\(.title)|\(.body // "No description")|\(.labels | map(.name) | join(","))"' 2>/dev/null || echo "||||")
+    
+    if [ -z "$pr_response" ] || [ "$pr_response" = "||||" ]; then
+        # If no PR found, skip if filter is active, otherwise show the commit
+        if [ -z "$FILTER_LABEL" ]; then
+            ((displayed++))
+            echo "[$displayed] Commit: $hash"
+            echo "    Subject: $subject"
+            echo "    PR: Not found in GitHub"
+            echo ""
+        fi
+    else
+        IFS='|' read -r pr_num pr_title pr_desc pr_labels <<< "$pr_response"
+        
+        # Check if filter matches
+        if [ -n "$FILTER_LABEL" ]; then
+            # Only show if the label is in the labels list
+            if ! echo "$pr_labels" | grep -q "$FILTER_LABEL"; then
+                continue
+            fi
+        fi
+        
+        ((displayed++))
+        echo "[$displayed] PR #$pr_num - $pr_title"
+        echo "    Commit: $hash"
+        if [ -n "$pr_desc" ] && [ "$pr_desc" != "No description" ]; then
+            # Truncate description to 200 chars
+            desc_short="${pr_desc:0:200}"
+            [ ${#pr_desc} -gt 200 ] && desc_short+="..."
+            echo "    Description: $desc_short"
+        fi
+        if [ -n "$pr_labels" ] && [ "$pr_labels" != "" ]; then
+            echo "    Labels: $pr_labels"
+        fi
+        echo ""
+    fi
+done <<< "$commits"
+
+echo ""
+if [ -n "$FILTER_LABEL" ]; then
+    echo "Done. Showing $displayed PRs with label '$FILTER_LABEL' from $displayed commits checked."
+else
+    echo "Done. Showing $displayed commits from $HEAD_BRANCH not in $BASE_BRANCH."
+fi
@@ -29,6 +29,7 @@ build_flags = -Wno-missing-field-initializers
 	-DUSE_THREAD_NAMES
 	-DTINYGPS_OPTION_NO_CUSTOM_FIELDS
 	-DPB_ENABLE_MALLOC=1
+	-DPB_VALIDATE_UTF8=1
 	-DRADIOLIB_EXCLUDE_CC1101=1
 	-DRADIOLIB_EXCLUDE_NRF24=1
 	-DRADIOLIB_EXCLUDE_RF69=1
@@ -58,7 +59,6 @@ build_flags = -Wno-missing-field-initializers
 	-DMESHTASTIC_EXCLUDE_POWERMON=1
 	-DMESHTASTIC_EXCLUDE_STATUS=1
 	-D MAX_THREADS=40 ; As we've split modules, we have more threads to manage
-	-DLED_BUILTIN=-1
 	#-DBUILD_EPOCH=$UNIX_TIME ; set in platformio-custom.py now
 	#-D OLED_PL=1
 	#-D DEBUG_HEAP=1 ; uncomment to add free heap space / memory leak debugging logs
@@ -68,7 +68,7 @@ monitor_speed = 115200
 monitor_filters = direct
 lib_deps =
 	# renovate: datasource=git-refs depName=meshtastic-esp8266-oled-ssd1306 packageName=https://github.com/meshtastic/esp8266-oled-ssd1306 gitBranch=master
-	https://github.com/meshtastic/esp8266-oled-ssd1306/archive/21e484f409cde18d44012caef84c244eb5ca28f3.zip
+	https://github.com/meshtastic/esp8266-oled-ssd1306/archive/6bfd1f135e1ebe37afd6050bb4b9964cea3fcfda.zip
 	# renovate: datasource=git-refs depName=meshtastic-OneButton packageName=https://github.com/meshtastic/OneButton gitBranch=master
 	https://github.com/meshtastic/OneButton/archive/fa352d668c53f290cfa480a5f79ad422cd828c70.zip
 	# renovate: datasource=git-refs depName=meshtastic-arduino-fsm packageName=https://github.com/meshtastic/arduino-fsm gitBranch=master
@@ -717,37 +717,17 @@ bool Power::setup()
        found = true;
 #endif
    }
-#ifdef EXT_PWR_DETECT
-    attachInterrupt(
-        EXT_PWR_DETECT,
-        []() {
-            power->setIntervalFromNow(0);
-            runASAP = true;
-        },
-        CHANGE);
-#endif
-#ifdef BATTERY_CHARGING_INV
-    attachInterrupt(
-        BATTERY_CHARGING_INV,
-        []() {
-            power->setIntervalFromNow(0);
-            runASAP = true;
-        },
-        CHANGE);
-#endif
-#ifdef EXT_CHRG_DETECT
-    attachInterrupt(
-        EXT_CHRG_DETECT,
-        []() {
-            power->setIntervalFromNow(0);
-            runASAP = true;
-            BaseType_t higherWake = 0;
-        },
-        CHANGE);
-#endif
+    attachPowerInterrupts();
    enabled = found;
    low_voltage_counter = 0;

+#ifdef ARCH_ESP32
+    // Register callbacks for before and after lightsleep
+    // Used to detach and reattach interrupts
+    lsObserver.observe(&notifyLightSleep);
+    lsEndObserver.observe(&notifyLightSleepEnd);
+#endif
+
    return found;
 }

@@ -1026,6 +1006,97 @@ int32_t Power::runOnce()
    return (statusHandler && statusHandler->isInitialized()) ? (1000 * 20) : RUN_SAME;
 }

+#ifdef ARCH_ESP32
+
+// Detach our class' interrupts before lightsleep
+// Allows sleep.cpp to configure its own interrupts, which wake the device on user-button press
+int Power::beforeLightSleep(void *unused)
+{
+    LOG_WARN("Detaching power interrupts for sleep");
+    detachPowerInterrupts();
+    return 0; // Indicates success
+}
+
+// Reconfigure our interrupts
+// Our class' interrupts were disconnected during sleep, to allow the user button to wake the device from sleep
+int Power::afterLightSleep(esp_sleep_wakeup_cause_t cause)
+{
+    attachPowerInterrupts();
+    return 0; // Indicates success
+}
+
+#endif
+
+/*
+ * Attach (or re-attach) hardware interrupts for power management
+ * Public method. Used outside class when waking from MCU sleep
+ */
+void Power::attachPowerInterrupts()
+{
+#ifdef EXT_PWR_DETECT
+    attachInterrupt(
+        EXT_PWR_DETECT,
+        []() {
+            power->setIntervalFromNow(0);
+            runASAP = true;
+        },
+        CHANGE);
+#endif
+#ifdef BATTERY_CHARGING_INV
+    attachInterrupt(
+        BATTERY_CHARGING_INV,
+        []() {
+            power->setIntervalFromNow(0);
+            runASAP = true;
+        },
+        CHANGE);
+#endif
+#ifdef EXT_CHRG_DETECT
+    attachInterrupt(
+        EXT_CHRG_DETECT,
+        []() {
+            power->setIntervalFromNow(0);
+            runASAP = true;
+            BaseType_t higherWake = 0;
+        },
+        CHANGE);
+#endif
+#ifdef PMU_IRQ
+    if (PMU) {
+        attachInterrupt(
+            PMU_IRQ,
+            [] {
+                pmu_irq = true;
+                power->setIntervalFromNow(0);
+                runASAP = true;
+            },
+            FALLING);
+    }
+#endif
+}
+
+/*
+ * Detach the "normal" button interrupts.
+ * Public method. Used before attaching a "wake-on-button" interrupt for MCU sleep
+ */
+void Power::detachPowerInterrupts()
+{
+#ifdef EXT_PWR_DETECT
+    detachInterrupt(EXT_PWR_DETECT);
+#endif
+#ifdef BATTERY_CHARGING_INV
+    detachInterrupt(BATTERY_CHARGING_INV);
+#endif
+#ifdef EXT_CHRG_DETECT
+    detachInterrupt(EXT_CHRG_DETECT);
+#endif
+#ifdef PMU_IRQ
+    if (PMU) {
+        detachInterrupt(PMU_IRQ);
+    }
+#endif
+}
+
 /**
 * Init the power manager chip
 *
@@ -1303,8 +1374,6 @@ bool Power::axpChipInit()
    }

    pinMode(PMU_IRQ, INPUT);
-    attachInterrupt(
-        PMU_IRQ, [] { pmu_irq = true; }, FALLING);

    // we do not look for AXPXXX_CHARGING_FINISHED_IRQ & AXPXXX_CHARGING_IRQ
    // because it occurs repeatedly while there is no battery also it could cause
@@ -34,6 +34,7 @@ class ScanI2C
        SHT31,
        SHT4X,
        SHTC3,
+        SHTXX,
        LPS22HB,
        QMC6310U,
        QMC6310N,
@@ -70,20 +70,25 @@ bool GPSUpdateScheduling::isUpdateDue()
 // Have we been searching for a GPS position for too long?
 bool GPSUpdateScheduling::searchedTooLong()
 {
+    constexpr uint32_t oneMinuteMs = 60UL * 1000UL;
+    constexpr uint32_t maxSearchClampMs = 15UL * oneMinuteMs; // Hard cap: 15 minutes is always too long
+    uint32_t elapsed = elapsedSearchMs();
+
+    // Anything over 15 minutes is too long, regardless of the broadcast interval.
+    // TODO: Make a smarter algorithm that backs off the search dwell time when not getting a lock.
+    if (elapsed > maxSearchClampMs)
+        return true;
+
    uint32_t minimumOrConfiguredSecs =
        Default::getConfiguredOrMinimumValue(config.position.position_broadcast_secs, default_broadcast_interval_secs);
    uint32_t maxSearchMs = Default::getConfiguredOrDefaultMs(minimumOrConfiguredSecs, default_broadcast_interval_secs);
-    // If broadcast interval set to max, no such thing as "too long"
-    if (maxSearchMs == UINT32_MAX)
-        return false;

    // If we've been searching longer than our position broadcast interval: that's too long
-    else if (elapsedSearchMs() > maxSearchMs)
+    if (elapsed > maxSearchMs)
        return true;

    // Otherwise, not too long yet!
-    else
-        return false;
+    return false;
 }

 // Updates the predicted time-to-get-lock, by exponentially smoothing the latest observation
@@ -0,0 +1,122 @@
+/*
+
+    NicheGraphics parallel E-Ink driver for the LilyGo T5-S3-ePaper-Pro (ED047TC1).
+
+    InkHUD buffer format : 1bpp, horizontal bytes, MSB = leftmost pixel, 1 = white
+    FastEPD buffer format: 1bpp, horizontal bytes, MSB = leftmost pixel, 1 = white
+
+    Both formats share the same pixel layout and polarity (1 = white, 0 = black).
+    The InkHUD safe-area buffer (944×523) is copied into the centre of the physical
+    960×540 FastEPD buffer so content clears the panel's inactive edge border.
+    See ED047TC1.h for the H_OFFSET_BYTES / V_OFFSET_TOP / V_OFFSET_BOTTOM constants.
+
+*/
+
+// Ruler diagnostic — uncomment to draw calibration lines at each physical edge.
+// #define EINK_EDGE_LINES
+
+#ifdef MESHTASTIC_INCLUDE_NICHE_GRAPHICS
+#ifdef T5_S3_EPAPER_PRO
+
+#include "./ED047TC1.h"
+
+#include "FastEPD.h"
+#include "configuration.h"
+
+using namespace NicheGraphics::Drivers;
+
+void ED047TC1::begin(SPIClass *spi, uint8_t pin_dc, uint8_t pin_cs, uint8_t pin_busy, uint8_t pin_rst)
+{
+    // Parallel display — SPI parameters are not used
+    (void)spi;
+    (void)pin_dc;
+    (void)pin_cs;
+    (void)pin_busy;
+    (void)pin_rst;
+
+    epaper = new FASTEPD;
+
+#if defined(T5_S3_EPAPER_PRO_V1)
+    epaper->initPanel(BB_PANEL_LILYGO_T5PRO, 28000000);
+#elif defined(T5_S3_EPAPER_PRO_V2)
+    epaper->initPanel(BB_PANEL_LILYGO_T5PRO_V2, 28000000);
+    // Initialize all PCA9535 port-0 pins as outputs / HIGH
+    for (int i = 0; i < 8; i++) {
+        epaper->ioPinMode(i, OUTPUT);
+        epaper->ioWrite(i, HIGH);
+    }
+#else
+#error "ED047TC1 driver: unsupported variant — define T5_S3_EPAPER_PRO_V1 or T5_S3_EPAPER_PRO_V2"
+#endif
+
+    epaper->setMode(BB_MODE_1BPP);
+    epaper->clearWhite();
+    epaper->fullUpdate(true); // Blocking initial clear
+}
+
+void ED047TC1::update(uint8_t *imageData, UpdateTypes type)
+{
+    if (!epaper)
+        return;
+
+    // InkHUD renders into a DISPLAY_WIDTH × DISPLAY_HEIGHT safe-area buffer.
+    // We need to place that into the centre of the physical 960×540 FastEPD buffer,
+    // leaving blank margins at every edge to avoid the panel's inactive border.
+    const uint32_t srcRowBytes = (DISPLAY_WIDTH + 7) / 8; // bytes per row in InkHUD buffer (118)
+    const uint32_t dstRowBytes = (960 + 7) / 8;           // bytes per row in physical buffer (120)
+    const uint32_t dstTotalRows = 540;
+
+    uint8_t *cur = epaper->currentBuffer();
+
+    // Fill physical buffer with white (0xFF = white in FastEPD 1bpp)
+    memset(cur, 0xFF, dstRowBytes * dstTotalRows);
+
+    // Copy each InkHUD row into the physical buffer with horizontal + vertical offsets
+    for (uint32_t row = 0; row < DISPLAY_HEIGHT; row++) {
+        const uint8_t *srcRow = imageData + row * srcRowBytes;
+        uint8_t *dstRow = cur + (row + V_OFFSET_TOP) * dstRowBytes + H_OFFSET_BYTES;
+        memcpy(dstRow, srcRow, srcRowBytes);
+    }
+
+#ifdef EINK_EDGE_LINES
+    // Draw a 1px black box at the exact boundary of the safe area within the
+    // physical buffer. If the margins are correct, all 4 lines should be
+    // fully visible and right at the edge of the usable display area.
+
+    auto setPixelBlack = [&](uint32_t col, uint32_t row) { cur[row * dstRowBytes + col / 8] &= ~(0x80 >> (col % 8)); };
+
+    const uint32_t safeX = H_OFFSET_BYTES * 8;
+    const uint32_t safeY = V_OFFSET_TOP;
+    const uint32_t safeW = DISPLAY_WIDTH;
+    const uint32_t safeH = DISPLAY_HEIGHT;
+
+    // Top edge: horizontal line at safeY
+    for (uint32_t col = safeX; col < safeX + safeW; col++)
+        setPixelBlack(col, safeY);
+
+    // Bottom edge: horizontal line at safeY + safeH - 1
+    for (uint32_t col = safeX; col < safeX + safeW; col++)
+        setPixelBlack(col, safeY + safeH - 1);
+
+    // Left edge: vertical line at safeX
+    for (uint32_t row = safeY; row < safeY + safeH; row++)
+        setPixelBlack(safeX, row);
+
+    // Right edge: vertical line at safeX + safeW - 1
+    for (uint32_t row = safeY; row < safeY + safeH; row++)
+        setPixelBlack(safeX + safeW - 1, row);
+#endif
+
+    if (type == FULL) {
+        epaper->fullUpdate(CLEAR_SLOW, false);
+        epaper->backupPlane(); // Sync pPrevious so next partialUpdate has a correct baseline
+    } else {
+        // FAST: true partial update — compares pCurrent vs pPrevious and only applies
+        // the update waveform to rows that actually changed. Unchanged rows get a neutral
+        // signal (no visible effect). partialUpdate() updates pPrevious internally.
+        epaper->partialUpdate(false, 0, dstTotalRows - 1);
+    }
+}
+
+#endif // T5_S3_EPAPER_PRO
+#endif // MESHTASTIC_INCLUDE_NICHE_GRAPHICS
@@ -0,0 +1,90 @@
+/*
+
+    E-Ink display driver adapter
+        - ED047TC1 (via FastEPD library)
+        - Manufacturer: E Ink / used in LilyGo T5-E-Paper-S3-Pro
+        - Size: 4.7 inch
+        - Physical resolution: 960px x 540px
+        - Interface: 8-bit parallel (NOT SPI)
+
+    Unlike the other NicheGraphics EInk drivers, this one drives a parallel e-paper
+    panel via the FastEPD library. SPI parameters passed to begin() are ignored.
+
+    The ED047TC1 panel has an inactive pixel border on all four edges (~4–8 physical
+    pixels). DISPLAY_WIDTH / DISPLAY_HEIGHT expose a reduced "safe area" to InkHUD so
+    that content is never drawn into this dead zone. The update() method copies the
+    InkHUD frame buffer into the centre of the larger physical 960×540 buffer, using
+    H_OFFSET_BYTES (horizontal, whole bytes = 8 pixels per byte),
+    V_OFFSET_TOP and V_OFFSET_BOTTOM (vertical, pixel rows) to position it.
+
+    Changing these constants shifts content inward from each physical edge:
+        H_OFFSET_BYTES = 1  →  8px left margin, 8px right margin   (960 – 8 – 8   = 944)
+        V_OFFSET_TOP   = 9  →  9px top margin  (asymmetric: top ≠ bottom)
+        V_OFFSET_BOTTOM = 8 →  8px bottom margin                    (540 – 9 – 8   = 523)
+
+*/
+
+#pragma once
+
+#ifdef MESHTASTIC_INCLUDE_NICHE_GRAPHICS
+
+#include "configuration.h"
+
+#include "./EInk.h"
+
+// Forward declare to avoid pulling FastEPD into all translation units
+class FASTEPD;
+
+namespace NicheGraphics::Drivers
+{
+
+class ED047TC1 : public EInk
+{
+    // Safe-area dimensions exposed to InkHUD (physical panel is 960×540).
+    //
+    // The ED047TC1 has an inactive pixel border on all physical edges.
+    // The physical buffer coordinates do NOT directly match the visual orientation
+    // due to FastEPD's portrait scan direction and InkHUD's rotation=3 (270° CW):
+    //
+    //   Physical buffer          Visual on device (rotation=3)
+    //   ─────────────────        ──────────────────────────────
+    //   Physical LEFT  cols  →   Visual TOP    edge
+    //   Physical RIGHT cols  →   Visual BOTTOM edge
+    //   Physical TOP   rows  →   Visual RIGHT  edge
+    //   Physical BOTTOM rows →   Visual LEFT   edge
+    //
+    // Offset constants shift the InkHUD safe-area away from each physical dead zone:
+    //   H_OFFSET_BYTES : whole bytes from physical left  (8px per byte, affects visual TOP)
+    //   Physical right margin = 960 − H_OFFSET_BYTES×8 − DISPLAY_WIDTH  (affects visual BOTTOM)
+    //   V_OFFSET_TOP   : pixel rows from physical top    (affects visual RIGHT)
+    //   V_OFFSET_BOTTOM: pixel rows from physical bottom (affects visual LEFT)
+    //
+    // Calibrated by flashing a 1px border box and adjusting until all 4 sides are visible.
+
+    static constexpr uint16_t DISPLAY_WIDTH = 944;  // 960 − H_OFFSET_BYTES×8 − right_margin (8+8 = 16px)
+    static constexpr uint16_t DISPLAY_HEIGHT = 523; // 540 − V_OFFSET_TOP − V_OFFSET_BOTTOM (9+8 = 17px)
+
+    static constexpr uint8_t H_OFFSET_BYTES = 1;  // visual TOP  : 8px physical left margin
+                                                  // visual BOTTOM: 960−8−944=8px physical right margin
+    static constexpr uint8_t V_OFFSET_TOP = 9;    // visual RIGHT : CONFIRMED OK
+    static constexpr uint8_t V_OFFSET_BOTTOM = 8; // visual LEFT  : 8px physical bottom margin
+
+    static constexpr UpdateTypes supported = static_cast<UpdateTypes>(FULL | FAST);
+
+  public:
+    ED047TC1() : EInk(DISPLAY_WIDTH, DISPLAY_HEIGHT, supported) {}
+
+    // EInk interface — SPI params are not used for this parallel display
+    void begin(SPIClass *spi, uint8_t pin_dc, uint8_t pin_cs, uint8_t pin_busy, uint8_t pin_rst = 0xFF) override;
+    void update(uint8_t *imageData, UpdateTypes type) override;
+
+  protected:
+    bool isUpdateDone() override { return true; } // FastEPD updates are blocking
+
+  private:
+    FASTEPD *epaper = nullptr;
+};
+
+} // namespace NicheGraphics::Drivers
+
+#endif // MESHTASTIC_INCLUDE_NICHE_GRAPHICS
@@ -88,8 +88,12 @@ class AppletFont

