Merge branch 'develop' into feature/rak4631-lockdown

avoid memory leak when possibly malformed packet received (#9781 )
getByIndex allocates memory and returns dummy channel whenever chIndex validation fails. Comment implies this may happen when malformed packet is received. The fix changes implementation so static dummyChannel is returned in such case. Co-authored-by: Ben Meadors <benmmeadors@gmail.com>
2026-10-11 22:31:23 +10:00 · 2026-03-02 06:40:58 -06:00 · 2026-02-28 18:37:41 -06:00 · 2026-02-28 17:17:29 -06:00 · 2026-02-28 11:08:15 -06:00 · 2026-02-28 11:57:47 -05:00
220 changed files with 5598 additions and 694 deletions
@@ -17,7 +17,7 @@ jobs:

    steps:
      - name: Stale PR+Issues
-        uses: actions/stale@v10.1.1
+        uses: actions/stale@v10.2.0
        with:
          days-before-stale: 45
          stale-issue-message: This issue has not had any comment or update in the last month. If it is still relevant, please post update comments. If no comments are made, this issue will be closed automagically in 7 days.
@@ -33,6 +33,7 @@ __pycache__
 *~

 venv/
+.venv/
 release/
 .vscode/extensions.json
 /compile_commands.json
@@ -8,20 +8,20 @@ plugins:
      uri: https://github.com/trunk-io/plugins
 lint:
  enabled:
-    - checkov@3.2.501
-    - renovate@43.10.3
+    - checkov@3.2.506
+    - renovate@43.43.2
    - prettier@3.8.1
-    - trufflehog@3.93.3
+    - trufflehog@3.93.5
    - yamllint@1.38.0
-    - bandit@1.9.3
+    - bandit@1.9.4
    - trivy@0.69.1
    - taplo@0.10.0
-    - ruff@0.15.1
-    - isort@7.0.0
+    - ruff@0.15.4
+    - isort@8.0.0
    - markdownlint@0.47.0
    - oxipng@10.1.0
    - svgo@4.0.0
-    - actionlint@1.7.10
+    - actionlint@1.7.11
    - flake8@7.3.0
    - hadolint@2.14.0
    - shfmt@3.6.0
@@ -0,0 +1,26 @@
+# Lightweight container for running native PlatformIO tests on non-Linux hosts
+FROM python:3.14-slim-trixie
+
+ENV DEBIAN_FRONTEND=noninteractive
+ENV PIP_ROOT_USER_ACTION=ignore
+
+# hadolint ignore=DL3008
+RUN apt-get update && apt-get install --no-install-recommends -y \
+        g++ git ca-certificates pkg-config \
+        libgpiod-dev libyaml-cpp-dev libbluetooth-dev libi2c-dev libuv1-dev \
+        libusb-1.0-0-dev libulfius-dev liborcania-dev libssl-dev \
+        libx11-dev libinput-dev libxkbcommon-x11-dev libsqlite3-dev libsdl2-dev \
+    && apt-get clean && rm -rf /var/lib/apt/lists/* \
+    && pip install --no-cache-dir platformio==6.1.19 \
+        && useradd --create-home --shell /usr/sbin/nologin meshtastic
+
+WORKDIR /firmware
+RUN chown -R meshtastic:meshtastic /firmware
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD platformio --version || exit 1
+
+USER meshtastic
+
+# Run tests by default; override with docker run args for specific filters
+CMD ["platformio", "test", "-e", "coverage", "-v"]
@@ -23,4 +23,4 @@ for BOARD in $BOARDS; do
 	CHECK="${CHECK} -e ${BOARD}"
 done

-pio check --flags "-DAPP_VERSION=${APP_VERSION} --suppressions-list=suppressions.txt --inline-suppr" $CHECK --skip-packages --pattern="src/" --fail-on-defect=medium --fail-on-defect=high
+pio check --flags "-DAPP_VERSION=${APP_VERSION} --suppressions-list=suppressions.txt --inline-suppr" $CHECK --skip-packages --pattern="src/" --fail-on-defect=low --fail-on-defect=medium --fail-on-defect=high
@@ -9,3 +9,5 @@ Lora:
  DIO3_TCXO_VOLTAGE: true
  DIO2_AS_RF_SWITCH: true
  spidev: spidev0.0
+  GPIO_DETECT_PA: 13
+  TX_GAIN_LORA: [8, 8, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 10, 10, 9, 8, 8, 7]
@@ -0,0 +1,16 @@
+# For use with Armbian luckfox-lyra-ultra-w
+# Enable overlay 'luckfox-lyra-ultra-w-spi0-cs0-spidev' with armbian-config
+# https://github.com/wehooper4/Meshtastic-Hardware/tree/main/Luckfox%20Ultra%20Hat
+# 1 Watt Lyra Ultra hat
+Lora:
+  Module: sx1262
+  DIO2_AS_RF_SWITCH: true
+  DIO3_TCXO_VOLTAGE: true
+  CS: 10
+  IRQ: 5
+  Busy: 11
+  Reset: 9
+  RXen: 14
+
+  spidev: spidev0.0 #pins are (CS=10, CLK=8, MOSI=6, MISO=7)
+  spiSpeed: 2000000
@@ -0,0 +1,17 @@
+# For use with Armbian luckfox-lyra-ultra-w
+# Enable overlay 'luckfox-lyra-ultra-w-spi0-cs0-spidev' with armbian-config
+# https://github.com/wehooper4/Meshtastic-Hardware/tree/main/Luckfox%20Ultra%20Hat
+# 2 Watt Lyra Ultra hat
+Lora:
+  Module: sx1262
+  DIO2_AS_RF_SWITCH: true
+  DIO3_TCXO_VOLTAGE: true
+  SX126X_MAX_POWER: 8
+  CS: 10
+  IRQ: 5
+  Busy: 11
+  Reset: 9
+  RXen: 14
+
+  spidev: spidev0.0 #pins are (CS=10, CLK=8, MOSI=6, MISO=7)
+  spiSpeed: 2000000
@@ -0,0 +1,25 @@
+# For use with Armbian luckfox-lyra // luckfox-lyra-plus
+# Enable overlay 'luckfox-lyra-plus-spi0-cs0_rmio13-spidev' with armbian-config
+# Waveshare LoRa HAT for Raspberry Pi Pico
+# https://www.waveshare.com/wiki/Pico-LoRa-SX1262
+Lora:
+  Module: sx1262
+  DIO2_AS_RF_SWITCH: true
+  DIO3_TCXO_VOLTAGE: true
+  spidev: spidev0.0
+  CS: # GPIO0_B5
+    pin: 13
+    gpiochip: 0
+    line: 13
+  IRQ: # GPIO1_C2
+    pin: 50
+    gpiochip: 1
+    line: 18
+  Busy: # GPIO0_B4
+    pin: 12
+    gpiochip: 0
+    line: 12
+  Reset: # GPIO0_A2
+    pin: 2
+    gpiochip: 0
+    line: 2
@@ -13,8 +13,7 @@ Lora:
 #  USB_Serialnum: 12345678
  SX126X_MAX_POWER: 22
 # Reduce output power to improve EMI
-  NUM_PA_POINTS: 22
-  TX_GAIN_LORA: 12, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 10, 10, 9, 8, 8, 7
+  TX_GAIN_LORA: [12, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 10, 10, 9, 8, 8, 7]
 # Note: This module integrates an additional PA to achieve higher output power.
 # The 'power' parameter here does not represent the actual RF output.
 # TX_GAIN_LORA defines the gain offset applied at each SX1262 input power step (1–22 dBm).
@@ -13,8 +13,7 @@ Lora:
 #  USB_Serialnum: 12345678
  SX126X_MAX_POWER: 22
 # Reduce output power to improve EMI
-  NUM_PA_POINTS: 22
-  TX_GAIN_LORA: 12, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 10, 10, 9, 8, 8, 7
+  TX_GAIN_LORA: [12, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 10, 10, 9, 8, 8, 7]
 # Note: This module integrates an additional PA to achieve higher output power.
 # The 'power' parameter here does not represent the actual RF output.
 # TX_GAIN_LORA defines the gain offset applied at each SX1262 input power step (1–22 dBm).
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# Run native PlatformIO tests inside Docker (for macOS / non-Linux hosts).
+#
+# Usage:
+#   ./bin/test-native-docker.sh                          # run all native tests
+#   ./bin/test-native-docker.sh -f test_transmit_history  # run specific test filter
+#   ./bin/test-native-docker.sh --rebuild                 # force rebuild the image
+#
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+ROOT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+IMAGE_NAME="meshtastic-native-test"
+
+REBUILD=false
+EXTRA_ARGS=()
+
+for arg in "$@"; do
+    if [[ "$arg" == "--rebuild" ]]; then
+        REBUILD=true
+    else
+        EXTRA_ARGS+=("$arg")
+    fi
+done
+
+if $REBUILD || ! docker image inspect "$IMAGE_NAME" >/dev/null 2>&1; then
+    echo "Building test image (first run may take a few minutes)..."
+    docker build -t "$IMAGE_NAME" -f "$ROOT_DIR/Dockerfile.test" "$ROOT_DIR"
+fi
+
+# Disable BUILD_EPOCH to avoid full rebuilds between test runs (matches CI)
+sed_cmd='s/-DBUILD_EPOCH=$UNIX_TIME/#-DBUILD_EPOCH=$UNIX_TIME/'
+
+# Default: run all tests. Pass extra args (e.g. -f test_transmit_history) through.
+if [[ ${#EXTRA_ARGS[@]} -eq 0 ]]; then
+    CMD=("platformio" "test" "-e" "coverage" "-v")
+else
+    CMD=("platformio" "test" "-e" "coverage" "-v" "${EXTRA_ARGS[@]}")
+fi
+
+exec docker run --rm \
+    -v "$ROOT_DIR:/src:ro" \
+    "$IMAGE_NAME" \
+    bash -c "rm -rf /tmp/fw-test && cp -a /src /tmp/fw-test && cd /tmp/fw-test && sed -i '${sed_cmd}' platformio.ini && ${CMD[*]}"
@@ -0,0 +1,40 @@
+{
+  "build": {
+    "arduino": {
+      "ldscript": "esp32s3_out.ld",
+      "partitions": "default.csv"
+    },
+    "core": "esp32",
+    "extra_flags": [
+      "-DBOARD_HAS_PSRAM",
+      "-DARDUINO_ESP32S3_DEV",
+      "-DARDUINO_USB_MODE=1",
+      "-DARDUINO_USB_CDC_ON_BOOT=1",
+      "-DARDUINO_RUNNING_CORE=1",
+      "-DARDUINO_EVENT_RUNNING_CORE=1"
+    ],
+    "f_cpu": "240000000L",
+    "f_flash": "80000000L",
+    "flash_mode": "qio",
+    "hwids": [["0x303A", "0x1001"]],
+    "mcu": "esp32s3",
+    "variant": "esp32s3"
+  },
+  "connectivity": ["wifi"],
+  "debug": {
+    "default_tool": "esp-builtin",
+    "onboard_tools": ["esp-builtin"],
+    "openocd_target": "esp32s3.cfg"
+  },
+  "frameworks": ["arduino", "espidf"],
+  "name": "LilyGo Mini-Epaper-S3 (4 MB Flash, 2MB PSRAM)",
+  "upload": {
+    "flash_size": "4MB",
+    "maximum_ram_size": 327680,
+    "maximum_size": 4194304,
+    "require_upload_port": true,
+    "speed": 460800
+  },
+  "url": "https://www.lilygo.cc",
+  "vendor": "LilyGo"
+}
@@ -8,7 +8,7 @@
    "extra_flags": [
      "-DBOARD_HAS_PSRAM",
      "-DARDUINO_USB_CDC_ON_BOOT=1",
-      "-DARDUINO_USB_MODE=0",
+      "-DARDUINO_USB_MODE=1",
      "-DARDUINO_RUNNING_CORE=1",
      "-DARDUINO_EVENT_RUNNING_CORE=0"
    ],
@@ -117,7 +117,7 @@ lib_deps =
 [radiolib_base]
 lib_deps =
 	# renovate: datasource=custom.pio depName=RadioLib packageName=jgromes/library/RadioLib
-	jgromes/RadioLib@7.5.0
+	jgromes/RadioLib@7.6.0

 [device-ui_base]
 lib_deps =
@@ -138,7 +138,7 @@ lib_deps =
 	# renovate: datasource=custom.pio depName=Adafruit BME280 packageName=adafruit/library/Adafruit BME280 Library
 	adafruit/Adafruit BME280 Library@2.3.0
 	# renovate: datasource=custom.pio depName=Adafruit DPS310 packageName=adafruit/library/Adafruit DPS310
-	adafruit/Adafruit DPS310@1.1.5
+	adafruit/Adafruit DPS310@1.1.6
 	# renovate: datasource=custom.pio depName=Adafruit MCP9808 packageName=adafruit/library/Adafruit MCP9808 Library
 	adafruit/Adafruit MCP9808 Library@2.0.2
 	# renovate: datasource=custom.pio depName=Adafruit INA260 packageName=adafruit/library/Adafruit INA260 Library
@@ -150,7 +150,7 @@ lib_deps =
 	# renovate: datasource=custom.pio depName=Adafruit LIS3DH packageName=adafruit/library/Adafruit LIS3DH
 	adafruit/Adafruit LIS3DH@1.3.0
 	# renovate: datasource=custom.pio depName=Adafruit AHTX0 packageName=adafruit/library/Adafruit AHTX0
-	adafruit/Adafruit AHTX0@2.0.5
+	adafruit/Adafruit AHTX0@2.0.6
 	# renovate: datasource=custom.pio depName=Adafruit LSM6DS packageName=adafruit/library/Adafruit LSM6DS
 	adafruit/Adafruit LSM6DS@4.7.4
 	# renovate: datasource=custom.pio depName=Adafruit TSL2591 packageName=adafruit/library/Adafruit TSL2591 Library
@@ -158,7 +158,7 @@ lib_deps =
 	# renovate: datasource=custom.pio depName=EmotiBit MLX90632 packageName=emotibit/library/EmotiBit MLX90632
 	emotibit/EmotiBit MLX90632@1.0.8
 	# renovate: datasource=custom.pio depName=Adafruit MLX90614 packageName=adafruit/library/Adafruit MLX90614 Library
-	adafruit/Adafruit MLX90614 Library@2.1.5
+	adafruit/Adafruit MLX90614 Library@2.1.6
 	# renovate: datasource=git-refs depName=INA3221 packageName=https://github.com/sgtwilko/INA3221 gitBranch=FixOverflow
 	https://github.com/sgtwilko/INA3221/archive/bb03d7e9bfcc74fc798838a54f4f99738f29fc6a.zip
 	# renovate: datasource=custom.pio depName=QMC5883L Compass packageName=mprograms/library/QMC5883LCompass
@@ -180,12 +180,12 @@ lib_deps =
 	# renovate: datasource=custom.pio depName=DFRobot_BMM150 packageName=dfrobot/library/DFRobot_BMM150
 	dfrobot/DFRobot_BMM150@1.0.0
 	# renovate: datasource=custom.pio depName=Adafruit_TSL2561 packageName=adafruit/library/Adafruit TSL2561
-	adafruit/Adafruit TSL2561@1.1.2
+	adafruit/Adafruit TSL2561@1.1.3
 	# renovate: datasource=custom.pio depName=BH1750_WE packageName=wollewald/library/BH1750_WE
 	wollewald/BH1750_WE@1.1.10

-; (not included in native / portduino)
-[environmental_extra]
+; Common environmental sensor libraries (not included in native / portduino)
+[environmental_extra_common]
 lib_deps =
 	# renovate: datasource=custom.pio depName=Adafruit BMP3XX packageName=adafruit/library/Adafruit BMP3XX Library
 	adafruit/Adafruit BMP3XX Library@2.1.6
@@ -205,10 +205,6 @@ lib_deps =
 	sparkfun/SparkFun Qwiic Scale NAU7802 Arduino Library@1.0.6
 	# renovate: datasource=custom.pio depName=ClosedCube OPT3001 packageName=closedcube/library/ClosedCube OPT3001
 	closedcube/ClosedCube OPT3001@1.1.2
-	# renovate: datasource=custom.pio depName=Bosch BSEC2 packageName=boschsensortec/library/bsec2
-	boschsensortec/bsec2@1.10.2610
-	# renovate: datasource=custom.pio depName=Bosch BME68x packageName=boschsensortec/library/BME68x Sensor Library
-	boschsensortec/BME68x Sensor Library@1.3.40408
 	# renovate: datasource=git-refs depName=meshtastic-DFRobot_LarkWeatherStation packageName=https://github.com/meshtastic/DFRobot_LarkWeatherStation gitBranch=master
 	https://github.com/meshtastic/DFRobot_LarkWeatherStation/archive/4de3a9cadef0f6a5220a8a906cf9775b02b0040d.zip
 	# renovate: datasource=custom.pio depName=Sensirion Core packageName=sensirion/library/Sensirion Core
@@ -217,33 +213,21 @@ lib_deps =
 	sensirion/Sensirion I2C SCD4x@1.1.0
 	# renovate: datasource=custom.pio depName=Sensirion I2C SFA3x packageName=sensirion/library/Sensirion I2C SFA3x
 	sensirion/Sensirion I2C SFA3x@1.0.0
+	# renovate: datasource=custom.pio depName=Sensirion I2C SCD30 packageName=sensirion/library/Sensirion I2C SCD30
+	sensirion/Sensirion I2C SCD30@1.0.0

-; Same as environmental_extra but without BSEC (saves ~3.5KB DRAM for original ESP32 targets)
+; Environmental sensors with BSEC2 (Bosch proprietary IAQ)
+[environmental_extra]
+lib_deps =
+	${environmental_extra_common.lib_deps}
+	# renovate: datasource=custom.pio depName=Bosch BSEC2 packageName=boschsensortec/library/bsec2
+	boschsensortec/bsec2@1.10.2610
+	# renovate: datasource=custom.pio depName=Bosch BME68x packageName=boschsensortec/library/BME68x Sensor Library
+	boschsensortec/BME68x Sensor Library@1.3.40408
+
+; Environmental sensors without BSEC (saves ~3.5KB DRAM for original ESP32 targets)
 [environmental_extra_no_bsec]
 lib_deps =
-	# renovate: datasource=custom.pio depName=Adafruit BMP3XX packageName=adafruit/library/Adafruit BMP3XX Library
-	adafruit/Adafruit BMP3XX Library@2.1.6
-	# renovate: datasource=custom.pio depName=Adafruit MAX1704X packageName=adafruit/library/Adafruit MAX1704X
-	adafruit/Adafruit MAX1704X@1.0.3
-	# renovate: datasource=custom.pio depName=Adafruit SHTC3 packageName=adafruit/library/Adafruit SHTC3 Library
-	adafruit/Adafruit SHTC3 Library@1.0.2
-	# renovate: datasource=custom.pio depName=Adafruit LPS2X packageName=adafruit/library/Adafruit LPS2X
-	adafruit/Adafruit LPS2X@2.0.6
-	# renovate: datasource=custom.pio depName=Adafruit SHT31 packageName=adafruit/library/Adafruit SHT31 Library
-	adafruit/Adafruit SHT31 Library@2.2.2
-	# renovate: datasource=custom.pio depName=Adafruit VEML7700 packageName=adafruit/library/Adafruit VEML7700 Library
-	adafruit/Adafruit VEML7700 Library@2.1.6
-	# renovate: datasource=custom.pio depName=Adafruit SHT4x packageName=adafruit/library/Adafruit SHT4x Library
-	adafruit/Adafruit SHT4x Library@1.0.5
-	# renovate: datasource=custom.pio depName=SparkFun Qwiic Scale NAU7802 packageName=sparkfun/library/SparkFun Qwiic Scale NAU7802 Arduino Library
-	sparkfun/SparkFun Qwiic Scale NAU7802 Arduino Library@1.0.6
-	# renovate: datasource=custom.pio depName=ClosedCube OPT3001 packageName=closedcube/library/ClosedCube OPT3001
-	closedcube/ClosedCube OPT3001@1.1.2
-	# renovate: datasource=git-refs depName=meshtastic-DFRobot_LarkWeatherStation packageName=https://github.com/meshtastic/DFRobot_LarkWeatherStation gitBranch=master
-	https://github.com/meshtastic/DFRobot_LarkWeatherStation/archive/4de3a9cadef0f6a5220a8a906cf9775b02b0040d.zip
-	# renovate: datasource=custom.pio depName=Sensirion Core packageName=sensirion/library/Sensirion Core
-	sensirion/Sensirion Core@0.7.3
-	# renovate: datasource=custom.pio depName=Sensirion I2C SCD4x packageName=sensirion/library/Sensirion I2C SCD4x
-	sensirion/Sensirion I2C SCD4x@1.1.0
-  # renovate: datasource=custom.pio depName=Sensirion I2C SFA3x packageName=sensirion/library/Sensirion I2C SFA3x
-	sensirion/Sensirion I2C SFA3x@1.0.0
+	${environmental_extra_common.lib_deps}
+	# renovate: datasource=custom.pio depName=adafruit/Adafruit BME680 Library packageName=adafruit/library/Adafruit BME680
+	adafruit/Adafruit BME680 Library@^2.0.5
@@ -7,6 +7,8 @@
 #include "sleep.h"

 #ifdef HAS_NCP5623
+#include <Wire.h>
+
 #include <NCP5623.h>
 #endif

@@ -4,6 +4,7 @@
 #include "configuration.h"
 #include "main.h"
 #include "sleep.h"
+#include <memory>

 #ifdef HAS_I2S
 #include <AudioFileSourcePROGMEM.h>
@@ -29,9 +30,9 @@ class AudioThread : public concurrency::OSThread
        io.digitalWrite(EXPANDS_AMP_EN, HIGH);
 #endif
        setCPUFast(true);
-        rtttlFile = new AudioFileSourcePROGMEM(data, len);
-        i2sRtttl = new AudioGeneratorRTTTL();
-        i2sRtttl->begin(rtttlFile, audioOut);
+        rtttlFile = std::unique_ptr<AudioFileSourcePROGMEM>(new AudioFileSourcePROGMEM(data, len));
+        i2sRtttl = std::unique_ptr<AudioGeneratorRTTTL>(new AudioGeneratorRTTTL());
+        i2sRtttl->begin(rtttlFile.get(), audioOut.get());
    }

    // Also handles actually playing the RTTTL, needs to be called in loop
@@ -47,14 +48,10 @@ class AudioThread : public concurrency::OSThread
    {
        if (i2sRtttl != nullptr) {
            i2sRtttl->stop();
-            delete i2sRtttl;
            i2sRtttl = nullptr;
        }

-        if (rtttlFile != nullptr) {
-            delete rtttlFile;
-            rtttlFile = nullptr;
-        }
+        rtttlFile = nullptr;

        setCPUFast(false);
 #ifdef T_LORA_PAGER
@@ -66,16 +63,14 @@ class AudioThread : public concurrency::OSThread
    {
        if (i2sRtttl != nullptr) {
            i2sRtttl->stop();
-            delete i2sRtttl;
            i2sRtttl = nullptr;
        }

 #ifdef T_LORA_PAGER
        io.digitalWrite(EXPANDS_AMP_EN, HIGH);
 #endif
-        ESP8266SAM *sam = new ESP8266SAM;
-        sam->Say(audioOut, text);
-        delete sam;
+        auto sam = std::unique_ptr<ESP8266SAM>(new ESP8266SAM);
+        sam->Say(audioOut.get(), text);
        setCPUFast(false);
 #ifdef T_LORA_PAGER
        io.digitalWrite(EXPANDS_AMP_EN, LOW);
@@ -96,15 +91,15 @@ class AudioThread : public concurrency::OSThread
  private:
    void initOutput()
    {
-        audioOut = new AudioOutputI2S(1, AudioOutputI2S::EXTERNAL_I2S);
+        audioOut = std::unique_ptr<AudioOutputI2S>(new AudioOutputI2S(1, AudioOutputI2S::EXTERNAL_I2S));
        audioOut->SetPinout(DAC_I2S_BCK, DAC_I2S_WS, DAC_I2S_DOUT, DAC_I2S_MCLK);
        audioOut->SetGain(0.2);
    };

-    AudioGeneratorRTTTL *i2sRtttl = nullptr;
-    AudioOutputI2S *audioOut = nullptr;
+    std::unique_ptr<AudioGeneratorRTTTL> i2sRtttl = nullptr;
+    std::unique_ptr<AudioOutputI2S> audioOut = nullptr;

-    AudioFileSourcePROGMEM *rtttlFile = nullptr;
+    std::unique_ptr<AudioFileSourcePROGMEM> rtttlFile = nullptr;
 };

 #endif
@@ -704,11 +704,11 @@ bool Power::setup()
        found = true;
    } else if (analogInit()) {
        found = true;
-    }
-
+    } else {
 #ifdef NRF_APM
-    found = true;
+        found = true;
 #endif
+    }
 #ifdef EXT_PWR_DETECT
    attachInterrupt(
        EXT_PWR_DETECT,
@@ -846,8 +846,10 @@ void Power::readPowerStatus()

    if (batteryLevel) {
        hasBattery = batteryLevel->isBatteryConnect() ? OptTrue : OptFalse;
+#ifndef NRF_APM
        usbPowered = batteryLevel->isVbusIn() ? OptTrue : OptFalse;
        isChargingNow = batteryLevel->isCharging() ? OptTrue : OptFalse;
+#endif
        if (hasBattery) {
            batteryVoltageMv = batteryLevel->getBattVoltage();
            // If the AXP192 returns a valid battery percentage, use it
@@ -182,7 +182,11 @@ static void darkEnter()
 static void serialEnter()
 {
    LOG_POWERFSM("State: serialEnter");
+#ifndef ARCH_NRF52
+    // nRF52 runs BLE on SoftDevice independently of USB serial — no need to disable it.
+    // (Same rationale as nbEnter() which already guards this with #ifdef ARCH_ESP32)
    setBluetoothEnable(false);
+#endif
    if (screen) {
        screen->setOn(true);
    }
@@ -227,34 +227,21 @@ void RedirectablePrint::log_to_ble(const char *logLevel, const char *format, va_
        isBleConnected = nrf52Bluetooth != nullptr && nrf52Bluetooth->isConnected();
 #endif
        if (isBleConnected) {
-            char *message;
-            size_t initialLen;
-            size_t len;
-            initialLen = strlen(format);
-            message = new char[initialLen + 1];
-            len = vsnprintf(message, initialLen + 1, format, arg);
-            if (len > initialLen) {
-                delete[] message;
-                message = new char[len + 1];
-                vsnprintf(message, len + 1, format, arg);
-            }
            auto thread = concurrency::OSThread::currentThread;
            meshtastic_LogRecord logRecord = meshtastic_LogRecord_init_zero;
            logRecord.level = getLogLevel(logLevel);
-            strcpy(logRecord.message, message);
+            vsprintf(logRecord.message, format, arg);
            if (thread)
                strcpy(logRecord.source, thread->ThreadName.c_str());
            logRecord.time = getValidTime(RTCQuality::RTCQualityDevice, true);

-            uint8_t *buffer = new uint8_t[meshtastic_LogRecord_size];
-            size_t size = pb_encode_to_bytes(buffer, meshtastic_LogRecord_size, meshtastic_LogRecord_fields, &logRecord);
+            auto buffer = std::unique_ptr<uint8_t[]>(new uint8_t[meshtastic_LogRecord_size]);
+            size_t size = pb_encode_to_bytes(buffer.get(), meshtastic_LogRecord_size, meshtastic_LogRecord_fields, &logRecord);
 #ifdef ARCH_ESP32
-            nimbleBluetooth->sendLog(buffer, size);
+            nimbleBluetooth->sendLog(buffer.get(), size);
 #elif defined(ARCH_NRF52)
-            nrf52Bluetooth->sendLog(buffer, size);
+            nrf52Bluetooth->sendLog(buffer.get(), size);
 #endif
-            delete[] message;
-            delete[] buffer;
        }
    }
 #else
@@ -292,8 +279,8 @@ void RedirectablePrint::log(const char *logLevel, const char *format, ...)

    // append \n to format
    size_t len = strlen(format);
-    char *newFormat = new char[len + 2];
-    strcpy(newFormat, format);
+    auto newFormat = std::unique_ptr<char[]>(new char[len + 2]);
+    strcpy(newFormat.get(), format);
    newFormat[len] = '\n';
    newFormat[len + 1] = '\0';

@@ -310,23 +297,18 @@ void RedirectablePrint::log(const char *logLevel, const char *format, ...)
            va_end(arg);
        }
        if (portduino_config.logoutputlevel < level_trace && strcmp(logLevel, MESHTASTIC_LOG_LEVEL_TRACE) == 0) {
-            delete[] newFormat;
            return;
        }
    }
    if (portduino_config.logoutputlevel < level_debug && strcmp(logLevel, MESHTASTIC_LOG_LEVEL_DEBUG) == 0) {
-        delete[] newFormat;
        return;
    } else if (portduino_config.logoutputlevel < level_info && strcmp(logLevel, MESHTASTIC_LOG_LEVEL_INFO) == 0) {
-        delete[] newFormat;
        return;
    } else if (portduino_config.logoutputlevel < level_warn && strcmp(logLevel, MESHTASTIC_LOG_LEVEL_WARN) == 0) {
-        delete[] newFormat;
        return;
    }
 #endif
    if (moduleConfig.serial.override_console_serial_port && strcmp(logLevel, MESHTASTIC_LOG_LEVEL_DEBUG) == 0) {
-        delete[] newFormat;
        return;
    }

@@ -338,11 +320,19 @@ void RedirectablePrint::log(const char *logLevel, const char *format, ...)
 #endif

        va_list arg;
+        va_list arg_copy;
+
        va_start(arg, format);

-        log_to_serial(logLevel, newFormat, arg);
-        log_to_syslog(logLevel, newFormat, arg);
-        log_to_ble(logLevel, newFormat, arg);
+        va_copy(arg_copy, arg);
+        log_to_serial(logLevel, newFormat.get(), arg_copy);
+        va_end(arg_copy);
+
+        va_copy(arg_copy, arg);
+        log_to_syslog(logLevel, newFormat.get(), arg_copy);
+        va_end(arg_copy);
+
+        log_to_ble(logLevel, newFormat.get(), arg);

        va_end(arg);
 #ifdef HAS_FREE_RTOS
@@ -352,7 +342,6 @@ void RedirectablePrint::log(const char *logLevel, const char *format, ...)
 #endif
    }

-    delete[] newFormat;
    return;
 }

@@ -35,6 +35,8 @@ void consoleInit()
 #if defined(SERIAL_HAS_ON_RECEIVE)
    // onReceive does only exist for HardwareSerial not for USB CDC serial
    Port.onReceive([sc]() { sc->rxInt(); });
+#else
+    (void)sc;
 #endif
    DEBUG_PORT.rpInit(); // Simply sets up semaphore
 }
@@ -76,8 +76,10 @@ bool NotifiedWorkerThread::notifyLater(uint32_t delay, uint32_t v, bool overwrit

 void NotifiedWorkerThread::checkNotification()
 {
-    auto n = notification;
-    notification = 0; // clear notification
+    // Atomically read and clear. (This avoids a potential race condition where an interrupt handler could set a new notification
+    // after checkNotification reads but before it clears, which would cause us to miss that notification until the next one comes
+    // in.)
+    auto n = notification.exchange(0); // read+clear atomically: like `n = notification; notification = 0;` but interrupt-safe
    if (n) {
        onNotify(n);
    }
@@ -1,6 +1,7 @@
 #pragma once