 // Greek
 #include "graphics/niche/Fonts/FreeSans12pt_Win1253.h"
+#include "graphics/niche/Fonts/FreeSans18pt_Win1253.h"
+#include "graphics/niche/Fonts/FreeSans24pt_Win1253.h"
 #include "graphics/niche/Fonts/FreeSans6pt_Win1253.h"
 #include "graphics/niche/Fonts/FreeSans9pt_Win1253.h"
+#define FREESANS_24PT_WIN1253 InkHUD::AppletFont(FreeSans24pt_Win1253, InkHUD::AppletFont::WINDOWS_1253, -5, 3)
+#define FREESANS_18PT_WIN1253 InkHUD::AppletFont(FreeSans18pt_Win1253, InkHUD::AppletFont::WINDOWS_1253, -4, 2)
 #define FREESANS_12PT_WIN1253 InkHUD::AppletFont(FreeSans12pt_Win1253, InkHUD::AppletFont::WINDOWS_1253, -3, 1)
 #define FREESANS_9PT_WIN1253 InkHUD::AppletFont(FreeSans9pt_Win1253, InkHUD::AppletFont::WINDOWS_1253, -2, -1)
 #define FREESANS_6PT_WIN1253 InkHUD::AppletFont(FreeSans6pt_Win1253, InkHUD::AppletFont::WINDOWS_1253, -1, -2)
@@ -143,6 +143,10 @@ int32_t ButtonThread::runOnce()
        leadUpSequenceActive = false;
        resetLeadUpSequence();
    }
+#ifdef INPUT_DEBUG
+    if (buttonCurrentlyPressed)
+        LOG_WARN("Button held for %u ms", millis() - buttonPressStartTime);
+#endif

    // Progressive lead-up sound system
    if (!_suppressLeadUp && buttonCurrentlyPressed && (millis() - buttonPressStartTime) >= BUTTON_LEADUP_MS) {
@@ -311,7 +315,8 @@ int32_t ButtonThread::runOnce()
 void ButtonThread::attachButtonInterrupts()
 {
    // Interrupt for user button, during normal use. Improves responsiveness.
-    attachInterrupt(_pinNum, _intRoutine, CHANGE);
+    if (_intRoutine != nullptr)
+        attachInterrupt(_pinNum, _intRoutine, CHANGE);
 }

 /*
@@ -320,7 +325,8 @@ void ButtonThread::attachButtonInterrupts()
 */
 void ButtonThread::detachButtonInterrupts()
 {
-    detachInterrupt(_pinNum);
+    if (_intRoutine != nullptr)
+        detachInterrupt(_pinNum);
 }

 #ifdef ARCH_ESP32
@@ -29,7 +29,8 @@ void TouchScreenImpl1::init()
    return;
 #else
    TouchScreenBase::init(true);
-    inputBroker->registerSource(this);
+    if (inputBroker)
+        inputBroker->registerSource(this);
 #endif
 }

@@ -340,138 +340,9 @@ void setup()

 #ifdef BLE_LED
    pinMode(BLE_LED, OUTPUT);
-#ifdef BLE_LED_INVERTED
-    digitalWrite(BLE_LED, HIGH);
-#else
-    digitalWrite(BLE_LED, LOW);
-#endif
-#endif
-
-#if defined(T_DECK)
-    // GPIO10 manages all peripheral power supplies
-    // Turn on peripheral power immediately after MUC starts.
-    // If some boards are turned on late, ESP32 will reset due to low voltage.
-    // ESP32-C3(Keyboard) , MAX98357A(Audio Power Amplifier) ,
-    // TF Card , Display backlight(AW9364DNR) , AN48841B(Trackball) , ES7210(Decoder)
-    pinMode(KB_POWERON, OUTPUT);
-    digitalWrite(KB_POWERON, HIGH);
-    // T-Deck has all three SPI peripherals (TFT, SD, LoRa) attached to the same SPI bus
-    // We need to initialize all CS pins in advance otherwise there will be SPI communication issues
-    // e.g. when detecting the SD card
-    pinMode(LORA_CS, OUTPUT);
-    digitalWrite(LORA_CS, HIGH);
-    pinMode(SDCARD_CS, OUTPUT);
-    digitalWrite(SDCARD_CS, HIGH);
-    pinMode(TFT_CS, OUTPUT);
-    digitalWrite(TFT_CS, HIGH);
-    delay(100);
-#elif defined(T_DECK_PRO)
-    pinMode(LORA_EN, OUTPUT);
-    digitalWrite(LORA_EN, HIGH);
-    pinMode(LORA_CS, OUTPUT);
-    digitalWrite(LORA_CS, HIGH);
-    pinMode(SDCARD_CS, OUTPUT);
-    digitalWrite(SDCARD_CS, HIGH);
-    pinMode(PIN_EINK_CS, OUTPUT);
-    digitalWrite(PIN_EINK_CS, HIGH);
-#if PIN_EINK_RES >= 0
-    pinMode(PIN_EINK_RES, OUTPUT);
-    digitalWrite(PIN_EINK_RES, HIGH);
-#endif
-    pinMode(CST328_PIN_RST, OUTPUT);
-    digitalWrite(CST328_PIN_RST, HIGH);
-#elif defined(T_LORA_PAGER)
-    pinMode(LORA_CS, OUTPUT);
-    digitalWrite(LORA_CS, HIGH);
-    pinMode(SDCARD_CS, OUTPUT);
-    digitalWrite(SDCARD_CS, HIGH);
-    pinMode(TFT_CS, OUTPUT);
-    digitalWrite(TFT_CS, HIGH);
-    pinMode(KB_INT, INPUT_PULLUP);
-    // io expander
-    io.begin(Wire, XL9555_SLAVE_ADDRESS0, SDA, SCL);
-    io.pinMode(EXPANDS_DRV_EN, OUTPUT);
-    io.digitalWrite(EXPANDS_DRV_EN, HIGH);
-    io.pinMode(EXPANDS_AMP_EN, OUTPUT);
-    io.digitalWrite(EXPANDS_AMP_EN, LOW);
-    io.pinMode(EXPANDS_LORA_EN, OUTPUT);
-    io.digitalWrite(EXPANDS_LORA_EN, HIGH);
-    io.pinMode(EXPANDS_GPS_EN, OUTPUT);
-    io.digitalWrite(EXPANDS_GPS_EN, HIGH);
-    io.pinMode(EXPANDS_KB_EN, OUTPUT);
-    io.digitalWrite(EXPANDS_KB_EN, HIGH);
-    io.pinMode(EXPANDS_SD_EN, OUTPUT);
-    io.digitalWrite(EXPANDS_SD_EN, HIGH);
-    io.pinMode(EXPANDS_GPIO_EN, OUTPUT);
-    io.digitalWrite(EXPANDS_GPIO_EN, HIGH);
-    io.pinMode(EXPANDS_SD_PULLEN, INPUT);
-#elif defined(HACKADAY_COMMUNICATOR)
-    pinMode(KB_INT, INPUT);
    digitalWrite(BLE_LED, LED_STATE_OFF);
 #endif

-#if defined(T_DECK)
-    // GPIO10 manages all peripheral power supplies
-    // Turn on peripheral power immediately after MUC starts.
-    // If some boards are turned on late, ESP32 will reset due to low voltage.
-    // ESP32-C3(Keyboard) , MAX98357A(Audio Power Amplifier) ,
-    // TF Card , Display backlight(AW9364DNR) , AN48841B(Trackball) , ES7210(Decoder)
-    pinMode(KB_POWERON, OUTPUT);
-    digitalWrite(KB_POWERON, HIGH);
-    // T-Deck has all three SPI peripherals (TFT, SD, LoRa) attached to the same SPI bus
-    // We need to initialize all CS pins in advance otherwise there will be SPI communication issues
-    // e.g. when detecting the SD card
-    pinMode(LORA_CS, OUTPUT);
-    digitalWrite(LORA_CS, HIGH);
-    pinMode(SDCARD_CS, OUTPUT);
-    digitalWrite(SDCARD_CS, HIGH);
-    pinMode(TFT_CS, OUTPUT);
-    digitalWrite(TFT_CS, HIGH);
-    delay(100);
-#elif defined(T_DECK_PRO)
-    pinMode(LORA_EN, OUTPUT);
-    digitalWrite(LORA_EN, HIGH);
-    pinMode(LORA_CS, OUTPUT);
-    digitalWrite(LORA_CS, HIGH);
-    pinMode(SDCARD_CS, OUTPUT);
-    digitalWrite(SDCARD_CS, HIGH);
-    pinMode(PIN_EINK_CS, OUTPUT);
-    digitalWrite(PIN_EINK_CS, HIGH);
-#if PIN_EINK_RES >= 0
-    pinMode(PIN_EINK_RES, OUTPUT);
-    digitalWrite(PIN_EINK_RES, HIGH);
-#endif
-    pinMode(CST328_PIN_RST, OUTPUT);
-    digitalWrite(CST328_PIN_RST, HIGH);
-#elif defined(T_LORA_PAGER)
-    pinMode(LORA_CS, OUTPUT);
-    digitalWrite(LORA_CS, HIGH);
-    pinMode(SDCARD_CS, OUTPUT);
-    digitalWrite(SDCARD_CS, HIGH);
-    pinMode(TFT_CS, OUTPUT);
-    digitalWrite(TFT_CS, HIGH);
-    pinMode(KB_INT, INPUT_PULLUP);
-    // io expander
-    io.begin(Wire, XL9555_SLAVE_ADDRESS0, SDA, SCL);
-    io.pinMode(EXPANDS_DRV_EN, OUTPUT);
-    io.digitalWrite(EXPANDS_DRV_EN, HIGH);
-    io.pinMode(EXPANDS_AMP_EN, OUTPUT);
-    io.digitalWrite(EXPANDS_AMP_EN, LOW);
-    io.pinMode(EXPANDS_LORA_EN, OUTPUT);
-    io.digitalWrite(EXPANDS_LORA_EN, HIGH);
-    io.pinMode(EXPANDS_GPS_EN, OUTPUT);
-    io.digitalWrite(EXPANDS_GPS_EN, HIGH);
-    io.pinMode(EXPANDS_KB_EN, OUTPUT);
-    io.digitalWrite(EXPANDS_KB_EN, HIGH);
-    io.pinMode(EXPANDS_SD_EN, OUTPUT);
-    io.digitalWrite(EXPANDS_SD_EN, HIGH);
-    io.pinMode(EXPANDS_GPIO_EN, OUTPUT);
-    io.digitalWrite(EXPANDS_GPIO_EN, HIGH);
-    io.pinMode(EXPANDS_SD_PULLEN, INPUT);
-#elif defined(HACKADAY_COMMUNICATOR)
-    pinMode(KB_INT, INPUT);
-#endif
-
    concurrency::hasBeenSetup = true;
 #if HAS_SCREEN
    meshtastic_Config_DisplayConfig_OledType screen_model =
@@ -4,6 +4,7 @@
 #include <memory>