 #include "OSThread.h"
+#include <atomic>

 namespace concurrency
 {
@@ -13,7 +14,7 @@ class NotifiedWorkerThread : public OSThread
    /**
     * The notification that was most recently used to wake the thread.  Read from runOnce()
     */
-    uint32_t notification = 0;
+    std::atomic<uint32_t> notification{0};

  public:
    NotifiedWorkerThread(const char *name) : OSThread(name) {}
@@ -1,24 +1,29 @@
 #pragma once

+#include <functional>
+#include <utility>
+
 #include "concurrency/OSThread.h"

 namespace concurrency
 {

 /**
- * @brief Periodically invoke a callback. This just provides C-style callback conventions
- *        rather than a virtual function - FIXME, remove?
+ * @brief Periodically invoke a callback.
+ *        Supports both legacy function pointers and modern callables.
 */
 class Periodic : public OSThread
 {
-    int32_t (*callback)();
-
  public:
    // callback returns the period for the next callback invocation (or 0 if we should no longer be called)
-    Periodic(const char *name, int32_t (*_callback)()) : OSThread(name), callback(_callback) {}
+    Periodic(const char *name, int32_t (*cb)()) : OSThread(name), callback(cb) {}
+    Periodic(const char *name, std::function<int32_t()> cb) : OSThread(name), callback(std::move(cb)) {}

  protected:
-    int32_t runOnce() override { return callback(); }
+    int32_t runOnce() override { return callback ? callback() : 0; }
+
+  private:
+    std::function<int32_t()> callback;
 };

 } // namespace concurrency
@@ -244,6 +244,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #define BQ25896_ADDR 0x6B
 #define LTR553ALS_ADDR 0x23
 #define SEN5X_ADDR 0x69
+#define SCD30_ADDR 0x61

 // -----------------------------------------------------------------------------
 // ACCELEROMETER
@@ -527,5 +528,69 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #define HAS_SCREEN 0
 #endif

+// -----------------------------------------------------------------------------
+// MESHTASTIC_LOCKDOWN — combined hardened build flag
+//
+// All targets:
+//   DEBUG_MUTE                         — suppress serial/USB log output
+//   MESHTASTIC_EXCLUDE_*               — strip non-essential modules
+//   MESHTASTIC_PHONEAPI_ACCESS_CONTROL — redact keys from unauthenticated BLE/USB/TCP clients
+//   HARDENED_DEFAULTS                  — set is_managed, RANDOM_PIN, TAK role at first boot
+//
+// nRF52 (CC310 hardware crypto):
+//   MESHTASTIC_ENCRYPTED_STORAGE       — AES-128-CTR + HMAC-SHA256 at-rest encryption
+//   MESHTASTIC_ENABLE_APPROTECT        — write UICR APPROTECT to block debug probe
+//
+// ESP32 (stub — mbedTLS crypto TODO):
+//   MESHTASTIC_ENCRYPTED_STORAGE       — same API, plaintext pass-through until ported
+//   APPROTECT equivalent               — burn JTAG_DISABLE + flash encryption via espsecure.py
+// -----------------------------------------------------------------------------
+#ifdef MESHTASTIC_LOCKDOWN
+
+// Suppress all serial/USB-CDC log output — prevents info leakage via physical access
+#define DEBUG_MUTE
+
+// Strip non-essential modules to reduce attack surface
+#define MESHTASTIC_EXCLUDE_DETECTIONSENSOR 1
+#define MESHTASTIC_EXCLUDE_ENVIRONMENTAL_SENSOR 1
+#define MESHTASTIC_EXCLUDE_AIR_QUALITY 1
+#define MESHTASTIC_EXCLUDE_HEALTH_TELEMETRY 1
+#define MESHTASTIC_EXCLUDE_POWER_TELEMETRY 1
+#define MESHTASTIC_EXCLUDE_RANGETEST 1
+#define MESHTASTIC_EXCLUDE_REMOTEHARDWARE 1
+#define MESHTASTIC_EXCLUDE_STOREFORWARD 1
+#define MESHTASTIC_EXCLUDE_CANNEDMESSAGES 1
+#define MESHTASTIC_EXCLUDE_SERIAL 1
+#define MESHTASTIC_EXCLUDE_POWERSTRESS 1
+#define MESHTASTIC_EXCLUDE_DROPZONE 1
+#define MESHTASTIC_EXCLUDE_REPLYBOT 1
+#define MESHTASTIC_EXCLUDE_PAXCOUNTER 1
+#define MESHTASTIC_EXCLUDE_AUDIO 1
+#define MESHTASTIC_EXCLUDE_STATUS 1
+#define MESHTASTIC_EXCLUDE_GENERIC_THREAD_MODULE 1
+#define MESHTASTIC_EXCLUDE_POWERMON 1
+#define MESHTASTIC_EXCLUDE_EXTERNALNOTIFICATION 1
+
+// Access control and hardened defaults are pure C++ — no platform-specific deps.
+#define MESHTASTIC_PHONEAPI_ACCESS_CONTROL 1
+#define HARDENED_DEFAULTS 1
+
+// Platform-specific security features:
+#if defined(ARCH_NRF52)
+// Full encrypted storage via CC310 hardware AES-128-CTR + HMAC-SHA256.
+#define MESHTASTIC_ENCRYPTED_STORAGE 1
+// Hardware JTAG/SWD lockout: firmware writes NRF_UICR->APPROTECT = 0x00 once.
+#define MESHTASTIC_ENABLE_APPROTECT 1
+#elif defined(ARCH_ESP32)
+// Encrypted storage stub: plaintext pass-through, same API, crypto TODO (mbedTLS).
+// APPROTECT equivalent: burn JTAG_DISABLE eFuse and enable flash encryption
+// via espsecure.py at provisioning time — not firmware-controlled.
+#define MESHTASTIC_ENCRYPTED_STORAGE 1
+#else
+#warning "MESHTASTIC_LOCKDOWN: encrypted storage not available on this platform; access control and hardened defaults still active"
+#endif
+
+#endif // MESHTASTIC_LOCKDOWN
+
 #include "DebugConfiguration.h"
 #include "RF95Configuration.h"
@@ -91,7 +91,8 @@ class ScanI2C
        CST226SE,
        SEN5X,
        SFA30,
-        CW2015
+        CW2015,
+        SCD30
    } DeviceType;

    // typedef uint8_t DeviceAddress;
@@ -117,6 +117,25 @@ uint16_t ScanI2CTwoWire::getRegisterValue(const ScanI2CTwoWire::RegisterLocation
    return value;
 }

+bool ScanI2CTwoWire::i2cCommandResponseLength(ScanI2C::DeviceAddress addr, uint16_t command, uint8_t expectedLength) const
+{
+    TwoWire *i2cBus = fetchI2CBus(addr);
+    i2cBus->beginTransmission(addr.address);
+    if (command > 0xFF) {
+        i2cBus->write((uint8_t)(command >> 8));
+    }
+    i2cBus->write((uint8_t)(command & 0xFF));
+    if (i2cBus->endTransmission() != 0) {
+        return false;
+    }
+    delay(20);
+    uint8_t received = i2cBus->requestFrom(addr.address, expectedLength);
+    bool match = (received == expectedLength);
+    while (i2cBus->available())
+        i2cBus->read();
+    return match;
+}
+
 /// for SEN5X detection
 // Note, this code needs to be called before setting the I2C bus speed
 // for the screen at high speed. The speed needs to be at 100kHz, otherwise
@@ -432,8 +451,7 @@ void ScanI2CTwoWire::scanPort(I2CPort port, uint8_t *address, uint8_t asize)
                if (getRegisterValue(ScanI2CTwoWire::RegisterLocation(addr, 0x7E), 2) == 0x5449) {
                    type = OPT3001;
                    logFoundDevice("OPT3001", (uint8_t)addr.address);
-                } else if (getRegisterValue(ScanI2CTwoWire::RegisterLocation(addr, 0x89), 6) !=
-                           0) { // unique SHT4x serial number (6 bytes inc. CRC)
+                } else if (i2cCommandResponseLength(addr, 0x89, 6)) { // SHT4x serial number (6 bytes inc. CRC)
                    type = SHT4X;
                    logFoundDevice("SHT4X", (uint8_t)addr.address);
                } else {
@@ -458,13 +476,19 @@ void ScanI2CTwoWire::scanPort(I2CPort port, uint8_t *address, uint8_t asize)
                break;

            case LPS22HB_ADDR_ALT:
-                registerValue = getRegisterValue(ScanI2CTwoWire::RegisterLocation(addr, 0xD060), 48); // get device marking
-                if (registerValue != 0) {
+                // SFA30 detection: send 2-byte command 0xD060 (Get Device Marking) and check for 48-byte response
+                if (i2cCommandResponseLength(addr, 0xD060, 48)) {
                    type = SFA30;
                    logFoundDevice("SFA30", (uint8_t)addr.address);
                    break;
                }
-                // TODO - What happens with these two?
+                // Fallback: LPS22HB detection at alternate address using WHO_AM_I register (0x0F == 0xB1)
+                registerValue = getRegisterValue(ScanI2CTwoWire::RegisterLocation(addr, 0x0F), 1);
+                if (registerValue == 0xB1) {
+                    type = LPS22HB;
+                    logFoundDevice("LPS22HB", (uint8_t)addr.address);
+                }
+                break;
                SCAN_SIMPLE_CASE(LPS22HB_ADDR, LPS22HB, "LPS22HB", (uint8_t)addr.address)
                SCAN_SIMPLE_CASE(QMC6310U_ADDR, QMC6310U, "QMC6310U", (uint8_t)addr.address)

@@ -557,6 +581,7 @@ void ScanI2CTwoWire::scanPort(I2CPort port, uint8_t *address, uint8_t asize)
                SCAN_SIMPLE_CASE(DFROBOT_RAIN_ADDR, DFROBOT_RAIN, "DFRobot Rain Gauge", (uint8_t)addr.address);
                SCAN_SIMPLE_CASE(LTR390UV_ADDR, LTR390UV, "LTR390UV", (uint8_t)addr.address);
                SCAN_SIMPLE_CASE(PCT2075_ADDR, PCT2075, "PCT2075", (uint8_t)addr.address);
+                SCAN_SIMPLE_CASE(SCD30_ADDR, SCD30, "SCD30", (uint8_t)addr.address);
            case CST328_ADDR:
                // Do we have the CST328 or the CST226SE
                registerValue = getRegisterValue(ScanI2CTwoWire::RegisterLocation(addr, 0xAB), 1);
@@ -55,6 +55,8 @@ class ScanI2CTwoWire : public ScanI2C

    uint16_t getRegisterValue(const RegisterLocation &, ResponseWidth, bool) const;

+    bool i2cCommandResponseLength(DeviceAddress addr, uint16_t command, uint8_t expectedLength) const;
+
    DeviceType probeOLED(ScanI2C::DeviceAddress) const;

    static void logFoundDevice(const char *device, uint8_t address);
@@ -52,7 +52,7 @@ SerialUART *GPS::_serial_gps = &GPS_SERIAL_PORT;
 HardwareSerial *GPS::_serial_gps = nullptr;
 #endif

-GPS *gps = nullptr;
+std::unique_ptr<GPS> gps = nullptr;

 static GPSUpdateScheduling scheduling;

@@ -127,7 +127,7 @@ static int32_t gpsSwitch()
    return 1000;
 }

-static concurrency::Periodic *gpsPeriodic;
+static std::unique_ptr<concurrency::Periodic> gpsPeriodic;
 #endif

 static void UBXChecksum(uint8_t *message, size_t length)
@@ -1485,7 +1485,7 @@ GnssModel_t GPS::getProbeResponse(unsigned long timeout, const std::vector<ChipI
    if (bufferSize > 2048)
        bufferSize = 2048;

-    char *response = new char[bufferSize](); // Dynamically allocate based on baud rate
+    auto response = std::unique_ptr<char[]>(new char[bufferSize]); // Dynamically allocate based on baud rate
    uint16_t responseLen = 0;
    unsigned long start = millis();
    while (millis() - start < timeout) {
@@ -1501,19 +1501,18 @@ GnssModel_t GPS::getProbeResponse(unsigned long timeout, const std::vector<ChipI
            if (c == ',' || (responseLen >= 2 && response[responseLen - 2] == '\r' && response[responseLen - 1] == '\n')) {
                // check if we can see our chips
                for (const auto &chipInfo : responseMap) {
-                    if (strstr(response, chipInfo.detectionString.c_str()) != nullptr) {
+                    if (strstr(response.get(), chipInfo.detectionString.c_str()) != nullptr) {
 #ifdef GPS_DEBUG
-                        LOG_DEBUG(response);
+                        LOG_DEBUG(response.get());
 #endif
                        LOG_INFO("%s detected", chipInfo.chipName.c_str());
-                        delete[] response; // Cleanup before return
                        return chipInfo.driver;
                    }
                }
            }
            if (responseLen >= 2 && response[responseLen - 2] == '\r' && response[responseLen - 1] == '\n') {
 #ifdef GPS_DEBUG
-                LOG_DEBUG(response);
+                LOG_DEBUG(response.get());
 #endif
                // Reset the response buffer for the next potential message
                responseLen = 0;
@@ -1522,13 +1521,12 @@ GnssModel_t GPS::getProbeResponse(unsigned long timeout, const std::vector<ChipI
        }
    }
 #ifdef GPS_DEBUG
-    LOG_DEBUG(response);
+    LOG_DEBUG(response.get());
 #endif
-    delete[] response;         // Cleanup before return
    return GNSS_MODEL_UNKNOWN; // Return unknown on timeout
 }

-GPS *GPS::createGps()
+std::unique_ptr<GPS> GPS::createGps()
 {
    int8_t _rx_gpio = config.position.rx_gpio;
    int8_t _tx_gpio = config.position.tx_gpio;
@@ -1553,7 +1551,7 @@ GPS *GPS::createGps()
    if (!_rx_gpio || !_serial_gps) // Configured to have no GPS at all
        return nullptr;

-    GPS *new_gps = new GPS;
+    auto new_gps = std::unique_ptr<GPS>(new GPS());
    new_gps->rx_gpio = _rx_gpio;
    new_gps->tx_gpio = _tx_gpio;

@@ -1581,7 +1579,7 @@ GPS *GPS::createGps()
 #ifdef PIN_GPS_SWITCH
    // toggle GPS via external GPIO switch
    pinMode(PIN_GPS_SWITCH, INPUT);
-    gpsPeriodic = new concurrency::Periodic("GPSSwitch", gpsSwitch);
+    gpsPeriodic = std::unique_ptr<concurrency::Periodic>(new concurrency::Periodic("GPSSwitch", gpsSwitch));
 #endif

 // Currently disabled per issue #525 (TinyGPS++ crash bug)
@@ -2,6 +2,8 @@
 #include "configuration.h"
 #if !MESHTASTIC_EXCLUDE_GPS

+#include <memory>
+
 #include "GPSStatus.h"
 #include "GpioLogic.h"
 #include "Observer.h"
@@ -118,7 +120,7 @@ class GPS : private concurrency::OSThread

    // Creates an instance of the GPS class.
    // Returns the new instance or null if the GPS is not present.
-    static GPS *createGps();
+    static std::unique_ptr<GPS> createGps();

    // Wake the GPS hardware - ready for an update
    void up();
@@ -256,5 +258,5 @@ class GPS : private concurrency::OSThread
    uint8_t fixeddelayCtr = 0;
 };

-extern GPS *gps;
+extern std::unique_ptr<GPS> gps;
 #endif // Exclude GPS
@@ -312,7 +312,7 @@ const char *RtcName(RTCQuality quality)
 * @param t The time to potentially set the RTC to.
 * @return True if the RTC was set to the provided time, false otherwise.
 */
-RTCSetResult perhapsSetRTC(RTCQuality q, struct tm &t)
+RTCSetResult perhapsSetRTC(RTCQuality q, const struct tm &t)
 {
    /* Convert to unix time
    The Unix epoch (or Unix time or POSIX time or Unix timestamp) is the number of seconds that have elapsed since January 1, 1970
@@ -41,7 +41,7 @@ extern uint32_t lastSetFromPhoneNtpOrGps;

 /// If we haven't yet set our RTC this boot, set it from a GPS derived time
 RTCSetResult perhapsSetRTC(RTCQuality q, const struct timeval *tv, bool forceUpdate = false);
-RTCSetResult perhapsSetRTC(RTCQuality q, struct tm &t);
+RTCSetResult perhapsSetRTC(RTCQuality q, const struct tm &t);

 /// Return a string name for the quality
 const char *RtcName(RTCQuality quality);
@@ -259,6 +259,17 @@ bool EInkDisplay::connect()
        adafruitDisplay->setRotation(3);
        adafruitDisplay->setPartialWindow(0, 0, EINK_WIDTH, EINK_HEIGHT);
    }
+#elif defined(MINI_EPAPER_S3)
+    spi1 = new SPIClass(HSPI);
+    spi1->begin(PIN_SPI1_SCK, PIN_SPI1_MISO, PIN_SPI1_MOSI, PIN_EINK_CS);
+
+    // Create GxEPD2 objects
+    auto lowLevel = new EINK_DISPLAY_MODEL(PIN_EINK_CS, PIN_EINK_DC, PIN_EINK_RES, PIN_EINK_BUSY, *spi1);
+    adafruitDisplay = new GxEPD2_BW<EINK_DISPLAY_MODEL, EINK_DISPLAY_MODEL::HEIGHT>(*lowLevel);
+
+    // Init GxEPD2
+    adafruitDisplay->init();
+    adafruitDisplay->setRotation(1);
 #elif defined(HELTEC_WIRELESS_PAPER) || defined(HELTEC_VISION_MASTER_E213)

    // Detect display model, before starting SPI
@@ -93,7 +93,8 @@ class EInkDisplay : public OLEDDisplay
    SPIClass *hspi = NULL;
 #endif

-#if defined(HELTEC_MESH_POCKET) || defined(SEEED_WIO_TRACKER_L1_EINK) || defined(HELTEC_MESH_SOLAR_EINK)
+#if defined(HELTEC_MESH_POCKET) || defined(SEEED_WIO_TRACKER_L1_EINK) || defined(HELTEC_MESH_SOLAR_EINK) ||                      \
+    defined(MINI_EPAPER_S3)
    SPIClass *spi1 = NULL;
 #endif

@@ -10,7 +10,7 @@ EInkDynamicDisplay::EInkDynamicDisplay(uint8_t address, int sda, int scl, OLEDDI
 {
    // If tracking ghost pixels, grab memory
 #ifdef EINK_LIMIT_GHOSTING_PX
-    dirtyPixels = new uint8_t[EInkDisplay::displayBufferSize](); // Init with zeros
+    dirtyPixels = std::unique_ptr<uint8_t[]>(new uint8_t[EInkDisplay::displayBufferSize]()); // Init with zeros
 #endif
 }

@@ -19,7 +19,7 @@ EInkDynamicDisplay::~EInkDynamicDisplay()
 {
    // If we were tracking ghost pixels, free the memory
 #ifdef EINK_LIMIT_GHOSTING_PX
-    delete[] dirtyPixels;
+    dirtyPixels = nullptr;
 #endif
 }

@@ -454,7 +454,7 @@ void EInkDynamicDisplay::checkExcessiveGhosting()
 void EInkDynamicDisplay::resetGhostPixelTracking()
 {
    // Copy the current frame into dirtyPixels[] from the display buffer
-    memcpy(dirtyPixels, EInkDisplay::buffer, EInkDisplay::displayBufferSize);
+    memcpy(dirtyPixels.get(), EInkDisplay::buffer, EInkDisplay::displayBufferSize);
 }
 #endif // EINK_LIMIT_GHOSTING_PX

@@ -1,6 +1,7 @@
 #pragma once

 #include "configuration.h"
+#include <memory>

 #if defined(USE_EINK) && defined(USE_EINK_DYNAMICDISPLAY)

@@ -116,11 +117,11 @@ class EInkDynamicDisplay : public EInkDisplay, protected concurrency::NotifiedWo
    // Optional - track ghosting, pixel by pixel
    // May 2024: no longer used by any display. Kept for possible future use.
 #ifdef EINK_LIMIT_GHOSTING_PX
-    void countGhostPixels();        // Count any pixels which have moved from black to white since last full-refresh
-    void checkExcessiveGhosting();  // Check if ghosting exceeds defined limit
-    void resetGhostPixelTracking(); // Clear the dirty pixels array. Call when full-refresh cleans the display.
-    uint8_t *dirtyPixels;           // Any pixels that have been black since last full-refresh (dynamically allocated mem)
-    uint32_t ghostPixelCount = 0;   // Number of pixels with problematic ghosting. Retained here for LOG_DEBUG use
+    void countGhostPixels();                // Count any pixels which have moved from black to white since last full-refresh
+    void checkExcessiveGhosting();          // Check if ghosting exceeds defined limit
+    void resetGhostPixelTracking();         // Clear the dirty pixels array. Call when full-refresh cleans the display.
+    std::unique_ptr<uint8_t[]> dirtyPixels; // Any pixels that have been black since last full-refresh (dynamically allocated mem)
+    uint32_t ghostPixelCount = 0;           // Number of pixels with problematic ghosting. Retained here for LOG_DEBUG use
 #endif

    // Conditional - async full refresh - only with modified meshtastic/GxEPD2
@@ -1,4 +1,6 @@
 #ifdef HAS_LP5562
+#include <Wire.h>
+
 #include <LP5562.h>
 extern LP5562 rgbw;

@@ -875,6 +875,10 @@ int32_t Screen::runOnce()
            break;
        case Cmd::STOP_ALERT_FRAME:
            NotificationRenderer::pauseBanner = false;
+            // Return from one-off alert mode back to regular frames.
+            if (!showingNormalScreen && NotificationRenderer::current_notification_type != notificationTypeEnum::text_input) {
+                setFrames();
+            }
            break;
        case Cmd::STOP_BOOT_SCREEN:
            EINK_ADD_FRAMEFLAG(dispdev, COSMETIC); // E-Ink: Explicitly use full-refresh for next frame
@@ -1209,8 +1209,8 @@ void TFTDisplay::display(bool fromBlank)
    bool somethingChanged = false;

    // Store colors byte-reversed so that TFT_eSPI doesn't have to swap bytes in a separate step
-    colorTftMesh = (TFT_MESH >> 8) | ((TFT_MESH & 0xFF) << 8);
-    colorTftBlack = (TFT_BLACK >> 8) | ((TFT_BLACK & 0xFF) << 8);
+    colorTftMesh = __builtin_bswap16(TFT_MESH);
+    colorTftBlack = __builtin_bswap16(TFT_BLACK);

    y = 0;
    while (y < displayHeight) {
@@ -539,7 +539,7 @@ void menuHandler::messageResponseMenu()
    // If viewing ALL chats, hide “Mute Chat”
    if (mode != graphics::MessageRenderer::ThreadMode::ALL && mode != graphics::MessageRenderer::ThreadMode::DIRECT) {
        const uint8_t chIndex = (threadChannel != 0) ? (uint8_t)threadChannel : channels.getPrimaryIndex();
-        auto &chan = channels.getByIndex(chIndex);
+        const auto &chan = channels.getByIndex(chIndex);

        optionsArray[options] = chan.settings.module_settings.is_muted ? "Unmute Channel" : "Mute Channel";
        optionsEnumArray[options++] = MuteChannel;
@@ -831,7 +831,7 @@ void menuHandler::messageViewModeMenu()
    // Gather unique peers
    auto dms = messageStore.getDirectMessages();
    std::vector<uint32_t> uniquePeers;
-    for (auto &m : dms) {
+    for (const auto &m : dms) {
        uint32_t peer = (m.sender == nodeDB->getNodeNum()) ? m.dest : m.sender;
        if (peer != nodeDB->getNodeNum() && std::find(uniquePeers.begin(), uniquePeers.end(), peer) == uniquePeers.end())
            uniquePeers.push_back(peer);
@@ -1397,7 +1397,7 @@ void menuHandler::manageNodeMenu()
        }

        if (selected == Favorite) {
-            auto n = nodeDB->getMeshNode(menuHandler::pickedNodeNum);
+            const auto *n = nodeDB->getMeshNode(menuHandler::pickedNodeNum);
            if (!n) {
                return;
            }
@@ -2292,14 +2292,13 @@ void menuHandler::wifiToggleMenu()
 void menuHandler::screenOptionsMenu()
 {
    // Check if brightness is supported
-    bool hasSupportBrightness = false;
-#if defined(ST7789_CS) || defined(USE_OLED) || defined(USE_SSD1306) || defined(USE_SH1106) || defined(USE_SH1107)
-    hasSupportBrightness = true;
-#endif
-
 #if defined(T_DECK)
    // TDeck Doesn't seem to support brightness at all, at least not reliably
-    hasSupportBrightness = false;
+    bool hasSupportBrightness = false;
+#elif defined(ST7789_CS) || defined(USE_OLED) || defined(USE_SSD1306) || defined(USE_SH1106) || defined(USE_SH1107)
+    bool hasSupportBrightness = true;
+#else
+    bool hasSupportBrightness = false;
 #endif

    enum optionsNumbers { Back, Brightness, ScreenColor, FrameToggles, DisplayUnits, MessageBubbles };
@@ -2444,7 +2443,7 @@ void menuHandler::frameTogglesMenu()
        nodelist_hopsignal,
        nodelist_distance,
        nodelist_bearings,
-        gps,
+        gps_position,
        lora,
        clock,
        show_favorites,
@@ -2482,7 +2481,7 @@ void menuHandler::frameTogglesMenu()
 #endif

    optionsArray[options] = screen->isFrameHidden("gps") ? "Show Position" : "Hide Position";
-    optionsEnumArray[options++] = gps;
+    optionsEnumArray[options++] = gps_position;
 #endif

    optionsArray[options] = screen->isFrameHidden("lora") ? "Show LoRa" : "Hide LoRa";
@@ -2545,7 +2544,7 @@ void menuHandler::frameTogglesMenu()
            screen->toggleFrameVisibility("nodelist_bearings");
            menuHandler::menuQueue = menuHandler::FrameToggles;
            screen->runNow();
-        } else if (selected == gps) {
+        } else if (selected == gps_position) {
            screen->toggleFrameVisibility("gps");
            menuHandler::menuQueue = menuHandler::FrameToggles;
            screen->runNow();
@@ -171,7 +171,7 @@ unsigned long getModeCycleIntervalMs()

 int calculateMaxScroll(int totalEntries, int visibleRows)
 {
-    return std::max(0, (totalEntries - 1) / (visibleRows * 2));
+    return max(0, (totalEntries - 1) / (visibleRows * 2));
 }

 void drawColumnSeparator(OLEDDisplay *display, int16_t x, int16_t yStart, int16_t yEnd)
@@ -187,13 +187,12 @@ void drawScrollbar(OLEDDisplay *display, int visibleNodeRows, int totalEntries,
    if (totalEntries <= visibleNodeRows * columns)
        return;

-    int scrollbarX = display->getWidth() - 2;
    int scrollbarHeight = display->getHeight() - scrollStartY - 10;
-    int thumbHeight = std::max(4, (scrollbarHeight * visibleNodeRows * columns) / totalEntries);
-    int perPage = visibleNodeRows * columns;
-    int maxScroll = std::max(0, (totalEntries - 1) / perPage);
-    int thumbY = scrollStartY + (scrollIndex * (scrollbarHeight - thumbHeight)) / std::max(1, maxScroll);
+    int thumbHeight = max(4, (scrollbarHeight * visibleNodeRows * columns) / totalEntries);
+    int thumbY = scrollStartY + (scrollIndex * (scrollbarHeight - thumbHeight)) /
+                                    max(1, max(0, (totalEntries - 1) / (visibleNodeRows * columns)));

+    int scrollbarX = display->getWidth() - 2;
    for (int i = 0; i < thumbHeight; i++) {
        display->setPixel(scrollbarX, thumbY + i);
    }
@@ -556,13 +555,13 @@ void drawNodeListScreen(OLEDDisplay *display, OLEDDisplayUiState *state, int16_t

    int maxScroll = 0;
    if (perPage > 0) {
-        maxScroll = std::max(0, (totalEntries - 1) / perPage);
+        maxScroll = max(0, (totalEntries - 1) / perPage);
    }

    if (scrollIndex > maxScroll)
        scrollIndex = maxScroll;
    int startIndex = scrollIndex * visibleNodeRows * totalColumns;
-    int endIndex = std::min(startIndex + visibleNodeRows * totalColumns, totalEntries);
+    int endIndex = min(startIndex + visibleNodeRows * totalColumns, totalEntries);
    int yOffset = 0;
    int col = 0;
    int lastNodeY = y;
@@ -580,7 +579,7 @@ void drawNodeListScreen(OLEDDisplay *display, OLEDDisplayUiState *state, int16_t
        if (extras)
            extras(display, node, xPos, yPos, columnWidth, heading, lat, lon);

-        lastNodeY = std::max(lastNodeY, yPos + FONT_HEIGHT_SMALL);
+        lastNodeY = max(lastNodeY, yPos + FONT_HEIGHT_SMALL);
        yOffset += rowYOffset;
        shownCount++;
        rowCount++;
@@ -613,13 +612,11 @@ void drawNodeListScreen(OLEDDisplay *display, OLEDDisplayUiState *state, int16_t
    if (millis() - popupTime < POPUP_DURATION_MS) {
        popupTotal = totalEntries;

-        int perPage = visibleNodeRows * totalColumns;
-
        popupStart = startIndex + 1;
-        popupEnd = std::min(startIndex + perPage, totalEntries);
+        popupEnd = min(startIndex + perPage, totalEntries);

        popupPage = (scrollIndex + 1);
-        popupMaxPage = std::max(1, (totalEntries + perPage - 1) / perPage);
+        popupMaxPage = max(1, (totalEntries + perPage - 1) / perPage);

        char buf[32];
        snprintf(buf, sizeof(buf), "%d-%d/%d  Pg %d/%d", popupStart, popupEnd, popupTotal, popupPage, popupMaxPage);
@@ -288,7 +288,8 @@ void UIRenderer::drawNodes(OLEDDisplay *display, int16_t x, int16_t y, const mes
 // **********************
 // * Favorite Node Info *
 // **********************
-void UIRenderer::drawNodeInfo(OLEDDisplay *display, const OLEDDisplayUiState *state, int16_t x, int16_t y)
+// cppcheck-suppress constParameterPointer; signature must match FrameCallback typedef from OLEDDisplayUi library
+void UIRenderer::drawNodeInfo(OLEDDisplay *display, OLEDDisplayUiState *state, int16_t x, int16_t y)
 {
    if (favoritedNodes.empty())
        return;
@@ -1388,6 +1389,7 @@ static int8_t lastFrameIndex = -1;
 static uint32_t lastFrameChangeTime = 0;
 constexpr uint32_t ICON_DISPLAY_DURATION_MS = 2000;

+// cppcheck-suppress constParameterPointer; signature must match OverlayCallback typedef from OLEDDisplayUi library
 void UIRenderer::drawNavigationBar(OLEDDisplay *display, OLEDDisplayUiState *state)
 {
    int currentFrame = state->currentFrame;
@@ -49,7 +49,7 @@ class UIRenderer
    // Navigation bar overlay
    static void drawNavigationBar(OLEDDisplay *display, OLEDDisplayUiState *state);

-    static void drawNodeInfo(OLEDDisplay *display, const OLEDDisplayUiState *state, int16_t x, int16_t y);
+    static void drawNodeInfo(OLEDDisplay *display, OLEDDisplayUiState *state, int16_t x, int16_t y);

    static void drawDeviceFocused(OLEDDisplay *display, OLEDDisplayUiState *state, int16_t x, int16_t y);