 #if !(MESHTASTIC_EXCLUDE_PKI)
+#include "HardwareRNG.h"
 #include "NodeDB.h"
 #include "aes-ccm.h"
 #include "meshUtils.h"
@@ -26,6 +27,15 @@ void CryptoEngine::generateKeyPair(uint8_t *pubKey, uint8_t *privKey)
 {
    // Mix in any randomness we can, to make key generation stronger.
    CryptRNG.begin(optstr(APP_VERSION));
+
+    uint8_t hardwareEntropy[64] = {0};
+    if (HardwareRNG::fill(hardwareEntropy, sizeof(hardwareEntropy), true)) {
+        CryptRNG.stir(hardwareEntropy, sizeof(hardwareEntropy));
+    } else {
+        LOG_WARN("Hardware entropy unavailable, falling back to software RNG");
+    }
+    memset(hardwareEntropy, 0, sizeof(hardwareEntropy));
+
    if (myNodeInfo.device_id.size == 16) {
        CryptRNG.stir(myNodeInfo.device_id.bytes, myNodeInfo.device_id.size);
    }
@@ -0,0 +1,161 @@
+#include "HardwareRNG.h"
+
+#include <algorithm>
+#include <cstring>
+#include <random>
+
+#include "configuration.h"
+
+#if HAS_RADIO
+#include "RadioLibInterface.h"
+#endif
+
+#if defined(ARCH_NRF52)
+#include <Adafruit_nRFCrypto.h>
+extern Adafruit_nRFCrypto nRFCrypto;
+#elif defined(ARCH_ESP32)
+#include <esp_system.h>
+#elif defined(ARCH_RP2040)
+#include <Arduino.h>
+#elif defined(ARCH_PORTDUINO)
+#include <random>
+#include <sys/random.h>
+#include <unistd.h>
+#endif
+
+namespace HardwareRNG
+{
+
+namespace
+{
+void fillWithRandomDevice(uint8_t *buffer, size_t length)
+{
+    std::random_device rd;
+    size_t offset = 0;
+    while (offset < length) {
+        uint32_t value = rd();
+        size_t toCopy = std::min(length - offset, sizeof(value));
+        memcpy(buffer + offset, &value, toCopy);
+        offset += toCopy;
+    }
+}
+
+#if HAS_RADIO
+bool mixWithLoRaEntropy(uint8_t *buffer, size_t length)
+{
+    // Only attempt to pull entropy from the modem if it is initialized and exposes the helper.
+    // When the radio stack is disabled or has not yet been configured, we simply skip this step
+    // and return false so callers know no extra mixing occurred.
+    RadioLibInterface *radio = RadioLibInterface::instance;
+    if (!radio) {
+#ifndef PIO_UNIT_TESTING
+        LOG_ERROR("No radio instance available to provide entropy");
+#endif
+        return false;
+    }
+
+    constexpr size_t chunkSize = 16;
+    uint8_t scratch[chunkSize];
+    size_t offset = 0;
+    bool mixed = false;
+
+    while (offset < length) {
+        size_t toCopy = std::min(length - offset, chunkSize);
+
+        // randomBytes() returns false if the modem does not support it or is not ready
+        // (for instance, when the radio is powered down). We break immediately to avoid
+        // blocking or returning partially-filled entropy and simply report failure.
+        if (!radio->randomBytes(scratch, toCopy)) {
+            break;
+        }
+
+        for (size_t i = 0; i < toCopy; ++i) {
+            buffer[offset + i] ^= scratch[i];
+        }
+
+        mixed = true;
+        offset += toCopy;
+    }
+
+    // Avoid leaving the modem-sourced bytes sitting on the stack longer than needed.
+    if (mixed) {
+        memset(scratch, 0, sizeof(scratch));
+    }
+
+    return mixed;
+}
+#endif
+} // namespace
+
+bool fill(uint8_t *buffer, size_t length, bool useRadioEntropy)
+{
+    if (!buffer || length == 0) {
+        return false;
+    }
+
+    bool filled = false;
+
+#if defined(ARCH_NRF52)
+    // The Nordic SDK RNG provides cryptographic-quality randomness backed by hardware.
+    nRFCrypto.begin();
+    auto result = nRFCrypto.Random.generate(buffer, length);
+    nRFCrypto.end();
+    filled = result;
+#elif defined(ARCH_ESP32)
+    // ESP32 exposes a true RNG via esp_fill_random().
+    esp_fill_random(buffer, length);
+    filled = true;
+#elif defined(ARCH_RP2040)
+    // RP2040 has a hardware random number generator accessible through the Arduino core.
+    size_t offset = 0;
+    while (offset < length) {
+        uint32_t value = rp2040.hwrand32();
+        size_t toCopy = std::min(length - offset, sizeof(value));
+        memcpy(buffer + offset, &value, toCopy);
+        offset += toCopy;
+    }
+    filled = true;
+#elif defined(ARCH_PORTDUINO)
+    // Prefer the host OS RNG first when running under Portduino.
+    ssize_t generated = ::getrandom(buffer, length, 0);
+    if (generated == static_cast<ssize_t>(length)) {
+        filled = true;
+    }
+
+    if (!filled) {
+        fillWithRandomDevice(buffer, length);
+        filled = true;
+    }
+#endif
+
+    if (!filled) {
+        // As a last resort, fall back to std::random_device. This should only be reached
+        // if a platform-specific source was unavailable.
+        fillWithRandomDevice(buffer, length);
+        filled = true;
+    }
+
+#if HAS_RADIO
+    if (useRadioEntropy) {
+        // Best-effort: if the radio is active and can provide modem entropy, XOR it over the
+        // buffer to improve overall quality. We consider the filling a success if either a
+        // good platform RNG or the modem RNG provided data, so we return true as long as at
+        // least one of those steps succeeded.
+        filled = mixWithLoRaEntropy(buffer, length) || filled;
+    }
+#endif
+
+    return filled;
+}
+
+bool seed(uint32_t &seedOut)
+{
+    uint32_t candidate = 0;
+    if (!fill(reinterpret_cast<uint8_t *>(&candidate), sizeof(candidate), true)) {
+        return false;
+    }
+    seedOut = candidate;
+    return true;
+}
+
+} // namespace HardwareRNG
@@ -0,0 +1,28 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+
+namespace HardwareRNG
+{
+
+/**
+ * Fill the provided buffer with random bytes sourced from the most
+ * appropriate hardware-backed RNG available on the current platform.
+ *
+ * @param buffer Destination buffer for random bytes
+ * @param length Number of bytes to write
+ * @param useRadioEntropy If true, attempt to mix radio entropy into the output as well.
+ * @return true if the buffer was fully populated with entropy, false on failure
+ */
+bool fill(uint8_t *buffer, size_t length, bool useRadioEntropy = false);
+
+/**
+ * Populate a 32-bit seed value with hardware-backed randomness where possible.
+ *
+ * @param seedOut Destination for the generated seed value
+ * @return true if a seed was produced from a reliable entropy source
+ */
+bool seed(uint32_t &seedOut);
+
+} // namespace HardwareRNG
@@ -4,6 +4,7 @@
 #include "MeshTypes.h"
 #include "PointerQueue.h"
 #include "configuration.h"
+#include "detect/LoRaRadioType.h"

 // Map from old region names to new region enums
 struct RegionInfo {
@@ -25,7 +26,7 @@ extern const RegionInfo *myRegion;
 extern void initRegion();

 // Valid LoRa spread factor range and defaults
-constexpr uint8_t LORA_SF_MIN = 7;
+constexpr uint8_t LORA_SF_MIN = 5;
 constexpr uint8_t LORA_SF_MAX = 12;
 constexpr uint8_t LORA_SF_DEFAULT = 11; // LONG_FAST default

@@ -37,10 +38,14 @@ constexpr uint8_t LORA_CR_DEFAULT = 5; // LONG_FAST default
 // Default bandwidth in kHz (LONG_FAST)
 constexpr float LORA_BW_DEFAULT_KHZ = 250.0f;

-/// Clamp spread factor to the valid LoRa range [7, 12].
+/// Clamp spread factor to the valid LoRa range [5, 12].
 /// Out-of-range values (including 0 from unset preset mode) return LORA_SF_DEFAULT.
 static inline uint8_t clampSpreadFactor(uint8_t sf)
 {
+    // We check for RF95 radios that are incompatible with Spreading Factors 5 and 6.
+    if (radioType == RF95_RADIO && (sf == 5 || sf == 6))
+        return LORA_SF_DEFAULT;
+
    if (sf < LORA_SF_MIN || sf > LORA_SF_MAX)
        return LORA_SF_DEFAULT;
    return sf;
@@ -17,14 +17,4 @@ template <class T> class PointerQueue : public TypedQueue<T *>

        return this->dequeue(&p, maxWait) ? p : nullptr;
    }
-
-#ifdef HAS_FREE_RTOS
-    // returns a ptr or null if the queue was empty
-    T *dequeuePtrFromISR(BaseType_t *higherPriWoken)
-    {
-        T *p;
-
-        return this->dequeueFromISR(&p, higherPriWoken) ? p : nullptr;
-    }
-#endif
 };
@@ -246,6 +246,24 @@ bool RadioLibInterface::findInTxQueue(NodeNum from, PacketId id)
    return txQueue.find(from, id);
 }

+bool RadioLibInterface::randomBytes(uint8_t *buffer, size_t length)
+{
+    if (!buffer || length == 0 || !iface) {
+        return false;
+    }
+
+    // Older RadioLib versions only expose random(min, max), so fill the buffer byte-by-byte.
+    for (size_t i = 0; i < length; ++i) {
+        int32_t value = iface->random(0, 255);
+        if (value < 0) {
+            return false;
+        }
+        buffer[i] = static_cast<uint8_t>(value & 0xFF);
+    }
+
+    return true;
+}
+
 /** radio helper thread callback.
 We never immediately transmit after any operation (either Rx or Tx). Instead we should wait a random multiple of
 'slotTimes' (see definition in RadioInterface.h) taken from a contention window (CW) to lower the chance of collision.
@@ -587,4 +605,4 @@ bool RadioLibInterface::startSend(meshtastic_MeshPacket *txp)

        return res == RADIOLIB_ERR_NONE;
    }
-}
+}
@@ -172,6 +172,12 @@ class RadioLibInterface : public RadioInterface, protected concurrency::Notified
    /** Attempt to find a packet in the TxQueue. Returns true if the packet was found. */
    virtual bool findInTxQueue(NodeNum from, PacketId id) override;

+    /**
+     * Request randomness sourced from the LoRa modem, if supported by the active RadioLib interface.
+     * @return true if len bytes were produced, false otherwise.
+     */
+    bool randomBytes(uint8_t *buffer, size_t length);
+
  private:
    /** if we have something waiting to send, start a short (random) timer so we can come check for collision before actually
     * doing the transmit */
@@ -448,6 +448,15 @@ template <typename T> void SX126xInterface<T>::resetAGC()
    // RX boosted gain mode
    lora.setRxBoostedGainMode(config.lora.sx126x_rx_boosted_gain);

+    // Re-apply the undocumented 0x8B5 RX sensitivity patch that was set in init().
+    // The CALIBRATE_ALL (0x7F) command above clears bit 0 of register 0x8B5, which
+    // silently removes the RX sensitivity improvement introduced in #9571 / #9777.
+    // Without this re-apply, every SX1262 node loses its RX boost ~60s after boot
+    // and never recovers until reboot. See empirical evidence in the PR description.
+    if (module.SPIsetRegValue(0x8B5, 0x01, 0, 0) != RADIOLIB_ERR_NONE) {
+        LOG_WARN("SX126x resetAGC: failed to re-apply 0x8B5 RX sensitivity patch");
+    }
+
    // 6. Resume receiving
    startReceive();
 }
@@ -1,6 +1,7 @@
 #include "TypeConversions.h"
 #include "mesh/generated/meshtastic/deviceonly.pb.h"
 #include "mesh/generated/meshtastic/mesh.pb.h"
+#include "meshUtils.h"

 meshtastic_NodeInfo TypeConversions::ConvertToNodeInfo(const meshtastic_NodeInfoLite *lite)
 {
@@ -81,7 +82,11 @@ meshtastic_UserLite TypeConversions::ConvertToUserLite(meshtastic_User user)
    meshtastic_UserLite lite = meshtastic_UserLite_init_default;

    strncpy(lite.long_name, user.long_name, sizeof(lite.long_name));
+    lite.long_name[sizeof(lite.long_name) - 1] = '\0';
+    sanitizeUtf8(lite.long_name, sizeof(lite.long_name));
    strncpy(lite.short_name, user.short_name, sizeof(lite.short_name));
+    lite.short_name[sizeof(lite.short_name) - 1] = '\0';
+    sanitizeUtf8(lite.short_name, sizeof(lite.short_name));
    lite.hw_model = user.hw_model;
    lite.role = user.role;
    lite.is_licensed = user.is_licensed;
@@ -99,7 +104,11 @@ meshtastic_User TypeConversions::ConvertToUser(uint32_t nodeNum, meshtastic_User

    snprintf(user.id, sizeof(user.id), "!%08x", nodeNum);
    strncpy(user.long_name, lite.long_name, sizeof(user.long_name));
+    user.long_name[sizeof(user.long_name) - 1] = '\0';
+    sanitizeUtf8(user.long_name, sizeof(user.long_name));
    strncpy(user.short_name, lite.short_name, sizeof(user.short_name));
+    user.short_name[sizeof(user.short_name) - 1] = '\0';
+    sanitizeUtf8(user.short_name, sizeof(user.short_name));
    user.hw_model = lite.hw_model;
    user.role = lite.role;
    user.is_licensed = lite.is_licensed;
@@ -285,7 +285,18 @@ typedef enum _meshtastic_Config_LoRaConfig_RegionCode {
    /* Nepal 865MHz */
    meshtastic_Config_LoRaConfig_RegionCode_NP_865 = 25,
    /* Brazil 902MHz */
-    meshtastic_Config_LoRaConfig_RegionCode_BR_902 = 26
+    meshtastic_Config_LoRaConfig_RegionCode_BR_902 = 26,
+    /* ITU Region 1 Amateur Radio 2m band (144-146 MHz) */
+    meshtastic_Config_LoRaConfig_RegionCode_ITU1_2M = 27,
+    /* ITU Region 2 / 3 Amateur Radio 2m band (144-148 MHz) */
+    meshtastic_Config_LoRaConfig_RegionCode_ITU23_2M = 28,
+    /* EU 866MHz band (Band no. 47b of 2006/771/EC and subsequent amendments) for Non-specific short-range devices (SRD) */
+    meshtastic_Config_LoRaConfig_RegionCode_EU_866 = 29,
+    /* EU 874MHz and 917MHz bands (Band no. 1 and 4 of 2022/172/EC and subsequent amendments) for Non-specific short-range devices (SRD) */
+    meshtastic_Config_LoRaConfig_RegionCode_EU_874 = 30,
+    meshtastic_Config_LoRaConfig_RegionCode_EU_917 = 31,
+    /* EU 868MHz band, with narrow presets */
+    meshtastic_Config_LoRaConfig_RegionCode_EU_N_868 = 32
 } meshtastic_Config_LoRaConfig_RegionCode;

 /* Standard predefined channel settings
@@ -315,7 +326,24 @@ typedef enum _meshtastic_Config_LoRaConfig_ModemPreset {
    meshtastic_Config_LoRaConfig_ModemPreset_SHORT_TURBO = 8,
    /* Long Range - Turbo
 This preset performs similarly to LongFast, but with 500Khz bandwidth. */
-    meshtastic_Config_LoRaConfig_ModemPreset_LONG_TURBO = 9
+    meshtastic_Config_LoRaConfig_ModemPreset_LONG_TURBO = 9,
+    /* Lite Fast
+ Medium range preset optimized for EU 866MHz SRD band with 125kHz bandwidth.
+ Comparable link budget to MEDIUM_FAST but compliant with Band no. 47b of 2006/771/EC. */
+    meshtastic_Config_LoRaConfig_ModemPreset_LITE_FAST = 10,
+    /* Lite Slow
+ Medium-to-moderate range preset optimized for EU 866MHz SRD band with 125kHz bandwidth.
+ Comparable link budget to LONG_FAST but compliant with Band no. 47b of 2006/771/EC. */
+    meshtastic_Config_LoRaConfig_ModemPreset_LITE_SLOW = 11,
+    /* Narrow Fast
+ Medium-to-moderate range preset optimized for EU 868MHz band with 62.5kHz bandwidth.
+ Comparable link budget to SHORT_SLOW, but with half the data rate.
+ Intended to avoid interference with other devices. */
+    meshtastic_Config_LoRaConfig_ModemPreset_NARROW_FAST = 12,
+    /* Narrow Slow
+ Moderate range preset optimized for EU 868MHz band with 62.5kHz bandwidth.
+ Comparable link budget and data rate to LONG_FAST. */
+    meshtastic_Config_LoRaConfig_ModemPreset_NARROW_SLOW = 13
 } meshtastic_Config_LoRaConfig_ModemPreset;

 typedef enum _meshtastic_Config_LoRaConfig_FEM_LNA_Mode {
@@ -702,12 +730,12 @@ extern "C" {
 #define _meshtastic_Config_DisplayConfig_CompassOrientation_ARRAYSIZE ((meshtastic_Config_DisplayConfig_CompassOrientation)(meshtastic_Config_DisplayConfig_CompassOrientation_DEGREES_270_INVERTED+1))

 #define _meshtastic_Config_LoRaConfig_RegionCode_MIN meshtastic_Config_LoRaConfig_RegionCode_UNSET
-#define _meshtastic_Config_LoRaConfig_RegionCode_MAX meshtastic_Config_LoRaConfig_RegionCode_BR_902
-#define _meshtastic_Config_LoRaConfig_RegionCode_ARRAYSIZE ((meshtastic_Config_LoRaConfig_RegionCode)(meshtastic_Config_LoRaConfig_RegionCode_BR_902+1))
+#define _meshtastic_Config_LoRaConfig_RegionCode_MAX meshtastic_Config_LoRaConfig_RegionCode_EU_N_868
+#define _meshtastic_Config_LoRaConfig_RegionCode_ARRAYSIZE ((meshtastic_Config_LoRaConfig_RegionCode)(meshtastic_Config_LoRaConfig_RegionCode_EU_N_868+1))