@@ -42,7 +42,7 @@ int LatchingBacklight::beforeDeepSleep(void *unused)
 {
    // Contingency only
    // - pin wasn't set
-    if (pin != (uint8_t)-1) {
+    if (pin != static_cast<uint8_t>(-1)) {
        off();
        pinMode(pin, INPUT); // High impedance - unnecessary?
    } else
@@ -55,7 +55,7 @@ int LatchingBacklight::beforeDeepSleep(void *unused)
 // The effect on the backlight is the same; peek and latch are separated to simplify short vs long press button handling
 void LatchingBacklight::peek()
 {
-    assert(pin != (uint8_t)-1);
+    assert(pin != static_cast<uint8_t>(-1));
    digitalWrite(pin, logicActive); // On
    on = true;
    latched = false;
@@ -67,7 +67,7 @@ void LatchingBacklight::peek()
 // The effect on the backlight is the same; peek and latch are separated to simplify short vs long press button handling
 void LatchingBacklight::latch()
 {
-    assert(pin != (uint8_t)-1);
+    assert(pin != static_cast<uint8_t>(-1));

    // Blink if moving from peek to latch
    // Indicates to user that the transition has taken place
@@ -89,7 +89,7 @@ void LatchingBacklight::latch()
 // Suitable for ending both peek and latch
 void LatchingBacklight::off()
 {
-    assert(pin != (uint8_t)-1);
+    assert(pin != static_cast<uint8_t>(-1));
    digitalWrite(pin, !logicActive); // Off
    on = false;
    latched = false;
@@ -40,7 +40,7 @@ class LatchingBacklight
    CallbackObserver<LatchingBacklight, void *> deepSleepObserver =
        CallbackObserver<LatchingBacklight, void *>(this, &LatchingBacklight::beforeDeepSleep);

-    uint8_t pin = (uint8_t)-1;
+    uint8_t pin = static_cast<uint8_t>(-1);
    bool logicActive = HIGH; // Is light active HIGH or active LOW

    bool on = false;      // Is light on (either peek or latched)
@@ -34,7 +34,7 @@ void InkHUD::Applet::drawPixel(int16_t x, int16_t y, uint16_t color)
 {
    // Only render pixels if they fall within user's cropped region
    if (x >= cropLeft && x < (cropLeft + cropWidth) && y >= cropTop && y < (cropTop + cropHeight))
-        assignedTile->handleAppletPixel(x, y, (Color)color);
+        assignedTile->handleAppletPixel(x, y, static_cast<Color>(color));
 }

 // Link our applet to a tile
@@ -144,6 +144,21 @@ void InkHUD::Applet::resetDrawingSpace()
    setFont(fontSmall);
 }

+// Sets one or more inputs to enabled/disabled for this applet and if they should be sent to it
+void InkHUD::Applet::setInputsSubscribed(uint8_t input, bool captured)
+{
+    if (captured)
+        subscribedInputs |= input;
+    else
+        subscribedInputs &= ~input;
+}
+
+// Checks if a specific input is enabled for this applet and should be sent to it
+bool InkHUD::Applet::isInputSubscribed(InputMask input)
+{
+    return (subscribedInputs & input) == input;
+}
+
 // Tell InkHUD::Renderer that we want to render now
 // Applets should internally listen for events they are interested in, via MeshModule, CallbackObserver etc
 // When an applet decides it has heard something important, and wants to redraw, it calls this method
@@ -312,7 +327,7 @@ void InkHUD::Applet::printAt(int16_t x, int16_t y, const char *text, HorizontalA
 }

 // Print text, specifying the position of any edge / corner of the textbox
-void InkHUD::Applet::printAt(int16_t x, int16_t y, std::string text, HorizontalAlignment ha, VerticalAlignment va)
+void InkHUD::Applet::printAt(int16_t x, int16_t y, const std::string &text, HorizontalAlignment ha, VerticalAlignment va)
 {
    printAt(x, y, text.c_str(), ha, va);
 }
@@ -334,7 +349,7 @@ InkHUD::AppletFont InkHUD::Applet::getFont()

 // Parse any text which might have "special characters"
 // Re-encodes UTF-8 characters to match our 8-bit encoded fonts
-std::string InkHUD::Applet::parse(std::string text)
+std::string InkHUD::Applet::parse(const std::string &text)
 {
    return getFont().decodeUTF8(text);
 }
@@ -361,10 +376,10 @@ std::string InkHUD::Applet::parseShortName(meshtastic_NodeInfoLite *node)
 }

 // Determine if all characters of a string are printable using the current font
-bool InkHUD::Applet::isPrintable(std::string text)
+bool InkHUD::Applet::isPrintable(const std::string &text)
 {
    // Scan for SUB (0x1A), which is the value assigned by AppletFont::applyEncoding if a unicode character is not handled
-    for (char &c : text) {
+    for (const char &c : text) {
        if (c == '\x1A')
            return false;
    }
@@ -387,7 +402,7 @@ uint16_t InkHUD::Applet::getTextWidth(const char *text)

 // Gets rendered width of a string
 // Wrapper for getTextBounds
-uint16_t InkHUD::Applet::getTextWidth(std::string text)
+uint16_t InkHUD::Applet::getTextWidth(const std::string &text)
 {
    return getTextWidth(text.c_str());
 }
@@ -435,7 +450,7 @@ std::string InkHUD::Applet::hexifyNodeNum(NodeNum num)

 // Print text, with word wrapping
 // Avoids splitting words in half, instead moving the entire word to a new line wherever possible
-void InkHUD::Applet::printWrapped(int16_t left, int16_t top, uint16_t width, std::string text)
+void InkHUD::Applet::printWrapped(int16_t left, int16_t top, uint16_t width, const std::string &text)
 {
    // Place the AdafruitGFX cursor to suit our "top" coord
    setCursor(left, top + getFont().heightAboveCursor());
@@ -492,15 +507,15 @@ void InkHUD::Applet::printWrapped(int16_t left, int16_t top, uint16_t width, std

                // Todo: rewrite making use of AdafruitGFX native text wrapping
                char cstr[] = {0, 0};
-                int16_t l, t;
-                uint16_t w, h;
+                int16_t bx, by;
+                uint16_t bw, bh;
                for (uint16_t c = 0; c < word.length(); c++) {
                    // Shove next char into a c string
                    cstr[0] = word[c];
-                    getTextBounds(cstr, getCursorX(), getCursorY(), &l, &t, &w, &h);
+                    getTextBounds(cstr, getCursorX(), getCursorY(), &bx, &by, &bw, &bh);

                    // Manual newline, if next character will spill beyond screen edge
-                    if ((l + w) > left + width)
+                    if ((bx + bw) > left + width)
                        setCursor(left, getCursorY() + getFont().lineHeight());

                    // Print next character
@@ -519,7 +534,7 @@ void InkHUD::Applet::printWrapped(int16_t left, int16_t top, uint16_t width, std

 // Simulate running printWrapped, to determine how tall the block of text will be.
 // This is a wasteful way of handling things. Maybe some way to optimize in future?
-uint32_t InkHUD::Applet::getWrappedTextHeight(int16_t left, uint16_t width, std::string text)
+uint32_t InkHUD::Applet::getWrappedTextHeight(int16_t left, uint16_t width, const std::string &text)
 {
    // Cache the current crop region
    int16_t cL = cropLeft;
@@ -649,7 +664,7 @@ uint16_t InkHUD::Applet::getActiveNodeCount()

    // For each node in db
    for (uint16_t i = 0; i < nodeDB->getNumMeshNodes(); i++) {
-        meshtastic_NodeInfoLite *node = nodeDB->getMeshNodeByIndex(i);
+        const meshtastic_NodeInfoLite *node = nodeDB->getMeshNodeByIndex(i);

        // Check if heard recently, and not our own node
        if (sinceLastSeen(node) < settings->recentlyActiveSeconds && node->num != nodeDB->getNodeNum())
@@ -702,7 +717,7 @@ std::string InkHUD::Applet::localizeDistance(uint32_t meters)
 }

 // Print text with a "faux bold" effect, by drawing it multiple times, offsetting slightly
-void InkHUD::Applet::printThick(int16_t xCenter, int16_t yCenter, std::string text, uint8_t thicknessX, uint8_t thicknessY)
+void InkHUD::Applet::printThick(int16_t xCenter, int16_t yCenter, const std::string &text, uint8_t thicknessX, uint8_t thicknessY)
 {
    // How many times to draw along x axis
    int16_t xStart;
@@ -770,7 +785,7 @@ bool InkHUD::Applet::approveNotification(NicheGraphics::InkHUD::Notification &n)
 │                               │
 └───────────────────────────────┘
 */
-void InkHUD::Applet::drawHeader(std::string text)
+void InkHUD::Applet::drawHeader(const std::string &text)
 {
    // Y position for divider
    // - between header text and messages
@@ -89,6 +89,9 @@ class Applet : public GFX
    virtual void onForeground() {}
    virtual void onBackground() {}
    virtual void onShutdown() {}
+
+    // Input Events
+
    virtual void onButtonShortPress() {}
    virtual void onButtonLongPress() {}
    virtual void onExitShort() {}
@@ -100,6 +103,18 @@ class Applet : public GFX
    virtual void onFreeText(char c) {}
    virtual void onFreeTextDone() {}
    virtual void onFreeTextCancel() {}
+    // List of inputs which can be subscribed to
+    enum InputMask {      // | No Joystick  |     With Joystick     |
+        BUTTON_SHORT = 1, // | Button Click | Joystick Center Click |
+        BUTTON_LONG = 2,  // | Button Hold  | Joystick Center Hold  |
+        EXIT_SHORT = 4,   // | no-op        | Back Button Click     |
+        EXIT_LONG = 8,    // | no-op        | Back Button Hold      |
+        NAV_UP = 16,      // | no-op        | Joystick Up           |
+        NAV_DOWN = 32,    // | no-op        | Joystick Down         |
+        NAV_LEFT = 64,    // | no-op        | Joystick Left         |
+        NAV_RIGHT = 128   // | no-op        | Joystick Right        |
+    };
+    bool isInputSubscribed(InputMask input); // Check if input should be handled by applet, this should not be overloaded.

    virtual bool approveNotification(Notification &n); // Allow an applet to veto a notification

@@ -121,20 +136,28 @@ class Applet : public GFX
    void setCrop(int16_t left, int16_t top, uint16_t width, uint16_t height); // Ignore pixels drawn outside a certain region
    void resetCrop();                                                         // Removes setCrop()

+    // User Input Handling
+
+    uint8_t subscribedInputs = 0b00000000; // Maybe uint16_t for futureproofing? other devices may need more inputs
+    void setInputsSubscribed(uint8_t input,
+                             bool captured); // Set if an input should be handled by applet or not, this should not be
+                                             // overloaded. Can take multiple inputs at once if you OR/`|` them together
+
    // Text

    void setFont(AppletFont f);
    AppletFont getFont();
-    uint16_t getTextWidth(std::string text);
+    uint16_t getTextWidth(const std::string &text);
    uint16_t getTextWidth(const char *text);
-    uint32_t getWrappedTextHeight(int16_t left, uint16_t width, std::string text); // Result of printWrapped
+    uint32_t getWrappedTextHeight(int16_t left, uint16_t width, const std::string &text); // Result of printWrapped
    void printAt(int16_t x, int16_t y, const char *text, HorizontalAlignment ha = LEFT, VerticalAlignment va = TOP);
-    void printAt(int16_t x, int16_t y, std::string text, HorizontalAlignment ha = LEFT, VerticalAlignment va = TOP);
-    void printThick(int16_t xCenter, int16_t yCenter, std::string text, uint8_t thicknessX, uint8_t thicknessY); // Faux bold
-    void printWrapped(int16_t left, int16_t top, uint16_t width, std::string text); // Per-word line wrapping
+    void printAt(int16_t x, int16_t y, const std::string &text, HorizontalAlignment ha = LEFT, VerticalAlignment va = TOP);
+    void printThick(int16_t xCenter, int16_t yCenter, const std::string &text, uint8_t thicknessX,
+                    uint8_t thicknessY);                                                   // Faux bold
+    void printWrapped(int16_t left, int16_t top, uint16_t width, const std::string &text); // Per-word line wrapping

    void hatchRegion(int16_t x, int16_t y, uint16_t w, uint16_t h, uint8_t spacing, Color color); // Fill with sparse lines
-    void drawHeader(std::string text); // Draw the standard applet header
+    void drawHeader(const std::string &text); // Draw the standard applet header

    // Meshtastic Logo

@@ -150,9 +173,9 @@ class Applet : public GFX
    std::string getTimeString();                               // Current time, human readable
    uint16_t getActiveNodeCount();                             // Duration determined by user, in onscreen menu
    std::string localizeDistance(uint32_t meters);             // Human readable distance, imperial or metric
-    std::string parse(std::string text);                       // Handle text which might contain special chars
+    std::string parse(const std::string &text);                // Handle text which might contain special chars
    std::string parseShortName(meshtastic_NodeInfoLite *node); // Get the shortname, or a substitute if has unprintable chars
-    bool isPrintable(std::string);                             // Check for characters which the font can't print
+    bool isPrintable(const std::string &text);                 // Check for characters which the font can't print

    // Convenient references

@@ -39,11 +39,11 @@ InkHUD::AppletFont::AppletFont(const GFXfont &adafruitGFXFont, Encoding encoding
        // Caution: signed and unsigned types
        int8_t glyphAscender = 0 - gfxFont->glyph[i].yOffset;
        if (glyphAscender > 0)
-            this->ascenderHeight = max(this->ascenderHeight, (uint8_t)glyphAscender);
+            this->ascenderHeight = max(this->ascenderHeight, static_cast<uint8_t>(glyphAscender));

        int8_t glyphDescender = gfxFont->glyph[i].height + gfxFont->glyph[i].yOffset;
        if (glyphDescender > 0)
-            this->descenderHeight = max(this->descenderHeight, (uint8_t)glyphDescender);
+            this->descenderHeight = max(this->descenderHeight, static_cast<uint8_t>(glyphDescender));
    }

    // Apply any manual padding to grow or shrink the line size
@@ -52,7 +52,7 @@ InkHUD::AppletFont::AppletFont(const GFXfont &adafruitGFXFont, Encoding encoding
    descenderHeight += paddingBottom;

    // Find how far the cursor advances when we "print" a space character
-    spaceCharWidth = gfxFont->glyph[(uint8_t)' ' - gfxFont->first].xAdvance;
+    spaceCharWidth = gfxFont->glyph[static_cast<uint8_t>(' ') - gfxFont->first].xAdvance;
 }

 /*
@@ -98,7 +98,7 @@ uint8_t InkHUD::AppletFont::widthBetweenWords()

 // Convert a unicode char from set of UTF-8 bytes to UTF-32
 // Used by AppletFont::applyEncoding, which remaps unicode chars for extended ASCII fonts, based on their UTF-32 value
-uint32_t InkHUD::AppletFont::toUtf32(std::string utf8)
+uint32_t InkHUD::AppletFont::toUtf32(const std::string &utf8)
 {
    uint32_t utf32 = 0;

@@ -132,7 +132,7 @@ uint32_t InkHUD::AppletFont::toUtf32(std::string utf8)

 // Process a string, collating UTF-8 bytes, and sending them off for re-encoding to extended ASCII
 // Not all InkHUD text is passed through here, only text which could potentially contain non-ASCII chars
-std::string InkHUD::AppletFont::decodeUTF8(std::string encoded)
+std::string InkHUD::AppletFont::decodeUTF8(const std::string &encoded)
 {
    // Final processed output
    std::string decoded;
@@ -141,7 +141,7 @@ std::string InkHUD::AppletFont::decodeUTF8(std::string encoded)
    std::string utf8Char;
    uint8_t utf8CharSize = 0;

-    for (char &c : encoded) {
+    for (const char &c : encoded) {

        // If first byte
        if (utf8Char.empty()) {
@@ -178,7 +178,7 @@ std::string InkHUD::AppletFont::decodeUTF8(std::string encoded)