 #define _meshtastic_Config_LoRaConfig_ModemPreset_MIN meshtastic_Config_LoRaConfig_ModemPreset_LONG_FAST
-#define _meshtastic_Config_LoRaConfig_ModemPreset_MAX meshtastic_Config_LoRaConfig_ModemPreset_LONG_TURBO
-#define _meshtastic_Config_LoRaConfig_ModemPreset_ARRAYSIZE ((meshtastic_Config_LoRaConfig_ModemPreset)(meshtastic_Config_LoRaConfig_ModemPreset_LONG_TURBO+1))
+#define _meshtastic_Config_LoRaConfig_ModemPreset_MAX meshtastic_Config_LoRaConfig_ModemPreset_NARROW_SLOW
+#define _meshtastic_Config_LoRaConfig_ModemPreset_ARRAYSIZE ((meshtastic_Config_LoRaConfig_ModemPreset)(meshtastic_Config_LoRaConfig_ModemPreset_NARROW_SLOW+1))

 #define _meshtastic_Config_LoRaConfig_FEM_LNA_Mode_MIN meshtastic_Config_LoRaConfig_FEM_LNA_Mode_DISABLED
 #define _meshtastic_Config_LoRaConfig_FEM_LNA_Mode_MAX meshtastic_Config_LoRaConfig_FEM_LNA_Mode_NOT_PRESENT
@@ -315,6 +315,8 @@ typedef enum _meshtastic_HardwareModel {
    meshtastic_HardwareModel_THINKNODE_M7 = 129,
    meshtastic_HardwareModel_THINKNODE_M8 = 130,
    meshtastic_HardwareModel_THINKNODE_M9 = 131,
+    /* The Heltec-V4-R8 uses an ESP32S3R8 chip, plus an SX1262. */
+    meshtastic_HardwareModel_HELTEC_V4_R8 = 132,
    /* ------------------------------------------------------------------------------------------------------------------------------------------
 Reserved ID For developing private Ports. These will show up in live traffic sparsely, so we can use a high number. Keep it within 8 bits.
 ------------------------------------------------------------------------------------------------------------------------------------------ */
@@ -117,4 +117,93 @@ size_t pb_string_length(const char *str, size_t max_len)
        }
    }
    return len;
+}
+
+bool sanitizeUtf8(char *buf, size_t bufSize)
+{
+    if (!buf || bufSize == 0)
+        return false;
+
+    // Ensure null-terminated within buffer
+    buf[bufSize - 1] = '\0';
+
+    bool replaced = false;
+    size_t i = 0;
+    size_t len = strlen(buf);
+
+    while (i < len) {
+        uint8_t b = (uint8_t)buf[i];
+
+        // Determine expected sequence length from lead byte
+        size_t seqLen;
+        uint32_t minCodepoint;
+        if (b <= 0x7F) {
+            // ASCII — valid single byte
+            i++;
+            continue;
+        } else if ((b & 0xE0) == 0xC0) {
+            seqLen = 2;
+            minCodepoint = 0x80; // Reject overlong
+        } else if ((b & 0xF0) == 0xE0) {
+            seqLen = 3;
+            minCodepoint = 0x800;
+        } else if ((b & 0xF8) == 0xF0) {
+            seqLen = 4;
+            minCodepoint = 0x10000;
+        } else {
+            // Invalid lead byte (0x80-0xBF or 0xF8+)
+            buf[i] = '?';
+            replaced = true;
+            i++;
+            continue;
+        }
+
+        // Check that we have enough bytes remaining
+        if (i + seqLen > len) {
+            // Truncated sequence at end of string — replace remaining bytes
+            for (size_t j = i; j < len; j++) {
+                buf[j] = '?';
+            }
+            replaced = true;
+            break;
+        }
+
+        // Validate continuation bytes (must be 10xxxxxx)
+        bool valid = true;
+        for (size_t j = 1; j < seqLen; j++) {
+            if (((uint8_t)buf[i + j] & 0xC0) != 0x80) {
+                valid = false;
+                break;
+            }
+        }
+
+        if (valid) {
+            // Decode codepoint to check for overlong encodings and surrogates
+            uint32_t cp = 0;
+            if (seqLen == 2)
+                cp = b & 0x1F;
+            else if (seqLen == 3)
+                cp = b & 0x0F;
+            else
+                cp = b & 0x07;
+            for (size_t j = 1; j < seqLen; j++)
+                cp = (cp << 6) | ((uint8_t)buf[i + j] & 0x3F);
+
+            if (cp < minCodepoint || cp > 0x10FFFF || (cp >= 0xD800 && cp <= 0xDFFF)) {
+                // Overlong encoding, out of Unicode range, or surrogate half
+                valid = false;
+            }
+        }
+
+        if (valid) {
+            i += seqLen;
+        } else {
+            // Replace only the lead byte; continuation bytes will be caught on next iteration
+            buf[i] = '?';
+            replaced = true;
+            i++;
+        }
+    }
+
+    return replaced;
 }
@@ -38,6 +38,10 @@ const std::string vformat(const char *const zcFormat, ...);
 // Get actual string length for nanopb char array fields.
 size_t pb_string_length(const char *str, size_t max_len);

+// Sanitize a fixed-size char buffer in-place by replacing invalid UTF-8 sequences with '?'.
+// Ensures the result is null-terminated within bufSize. Returns true if any bytes were replaced.
+bool sanitizeUtf8(char *buf, size_t bufSize);
+
 /// Calculate 2^n without calling pow() - used for spreading factor and other calculations
 inline uint32_t pow_of_2(uint32_t n)
 {
@@ -599,10 +599,14 @@ void AdminModule::handleSetOwner(const meshtastic_User &o)
    if (*o.long_name) {
        changed |= strcmp(owner.long_name, o.long_name);
        strncpy(owner.long_name, o.long_name, sizeof(owner.long_name));
+        owner.long_name[sizeof(owner.long_name) - 1] = '\0';
+        sanitizeUtf8(owner.long_name, sizeof(owner.long_name));
    }
    if (*o.short_name) {
        changed |= strcmp(owner.short_name, o.short_name);
        strncpy(owner.short_name, o.short_name, sizeof(owner.short_name));
+        owner.short_name[sizeof(owner.short_name) - 1] = '\0';
+        sanitizeUtf8(owner.short_name, sizeof(owner.short_name));
    }
    snprintf(owner.id, sizeof(owner.id), "!%08x", nodeDB->getNodeNum());

@@ -1400,7 +1404,11 @@ void AdminModule::handleSetHamMode(const meshtastic_HamParameters &p)

    // Set call sign and override lora limitations for licensed use
    strncpy(owner.long_name, p.call_sign, sizeof(owner.long_name));
+    owner.long_name[sizeof(owner.long_name) - 1] = '\0';
+    sanitizeUtf8(owner.long_name, sizeof(owner.long_name));
    strncpy(owner.short_name, p.short_name, sizeof(owner.short_name));
+    owner.short_name[sizeof(owner.short_name) - 1] = '\0';
+    sanitizeUtf8(owner.short_name, sizeof(owner.short_name));
    owner.is_licensed = true;
    config.lora.override_duty_cycle = true;
    config.lora.tx_power = p.tx_power;
@@ -1,6 +1,7 @@
 #include "NRF52Bluetooth.h"
 #include "BLEDfuSecure.h"
 #include "BluetoothCommon.h"
+#include "HardwareRNG.h"
 #include "PowerFSM.h"
 #include "configuration.h"
 #include "main.h"
@@ -272,9 +273,13 @@ void NRF52Bluetooth::setup()
    Bluefruit.setTxPower(NRF52_BLE_TX_POWER);
 #endif
    if (config.bluetooth.mode != meshtastic_Config_BluetoothConfig_PairingMode_NO_PIN) {
-        configuredPasskey = config.bluetooth.mode == meshtastic_Config_BluetoothConfig_PairingMode_FIXED_PIN
-                                ? config.bluetooth.fixed_pin
-                                : random(100000, 999999);
+        if (config.bluetooth.mode == meshtastic_Config_BluetoothConfig_PairingMode_FIXED_PIN) {
+            configuredPasskey = config.bluetooth.fixed_pin;
+        } else {
+            uint32_t hwrand = 0;
+            HardwareRNG::fill(reinterpret_cast<uint8_t *>(&hwrand), sizeof(hwrand));
+            configuredPasskey = hwrand % 900000u + 100000u;
+        }
        auto pinString = std::to_string(configuredPasskey);
        LOG_INFO("Bluetooth pin set to '%i'", configuredPasskey);
        Bluefruit.Security.setPIN(pinString.c_str());
@@ -17,6 +17,7 @@
 #include <nrfx_wdt.h>
 #include <stdio.h>
 // #include <Adafruit_USBD_Device.h>
+#include "HardwareRNG.h"
 #include "NodeDB.h"
 #include "PowerMon.h"
 #include "error.h"
@@ -398,15 +399,14 @@ void nrf52Setup()
 #endif

    // Init random seed
-    union seedParts {
-        uint32_t seed32;
-        uint8_t seed8[4];
-    } seed;
-    nRFCrypto.begin();
-    nRFCrypto.Random.generate(seed.seed8, sizeof(seed.seed8));
-    LOG_DEBUG("Set random seed %u", seed.seed32);
-    randomSeed(seed.seed32);
-    nRFCrypto.end();
+    uint32_t seed = 0;
+    if (!HardwareRNG::seed(seed)) {
+        LOG_WARN("Hardware RNG seed unavailable, using PRNG fallback");
+        // Use a hardware timer value as a fallback seed for better entropy
+        seed = micros();
+    }
+    LOG_DEBUG("Set random seed %u", seed);
+    randomSeed(seed);

    // Set up nrfx watchdog. Do not enable the watchdog yet (we do that
    // the first time through the main loop), so that other threads can
@@ -1,4 +1,5 @@
 #include "CryptoEngine.h"
+#include "HardwareRNG.h"
 #include "PortduinoGPIO.h"
 #include "SPIChip.h"
 #include "mesh/RF95Interface.h"
@@ -233,7 +234,9 @@ void portduinoSetup()
        std::cout << "Running in simulated mode." << std::endl;
        portduino_config.MaxNodes = 200; // Default to 200 nodes
        // Set the random seed equal to TCPPort to have a different seed per instance
-        randomSeed(TCPPort);
+        uint32_t seed = TCPPort;
+        HardwareRNG::seed(seed);
+        randomSeed(seed);
        return;
    }

@@ -512,7 +515,9 @@ void portduinoSetup()
 #endif
    printf("MAC ADDRESS: %02X:%02X:%02X:%02X:%02X:%02X\n", dmac[0], dmac[1], dmac[2], dmac[3], dmac[4], dmac[5]);
    // Rather important to set this, if not running simulated.
-    randomSeed(time(NULL));
+    uint32_t seed = static_cast<uint32_t>(time(NULL));
+    HardwareRNG::seed(seed);
+    randomSeed(seed);

    std::string defaultGpioChipName = gpioChipName + std::to_string(portduino_config.lora_default_gpiochip);

@@ -645,7 +650,9 @@ void portduinoSetup()
    if (verboseEnabled && portduino_config.logoutputlevel != level_trace) {
        portduino_config.logoutputlevel = level_debug;
    }
-
+    if (portduino_config.lora_spi_dev != "") {
+        portduinoSetOptions({.realHardware = true});
+    }
    return;
 }

@@ -1,3 +1,4 @@
+#include "HardwareRNG.h"
 #include "configuration.h"
 #include "hardware/xosc.h"
 #include <hardware/clocks.h>
@@ -98,10 +99,12 @@ void getMacAddr(uint8_t *dmac)

 void rp2040Setup()
 {
-    /* Sets a random seed to make sure we get different random numbers on each boot.
-       Taken from CPU cycle counter and ROSC oscillator, so should be pretty random.
-    */
-    randomSeed(rp2040.hwrand32());
+    /* Sets a random seed to make sure we get different random numbers on each boot. */
+    uint32_t seed = 0;
+    if (!HardwareRNG::seed(seed)) {
+        seed = rp2040.hwrand32();
+    }
+    randomSeed(seed);

 #ifdef RP2040_SLOW_CLOCK
    uint f_pll_sys = frequency_count_khz(CLOCKS_FC0_SRC_VALUE_PLL_SYS_CLKSRC_PRIMARY);
@@ -81,7 +81,7 @@ extern RAK9154Sensor rak9154Sensor;
 extern XPowersLibInterface *PMU;
 #endif

-class Power : private concurrency::OSThread
+class Power : public concurrency::OSThread
 {

  public:
@@ -96,6 +96,14 @@ class Power : private concurrency::OSThread
    void setStatusHandler(meshtastic::PowerStatus *handler) { statusHandler = handler; }
    const uint16_t OCV[11] = {OCV_ARRAY};

+#ifdef ARCH_ESP32
+    int beforeLightSleep(void *unused);
+    int afterLightSleep(esp_sleep_wakeup_cause_t cause);
+#endif
+
+    void attachPowerInterrupts();
+    void detachPowerInterrupts();
+
  protected:
    meshtastic::PowerStatus *statusHandler;

@@ -120,6 +128,14 @@ class Power : private concurrency::OSThread
    // open circuit voltage lookup table
    uint8_t low_voltage_counter;
    uint32_t lastLogTime = 0;
+
+#ifdef ARCH_ESP32
+    // Get notified when lightsleep begins and ends
+    CallbackObserver<Power, void *> lsObserver = CallbackObserver<Power, void *>(this, &Power::beforeLightSleep);
+    CallbackObserver<Power, esp_sleep_wakeup_cause_t> lsEndObserver =
+        CallbackObserver<Power, esp_sleep_wakeup_cause_t>(this, &Power::afterLightSleep);
+#endif
+
 #ifdef DEBUG_HEAP
    uint32_t lastheap;
 #endif
@@ -497,13 +497,12 @@ esp_sleep_wakeup_cause_t doLightSleep(uint64_t sleepMsec) // FIXME, use a more r
    esp_sleep_wakeup_cause_t cause = esp_sleep_get_wakeup_cause();
    notifyLightSleepEnd.notifyObservers(cause); // Button interrupts are reattached here

-#ifdef BUTTON_PIN
    if (cause == ESP_SLEEP_WAKEUP_GPIO) {
-        LOG_INFO("Exit light sleep gpio: btn=%d",
-                 !digitalRead(config.device.button_gpio ? config.device.button_gpio : BUTTON_PIN));
-    } else
-#endif
-    {
+        LOG_INFO("Exit light sleep gpio");
+        // If we woke because of a GPIO, it's possible power needs to run to handle.
+        power->setIntervalFromNow(0);
+        runASAP = true;
+    } else {
        LOG_INFO("Exit light sleep cause: %d", cause);
    }