 // Re-encode a single UTF-8 character to extended ASCII
 // Target encoding depends on the font
-char InkHUD::AppletFont::applyEncoding(std::string utf8)
+char InkHUD::AppletFont::applyEncoding(const std::string &utf8)
 {
    // ##################################################### Syntactic Sugar #####################################################
 #define REMAP(in, out)                                                                                                           \
@@ -30,20 +30,21 @@ class AppletFont
    };

    AppletFont();
-    AppletFont(const GFXfont &adafruitGFXFont, Encoding encoding = ASCII, int8_t paddingTop = 0, int8_t paddingBottom = 0);
+    explicit AppletFont(const GFXfont &adafruitGFXFont, Encoding encoding = ASCII, int8_t paddingTop = 0,
+                        int8_t paddingBottom = 0);

    uint8_t lineHeight();
    uint8_t heightAboveCursor();
    uint8_t heightBelowCursor();
    uint8_t widthBetweenWords(); // Width of the space character

-    std::string decodeUTF8(std::string encoded);
+    std::string decodeUTF8(const std::string &encoded);

-    const GFXfont *gfxFont = NULL; // Default value: in-built AdafruitGFX font
+    const GFXfont *gfxFont = nullptr; // Default value: in-built AdafruitGFX font

  private:
-    uint32_t toUtf32(std::string utf8);
-    char applyEncoding(std::string utf8);
+    uint32_t toUtf32(const std::string &utf8);
+    char applyEncoding(const std::string &utf8);

    uint8_t height = 8;          // Default value: in-built AdafruitGFX font
    uint8_t ascenderHeight = 0;  // Default value: in-built AdafruitGFX font
@@ -81,25 +81,25 @@ ProcessMessage InkHUD::NodeListApplet::handleReceived(const meshtastic_MeshPacke
 uint8_t InkHUD::NodeListApplet::maxCards()
 {
    // Cache result. Shouldn't change during execution
-    static uint8_t cards = 0;
+    static uint8_t maxCardCount = 0;

-    if (!cards) {
+    if (!maxCardCount) {
        const uint16_t height = Tile::maxDisplayDimension();

        // Use a loop instead of arithmetic, because it's easier for my brain to follow
        // Add cards one by one, until the latest card extends below screen

        uint16_t y = cardH; // First card: no margin above
-        cards = 1;
+        maxCardCount = 1;

        while (y < height) {
            y += cardMarginH;
            y += cardH;
-            cards++;
+            maxCardCount++;
        }
    }

-    return cards;
+    return maxCardCount;
 }

 // Draw, using info which derived applet placed into NodeListApplet::cards for us
@@ -137,12 +137,12 @@ void InkHUD::NodeListApplet::onRender(bool full)

        // Gather info
        // ========================================
-        NodeNum &nodeNum = card->nodeNum;
+        const NodeNum &nodeNum = card->nodeNum;
        SignalStrength &signal = card->signal;
        std::string longName;  // handled below
        std::string shortName; // handled below
        std::string distance;  // handled below;
-        uint8_t &hopsAway = card->hopsAway;
+        const uint8_t &hopsAway = card->hopsAway;

        meshtastic_NodeInfoLite *node = nodeDB->getMeshNode(nodeNum);

@@ -0,0 +1,79 @@
+#ifdef MESHTASTIC_INCLUDE_INKHUD
+#include "./UserAppletInputExample.h"
+
+using namespace NicheGraphics;
+
+void InkHUD::UserAppletInputExampleApplet::onActivate()
+{
+    setGrabbed(false);
+}
+
+void InkHUD::UserAppletInputExampleApplet::onRender(bool full)
+{
+    drawHeader("Input Example");
+    uint16_t headerHeight = getHeaderHeight();
+
+    std::string buttonName;
+    if (settings->joystick.enabled)
+        buttonName = "joystick center button";
+    else
+        buttonName = "user button";
+
+    std::string additional = " | Control is grabbed, long press " + buttonName + " to release controls";
+    if (!isGrabbed)
+        additional = " | Control is released, long press " + buttonName + " to grab controls";
+
+    printWrapped(0, headerHeight, width(), "Last button: " + lastInput + additional);
+}
+
+void InkHUD::UserAppletInputExampleApplet::setGrabbed(bool grabbed)
+{
+    isGrabbed = grabbed;
+    setInputsSubscribed(BUTTON_SHORT | EXIT_SHORT | EXIT_LONG | NAV_UP | NAV_DOWN | NAV_LEFT | NAV_RIGHT,
+                        grabbed);           // Enables/disables grabbing all inputs
+    setInputsSubscribed(BUTTON_LONG, true); // Always grab this input
+}
+
+void InkHUD::UserAppletInputExampleApplet::onButtonShortPress()
+{
+    lastInput = "BUTTON_SHORT";
+    requestUpdate();
+}
+void InkHUD::UserAppletInputExampleApplet::onButtonLongPress()
+{
+    lastInput = "BUTTON_LONG";
+    setGrabbed(!isGrabbed);
+    requestUpdate();
+}
+void InkHUD::UserAppletInputExampleApplet::onExitShort()
+{
+    lastInput = "EXIT_SHORT";
+    requestUpdate();
+}
+void InkHUD::UserAppletInputExampleApplet::onExitLong()
+{
+    lastInput = "EXIT_LONG";
+    requestUpdate();
+}
+void InkHUD::UserAppletInputExampleApplet::onNavUp()
+{
+    lastInput = "NAV_UP";
+    requestUpdate();
+}
+void InkHUD::UserAppletInputExampleApplet::onNavDown()
+{
+    lastInput = "NAV_DOWN";
+    requestUpdate();
+}
+void InkHUD::UserAppletInputExampleApplet::onNavLeft()
+{
+    lastInput = "NAV_LEFT";
+    requestUpdate();
+}
+void InkHUD::UserAppletInputExampleApplet::onNavRight()
+{
+    lastInput = "NAV_RIGHT";
+    requestUpdate();
+}
+
+#endif
@@ -0,0 +1,36 @@
+#ifdef MESHTASTIC_INCLUDE_INKHUD
+
+#pragma once
+
+#include "configuration.h"
+
+#include "graphics/niche/InkHUD/Applet.h"
+
+namespace NicheGraphics::InkHUD
+{
+
+class UserAppletInputExampleApplet : public Applet
+{
+  public:
+    void onActivate() override;
+
+    void onRender(bool full) override;
+    void onButtonShortPress() override;
+    void onButtonLongPress() override;
+    void onExitShort() override;
+    void onExitLong() override;
+    void onNavUp() override;
+    void onNavDown() override;
+    void onNavLeft() override;
+    void onNavRight() override;
+
+  private:
+    std::string lastInput = "None";
+    bool isGrabbed = false;
+
+    void setGrabbed(bool grabbed);
+};
+
+} // namespace NicheGraphics::InkHUD
+
+#endif
@@ -29,10 +29,10 @@ int InkHUD::BatteryIconApplet::onPowerStatusUpdate(const meshtastic::Status *sta
    // If we get a different type of status, something has gone weird elsewhere
    assert(status->getStatusType() == STATUS_TYPE_POWER);

-    meshtastic::PowerStatus *powerStatus = (meshtastic::PowerStatus *)status;
+    const meshtastic::PowerStatus *pwrStatus = (const meshtastic::PowerStatus *)status;

    // Get the new state of charge %, and round to the nearest 10%
-    uint8_t newSocRounded = ((powerStatus->getBatteryChargePercent() + 5) / 10) * 10;
+    uint8_t newSocRounded = ((pwrStatus->getBatteryChargePercent() + 5) / 10) * 10;

    // If rounded value has changed, trigger a display update
    // It's okay to requestUpdate before we store the new value, as the update won't run until next loop()
@@ -1176,7 +1176,7 @@ void InkHUD::MenuApplet::showPage(MenuPage page)
        items.push_back(MenuItem("Back", previousPage));

        for (uint8_t i = 0; i < MAX_NUM_CHANNELS; i++) {
-            meshtastic_Channel &ch = channels.getByIndex(i);
+            const meshtastic_Channel &ch = channels.getByIndex(i);

            if (!ch.has_settings)
                continue;
@@ -1252,7 +1252,7 @@ void InkHUD::MenuApplet::showPage(MenuPage page)
    case NODE_CONFIG_CHANNEL_PRECISION: {
        previousPage = MenuPage::NODE_CONFIG_CHANNEL_DETAIL;
        items.push_back(MenuItem("Back", previousPage));
-        meshtastic_Channel &ch = channels.getByIndex(selectedChannelIndex);
+        const meshtastic_Channel &ch = channels.getByIndex(selectedChannelIndex);
        if (!ch.settings.has_module_settings || ch.settings.module_settings.position_precision == 0) {
            items.push_back(MenuItem("Position is Off", MenuPage::NODE_CONFIG_CHANNEL_DETAIL));
            break;
@@ -1524,7 +1524,15 @@ void InkHUD::MenuApplet::onButtonShortPress()
        if (!settings->joystick.enabled) {
            if (!cursorShown) {
                cursorShown = true;
+                // Select the first item that isn't a header
                cursor = 0;
+                while (cursor < items.size() && items.at(cursor).isHeader) {
+                    cursor++;
+                }
+                if (cursor >= items.size()) {
+                    cursorShown = false;
+                    cursor = 0;
+                }
            } else {
                do {
                    cursor = (cursor + 1) % items.size();
@@ -1576,7 +1584,15 @@ void InkHUD::MenuApplet::onNavUp()

        if (!cursorShown) {
            cursorShown = true;
-            cursor = 0;
+            // Select the last item that isn't a header
+            cursor = items.size() - 1;
+            while (items.at(cursor).isHeader) {
+                if (cursor == 0) {
+                    cursorShown = false;
+                    break;
+                }
+                cursor--;
+            }
        } else {
            do {
                if (cursor == 0)
@@ -1597,7 +1613,15 @@ void InkHUD::MenuApplet::onNavDown()

        if (!cursorShown) {
            cursorShown = true;
+            // Select the first item that isn't a header
            cursor = 0;
+            while (cursor < items.size() && items.at(cursor).isHeader) {
+                cursor++;
+            }
+            if (cursor >= items.size()) {
+                cursorShown = false;
+                cursor = 0;
+            }
        } else {
            do {
                cursor = (cursor + 1) % items.size();
@@ -1759,7 +1783,7 @@ void InkHUD::MenuApplet::populateRecipientPage()

    for (uint8_t i = 0; i < MAX_NUM_CHANNELS; i++) {
        // Get the channel, and check if it's enabled
-        meshtastic_Channel &channel = channels.getByIndex(i);
+        const meshtastic_Channel &channel = channels.getByIndex(i);
        if (!channel.has_settings || channel.role == meshtastic_Channel_Role_DISABLED)
            continue;

@@ -1829,7 +1853,7 @@ void InkHUD::MenuApplet::populateRecipientPage()
    items.push_back(MenuItem("Exit", MenuPage::EXIT));
 }

-void InkHUD::MenuApplet::drawInputField(uint16_t left, uint16_t top, uint16_t width, uint16_t height, std::string text)
+void InkHUD::MenuApplet::drawInputField(uint16_t left, uint16_t top, uint16_t width, uint16_t height, const std::string &text)
 {
    setFont(fontSmall);
    uint16_t wrapMaxH = 0;
@@ -55,7 +55,7 @@ class MenuApplet : public SystemApplet, public concurrency::OSThread
    void populateRecentsPage();   // Create menu items: a choice of values for settings.recentlyActiveSeconds

    void drawInputField(uint16_t left, uint16_t top, uint16_t width, uint16_t height,
-                        std::string text); // Draw input field for free text
+                        const std::string &text); // Draw input field for free text
    uint16_t getSystemInfoPanelHeight();
    void drawSystemInfoPanel(int16_t left, int16_t top, uint16_t width,
                             uint16_t *height = nullptr);                   // Info panel at top of root menu
@@ -228,17 +228,17 @@ std::string InkHUD::NotificationApplet::getNotificationText(uint16_t widthAvaila
                  Notification::Type::NOTIFICATION_MESSAGE_BROADCAST)) {

        // Although we are handling DM and broadcast notifications together, we do need to treat them slightly differently
-        bool isBroadcast = currentNotification.type == Notification::Type::NOTIFICATION_MESSAGE_BROADCAST;
+        bool msgIsBroadcast = currentNotification.type == Notification::Type::NOTIFICATION_MESSAGE_BROADCAST;

        // Pick source of message
-        MessageStore::Message *message =
-            isBroadcast ? &inkhud->persistence->latestMessage.broadcast : &inkhud->persistence->latestMessage.dm;
+        const MessageStore::Message *message =
+            msgIsBroadcast ? &inkhud->persistence->latestMessage.broadcast : &inkhud->persistence->latestMessage.dm;

        // Find info about the sender
        meshtastic_NodeInfoLite *node = nodeDB->getMeshNode(message->sender);

        // Leading tag (channel vs. DM)
-        text += isBroadcast ? "From:" : "DM: ";
+        text += msgIsBroadcast ? "From:" : "DM: ";

        // Sender id
        if (node && node->has_user)
@@ -252,7 +252,7 @@ std::string InkHUD::NotificationApplet::getNotificationText(uint16_t widthAvaila
            text.clear();

            // Leading tag (channel vs. DM)
-            text += isBroadcast ? "Msg from " : "DM from ";
+            text += msgIsBroadcast ? "Msg from " : "DM from ";

            // Sender id
            if (node && node->has_user)
@@ -55,12 +55,12 @@ int InkHUD::PairingApplet::onBluetoothStatusUpdate(const meshtastic::Status *sta
    // We'll mimic that behavior, just to keep in line with the other Statuses,
    // even though I'm not sure what the original reason for jumping through these extra hoops was.
    assert(status->getStatusType() == STATUS_TYPE_BLUETOOTH);
-    meshtastic::BluetoothStatus *bluetoothStatus = (meshtastic::BluetoothStatus *)status;
+    const auto *btStatus = static_cast<const meshtastic::BluetoothStatus *>(status);

    // When pairing begins
-    if (bluetoothStatus->getConnectionState() == meshtastic::BluetoothStatus::ConnectionState::PAIRING) {
+    if (btStatus->getConnectionState() == meshtastic::BluetoothStatus::ConnectionState::PAIRING) {
        // Store the passkey for rendering
-        passkey = bluetoothStatus->getPasskey();
+        passkey = btStatus->getPasskey();