@@ -0,0 +1,322 @@
+# Native Unit Tests — Authoring Guide
+
+This directory contains C++ unit tests that run on the host machine via PlatformIO's native environment. Tests use the [Unity](http://www.throwtheswitch.org/unity) framework.
+
+## Running Tests
+
+```bash
+# All test suites
+pio test -e native
+
+# Single suite
+pio test -e native -f test_your_module
+
+# Verbose (shows build errors in detail)
+pio test -e native -f test_your_module -vvv
+```
+
+### Helper Scripts (Useful Shortcuts)
+
+These wrappers are handy when local host dependencies are missing or when you want repeatable commands.
+
+```bash
+# Run native tests in Docker (recommended on macOS / non-Linux hosts)
+./bin/test-native-docker.sh
+
+# Pass normal PlatformIO test args through to Dockerized test run
+./bin/test-native-docker.sh -f test_your_module
+
+# Force Docker image rebuild (after dependency changes)
+./bin/test-native-docker.sh --rebuild
+
+# Run simulator integration check (build native first)
+pio run -e native && ./bin/test-simulator.sh
+
+# Build and run meshtasticd natively
+./bin/native-run.sh
+
+# Build and run under gdbserver on localhost:2345
+./bin/native-gdbserver.sh
+
+# Build native release artifact into ./release/
+./bin/build-native.sh native
+```
+
+Notes:
+
+- The repository script name is `./bin/test-simulator.sh` (there is no `test-native-simulator.sh`).
+- `./bin/test-native-docker.sh` is the closest match to CI behavior for native tests and avoids host package setup.
+
+### System Dependencies (Ubuntu/Debian)
+
+The native build requires several system libraries. Install them all at once:
+
+```bash
+sudo apt-get install -y \
+  libbluetooth-dev libgpiod-dev libyaml-cpp-dev openssl libssl-dev \
+  libulfius-dev liborcania-dev libusb-1.0-0-dev libi2c-dev libuv1-dev
+```
+
+See `.github/actions/setup-native/action.yml` for the canonical list.
+
+## Creating a New Test Suite
+
+### 1. Directory Structure
+
+```text
+test/test_your_module/test_main.cpp
+```
+
+One file per suite. No per-test `platformio.ini` is needed — tests build under the `[env:native]` environment defined in the root `platformio.ini`.
+
+### 2. File Skeleton
+
+```cpp
+#include "MeshTypes.h"      // Include BEFORE TestUtil.h (provides NodeNum, etc.)
+#include "TestUtil.h"        // initializeTestEnvironment(), testDelay()
+#include <unity.h>
+
+#if YOUR_FEATURE_GUARD       // Same #if guard as the module under test
+
+#include "FSCommon.h"
+#include "gps/RTC.h"
+#include "mesh/NodeDB.h"
+#include "modules/YourModule.h"
+#include <cstdio>
+#include <cstring>
+#include <memory>
+
+// --- Test output helpers ---
+// Unity swallows printf/stdout. Only TEST_MESSAGE() output appears in results.
+#define MSG_BUF_LEN 200
+#define TEST_MSG_FMT(fmt, ...) do { \
+    char _buf[MSG_BUF_LEN]; \
+    snprintf(_buf, sizeof(_buf), fmt, __VA_ARGS__); \
+    TEST_MESSAGE(_buf); \
+} while(0)
+
+// --- Tests ---
+
+void test_example()
+{
+    TEST_MESSAGE("=== Example test ===");
+    TEST_ASSERT_TRUE(true);
+}
+
+// --- Unity lifecycle ---
+
+void setUp(void) { /* runs before every test */ }
+void tearDown(void) { /* runs after every test */ }
+
+void setup()
+{
+    initializeTestEnvironment();   // MUST call — sets up RTC, OSThread, console
+    UNITY_BEGIN();
+    RUN_TEST(test_example);
+    exit(UNITY_END());             // exit() required — Unity runner expects it
+}
+
+void loop() {}
+
+#else // !YOUR_FEATURE_GUARD
+
+void setUp(void) {}
+void tearDown(void) {}
+
+void setup()
+{
+    initializeTestEnvironment();
+    UNITY_BEGIN();
+    exit(UNITY_END());
+}
+
+void loop() {}
+
+#endif
+```
+
+### 3. Feature Guard
+
+Wrap the entire test body in the same `#if` guard the module uses (e.g. `#if HAS_VARIABLE_HOPS`, `#if !MESHTASTIC_EXCLUDE_GPS`). When the feature is disabled, the `#else` branch produces an empty passing suite.
+
+## Common Patterns
+
+### MockNodeDB
+
+Most module tests need to inject nodes with controlled hop distances and ages:
+
+```cpp
+class MockNodeDB : public NodeDB
+{
+  public:
+    void clearTestNodes()
+    {
+        testNodes.clear();
+        numMeshNodes = 0;
+    }
+
+    void addTestNode(NodeNum num, uint8_t hopsAway, bool hasHops,
+                     uint32_t ageSecs, bool viaMqtt = false)
+    {
+        meshtastic_NodeInfoLite node = meshtastic_NodeInfoLite_init_zero;
+        node.num = num;
+        node.has_hops_away = hasHops;
+        node.hops_away = hopsAway;
+        node.via_mqtt = viaMqtt;
+        node.last_heard = getTime() - ageSecs;
+        testNodes.push_back(node);
+        meshNodes = &testNodes;
+        numMeshNodes = testNodes.size();
+    }
+
+    std::vector<meshtastic_NodeInfoLite> testNodes;
+};
+
+static MockNodeDB *mockNodeDB = nullptr;
+```
+
+Set `nodeDB = mockNodeDB;` in `setUp()`.
+
+### Test Shim (Exposing Protected/Private Members)
+
+Subclass the module under test to make protected methods callable and private members writable:
+
+```cpp
+class YourModuleTestShim : public YourModule
+{
+  public:
+    // Expose protected methods
+    using YourModule::runOnce;
+    using YourModule::someProtectedMethod;
+
+    // Access private members via friend (see below)
+    void setPrivateField(int x) { privateField = x; }
+};
+```
+
+In the module header, grant friend access under the `UNIT_TEST` define (set automatically by PlatformIO's test framework):
+
+```cpp
+// In YourModule.h, inside the class body:
+#ifdef UNIT_TEST
+    friend class YourModuleTestShim;
+#endif
+```
+
+### Global Singleton Lifecycle
+
+Most modules use a global pointer (`extern YourModule *yourModule;`). Manage it carefully:
+
+```cpp
+void setUp(void) {
+    // ... setup ...
+}
+
+void tearDown(void) {
+    yourModule = nullptr;   // prevent dangling pointer between tests
+}
+
+void test_something() {
+    auto shim = std::unique_ptr<YourModuleTestShim>(new YourModuleTestShim());
+    yourModule = shim.get();
+    // ... test ...
+    yourModule = nullptr;
+}
+```
+
+## Pitfalls and How to Avoid Them
+
+### 1. Persisted Filesystem State Leaks Between Tests
+
+Modules that save state to `/prefs/*.bin` will have that state loaded by the next test's constructor via `loadState()`. This causes values from one test (e.g. rolling averages from a megamesh scenario) to bleed into unrelated tests.
+
+**Fix:** Delete state files at the start of `setUp()`:
+
+```cpp
+void setUp(void) {
+    // ...
+#ifdef FSCom
+    FSCom.remove("/prefs/your_module.bin");
+#endif
+}
+```
+
+### 2. File-Scope Mutable Globals Persist Across Tests
+
+Variables like `static uint8_t someDenominator = 8;` in the module `.cpp` file retain mutations from previous tests. This is distinct from member variables — it affects all instances.
+
+**Fix:** Add a `static void resetGlobal()` method to the module and call it in `setUp()`.
+
+### 3. Randomness Breaks Determinism
+
+If the module uses `rand()` for jitter or similar, test results become non-reproducible.
+
+**Fix:** Add a static enable/disable flag:
+
+```cpp
+// Module header:
+static void setJitter(bool enabled) { s_jitterEnabled = enabled; }
+
+// Test setUp:
+YourModule::setJitter(false);
+
+// Test tearDown:
+YourModule::setJitter(true);
+```
+
+### 4. Time-Dependent Logic Produces Zeros
+
+Rolling averages weighted by `elapsedMs / ONE_HOUR_MS` collapse to zero when tests complete in microseconds. Sample windows, EMA alphas, and interval-based accumulators all suffer from this.
+
+**Fix:** Expose the timestamp via friend access and simulate realistic elapsed time:
+
+```cpp
+// In test shim:
+void setWindowStartMs(uint32_t ms) { windowStartMs = ms; }
+
+// In test:
+shim.setWindowStartMs(millis() - 3600000UL);  // pretend 1 hour elapsed
+```
+
+### 5. Capacity Limits Cause Cascading Failures
+
+Fixed-size data structures (hash sets, ring buffers) overflow when tests inject more data than fits. This triggers early flushes with near-zero time fractions, compounding the time-dependent-zeros problem.
+
+**Fix:** Simulate multiple realistic time windows rather than one massive burst. Let adaptive mechanisms (if any) self-tune over several rolls.
+
+## setUp/tearDown Checklist
+
+- [ ] Create and clear MockNodeDB (if needed)
+- [ ] Zero global configs: `config`, `moduleConfig`, `myNodeInfo`
+- [ ] Set `nodeDB = mockNodeDB`
+- [ ] Delete persisted state files (`FSCom.remove(...)`)
+- [ ] Reset file-scope mutable globals
+- [ ] Disable randomness/jitter flags
+- [ ] In `tearDown`: null the global singleton pointer, restore flags
+
+## Test Organization
+
+A well-structured test suite follows this pattern:
+
+1. **Topology/scenario builders** — static helper functions that set up specific test conditions
+2. **Injection helpers** — simulate realistic traffic, time, or event patterns
+3. **Scenario tests** — each builds a scenario, runs the module, asserts on outcomes
+4. **Lifecycle tests** — state persistence, startup from blank, restart recovery
+5. **Summary test** (optional) — emits a scenario table into the log for quick CI review
+
+## Existing Test Suites
+
+| Suite                        | Module Under Test             |
+| ---------------------------- | ----------------------------- |
+| `test_crypto`                | CryptoEngine                  |
+| `test_mqtt`                  | MQTT integration              |
+| `test_radio`                 | Radio interface               |
+| `test_mesh_module`           | Module framework              |
+| `test_meshpacket_serializer` | Packet serialization          |
+| `test_transmit_history`      | Retransmission tracking       |
+| `test_atak`                  | ATAK integration              |
+| `test_default`               | Default configuration helpers |
+| `test_http_content_handler`  | HTTP handling                 |
+| `test_serial`                | Serial communication          |
+| `test_hop_scaling`           | Hop scaling algorithm         |
+| `test_traffic_management`    | Traffic management            |
@@ -0,0 +1,195 @@
+#include "meshUtils.h"
+#include <cstring>
+#include <unity.h>
+
+void setUp(void) {}
+void tearDown(void) {}
+
+// --- Valid UTF-8 should pass through unchanged ---
+
+void test_ascii_unchanged()
+{
+    char buf[32] = "Hello World";
+    TEST_ASSERT_FALSE(sanitizeUtf8(buf, sizeof(buf)));
+    TEST_ASSERT_EQUAL_STRING("Hello World", buf);
+}
+
+void test_valid_2byte_unchanged()
+{
+    // "café" — é is C3 A9
+    char buf[16] = "caf\xC3\xA9";
+    TEST_ASSERT_FALSE(sanitizeUtf8(buf, sizeof(buf)));
+    TEST_ASSERT_EQUAL_STRING("caf\xC3\xA9", buf);
+}
+
+void test_valid_3byte_unchanged()
+{
+    // "€" is E2 82 AC
+    char buf[16] = "\xE2\x82\xAC";
+    TEST_ASSERT_FALSE(sanitizeUtf8(buf, sizeof(buf)));
+    TEST_ASSERT_EQUAL_STRING("\xE2\x82\xAC", buf);
+}
+
+void test_valid_4byte_emoji_unchanged()
+{
+    // 🌙 is F0 9F 8C 99
+    char buf[16] = "\xF0\x9F\x8C\x99";
+    TEST_ASSERT_FALSE(sanitizeUtf8(buf, sizeof(buf)));
+    TEST_ASSERT_EQUAL_STRING("\xF0\x9F\x8C\x99", buf);
+}
+
+void test_valid_mixed_unchanged()
+{
+    // "Hi 🌙!" — mix of ASCII and 4-byte
+    char buf[16] = "Hi \xF0\x9F\x8C\x99!";
+    TEST_ASSERT_FALSE(sanitizeUtf8(buf, sizeof(buf)));
+    TEST_ASSERT_EQUAL_STRING("Hi \xF0\x9F\x8C\x99!", buf);
+}
+
+void test_empty_string()
+{
+    char buf[8] = "";
+    TEST_ASSERT_FALSE(sanitizeUtf8(buf, sizeof(buf)));
+    TEST_ASSERT_EQUAL_STRING("", buf);
+}
+
+// --- Invalid sequences observed in the wild ---
+
+void test_truncated_4byte_at_end()
+{
+    // Name with valid emoji 🌙 followed by a truncated 4-byte sequence + ASCII
+    char buf[32] = "Lunar Tower \xF0\x9F\x8C\x99\xF0\x9F\x97"
+                   "4";
+    TEST_ASSERT_TRUE(sanitizeUtf8(buf, sizeof(buf)));
+    // The 🌙 should be preserved; F0 9F 97 is an incomplete 4-byte sequence,
+    // '4' (0x34) is not a valid continuation byte
+    TEST_ASSERT_EQUAL_STRING("Lunar Tower \xF0\x9F\x8C\x99???4", buf);
+}
+
+void test_lone_lead_bytes_without_continuations()
+{
+    // Mixed ASCII with stray multibyte lead bytes (E1, F3) lacking proper continuations
+    char buf[32] = "Mesht\xE1\xF3tic 37e2";
+    TEST_ASSERT_TRUE(sanitizeUtf8(buf, sizeof(buf)));
+    // E1 expects 2 continuation bytes, but F3 is not a continuation → E1 replaced
+    // F3 expects 3 continuation bytes, 't','i','c' are not continuations → F3 replaced
+    TEST_ASSERT_EQUAL_STRING("Mesht??tic 37e2", buf);
+}
+
+// --- Edge cases ---
+
+void test_bare_continuation_byte()
+{
+    // 0x80 alone is invalid (continuation byte with no lead)
+    char buf[8] = "\x80";
+    TEST_ASSERT_TRUE(sanitizeUtf8(buf, sizeof(buf)));
+    TEST_ASSERT_EQUAL_STRING("?", buf);
+}
+
+void test_overlong_2byte()
+{
+    // C0 AF is an overlong encoding of U+002F '/'
+    char buf[8] = "\xC0\xAF";
+    TEST_ASSERT_TRUE(sanitizeUtf8(buf, sizeof(buf)));
+    // C0 is a 2-byte lead, AF is valid continuation, but codepoint 0x2F < 0x80 → overlong
+    // C0 replaced, AF (now bare continuation) also replaced
+    TEST_ASSERT_EQUAL_STRING("??", buf);
+}
+
+void test_surrogate_half()
+{
+    // ED A0 80 encodes U+D800 (surrogate half — invalid in UTF-8)
+    char buf[8] = "\xED\xA0\x80";
+    TEST_ASSERT_TRUE(sanitizeUtf8(buf, sizeof(buf)));
+    TEST_ASSERT_EQUAL_STRING("???", buf);
+}
+
+void test_5byte_sequence_rejected()
+{
+    // F8 80 80 80 80 — 5-byte sequence, not valid UTF-8
+    char buf[8] = "\xF8\x80\x80\x80\x80";
+    TEST_ASSERT_TRUE(sanitizeUtf8(buf, sizeof(buf)));
+    // F8 is invalid lead (>= 0xF8), each 0x80 is bare continuation
+    TEST_ASSERT_EQUAL_STRING("?????", buf);
+}
+
+void test_truncated_3byte_at_buffer_end()
+{
+    // Buffer is exactly 4 bytes: E2 82 then forced null at [3]
+    char buf[4];
+    buf[0] = '\xE2';
+    buf[1] = '\x82';
+    buf[2] = '\0'; // String ends before the 3-byte sequence completes
+    buf[3] = '\0';
+    TEST_ASSERT_TRUE(sanitizeUtf8(buf, sizeof(buf)));
+    TEST_ASSERT_EQUAL_STRING("??", buf);
+}
+
+void test_null_termination_enforced()
+{
+    // Fill buffer completely with no null terminator
+    char buf[5];
+    memset(buf, 'A', sizeof(buf));
+    TEST_ASSERT_TRUE(sanitizeUtf8(buf, sizeof(buf)));
+    // Should be null-terminated and content preserved (all ASCII)
+    TEST_ASSERT_EQUAL_STRING("AAAA", buf);
+}
+
+void test_null_buffer()
+{
+    TEST_ASSERT_FALSE(sanitizeUtf8(nullptr, 10));
+}
+
+void test_zero_size()
+{
+    char buf[4] = "Hi";
+    TEST_ASSERT_FALSE(sanitizeUtf8(buf, 0));
+    // Buffer should be untouched
+    TEST_ASSERT_EQUAL_STRING("Hi", buf);
+}
+
+void test_valid_max_codepoint()
+{
+    // U+10FFFF = F4 8F BF BF (maximum valid Unicode codepoint)
+    char buf[8] = "\xF4\x8F\xBF\xBF";
+    TEST_ASSERT_FALSE(sanitizeUtf8(buf, sizeof(buf)));
+    TEST_ASSERT_EQUAL_STRING("\xF4\x8F\xBF\xBF", buf);
+}
+
+void test_above_max_codepoint()
+{
+    // U+110000 = F4 90 80 80 (just above maximum valid Unicode)
+    char buf[8] = "\xF4\x90\x80\x80";
+    TEST_ASSERT_TRUE(sanitizeUtf8(buf, sizeof(buf)));
+}
+
+int main(int argc, char **argv)
+{
+    UNITY_BEGIN();
+
+    // Valid UTF-8 passthrough
+    RUN_TEST(test_ascii_unchanged);
+    RUN_TEST(test_valid_2byte_unchanged);
+    RUN_TEST(test_valid_3byte_unchanged);
+    RUN_TEST(test_valid_4byte_emoji_unchanged);
+    RUN_TEST(test_valid_mixed_unchanged);
+    RUN_TEST(test_empty_string);
+
+    // Invalid sequences observed in the wild
+    RUN_TEST(test_truncated_4byte_at_end);
+    RUN_TEST(test_lone_lead_bytes_without_continuations);
+
+    // Edge cases
+    RUN_TEST(test_bare_continuation_byte);
+    RUN_TEST(test_overlong_2byte);
+    RUN_TEST(test_surrogate_half);
+    RUN_TEST(test_5byte_sequence_rejected);
+    RUN_TEST(test_truncated_3byte_at_buffer_end);
+    RUN_TEST(test_null_termination_enforced);
+    RUN_TEST(test_null_buffer);
+    RUN_TEST(test_zero_size);
+    RUN_TEST(test_valid_max_codepoint);
+    RUN_TEST(test_above_max_codepoint);
+
+    return UNITY_END();
+}
@@ -8,7 +8,6 @@ build_flags =
  -I variants/esp32/chatter2
  -DMESHTASTIC_EXCLUDE_WEBSERVER=1
  -DMESHTASTIC_EXCLUDE_PAXCOUNTER=1
-  -ULED_BUILTIN
  
 lib_deps =
  ${esp32_base.lib_deps}
@@ -10,7 +10,6 @@ build_flags =
  -D EBYTE_E22
  -D EBYTE_E22_900M30S ; Assume Tx power curve is identical to 900M30S as there is no documentation
  -I variants/esp32/diy/9m2ibr_aprs_lora_tracker
-  -ULED_BUILTIN
 build_src_filter =
  ${esp32_base.build_src_filter}
  +<../variants/esp32/diy/9m2ibr_aprs_lora_tracker>
@@ -14,4 +14,3 @@ build_flags =
  ${esp32_base.build_flags}
  -D DIY_V1
  -I variants/esp32/diy/hydra
-  -ULED_BUILTIN
@@ -17,4 +17,3 @@ build_flags =
  -D DIY_V1
  -D EBYTE_E22
  -I variants/esp32/diy/v1
-  -ULED_BUILTIN
@@ -14,4 +14,3 @@ build_flags =
  ${esp32_base.build_flags}
  -D HELTEC_V2_1
  -I variants/esp32/heltec_v2.1
-  -ULED_BUILTIN
@@ -14,4 +14,3 @@ build_flags =
  ${esp32_base.build_flags}
  -D HELTEC_V2_0
  -I variants/esp32/heltec_v2
-  -ULED_BUILTIN
@@ -19,7 +19,7 @@ build_flags =
 lib_deps = 
  ${esp32_base.lib_deps}
  # renovate: datasource=custom.pio depName=GxEPD2 packageName=zinggjm/library/GxEPD2
-  zinggjm/GxEPD2@1.6.8
+  zinggjm/GxEPD2@1.6.9
  # renovate: datasource=custom.pio depName=SensorLib packageName=lewisxhe/library/SensorLib
  lewisxhe/SensorLib@0.3.4
 lib_ignore =
@@ -14,4 +14,3 @@ build_flags =
  ${esp32_base.build_flags}
  -D NANO_G1_EXPLORER
  -I variants/esp32/nano-g1-explorer
-  -ULED_BUILTIN
@@ -14,4 +14,3 @@ build_flags =
  ${esp32_base.build_flags}
  -D NANO_G1
  -I variants/esp32/nano-g1
-  -ULED_BUILTIN
@@ -9,7 +9,6 @@ build_flags =
  -DHAS_STK8XXX=1
  -O2
  -I variants/esp32/radiomaster_900_bandit
-  -ULED_BUILTIN
 board_build.f_cpu = 240000000L
 upload_protocol = esptool
 lib_deps =
@@ -13,6 +13,5 @@ build_flags =
  -DCONFIG_DISABLE_HAL_LOCKS=1
  -O2
  -I variants/esp32/radiomaster_900_bandit_nano
-  -ULED_BUILTIN
 board_build.f_cpu = 240000000L
 upload_protocol = esptool
@@ -16,6 +16,5 @@ build_flags =
  -DCONFIG_DISABLE_HAL_LOCKS=1
  -O2
  -I variants/esp32/radiomaster_900_bandit_nano
-  -ULED_BUILTIN
 board_build.f_cpu = 240000000L
 upload_protocol = esptool
@@ -14,4 +14,3 @@ build_flags =
  ${esp32_base.build_flags}
  -D STATION_G1
  -I variants/esp32/station-g1
-  -ULED_BUILTIN
@@ -16,7 +16,6 @@ board_check = true
 build_flags = ${esp32_base.build_flags}
  -D TBEAM_V10
  -I variants/esp32/tbeam
-  -ULED_BUILTIN
 upload_speed = 921600

 [env:tbeam-displayshield]
@@ -13,5 +13,4 @@ build_flags =
  ${esp32_base.build_flags}
  -D TLORA_V1
  -I variants/esp32/tlora_v1
-  -ULED_BUILTIN
 upload_speed = 115200
@@ -12,7 +12,7 @@ extends = esp32_base
 board = ttgo-lora32-v21
 board_check = true
 build_flags = 
-  ${esp32_base.build_flags} -D TLORA_V2_1_16 -I variants/esp32/tlora_v2_1_16 -ULED_BUILTIN
+  ${esp32_base.build_flags} -D TLORA_V2_1_16 -I variants/esp32/tlora_v2_1_16
 upload_speed = 115200

 [env:sugarcube]
@@ -7,5 +7,4 @@ build_flags =
  -D TLORA_V2_1_16
  -I variants/esp32/tlora_v2_1_16
  -D LORA_TCXO_GPIO=33
-  -ULED_BUILTIN
 upload_speed = 115200
@@ -7,4 +7,3 @@ build_flags =
  -I variants/esp32/tlora_v2_1_16
  -D LORA_TCXO_GPIO=12
  -D BUTTON_PIN=0
-  -ULED_BUILTIN
@@ -8,4 +8,3 @@ build_flags =
  -I variants/esp32c6/tlora_c6
  -DARDUINO_USB_CDC_ON_BOOT=1
  -DARDUINO_USB_MODE=1
-  -ULED_BUILTIN
@@ -11,7 +11,7 @@ upload_speed = 921600
 lib_deps =
  ${esp32s3_base.lib_deps}
  # renovate: datasource=custom.pio depName=GxEPD2 packageName=zinggjm/library/GxEPD2
-  zinggjm/GxEPD2@1.6.8
+  zinggjm/GxEPD2@1.6.9
 build_unflags =
  ${esp32s3_base.build_unflags}
  -DARDUINO_USB_MODE=1
@@ -23,4 +23,4 @@ build_flags = ${esp32s3_base.build_flags}

 lib_deps = ${esp32s3_base.lib_deps}
  # renovate: datasource=custom.pio depName=GxEPD2 packageName=zinggjm/library/GxEPD2
-  zinggjm/GxEPD2@1.6.8
+  zinggjm/GxEPD2@1.6.9
@@ -6,5 +6,4 @@ board_build.partitions = default_8MB.csv
 build_flags = 
  ${esp32s3_base.build_flags} -I variants/esp32s3/heltec_capsule_sensor_v3
  -D HELTEC_CAPSULE_SENSOR_V3
-  -ULED_BUILTIN
  ;-D DEBUG_DISABLED ; uncomment this line to disable DEBUG output
@@ -7,4 +7,3 @@ build_flags =
  ${esp32s3_base.build_flags}
  -I variants/esp32s3/heltec_sensor_hub
  -D HELTEC_SENSOR_HUB
-  -ULED_BUILTIN
@@ -18,4 +18,3 @@ build_flags =
  ${esp32s3_base.build_flags}
  -D HELTEC_V3
  -I variants/esp32s3/heltec_v3
-  -ULED_BUILTIN
@@ -8,7 +8,6 @@ build_flags =
  -D HELTEC_V4
  -D HAS_LORA_FEM=1
  -I variants/esp32s3/heltec_v4
-  -ULED_BUILTIN


 [env:heltec-v4]
@@ -17,4 +17,3 @@ build_flags =
  ${esp32s3_base.build_flags}
  -D HELTEC_WSL_V3
  -I variants/esp32s3/heltec_wsl_v3
-  -ULED_BUILTIN
@@ -30,7 +30,7 @@ build_flags =
 lib_deps =
  ${esp32s3_base.lib_deps}
  # renovate: datasource=custom.pio depName=GxEPD2 packageName=zinggjm/library/GxEPD2
-  zinggjm/GxEPD2@1.6.8
+  zinggjm/GxEPD2@1.6.9
  # renovate: datasource=git-refs depName=CSE_Touch packageName=https://github.com/CIRCUITSTATE/CSE_Touch gitBranch=main
  https://github.com/CIRCUITSTATE/CSE_Touch/archive/b44f23b6f870b848f1fbe453c190879bc6cfaafa.zip
  # renovate: datasource=github-tags depName=CSE_CST328 packageName=CIRCUITSTATE/CSE_CST328
@@ -34,7 +34,7 @@ build_flags =
 lib_deps =
  ${esp32s3_base.lib_deps}
  # renovate: datasource=custom.pio depName=GxEPD2 packageName=zinggjm/library/GxEPD2
-  zinggjm/GxEPD2@1.6.8
+  zinggjm/GxEPD2@1.6.9
  # renovate: datasource=git-refs depName=CSE_Touch packageName=https://github.com/CIRCUITSTATE/CSE_Touch gitBranch=main
  https://github.com/CIRCUITSTATE/CSE_Touch/archive/b44f23b6f870b848f1fbe453c190879bc6cfaafa.zip
  # renovate: datasource=github-tags depName=CSE_CST328 packageName=CIRCUITSTATE/CSE_CST328
@@ -39,7 +39,7 @@
 #define DAC_I2S_BCK 48
 #define DAC_I2S_WS 15
 #define DAC_I2S_DOUT 46
-#define DAC_I2S_MCLK 0
+#define DAC_I2S_MCLK -1

 #define HAS_AXP2101

@@ -6,26 +6,27 @@ NicheGraphics attempts a different approach:
 Per-device config takes place in this setupNicheGraphics() method
 (And a small amount in platformio.ini)

-This file sets up InkHUD for Heltec VM-E290.
-Different NicheGraphics UIs and different hardware variants will each have their own setup procedure.
+This file sets up InkHUD for the LilyGo T5-E-Paper-S3-Pro.
+
+The board uses a 4.7" ED047TC1 parallel e-paper display (960×540, 8-bit parallel interface).
+This is driven via the FastEPD library through the NicheGraphics ED047TC1 driver adapter.

 */

 #pragma once

 #include "configuration.h"
-#include "mesh/MeshModule.h"

 #ifdef MESHTASTIC_INCLUDE_NICHE_GRAPHICS

 // InkHUD-specific components
 // ---------------------------
-// #include "graphics/niche/InkHUD/InkHUD.h"
-#include "graphics/niche/InkHUD/WindowManager.h"
+#include "graphics/niche/InkHUD/InkHUD.h"

 // Applets
 #include "graphics/niche/InkHUD/Applets/User/AllMessage/AllMessageApplet.h"
 #include "graphics/niche/InkHUD/Applets/User/DM/DMApplet.h"
+#include "graphics/niche/InkHUD/Applets/User/FavoritesMap/FavoritesMapApplet.h"
 #include "graphics/niche/InkHUD/Applets/User/Heard/HeardApplet.h"
 #include "graphics/niche/InkHUD/Applets/User/Positions/PositionsApplet.h"
 #include "graphics/niche/InkHUD/Applets/User/RecentsList/RecentsListApplet.h"
@@ -34,26 +35,20 @@ Different NicheGraphics UIs and different hardware variants will each have their
 // Shared NicheGraphics components
 // --------------------------------
 #include "graphics/niche/Drivers/Backlight/LatchingBacklight.h"
-#include "graphics/niche/Drivers/EInk/DEPG0290BNS800.h"
+#include "graphics/niche/Drivers/EInk/ED047TC1.h"
 #include "graphics/niche/Inputs/TwoButton.h"

 void setupNicheGraphics()
 {
    using namespace NicheGraphics;

-    // SPI
-    // -----------------------------
-
-    // Display is connected to HSPI
-    SPIClass *hspi = new SPIClass(HSPI);
-    hspi->begin(PIN_EINK_SCLK, -1, PIN_EINK_MOSI, PIN_EINK_CS);
-
    // E-Ink Driver
    // -----------------------------
+    // The ED047TC1 is a parallel display — no SPI bus setup needed.
+    // begin() args are part of the EInk interface but are ignored for parallel displays.

-    // Use E-Ink driver
-    Drivers::EInk *driver = new Drivers::DEPG0290BNS800;
-    driver->begin(hspi, PIN_EINK_DC, PIN_EINK_CS, PIN_EINK_BUSY);
+    Drivers::EInk *driver = new Drivers::ED047TC1;
+    driver->begin(nullptr, 0, 0, 0);

    // InkHUD
    // ----------------------------
@@ -67,57 +62,57 @@ void setupNicheGraphics()
    // Set how unhealthy additional FAST updates beyond this number are
    inkhud->setDisplayResilience(7, 1.5);

-    // Prepare fonts
-    InkHUD::Applet::fontLarge = FREESANS_9PT_WIN1252;
-    InkHUD::Applet::fontSmall = FREESANS_6PT_WIN1252;
+    // Prepare fonts — use larger sizes to suit the 4.7" screen at ~234 DPI
+    InkHUD::Applet::fontLarge = FREESANS_24PT_WIN1253;
+    InkHUD::Applet::fontMedium = FREESANS_18PT_WIN1253;
+    InkHUD::Applet::fontSmall = FREESANS_12PT_WIN1253;

-    // Init settings, and customize defaults
+    // Customize default settings
    inkhud->persistence->settings.userTiles.maxCount = 2; // How many tiles can the display handle?
-    inkhud->persistence->settings.rotation = 1;           // 90 degrees clockwise
+    inkhud->persistence->settings.rotation = 3;           // 270 degrees clockwise
    inkhud->persistence->settings.userTiles.count = 1;    // One tile only by default, keep things simple for new users
-    inkhud->persistence->settings.optionalMenuItems.nextTile = false;  // Behavior handled by aux button instead
-    inkhud->persistence->settings.optionalFeatures.batteryIcon = true; // Device definitely has a battery
+    inkhud->persistence->settings.optionalFeatures.batteryIcon = true;
+    inkhud->persistence->settings.optionalMenuItems.backlight = true;

-    // Setup backlight
-    // Note: AUX button behavior configured further down
-    Drivers::LatchingBacklight *backlight = Drivers::LatchingBacklight::getInstance();
-    backlight->setPin(PIN_EINK_EN);
+    // Alignment must cancel rotation for visual-frame touch input: (rotation + alignment) % 4 == 0.
+    inkhud->persistence->settings.joystick.alignment = (4 - inkhud->persistence->settings.rotation) % 4;

    // Pick applets
    // Note: order of applets determines priority of "auto-show" feature
-    // Optional arguments for defaults:
-    // - is activated?
-    // - is autoshown?
-    // - is foreground on a specific tile (index)?
-    inkhud->addApplet("All Messages", new InkHUD::AllMessageApplet, true, true); // Activated, autoshown
-    inkhud->addApplet("DMs", new InkHUD::DMApplet);
-    inkhud->addApplet("Channel 0", new InkHUD::ThreadedMessageApplet(0));
-    inkhud->addApplet("Channel 1", new InkHUD::ThreadedMessageApplet(1));
-    inkhud->addApplet("Positions", new InkHUD::PositionsApplet, true); // Activated
-    inkhud->addApplet("Recents List", new InkHUD::RecentsListApplet);
+    inkhud->addApplet("All Messages", new InkHUD::AllMessageApplet, false, false);      // Not Active, not autoshown
+    inkhud->addApplet("DMs", new InkHUD::DMApplet, true, true);                         // Activated, Autoshown
+    inkhud->addApplet("Channel 0", new InkHUD::ThreadedMessageApplet(0), true, true);   // Activated, Autoshown
+    inkhud->addApplet("Channel 1", new InkHUD::ThreadedMessageApplet(1), false, false); // Not Active, not autoshown
+    inkhud->addApplet("Positions", new InkHUD::PositionsApplet, true, false);           // Activated, not autoshown
+    inkhud->addApplet("Recents List", new InkHUD::RecentsListApplet, true, false);      // Activated, not autoshown
    inkhud->addApplet("Heard", new InkHUD::HeardApplet, true, false, 0); // Activated, not autoshown, default on tile 0
-    // inkhud->addApplet("Basic", new InkHUD::BasicExampleApplet);
-    // inkhud->addApplet("NewMsg", new InkHUD::NewMsgExampleApplet);
+    inkhud->addApplet("Favorites Map", new InkHUD::FavoritesMapApplet, false, false); // Not Active, not autoshown
+
+    // Backlight
+    // ----------------------------
+    Drivers::LatchingBacklight *backlight = Drivers::LatchingBacklight::getInstance();
+    backlight->setPin(BOARD_BL_EN); // GPIO11 on V2

    // Start running InkHUD
    inkhud->begin();

+    // Touch navigation requires joystick mode — enforce post-begin so flash cannot override.
+    inkhud->persistence->settings.joystick.enabled = true;
+    inkhud->persistence->settings.joystick.aligned = true;
+
    // Buttons
    // --------------------------

    Inputs::TwoButton *buttons = Inputs::TwoButton::getInstance(); // A shared NicheGraphics component