        // Show pairing screen
        bringToForeground();
@@ -0,0 +1,111 @@
+#ifdef MESHTASTIC_INCLUDE_INKHUD
+
+#include "./FavoritesMapApplet.h"
+#include "NodeDB.h"
+
+using namespace NicheGraphics;
+
+bool InkHUD::FavoritesMapApplet::shouldDrawNode(meshtastic_NodeInfoLite *node)
+{
+    // Keep our own node available as map anchor/center; all others must be favorited.
+    return node && (node->num == nodeDB->getNodeNum() || node->is_favorite);
+}
+
+void InkHUD::FavoritesMapApplet::onRender(bool full)
+{
+    // Custom empty state text for favorites-only map.
+    if (!enoughMarkers()) {
+        printAt(X(0.5), Y(0.5) - (getFont().lineHeight() / 2), "Favorite node position", CENTER, MIDDLE);
+        printAt(X(0.5), Y(0.5) + (getFont().lineHeight() / 2), "will appear here", CENTER, MIDDLE);
+        return;
+    }
+
+    // Draw the usual map applet first.
+    MapApplet::onRender(full);
+
+    // Draw our latest "node of interest" as a special marker.
+    meshtastic_NodeInfoLite *node = nodeDB->getMeshNode(lastFrom);
+    if (node && node->is_favorite && nodeDB->hasValidPosition(node) && enoughMarkers())
+        drawLabeledMarker(node);
+}
+
+// Determine if we need to redraw the map, when we receive a new position packet.
+ProcessMessage InkHUD::FavoritesMapApplet::handleReceived(const meshtastic_MeshPacket &mp)
+{
+    // If applet is not active, we shouldn't be handling any data.
+    if (!isActive())
+        return ProcessMessage::CONTINUE;
+
+    // Try decode a position from the packet.
+    bool hasPosition = false;
+    float lat;
+    float lng;
+    if (mp.which_payload_variant == meshtastic_MeshPacket_decoded_tag && mp.decoded.portnum == meshtastic_PortNum_POSITION_APP) {
+        meshtastic_Position position = meshtastic_Position_init_default;
+        if (pb_decode_from_bytes(mp.decoded.payload.bytes, mp.decoded.payload.size, &meshtastic_Position_msg, &position)) {
+            if (position.has_latitude_i && position.has_longitude_i         // Actually has position
+                && (position.latitude_i != 0 || position.longitude_i != 0)) // Position isn't "null island"
+            {
+                hasPosition = true;
+                lat = position.latitude_i * 1e-7; // Convert from Meshtastic's internal int32_t format
+                lng = position.longitude_i * 1e-7;
+            }
+        }
+    }
+
+    // Skip if we didn't get a valid position.
+    if (!hasPosition)
+        return ProcessMessage::CONTINUE;
+
+    const int8_t hopsAway = getHopsAway(mp);
+    const bool hasHopsAway = hopsAway >= 0;
+
+    // Determine if the position packet would change anything on-screen.
+    bool somethingChanged = false;
+
+    // If our own position.
+    if (isFromUs(&mp)) {
+        // Ignore tiny local movement to reduce update spam.
+        if (GeoCoord::latLongToMeter(ourLastLat, ourLastLng, lat, lng) > 50) {
+            somethingChanged = true;
+            ourLastLat = lat;
+            ourLastLng = lng;
+        }
+    } else {
+        // For non-local packets, this applet only reacts to favorited nodes.
+        const meshtastic_NodeInfoLite *sender = nodeDB->getMeshNode(mp.from);
+        if (!sender || !sender->is_favorite)
+            return ProcessMessage::CONTINUE;
+
+        // Check if this position is from someone different than our previous position packet.
+        if (mp.from != lastFrom) {
+            somethingChanged = true;
+            lastFrom = mp.from;
+            lastLat = lat;
+            lastLng = lng;
+            lastHopsAway = hopsAway;
+        }
+
+        // Same sender: check if position changed.
+        else if (GeoCoord::latLongToMeter(lastLat, lastLng, lat, lng) > 10) {
+            somethingChanged = true;
+            lastLat = lat;
+            lastLng = lng;
+        }
+
+        // Same sender, same position: check if hops changed.
+        else if (hasHopsAway && (hopsAway != lastHopsAway)) {
+            somethingChanged = true;
+            lastHopsAway = hopsAway;
+        }
+    }
+
+    if (somethingChanged) {
+        requestAutoshow();
+        requestUpdate();
+    }
+
+    return ProcessMessage::CONTINUE;
+}
+
+#endif
@@ -0,0 +1,44 @@
+#ifdef MESHTASTIC_INCLUDE_INKHUD
+
+/*
+
+Plots position of favorited nodes from DB, with North facing up.
+Scaled to fit the most distant node.
+Size of marker represents hops away.
+The favorite node which most recently sent a position will be labeled.
+
+*/
+
+#pragma once
+
+#include "configuration.h"
+
+#include "graphics/niche/InkHUD/Applets/Bases/Map/MapApplet.h"
+
+#include "SinglePortModule.h"
+
+namespace NicheGraphics::InkHUD
+{
+
+class FavoritesMapApplet : public MapApplet, public SinglePortModule
+{
+  public:
+    FavoritesMapApplet() : SinglePortModule("FavoritesMapApplet", meshtastic_PortNum_POSITION_APP) {}
+    void onRender(bool full) override;
+
+  protected:
+    bool shouldDrawNode(meshtastic_NodeInfoLite *node) override;
+    ProcessMessage handleReceived(const meshtastic_MeshPacket &mp) override;
+
+    NodeNum lastFrom = 0; // Sender of most recent favorited (non-local) position packet
+    float lastLat = 0.0;
+    float lastLng = 0.0;
+    float lastHopsAway = 0;
+
+    float ourLastLat = 0.0; // Info about most recent local position
+    float ourLastLng = 0.0;
+};
+
+} // namespace NicheGraphics::InkHUD
+
+#endif
@@ -69,9 +69,10 @@ void InkHUD::HeardApplet::populateFromNodeDB()
    }

    // Sort the collection by age
-    std::sort(ordered.begin(), ordered.end(), [](meshtastic_NodeInfoLite *top, meshtastic_NodeInfoLite *bottom) -> bool {
-        return (top->last_heard > bottom->last_heard);
-    });
+    std::sort(ordered.begin(), ordered.end(),
+              [](const meshtastic_NodeInfoLite *top, const meshtastic_NodeInfoLite *bottom) -> bool {
+                  return (top->last_heard > bottom->last_heard);
+              });

    // Keep the most recent entries only
    // Just enough to fill the screen
@@ -69,7 +69,7 @@ void InkHUD::ThreadedMessageApplet::onRender(bool full)
    while (msgB >= (0 - fontSmall.lineHeight()) && i < store->messages.size()) {

        // Grab data for message
-        MessageStore::Message &m = store->messages.at(i);
+        const MessageStore::Message &m = store->messages.at(i);
        bool outgoing = (m.sender == 0) || (m.sender == myNodeInfo.my_node_num); // Own NodeNum if canned message
        std::string bodyText = parse(m.text);                                    // Parse any non-ascii chars in the message

@@ -59,10 +59,16 @@ void InkHUD::Events::onButtonShort()
    if (consumer) {
        consumer->onButtonShortPress();
    } else if (!dismissedExt) { // Don't change applet if this button press silenced the external notification module
-        if (!settings->joystick.enabled)
-            inkhud->nextApplet();
-        else
-            inkhud->openMenu();
+        Applet *userConsumer = inkhud->getActiveApplet();
+
+        if (userConsumer != nullptr && userConsumer->isInputSubscribed(Applet::BUTTON_SHORT))
+            userConsumer->onButtonShortPress();
+        else {
+            if (!settings->joystick.enabled)
+                inkhud->nextApplet();
+            else
+                inkhud->openMenu();
+        }
    }
 }

@@ -84,8 +90,14 @@ void InkHUD::Events::onButtonLong()
    // If no system applet is handling input, default behavior instead is to open the menu
    if (consumer)
        consumer->onButtonLongPress();
-    else
-        inkhud->openMenu();
+    else {
+        Applet *userConsumer = inkhud->getActiveApplet();
+
+        if (userConsumer != nullptr && userConsumer->isInputSubscribed(Applet::BUTTON_LONG))
+            userConsumer->onButtonLongPress();
+        else
+            inkhud->openMenu();
+    }
 }

 void InkHUD::Events::onExitShort()
@@ -110,8 +122,14 @@ void InkHUD::Events::onExitShort()
        // If no system applet is handling input, default behavior instead is change tiles
        if (consumer)
            consumer->onExitShort();
-        else if (!dismissedExt) // Don't change tile if this button press silenced the external notification module
-            inkhud->nextTile();
+        else if (!dismissedExt) { // Don't change tile if this button press silenced the external notification module
+            Applet *userConsumer = inkhud->getActiveApplet();
+
+            if (userConsumer != nullptr && userConsumer->isInputSubscribed(Applet::EXIT_SHORT))
+                userConsumer->onExitShort();
+            else
+                inkhud->nextTile();
+        }
    }
 }

@@ -133,6 +151,13 @@ void InkHUD::Events::onExitLong()

        if (consumer)
            consumer->onExitLong();
+        else {
+            Applet *userConsumer = inkhud->getActiveApplet();
+
+            if (userConsumer != nullptr && userConsumer->isInputSubscribed(Applet::EXIT_LONG))
+                userConsumer->onExitLong();
+            // Nothing uses exit long yet
+        }
    }
 }

@@ -157,6 +182,12 @@ void InkHUD::Events::onNavUp()

        if (consumer)
            consumer->onNavUp();
+        else if (!dismissedExt) {
+            Applet *userConsumer = inkhud->getActiveApplet();
+
+            if (userConsumer != nullptr && userConsumer->isInputSubscribed(Applet::NAV_UP))
+                userConsumer->onNavUp();
+        }
    }
 }

@@ -181,6 +212,12 @@ void InkHUD::Events::onNavDown()

        if (consumer)
            consumer->onNavDown();
+        else if (!dismissedExt) {
+            Applet *userConsumer = inkhud->getActiveApplet();
+
+            if (userConsumer != nullptr && userConsumer->isInputSubscribed(Applet::NAV_DOWN))
+                userConsumer->onNavDown();
+        }
    }
 }

@@ -206,8 +243,14 @@ void InkHUD::Events::onNavLeft()
        // If no system applet is handling input, default behavior instead is to cycle applets
        if (consumer)
            consumer->onNavLeft();
-        else if (!dismissedExt) // Don't change applet if this button press silenced the external notification module
-            inkhud->prevApplet();
+        else if (!dismissedExt) { // Don't change applet if this button press silenced the external notification module
+            Applet *userConsumer = inkhud->getActiveApplet();
+
+            if (userConsumer != nullptr && userConsumer->isInputSubscribed(Applet::NAV_LEFT))
+                userConsumer->onNavLeft();
+            else
+                inkhud->prevApplet();
+        }
    }
 }

@@ -233,8 +276,14 @@ void InkHUD::Events::onNavRight()
        // If no system applet is handling input, default behavior instead is to cycle applets
        if (consumer)
            consumer->onNavRight();
-        else if (!dismissedExt) // Don't change applet if this button press silenced the external notification module
-            inkhud->nextApplet();
+        else if (!dismissedExt) { // Don't change applet if this button press silenced the external notification module
+            Applet *userConsumer = inkhud->getActiveApplet();
+
+            if (userConsumer != nullptr && userConsumer->isInputSubscribed(Applet::NAV_RIGHT))
+                userConsumer->onNavRight();
+            else
+                inkhud->nextApplet();
+        }
    }
 }

@@ -210,6 +210,12 @@ void InkHUD::InkHUD::prevApplet()
    windowManager->prevApplet();
 }

+// Returns the currently active applet
+InkHUD::Applet *InkHUD::InkHUD::getActiveApplet()
+{
+    return windowManager->getActiveApplet();
+}
+
 // Show the menu (on the the focused tile)
 // The applet previously displayed there will be restored once the menu closes
 void InkHUD::InkHUD::openMenu()
@@ -74,6 +74,7 @@ class InkHUD

    void nextApplet();
    void prevApplet();
+    NicheGraphics::InkHUD::Applet *getActiveApplet();
    void openMenu();
    void openAlignStick();
    void openKeyboard();
@@ -12,7 +12,7 @@ using namespace NicheGraphics;
 constexpr uint8_t MAX_MESSAGES_SAVED = 10;
 constexpr uint32_t MAX_MESSAGE_SIZE = 250;

-InkHUD::MessageStore::MessageStore(std::string label)
+InkHUD::MessageStore::MessageStore(const std::string &label)
 {
    filename = "";
    filename += "/NicheGraphics";
@@ -50,12 +50,13 @@ void InkHUD::MessageStore::saveToFlash()
    // For each message
    for (uint8_t i = 0; i < messages.size() && i < MAX_MESSAGES_SAVED; i++) {
        Message &m = messages.at(i);
-        f.write((uint8_t *)&m.timestamp, sizeof(m.timestamp));                    // Write timestamp. 4 bytes
-        f.write((uint8_t *)&m.sender, sizeof(m.sender));                          // Write sender NodeId. 4 Bytes
-        f.write((uint8_t *)&m.channelIndex, sizeof(m.channelIndex));              // Write channel index. 1 Byte
-        f.write((uint8_t *)m.text.c_str(), min(MAX_MESSAGE_SIZE, m.text.size())); // Write message text. Variable length
-        f.write('\0');                                                            // Append null term
-        LOG_DEBUG("Wrote message %u, length %u, text \"%s\"", (uint32_t)i, min(MAX_MESSAGE_SIZE, m.text.size()), m.text.c_str());
+        f.write(reinterpret_cast<const uint8_t *>(&m.timestamp), sizeof(m.timestamp));       // Write timestamp. 4 bytes
+        f.write(reinterpret_cast<const uint8_t *>(&m.sender), sizeof(m.sender));             // Write sender NodeId. 4 Bytes
+        f.write(reinterpret_cast<const uint8_t *>(&m.channelIndex), sizeof(m.channelIndex)); // Write channel index. 1 Byte
+        f.write(reinterpret_cast<const uint8_t *>(m.text.c_str()), min(MAX_MESSAGE_SIZE, m.text.size())); // Write message text
+        f.write('\0');                                                                                    // Append null term
+        LOG_DEBUG("Wrote message %u, length %u, text \"%s\"", static_cast<uint32_t>(i), min(MAX_MESSAGE_SIZE, m.text.size()),
+                  m.text.c_str());
    }

    // Release firmware's SPI lock, because SafeFile::close needs it
@@ -111,17 +112,17 @@ void InkHUD::MessageStore::loadFromFlash()

        // First byte: how many messages are in the flash store
        uint8_t flashMessageCount = 0;
-        f.readBytes((char *)&flashMessageCount, 1);
-        LOG_DEBUG("Messages available: %u", (uint32_t)flashMessageCount);
+        f.readBytes(reinterpret_cast<char *>(&flashMessageCount), 1);
+        LOG_DEBUG("Messages available: %u", static_cast<uint32_t>(flashMessageCount));

        // For each message
        for (uint8_t i = 0; i < flashMessageCount && i < MAX_MESSAGES_SAVED; i++) {
            Message m;

            // Read meta data (fixed width)
-            f.readBytes((char *)&m.timestamp, sizeof(m.timestamp));
-            f.readBytes((char *)&m.sender, sizeof(m.sender));
-            f.readBytes((char *)&m.channelIndex, sizeof(m.channelIndex));
+            f.readBytes(reinterpret_cast<char *>(&m.timestamp), sizeof(m.timestamp));
+            f.readBytes(reinterpret_cast<char *>(&m.sender), sizeof(m.sender));
+            f.readBytes(reinterpret_cast<char *>(&m.channelIndex), sizeof(m.channelIndex));

            // Read characters until we find a null term
            char c;
@@ -136,7 +137,8 @@ void InkHUD::MessageStore::loadFromFlash()
            // Store in RAM
            messages.push_back(m);

-            LOG_DEBUG("#%u, timestamp=%u, sender(num)=%u, text=\"%s\"", (uint32_t)i, m.timestamp, m.sender, m.text.c_str());
+            LOG_DEBUG("#%u, timestamp=%u, sender(num)=%u, text=\"%s\"", static_cast<uint32_t>(i), m.timestamp, m.sender,
+                      m.text.c_str());
        }

        f.close();
@@ -31,7 +31,7 @@ class MessageStore
    };