-    // Setup the main user button (0)
+    // Setup the main user button (boot button, GPIO 0)
    buttons->setWiring(0, BUTTON_PIN);
-    buttons->setHandlerShortPress(0, []() { InkHUD::InkHUD::getInstance()->shortpress(); });
-    buttons->setHandlerLongPress(0, []() { InkHUD::InkHUD::getInstance()->longpress(); });
+    buttons->setHandlerShortPress(0, [inkhud]() { inkhud->shortpress(); });
+    buttons->setHandlerLongPress(0, [inkhud]() { inkhud->longpress(); });

-    // Setup the aux button (1)
-    // Bonus feature of VME290
-    buttons->setWiring(1, BUTTON_PIN_SECONDARY);
-    buttons->setHandlerShortPress(1, []() { InkHUD::InkHUD::getInstance()->nextTile(); });
+    // No dedicated aux button on this board

    buttons->start();
 }

-#endif
+#endif
@@ -2,21 +2,123 @@

 #ifdef T5_S3_EPAPER_PRO

+#include "Observer.h"
 #include "TouchDrvGT911.hpp"
 #include "Wire.h"
+#include "input/InputBroker.h"
 #include "input/TouchScreenImpl1.h"
+#include "sleep.h"
+
+#ifdef MESHTASTIC_INCLUDE_NICHE_GRAPHICS
+#include "graphics/niche/InkHUD/InkHUD.h"
+#include "graphics/niche/InkHUD/SystemApplet.h"
+
+// Bridges touch events from TouchScreenImpl1 directly into InkHUD,
+// bypassing the InputBroker (which is excluded in InkHUD builds).
+// Routing mirrors the mini-epaper-s3 two-way rocker pattern:
+//   - Nav left/right: prevApplet/nextApplet when idle, navUp/Down when a system applet has focus (e.g. menu)
+//   - Nav up/down:    navUp/navDown always (menu scroll)
+//   - Tap:            shortpress (cycle applets / confirm in menu)
+//   - Long press:     longpress (open menu / back)
+class TouchInkHUDBridge : public Observer<const InputEvent *>
+{
+    int onNotify(const InputEvent *e) override
+    {
+        auto *inkhud = NicheGraphics::InkHUD::InkHUD::getInstance();
+
+        // Keep alignment in sync with the current rotation so that visual-frame gestures
+        // always pass through nav functions without remapping: (rotation + alignment) % 4 == 0.
+        inkhud->persistence->settings.joystick.alignment = (4 - inkhud->persistence->settings.rotation) % 4;
+
+        // Check whether a system applet (e.g. menu) is currently handling input
+        bool systemHandlingInput = false;
+        for (NicheGraphics::InkHUD::SystemApplet *sa : inkhud->systemApplets) {
+            if (sa->handleInput) {
+                systemHandlingInput = true;
+                break;
+            }
+        }
+
+        switch (e->inputEvent) {
+        case INPUT_BROKER_USER_PRESS:
+            inkhud->shortpress();
+            break;
+        case INPUT_BROKER_SELECT:
+            inkhud->longpress();
+            break;
+        case INPUT_BROKER_LEFT:
+            if (systemHandlingInput)
+                inkhud->navUp();
+            else
+                inkhud->prevApplet();
+            break;
+        case INPUT_BROKER_RIGHT:
+            if (systemHandlingInput)
+                inkhud->navDown();
+            else
+                inkhud->nextApplet();
+            break;
+        case INPUT_BROKER_UP:
+            inkhud->navUp();
+            break;
+        case INPUT_BROKER_DOWN:
+            inkhud->navDown();
+            break;
+        default:
+            break;
+        }
+        return 0;
+    }
+};
+
+static TouchInkHUDBridge touchBridge;
+#endif // MESHTASTIC_INCLUDE_NICHE_GRAPHICS

 TouchDrvGT911 touch;

+// Commands the GT911 into standby before the Wire bus is torn down.
+// notifyDeepSleep fires before Wire.end() in doDeepSleep(), so I2C is still available here.
+struct TouchDeepSleepObserver {
+    int onDeepSleep(void *)
+    {
+        touch.sleep();
+        return 0;
+    }
+    CallbackObserver<TouchDeepSleepObserver, void *> observer{this, &TouchDeepSleepObserver::onDeepSleep};
+} static touchDeepSleepObserver;
+
 bool readTouch(int16_t *x, int16_t *y)
 {
    if (!digitalRead(GT911_PIN_INT)) {
        int16_t raw_x;
        int16_t raw_y;
        if (touch.getPoint(&raw_x, &raw_y)) {
-            // rotate 90° for landscape
-            *x = raw_y;
-            *y = EPD_WIDTH - 1 - raw_x;
+#ifdef MESHTASTIC_INCLUDE_NICHE_GRAPHICS
+            // Transform raw GT911 axes to visual-frame coordinates for the current display rotation.
+            // rotation=3 is the physical identity (device's default orientation).
+            switch (NicheGraphics::InkHUD::InkHUD::getInstance()->persistence->settings.rotation) {
+            default:
+            case 3:
+                *x = raw_x;
+                *y = raw_y;
+                break; // identity
+            case 2:
+                *x = (EPD_WIDTH - 1) - raw_y;
+                *y = raw_x;
+                break; // 90° CW tilt
+            case 1:
+                *x = (EPD_HEIGHT - 1) - raw_x;
+                *y = (EPD_WIDTH - 1) - raw_y;
+                break; // 180° flip
+            case 0:
+                *x = raw_y;
+                *y = (EPD_HEIGHT - 1) - raw_x;
+                break; // 90° CCW tilt
+            }
+#else
+            *x = raw_x;
+            *y = raw_y;
+#endif
            LOG_DEBUG("touched(%d/%d)", *x, *y);
            return true;
        }
@@ -31,15 +133,46 @@ void earlyInitVariant()
    pinMode(SDCARD_CS, OUTPUT);
    digitalWrite(SDCARD_CS, HIGH);
    pinMode(BOARD_BL_EN, OUTPUT);
+
+    // Program GT911 touch controller to I2C address 0x14 (GT911_SLAVE_ADDRESS_H) before
+    // the I2C bus scan runs.  GPIO3 (INT) defaults LOW on ESP32-S3 cold boot, which would
+    // leave the GT911 at 0x5D (GT911_SLAVE_ADDRESS_L) — the same address as the SFA30
+    // air quality sensor — causing a false-positive SFA30 detection during the I2C scan.
+    //
+    // GT911 datasheet §4.3 "Address Selection":
+    //   Pull INT HIGH before releasing RST → device latches address 0x14 (SLAVE_ADDRESS_H)
+    //   Pull INT LOW  before releasing RST → device latches address 0x5D (SLAVE_ADDRESS_L)
+    //   Minimum RST assert time: 100 µs; minimum startup time after RST deassert: 5 ms.
+    //
+    // lateInitVariant() calls touch.begin() which repeats this sequence internally while
+    // also performing full I2C initialisation; the double-reset is harmless.
+    pinMode(GT911_PIN_RST, OUTPUT);
+    digitalWrite(GT911_PIN_RST, LOW);
+    pinMode(GT911_PIN_INT, OUTPUT);
+    digitalWrite(GT911_PIN_INT, HIGH); // HIGH → latch address 0x14
+    delay(1);                          // > 100 µs
+    digitalWrite(GT911_PIN_RST, HIGH);
+    delay(10);                     // > 5 ms startup
+    pinMode(GT911_PIN_INT, INPUT); // release INT for interrupt use
+}
+
+void variant_shutdown()
+{
+    // Ensure frontlight is off during deep sleep
+    digitalWrite(BOARD_BL_EN, LOW);
 }

 // T5-S3-ePaper Pro specific (late-) init
 void lateInitVariant(void)
 {
    touch.setPins(GT911_PIN_RST, GT911_PIN_INT);
-    if (touch.begin(Wire, GT911_SLAVE_ADDRESS_L, GT911_PIN_SDA, GT911_PIN_SCL)) {
+    if (touch.begin(Wire, GT911_SLAVE_ADDRESS_H, GT911_PIN_SDA, GT911_PIN_SCL)) {
+        touchDeepSleepObserver.observer.observe(&notifyDeepSleep);
        touchScreenImpl1 = new TouchScreenImpl1(EPD_WIDTH, EPD_HEIGHT, readTouch);
        touchScreenImpl1->init();
+#ifdef MESHTASTIC_INCLUDE_NICHE_GRAPHICS
+        touchBridge.observe(touchScreenImpl1);
+#endif
    } else {
        LOG_ERROR("Failed to find touch controller!");
    }
@@ -26,9 +26,9 @@
 #define GT911_PIN_RST 9
 #endif

-#define PCF85063_RTC 0x51
+#define PCF8563_RTC 0x51
 #define HAS_RTC 1
-#define PCF85063_INT 2
+#define PCF8563_INT 2

 #define USE_POWERSAVE
 #define SLEEP_TIME 120
@@ -9,8 +9,6 @@
 #define BUTTON_PIN 0 // The middle button GPIO on the T-Beam S3
 //  #define EXT_NOTIFY_OUT 13 // Default pin to use for Ext Notify Module.

-#define LED_STATE_ON 0 // State when LED is lit
-
 // TTGO uses a common pinout for their SX1262 vs RF95 modules - both can be enabled and we will probe at runtime for RF95 and if
 // not found then probe for SX1262
 #define USE_SX1262
@@ -76,4 +74,4 @@
 // has 32768 Hz crystal
 #define HAS_32768HZ 1

-#define USE_SH1106
+#define USE_SH1106
@@ -12,5 +12,5 @@ build_src_filter = ${nrf52_base.build_src_filter} +<../variants/nrf52840/Dongle_
 lib_deps = 
  ${nrf52840_base.lib_deps}
  # renovate: datasource=custom.pio depName=GxEPD2 packageName=zinggjm/library/GxEPD2
-  zinggjm/GxEPD2@1.6.8
+  zinggjm/GxEPD2@1.6.9
 debug_tool = jlink
@@ -16,7 +16,7 @@ build_src_filter = ${nrf52_base.build_src_filter} +<../variants/nrf52840/ME25LS0
 lib_deps = 
  ${nrf52840_base.lib_deps}
  # renovate: datasource=custom.pio depName=GxEPD2 packageName=zinggjm/library/GxEPD2
-  zinggjm/GxEPD2@1.6.8
+  zinggjm/GxEPD2@1.6.9
 ; If not set we will default to uploading over serial (first it forces bootloader entry by talking 1200bps to cdcacm)
 upload_protocol = nrfutil
 ;upload_port = /dev/ttyACM1
@@ -15,6 +15,6 @@ lib_deps =
  # renovate: datasource=git-refs depName=meshtastic-ESP32_Codec2 packageName=https://github.com/meshtastic/ESP32_Codec2 gitBranch=master
  https://github.com/meshtastic/ESP32_Codec2/archive/633326c78ac251c059ab3a8c430fcdf25b41672f.zip
  # renovate: datasource=custom.pio depName=GxEPD2 packageName=zinggjm/library/GxEPD2
-  zinggjm/GxEPD2@1.6.8
+  zinggjm/GxEPD2@1.6.9
 debug_tool = jlink
 ;upload_port = /dev/ttyACM4
@@ -9,5 +9,5 @@ build_src_filter = ${nrf52_base.build_src_filter} +<../variants/nrf52840/TWC_mes
 lib_deps = 
  ${nrf52840_base.lib_deps}
  # renovate: datasource=custom.pio depName=GxEPD2 packageName=zinggjm/library/GxEPD2
-  zinggjm/GxEPD2@1.6.8
+  zinggjm/GxEPD2@1.6.9
 debug_tool = jlink
@@ -4,6 +4,7 @@ extends = nrf52_base
 build_flags =
   ${nrf52_base.build_flags}
  -DSERIAL_BUFFER_SIZE=4096
+  -DLED_BUILTIN=-1

 lib_deps =
  ${nrf52_base.lib_deps}
@@ -79,4 +80,4 @@ debug_speed = 4000

 ; The following is not needed because it automatically tries do this
 ;debug_server_ready_pattern = -.*GDB server started on port \d+.*
-;debug_port = localhost:3333
+;debug_port = localhost:3333
@@ -15,7 +15,7 @@ build_src_filter = ${nrf52_base.build_src_filter} +<../variants/nrf52840/rak4631
 lib_deps = 
  ${nrf52840_base.lib_deps}
  # renovate: datasource=custom.pio depName=GxEPD2 packageName=zinggjm/library/GxEPD2
-  zinggjm/GxEPD2@1.6.8
+  zinggjm/GxEPD2@1.6.9
  # renovate: datasource=custom.pio depName=Melopero RV3028 packageName=melopero/library/Melopero RV3028
  melopero/Melopero RV3028@1.2.0
  # renovate: datasource=custom.pio depName=RAK NCP5623 RGB LED packageName=rakwireless/library/RAKwireless NCP5623 RGB LED library
@@ -17,7 +17,7 @@ build_src_filter = ${nrf52_base.build_src_filter} +<../variants/nrf52840/rak4631
 lib_deps = 
  ${nrf52840_base.lib_deps}
  # renovate: datasource=custom.pio depName=GxEPD2 packageName=zinggjm/library/GxEPD2
-  zinggjm/GxEPD2@1.6.8
+  zinggjm/GxEPD2@1.6.9
  # renovate: datasource=custom.pio depName=Melopero RV3028 packageName=melopero/library/Melopero RV3028
  melopero/Melopero RV3028@1.2.0
  # renovate: datasource=custom.pio depName=RAK NCP5623 RGB LED packageName=rakwireless/library/RAKwireless NCP5623 RGB LED library
@@ -22,7 +22,6 @@ build_flags =
  -D HW_SPI1_DEVICE
  -D HAS_UDP_MULTICAST=1
  -fexceptions  # for exception handling in MQTT
-  -ULED_BUILTIN
 build_src_filter = ${rp2040_base.build_src_filter} +<mesh/wifi/>
 lib_deps =
  ${rp2040_base.lib_deps}
Author	SHA1	Message	Date
copilot-swe-agent[bot]andthebentern	5026bc5f84	Remove dead UINT32_MAX branch from searchedTooLong Agent-Logs-Url: https://github.com/meshtastic/firmware/sessions/6dad5b56-902e-4d0e-90c1-038a9c2df364 Co-authored-by: thebentern <9000580+thebentern@users.noreply.github.com>	2026-04-25 11:50:18 +00:00
Ben Meadors	30db82ea50	Merge branch 'master' into jp-bennett-patch-2	2026-04-25 06:39:45 -05:00
Ben MeadorsandCopilot	45ccb2ce1f	Update src/gps/GPSUpdateScheduling.cpp Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>	2026-04-25 06:39:36 -05:00
Ben Meadors	7347091055	Add script to show unmerged commits from develop to master	2026-04-25 06:10:45 -05:00
github-actions[bot]andthebentern	55f15076ca	Update protobufs (#10295 ) Co-authored-by: thebentern <9000580+thebentern@users.noreply.github.com>	2026-04-25 06:08:07 -05:00
copilot-swe-agent[bot]andthebentern	b6a5171357	Fix searchedTooLong: move 15-min cap before UINT32_MAX check, cache elapsed, add constexpr Agent-Logs-Url: https://github.com/meshtastic/firmware/sessions/b7f74430-9e7e-4a6f-8095-6176c1eee972 Co-authored-by: thebentern <9000580+thebentern@users.noreply.github.com>	2026-04-25 11:06:35 +00:00
Jonathan Bennett	5e76f637bb	trunk	2026-04-24 19:53:47 -05:00
Jonathan Bennett	85f8179aaf	Add search duration check for exceeding 15 minutes Added a condition to check if the search duration exceeds 15 minutes, indicating too long of a search.	2026-04-24 19:50:48 -05:00
Jonathan Bennett	439b87b860	Detach power interrupts for sleep (#10230 ) * Detach power interrupts for sleep * Gate PMU IRQ behind a found PMU	2026-04-24 06:48:21 -05:00
Jonathan BennettandBen Meadors	d47301defc	Add PortduinoSetOptions to overwrite the realhardware bool (#10157 ) Co-authored-by: Ben Meadors <benmmeadors@gmail.com>	2026-04-24 06:48:09 -05:00
Jonathan Bennett	04b819a7b5	Remove incorrect LED_STATE_ON definition for t-beam-s3 (#10280 ) Fixes #9912 and #10170	2026-04-24 06:47:38 -05:00
github-actions[bot]andvidplace7	8e653122c7	Upgrade trunk (#10284 ) Co-authored-by: vidplace7 <1779290+vidplace7@users.noreply.github.com>	2026-04-24 05:40:44 -05:00
renovate[bot]	5ea3d143da	Update meshtastic-esp8266-oled-ssd1306 digest to 6bfd1f1 (#10277 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-04-23 19:30:47 -05:00
Ben MeadorsandCopilot	56c897e826	Can't LOG when we don't have logging set up yet in the native test suite Co-authored-by: Copilot <copilot@github.com>	2026-04-23 14:42:29 -05:00
Ben Meadors	2cc13a1132	Sane sanitization	2026-04-23 14:19:33 -05:00
Jonathan Bennett	031f332ec1	We have HardwareRNG, let's use it! (#10274 )	2026-04-23 13:16:49 -05:00
github-actions[bot]andvidplace7	48747ee43d	Upgrade trunk (#10266 ) Co-authored-by: vidplace7 <1779290+vidplace7@users.noreply.github.com>	2026-04-23 06:16:23 -05:00
Thomas Göttgens	7c27f4e2df	Revert "Update LovyanGFX to v1.2.20 (#10232 )" (#10269 ) This reverts commit `fb1de111d7`.	2026-04-23 12:37:05 +02:00
Jonathan Bennett	92c0133ef9	Finish evil merge cleanup (#10253 )	2026-04-22 21:47:20 -05:00
Ben Meadors	6171ad8c14	Remove duplicate GPIO init block in setup() from bad merge in PR #9378 The T-Deck-Pro V1.1 PR (#9378) had a backwards merge (`e7b66281`) that pulled 236 commits of master INTO a 1-commit fork branch, then a second merge (`8fd0a7f2`) duplicated the entire T_DECK/T_DECK_PRO/T_LORA_PAGER/HACKADAY peripheral init block in setup(). Also removes a stray digitalWrite(BLE_LED, LED_STATE_OFF) in the HACKADAY section that was an artifact of the evil merge at `e7b66281`.	2026-04-22 19:35:13 -05:00
Jason P	d8b11f0b14	Improve options to align to names of UI options (#10240 )	2026-04-22 11:42:25 -05:00
github-actions[bot]andvidplace7	a710841723	Upgrade trunk (#10236 ) Co-authored-by: vidplace7 <1779290+vidplace7@users.noreply.github.com>	2026-04-22 11:35:07 -05:00
renovate[bot]	fb1de111d7	Update LovyanGFX to v1.2.20 (#10232 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-04-22 11:34:48 -05:00
Jonathan Bennett	2b5daf2438	T watch pinfix (#10231 ) * Minor button debugging bits * pin0 is a pin, pin -1 means disabled	2026-04-21 20:02:56 -05:00
George Claude Sonnet 4.6 HarukiToreda	9361b85f47	feat(t5s3-epaper): add InkHUD port for LilyGo T5 E-Paper S3 Pro (#10211 ) * niche: add InkHUD port for LilyGo T5-E-Paper-S3-Pro (ED047TC1) Add a NicheGraphics EInk driver adapter for the 4.7" ED047TC1 parallel e-paper display used on the T5-E-Paper-S3-Pro (H752-01). The driver wraps FastEPD and handles the polarity difference between InkHUD's buffer format (0xFF = white) and FastEPD's (0x00 = white). Rewrite variants/esp32s3/t5s3_epaper/nicheGraphics.h which was an incomplete copy of the Heltec VM-E290 setup referencing undefined SPI pin macros and a non-existent BUTTON_PIN_SECONDARY. The board uses a parallel display, not the small SPI DEPG0290BNS800 that was referenced. * fix: guard inputBroker null dereference in TouchScreenImpl1::init() When MESHTASTIC_EXCLUDE_INPUTBROKER is defined (e.g. InkHUD builds), inputBroker is nullptr. Calling inputBroker->registerSource() in that state caused a LoadProhibited panic on any board that has both HAS_TOUCHSCREEN=1 and the InputBroker excluded. Add a null check before registerSource() to prevent the crash. * niche: fix display rotation for T5-E-Paper-S3-Pro InkHUD port Set rotation=3 (270° CW) in nicheGraphics.h to correct for FastEPD scanning the ED047TC1 panel in portrait orientation, resulting in correct landscape display output. * fix: update buffer format descriptions and remove polarity inversion for InkHUD and FastEPD * fix: update ED047TC1 driver to handle inactive pixel borders and adjust safe-area dimensions * fix: comment out ruler diagnostic for E-Ink driver * feat: implement TouchInkHUDBridge for direct touch event handling in InkHUD * niche: add FreeSans 18pt/24pt Win1253 (Greek) fonts for larger InkHUD displays Add Win1253-encoded FreeSans 18pt and 24pt font headers to support Greek script on larger InkHUD screens (e.g., the 4.7" ED047TC1 at ~234 DPI). Register FREESANS_24PT_WIN1253 and FREESANS_18PT_WIN1253 macros in AppletFont.h. Set fontLarge=24pt, fontMedium=18pt, fontSmall=12pt in nicheGraphics.h for the T5-E-Paper-S3-Pro. * feat(ed047tc1): use true partial update for FAST refresh Replace fullUpdate(CLEAR_FAST) with partialUpdate() for FAST display updates. FastEPD's partialUpdate() diffs pCurrent against pPrevious and only applies the update waveform to rows that have changed, leaving unchanged rows with a neutral signal. This reduces visible flicker on routine updates (new messages, position changes) — only the affected region of the screen refreshes. Full-screen CLEAR_SLOW updates are preserved for periodic ghosting cleanup, driven by InkHUD's setDisplayResilience() ratio. * feat(t5s3-epaper): enable frontlight via LatchingBacklight Wire up BOARD_BL_EN (GPIO11) to InkHUD's LatchingBacklight driver. Enable the backlight menu item so users can toggle "Keep Backlight On" via Settings. The backlight turns on automatically when the menu opens and off when it closes. * Fix RTC chip (PCF8563 not PCF85063) and GT911 I2C address collision - variant.h used PCF85063_RTC but the board has a PCF8563. The difference is the RAM register: PCF85063 has 1 byte of RAM; PCF8563 does not. The PCF85063 driver was trying to write this register on init, failing every time, and setDateTime writes were silently discarded — RTC time was never persisted across reboots. Switch to PCF8563_RTC/PCF8563_INT. Before: [E][SensorPCF85063.hpp:375] initImpl(): Failed to write to RAM memory register. Maybe this chip is pcf8563. Read RTC time from PCF85063 getDateTime as 2026-04-05 00:00:23 PCF85063 setDateTime 2026-04-05 18:40:59 Read RTC time from PCF85063 getDateTime as 2026-04-05 00:00:19 ← lost After: PCF8563 found at address 0x51 Read RTC time from PCF8563 getDateTime as 2026-04-05 18:58:37 ← persisted PCF8563 setDateTime 2026-04-05 18:58:44 Read RTC time from PCF8563 getDateTime as 2026-04-05 18:58:44 ← round-trips - GT911 touch was initialized with GT911_SLAVE_ADDRESS_L (0x5D), which collides with the SFA30 air quality sensor also at 0x5D on the same I2C bus. Switch to GT911_SLAVE_ADDRESS_H (0x14): the library drives INT high during reset to program the GT911 to address 0x14, eliminating the address conflict. Before: SFA30 found at address 0x5d [I][TouchDrvGT911.hpp:568] initImpl(): Try using 0x5D as the device address After: SFA30 found at address 0x5d [I][TouchDrvGT911.hpp:544] initImpl(): Try using 0x14 as the device address * t5s3_epaper: fix GT911 ghost-SFA30 via early I2C address latch Investigation findings ---------------------- Boot logs showed "SFA30 found at address 0x5d" on every cold power-on, and AirQualityTelemetry was registering an SFA30 sensor. However, every readMeasuredValues() call returned error 268 (0x010C = Sensirion WriteError \| I2cAddressNack), meaning the I2C write to 0x5D was being NACK'd — inconsistent with a real SFA30. Root cause: the GT911 touch controller latches its I2C address from the INT pin level at reset time (GT911 datasheet §4.3). GPIO3 (INT) defaults LOW on ESP32-S3 cold boot → GT911 always powers up at 0x5D (SLAVE_ADDRESS_L). The I2C scanner runs before lateInitVariant() had a chance to reprogram the chip. The scanner's SFA30 detection (ScanI2CTwoWire.cpp) sends the 2-byte command 0xD060 to 0x5D and requests 48 bytes back. GT911 ACKs the write (treating it as a register address) and returns 48 bytes of register data, passing the length check — a false-positive SFA30 detection. Confirmed via second cold-boot log: after the previous commit moved GT911 to 0x14 in lateInitVariant(), address 0x5D still appeared in the scan because the scanner runs first. The board has no physical SFA30 fitted. Fix --- Add the GT911 address-latch reset sequence to earlyInitVariant(), before Wire is initialised and before the I2C scan runs. Per the datasheet: drive RST LOW, drive INT HIGH (selects address 0x14 / SLAVE_ADDRESS_H), hold >100 µs, release RST, wait >5 ms startup. GPIO-only, no Wire dependency. lateInitVariant() then repeats this sequence internally via touch.begin(); the double-reset is harmless. Verified in boot log: Before: "SFA30 found at address 0x5d", 5 I2C devices, NACK errors After: no SFA30 entry, 4 I2C devices (TCA9535/PCF8563/BQ27220/BQ25896), GT911 found at 0x14 and touch initialised successfully, AirQualityTelemetry registers no sensors (correct — no SFA30 present) * t5s3_epaper: add variant_shutdown() for touch sleep and backlight off Put GT911 into low-power standby (command 0x05) and drive BOARD_BL_EN LOW before deep sleep to avoid unnecessary current draw. * t5s3_epaper: fix touch gesture routing and coordinate mapping readTouch() now transforms raw GT911 axes to visual-frame coordinates based on the current display rotation (rotation=3 is the hardware identity). This ensures TouchScreenBase detects swipe direction correctly regardless of which rotation the user has selected. TouchInkHUDBridge dynamically sets joystick.alignment = (4-rotation)%4 on each touch event so that (rotation+alignment)%4==0 always, keeping nav calls pass-through without remapping. nicheGraphics.h now calls loadSettings() first so that rotation is persisted across reboots. rotation=3 and other first-boot defaults are only applied when tips.firstBoot is set. alignment is recomputed from the loaded rotation on every boot. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * t5s3_epaper: fix GT911 sleep timing via notifyDeepSleep observer touch.sleep() was called from variant_shutdown(), which runs inside cpuDeepSleep() — after Wire.end() had already torn down the I2C bus in doDeepSleep(). This caused Wire NULL TX buffer errors and left the GT911 awake during deep sleep. Register a CallbackObserver on notifyDeepSleep, which fires before Wire.end(), so the I2C command reaches the chip while the bus is live. Pattern matches LatchingBacklight and other NicheGraphics components. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * t5s3_epaper: fix touch nav and applet defaults in nicheGraphics Enable joystick mode post-begin so menu scroll and swipe-up/down gestures are not silently dropped by the joystick.enabled gate in Events.cpp. Activate DMs and Channel 0/1 applets with correct autoshow defaults matching the mini-epaper-s3 reference pattern. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Update nicheGraphics.h * t5s3_epaper: fix ED047TC1 driver docs and remove spurious beginPolling Addressing PR review comments: Remove beginPolling(1, 0) after the blocking FastEPD update — it incorrectly set updateRunning=true for one loop cycle after the hardware was already done, causing busy() to briefly return true. Since isUpdateDone() always returns true, no polling is needed. Also fix stale comments: safe-area buffer size was 944×532, now 944×523; V_OFFSET_ROWS didn't exist, replaced with the actual V_OFFSET_TOP=9 / V_OFFSET_BOTTOM=8 constant names. * t5s3_epaper: clean up applet addition formatting in setupNicheGraphics * t5s3_epaper: guard ED047TC1.cpp against non-T5S3 InkHUD builds The InkHUD base config pulls in all of src/graphics/niche/ so every InkHUD device compiled ED047TC1.cpp, triggering the #error on line 48 for boards that define neither T5_S3_EPAPER_PRO_V1 nor V2. Wrap the file body with #ifdef T5_S3_EPAPER_PRO so it is only compiled for T5S3 targets. The #error is preserved inside the guard to catch future hardware revisions that forget to update the driver. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: HarukiToreda <116696711+HarukiToreda@users.noreply.github.com>	2026-04-21 15:35:28 -05:00
Ben MeadorsandCopilot	68383c8bd5	Add encryption overview to agent instructions in AGENTS.md (#10207 ) * Add encryption overview to agent instructions in AGENTS.md * Update AGENTS.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update copilot-instructions.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update copilot-instructions.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Clarify nonce and wire overhead details in encryption section of copilot instructions * Enhance encryption documentation in copilot instructions and agents guide for clarity on key management and reset behaviors * Update .github/copilot-instructions.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Fix botched merge conflict resolution --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>	2026-04-21 10:49:13 -05:00
TomandBen Meadors	76dea77929	Add authoring guide for native unit tests in README.md (#10201 ) * Add authoring guide for native unit tests in README.md * Enhance documentation for agent tooling and native unit tests in README and related files --------- Co-authored-by: Ben Meadors <benmmeadors@gmail.com>	2026-04-21 10:49:08 -05:00
Clive Blackledge	d7ba178bf1	Fix: prompt markdownlint md040 fix for new prompts. (#10199 ) * Add ESP32 Power Management lessons learned document Documents our experimentation with ESP-IDF DFS and why it doesn't work well for Meshtastic (RTOS locks, BLE locks, USB issues). Proposes simpler alternative: manual setCpuFrequencyMhz() control with explicit triggers for when to go fast vs slow. * docs(prompts): fix markdown fence language tags * docs: remove ESP32 power management notes	2026-04-21 10:49:01 -05:00
Jennifer Sanchez	5f836cdf3b	Added support for Spreading Factors 5 and 6 on compatible radios (#10160 )	2026-04-21 10:48:33 -05:00
github-actions[bot]andvidplace7	a8a5315460	Upgrade trunk (#10221 ) Co-authored-by: vidplace7 <1779290+vidplace7@users.noreply.github.com>	2026-04-21 17:14:12 +02:00
Jonathan Bennett	d8e4389da2	No longer need undefines, thanks to #10179 (#10180 )	2026-04-21 09:57:48 -05:00
Jonathan Bennett	25febfdeee	More cleanly remove LED_BUILTIN (#10179 ) * Test PR to remove LED_BUILTIN Comment out the LED_BUILTIN definition in platformio.ini * Add LED_BUILTIN definition to nrf52840.ini	2026-04-21 09:57:41 -05:00
Ruledo	f5be09c123	Add Luckfox Pico Max Waveshare Pico LoRa config (#10175 ) Add a meshtasticd config for the Luckfox Pico Max with the Waveshare Pico LoRa SX1262 TCXO HAT. Tested on hardware with successful SX1262 init, broadcast, and direct messaging.	2026-04-21 09:57:33 -05:00
Darafei Praliaskouski Copilot Ben Meadors Jonathan Bennett	23321c4588	Reduce key duplication by enabling hardware RNG (#8803 ) * Reduce key duplication by enabling hardware RNG * Apply suggestion from @Copilot Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Apply suggestion from @Copilot Use micros() for worst case random seed for nrf52 Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Minor cleanup, remove dead code and clarify comment * trunk * Add useRadioEntropy bool, default false. --------- Co-authored-by: Ben Meadors <benmmeadors@gmail.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Jonathan Bennett <jbennett@incomsystems.biz>	2026-04-21 09:57:06 -05:00
Catalin Patulea	e1f5043489	Delete PointerQueue::dequeuePtrFromISR, unused since commit `db766f1` (#99 ). (#10090 )	2026-04-21 09:57:00 -05:00
Jaime Roldan	5d9a2564e4	fix(nodedb): force null-terminate name fields in UserLite/User conversions (#8174 ) (#10218 )	2026-04-21 09:52:47 -05:00
nightjoker7	84ce1ea147	SX126x: re-apply 0x8B5 register in resetAGC() to preserve RX sensitivity (#10219 ) The CALIBRATE_ALL (0x7F) command inside resetAGC() clears bit 0 of the undocumented 0x8B5 register. That bit is set once in init() by #9571 and #9777 to improve SX1262 RX sensitivity, and the AGC-reset path was not re-applying it. Result: every SX1262 node silently loses the RX sensitivity patch ~60s after boot and never recovers until reboot. Empirically confirmed on Heltec Mesh Node T114 (nRF52840 + SX1262): - Post-calibration read of 0x8B5 = 0x04 (bit 0 cleared) - After re-apply: 0x05 (bit 0 set) Reproducible every AGC_RESET_INTERVAL_MS tick. Fix re-applies the register bit alongside the existing post-calibration re-applies (setDio2AsRfSwitch, setRxBoostedGainMode).	2026-04-21 09:50:35 -05:00
renovate[bot]	eba74fa6e2	Update GxEPD2 to v1.6.9 (#10212 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-04-21 06:08:28 -05:00