    MessageStore() = delete;
-    explicit MessageStore(std::string label); // Label determines filename in flash
+    explicit MessageStore(const std::string &label); // Label determines filename in flash

    void saveToFlash();
    void loadFromFlash();
@@ -8,5 +8,5 @@ build_flags =
  -D MESHTASTIC_EXCLUDE_INPUTBROKER ; Suppress default input handling
  -D HAS_BUTTON=0 ; Suppress default ButtonThread
 lib_deps =
-  # TODO renovate
-  https://github.com/ZinggJM/GFX_Root#2.0.0 ; Used by InkHUD as a "slimmer" version of AdafruitGFX
+  # renovate: datasource=github-tags depName=GFX_Root packageName=ZinggJM/GFX_Root
+  https://github.com/ZinggJM/GFX_Root/archive/3195764e352a0d2567c8d277ac408ca7293a99b0.zip ; Used by InkHUD as a "slimmer" version of AdafruitGFX
@@ -269,42 +269,42 @@ void InkHUD::Renderer::clearTile(Tile *t)
    // Rotate the tile dimensions
    int16_t left = 0;
    int16_t top = 0;
-    uint16_t width = 0;
-    uint16_t height = 0;
+    uint16_t tileW = 0;
+    uint16_t tileH = 0;
    switch (settings->rotation) {
    case 0:
        left = t->getLeft();
        top = t->getTop();
-        width = t->getWidth();
-        height = t->getHeight();
+        tileW = t->getWidth();
+        tileH = t->getHeight();
        break;
    case 1:
        left = driver->width - (t->getTop() + t->getHeight());
        top = t->getLeft();
-        width = t->getHeight();
-        height = t->getWidth();
+        tileW = t->getHeight();
+        tileH = t->getWidth();
        break;
    case 2:
        left = driver->width - (t->getLeft() + t->getWidth());
        top = driver->height - (t->getTop() + t->getHeight());
-        width = t->getWidth();
-        height = t->getHeight();
+        tileW = t->getWidth();
+        tileH = t->getHeight();
        break;
    case 3:
        left = t->getTop();
        top = driver->height - (t->getLeft() + t->getWidth());
-        width = t->getHeight();
-        height = t->getWidth();
+        tileW = t->getHeight();
+        tileH = t->getWidth();
        break;
    }

    // Calculate the bounds to clear
    uint16_t xStart = (left < 0) ? 0 : left;
    uint16_t yStart = (top < 0) ? 0 : top;
-    if (xStart >= driver->width || yStart >= driver->height || left + width < 0 || top + height < 0)
+    if (xStart >= driver->width || yStart >= driver->height || left + tileW < 0 || top + tileH < 0)
        return; // the box is completely off the screen
-    uint16_t xEnd = left + width;
-    uint16_t yEnd = top + height;
+    uint16_t xEnd = left + tileW;
+    uint16_t yEnd = top + tileH;
    if (xEnd > driver->width)
        xEnd = driver->width;
    if (yEnd > driver->height)
@@ -273,6 +273,12 @@ void InkHUD::WindowManager::prevApplet()
    inkhud->forceUpdate(EInk::UpdateTypes::FAST); // bringToForeground already requested, but we're manually forcing FAST
 }

+// Returns active applet
+NicheGraphics::InkHUD::Applet *InkHUD::WindowManager::getActiveApplet()
+{
+    return userTiles.at(settings->userTiles.focused)->getAssignedApplet();
+}
+
 // Rotate the display image by 90 degrees
 void InkHUD::WindowManager::rotate()
 {
@@ -396,7 +402,7 @@ void InkHUD::WindowManager::autoshow()
 {
    // Don't perform autoshow if a system applet has exclusive use of the display right now
    // Note: lockRequests prevents autoshow attempting to hide menuApplet
-    for (SystemApplet *sa : inkhud->systemApplets) {
+    for (const SystemApplet *sa : inkhud->systemApplets) {
        if (sa->lockRendering || sa->lockRequests)
            return;
    }
@@ -29,6 +29,7 @@ class WindowManager

    void nextTile();
    void prevTile();
+    Applet *getActiveApplet();
    void openMenu();
    void openAlignStick();
    void openKeyboard();
@@ -146,7 +146,7 @@ void CannedMessageStore::handleGet(meshtastic_AdminMessage *response)
    std::string merged;
    if (!messages.empty()) { // Don't run if no messages: error on pop_back with size=0
        merged.reserve(201);
-        for (std::string &s : messages) {
+        for (const std::string &s : messages) {
            merged += s;
            merged += '|';
        }
@@ -276,7 +276,8 @@ int32_t ButtonThread::runOnce()
        case BUTTON_EVENT_LONG_RELEASED: {

            LOG_INFO("LONG PRESS RELEASE AFTER %u MILLIS", millis() - buttonPressStartTime);
-            if (millis() > 30000 && _longLongPress != INPUT_BROKER_NONE &&
+            // Require press started after boot holdoff to avoid phantom shutdown from floating pins
+            if (millis() > 30000 && buttonPressStartTime > 30000 && _longLongPress != INPUT_BROKER_NONE &&
                (millis() - buttonPressStartTime) >= _longLongPressTime && leadUpPlayed) {
                evt.inputEvent = _longLongPress;
                this->notifyObservers(&evt);
@@ -106,8 +106,8 @@ static unsigned char HackadayCommunicatorTapMap[_TCA8418_NUM_KEYS][2] = {{},
                                                                         {}};

 HackadayCommunicatorKeyboard::HackadayCommunicatorKeyboard()
-    : TCA8418KeyboardBase(_TCA8418_ROWS, _TCA8418_COLS), modifierFlag(0), last_modifier_time(0), last_key(-1), next_key(-1),
-      last_tap(0L), char_idx(0), tap_interval(0)
+    : TCA8418KeyboardBase(_TCA8418_ROWS, _TCA8418_COLS), modifierFlag(0), last_modifier_time(0), last_key(UINT8_MAX),
+      next_key(UINT8_MAX), last_tap(0L), char_idx(0), tap_interval(0)
 {
    reset();
 }
@@ -147,7 +147,6 @@ void HackadayCommunicatorKeyboard::pressed(uint8_t key)
        modifierFlag = 0;
    }

-    uint8_t next_key = 0;
    int row = (key - 1) / 10;
    int col = (key - 1) % 10;
    if (row >= _TCA8418_ROWS || col >= _TCA8418_COLS) {
@@ -187,8 +186,8 @@ void HackadayCommunicatorKeyboard::released()
        return;
    }

-    if (last_key < 0 || last_key >= _TCA8418_NUM_KEYS) {
-        last_key = -1;
+    if (last_key >= _TCA8418_NUM_KEYS) {
+        last_key = UINT8_MAX;
        state = Idle;
        return;
    }
@@ -18,8 +18,8 @@ class HackadayCommunicatorKeyboard : public TCA8418KeyboardBase
  private:
    uint8_t modifierFlag;        // Flag to indicate if a modifier key is pressed
    uint32_t last_modifier_time; // Timestamp of the last modifier key press
-    int8_t last_key;
-    int8_t next_key;
+    uint8_t last_key;
+    uint8_t next_key;
    uint32_t last_tap;
    uint8_t char_idx;
    int32_t tap_interval;
@@ -100,13 +100,28 @@ void InputBroker::processInputEventQueue()

 int InputBroker::handleInputEvent(const InputEvent *event)
 {
-    powerFSM.trigger(EVENT_INPUT); // todo: not every input should wake, like long hold release
+#if HAS_SCREEN
+    bool screenWasOff = false;
+    if (screen) {
+        screenWasOff = !screen->isScreenOn();
+    }
+#endif
+    powerFSM.trigger(EVENT_INPUT);

    if (event && event->inputEvent != INPUT_BROKER_NONE && externalNotificationModule &&
        moduleConfig.external_notification.enabled && externalNotificationModule->nagging()) {
        externalNotificationModule->stopNow();
+        // If this turns off a notification, don't further process the event
+        return 0;
    }

+#if HAS_SCREEN
+    if (screen && screenWasOff) {
+        // If the screen was off, it is in the process of turning on, and we just drop the event
+        return 0;
+    }
+#endif
+
    this->notifyObservers(event);
    return 0;
 }
@@ -91,7 +91,7 @@ MPR121Keyboard::MPR121Keyboard() : m_wire(nullptr), m_addr(0), readCallback(null
 {
    // LOG_DEBUG("MPR121 @ %02x", m_addr);
    state = Init;
-    last_key = -1;
+    last_key = UINT8_MAX;
    last_tap = 0L;
    char_idx = 0;
    queue = "";
@@ -359,8 +359,8 @@ void MPR121Keyboard::released()
        return;
    }
    // would clear longpress callback... later.
-    if (last_key < 0 || last_key > _NUM_KEYS) { // reset to idle if last_key out of bounds
-        last_key = -1;
+    if (last_key >= _NUM_KEYS) { // reset to idle if last_key out of bounds
+        last_key = UINT8_MAX;
        state = Idle;
        return;
    }
@@ -14,7 +14,7 @@ class MPR121Keyboard

    MPR121States state;

-    int8_t last_key;
+    uint8_t last_key;
    uint32_t last_tap;
    uint8_t char_idx;

@@ -43,8 +43,8 @@ static unsigned char TCA8418LongPressMap[_TCA8418_NUM_KEYS] = {
 };

 TCA8418Keyboard::TCA8418Keyboard()
-    : TCA8418KeyboardBase(_TCA8418_ROWS, _TCA8418_COLS), last_key(-1), next_key(-1), last_tap(0L), char_idx(0), tap_interval(0),
-      should_backspace(false)
+    : TCA8418KeyboardBase(_TCA8418_ROWS, _TCA8418_COLS), last_key(UINT8_MAX), next_key(UINT8_MAX), last_tap(0L), char_idx(0),
+      tap_interval(0), should_backspace(false)
 {
 }

@@ -63,7 +63,6 @@ void TCA8418Keyboard::pressed(uint8_t key)
    if (state == Init || state == Busy) {
        return;
    }
-    uint8_t next_key = 0;
    int row = (key - 1) / 10;
    int col = (key - 1) % 10;

@@ -72,7 +71,7 @@ void TCA8418Keyboard::pressed(uint8_t key)
    }

    // Compute key index based on dynamic row/column
-    next_key = row * _TCA8418_COLS + col;
+    next_key = (uint8_t)(row * _TCA8418_COLS + col);

    // LOG_DEBUG("TCA8418: Key %u -> Next Key %u", key, next_key);

@@ -106,8 +105,8 @@ void TCA8418Keyboard::released()
        return;
    }

-    if (last_key < 0 || last_key > _TCA8418_NUM_KEYS) { // reset to idle if last_key out of bounds
-        last_key = -1;
+    if (last_key >= _TCA8418_NUM_KEYS) { // reset to idle if last_key out of bounds
+        last_key = UINT8_MAX;
        state = Idle;
        return;
    }
@@ -14,8 +14,8 @@ class TCA8418Keyboard : public TCA8418KeyboardBase
    void pressed(uint8_t key) override;
    void released(void) override;

-    int8_t last_key;
-    int8_t next_key;
+    uint8_t last_key;
+    uint8_t next_key;
    uint32_t last_tap;
    uint8_t char_idx;
    int32_t tap_interval;
@@ -62,8 +62,8 @@ static unsigned char TDeckProTapMap[_TCA8418_NUM_KEYS][5] = {
 };

 TDeckProKeyboard::TDeckProKeyboard()
-    : TCA8418KeyboardBase(_TCA8418_ROWS, _TCA8418_COLS), modifierFlag(0), last_modifier_time(0), last_key(-1), next_key(-1),
-      last_tap(0L), char_idx(0), tap_interval(0)
+    : TCA8418KeyboardBase(_TCA8418_ROWS, _TCA8418_COLS), modifierFlag(0), last_modifier_time(0), last_key(UINT8_MAX),
+      next_key(UINT8_MAX), last_tap(0L), char_idx(0), tap_interval(0)
 {
 }

@@ -101,7 +101,6 @@ void TDeckProKeyboard::pressed(uint8_t key)
        modifierFlag = 0;
    }

-    uint8_t next_key = 0;
    int row = (key - 1) / 10;
    int col = (key - 1) % 10;

@@ -142,8 +141,8 @@ void TDeckProKeyboard::released()
        return;
    }

-    if (last_key < 0 || last_key >= _TCA8418_NUM_KEYS) {
-        last_key = -1;
+    if (last_key >= _TCA8418_NUM_KEYS) {
+        last_key = UINT8_MAX;
        state = Idle;
        return;
    }
@@ -19,8 +19,8 @@ class TDeckProKeyboard : public TCA8418KeyboardBase
  private:
    uint8_t modifierFlag;        // Flag to indicate if a modifier key is pressed
    uint32_t last_modifier_time; // Timestamp of the last modifier key press
-    int8_t last_key;
-    int8_t next_key;
+    uint8_t last_key;
+    uint8_t next_key;
    uint32_t last_tap;
    uint8_t char_idx;
    int32_t tap_interval;
@@ -65,8 +65,8 @@ static unsigned char TLoraPagerTapMap[_TCA8418_NUM_KEYS][3] = {{'q', 'Q', '1'},
                                                               {' ', 0x00, Key::BL_TOGGLE}};

 TLoraPagerKeyboard::TLoraPagerKeyboard()
-    : TCA8418KeyboardBase(_TCA8418_ROWS, _TCA8418_COLS), modifierFlag(0), last_modifier_time(0), last_key(-1), next_key(-1),
-      last_tap(0L), char_idx(0), tap_interval(0)
+    : TCA8418KeyboardBase(_TCA8418_ROWS, _TCA8418_COLS), modifierFlag(0), last_modifier_time(0), last_key(UINT8_MAX),
+      next_key(UINT8_MAX), last_tap(0L), char_idx(0), tap_interval(0)
 {
 #if ESP_IDF_VERSION >= ESP_IDF_VERSION_VAL(5, 0, 0)
    ledcAttach(KB_BL_PIN, LEDC_BACKLIGHT_FREQ, LEDC_BACKLIGHT_BIT_WIDTH);
@@ -129,7 +129,6 @@ void TLoraPagerKeyboard::pressed(uint8_t key)
        modifierFlag = 0;
    }

-    uint8_t next_key = 0;
    int row = (key - 1) / 10;
    int col = (key - 1) % 10;

@@ -170,8 +169,8 @@ void TLoraPagerKeyboard::released()
        return;
    }

-    if (last_key < 0 || last_key >= _TCA8418_NUM_KEYS) {
-        last_key = -1;
+    if (last_key >= _TCA8418_NUM_KEYS) {
+        last_key = UINT8_MAX;
        state = Idle;
        return;
    }
@@ -21,8 +21,8 @@ class TLoraPagerKeyboard : public TCA8418KeyboardBase
  private:
    uint8_t modifierFlag;        // Flag to indicate if a modifier key is pressed
    uint32_t last_modifier_time; // Timestamp of the last modifier key press
-    int8_t last_key;
-    int8_t next_key;
+    uint8_t last_key;
+    uint8_t next_key;
    uint32_t last_tap;
    uint8_t char_idx;
    int32_t tap_interval;
@@ -9,6 +9,7 @@
 #include "PowerMon.h"
 #include "RadioLibInterface.h"
 #include "ReliableRouter.h"
+#include "TransmitHistory.h"
 #include "airtime.h"
 #include "buzz.h"
 #include "power/PowerHAL.h"
@@ -58,6 +59,13 @@ NimbleBluetooth *nimbleBluetooth = nullptr;
 NRF52Bluetooth *nrf52Bluetooth = nullptr;
 #endif

+#ifdef MESHTASTIC_ENABLE_APPROTECT
+#include "security/APProtect.h"
+#endif
+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+#include "security/EncryptedStorage.h"
+#endif
+
 #if HAS_WIFI || defined(USE_WS5500)
 #include "mesh/api/WiFiServerAPI.h"
 #include "mesh/wifi/WiFiAPClient.h"
@@ -192,8 +200,6 @@ bool kb_found = false;
 // global bool to record that on-screen keyboard (OSK) is present
 bool osk_found = false;

-unsigned long last_listen = 0;
-
 // The I2C address of the RTC Module (if found)
 ScanI2C::DeviceAddress rtc_found = ScanI2C::ADDRESS_NONE;
 // The I2C address of the Accelerometer (if found)
@@ -248,10 +254,7 @@ uint32_t timeLastPowered = 0;
 static OSThread *powerFSMthread;
 OSThread *ambientLightingThread;

-RadioInterface *rIf = NULL;
-#ifdef ARCH_PORTDUINO
 RadioLibHal *RadioLibHAL = NULL;
-#endif

 /**
 * Some platforms (nrf52) might provide an alterate version that suppresses calling delay from sleep.
@@ -368,6 +371,10 @@ void setup()
    consoleInit(); // Set serial baud rate and init our mesh console
 #endif

+#ifdef MESHTASTIC_ENABLE_APPROTECT
+    enableAPProtect();
+#endif
+
 #ifdef UNPHONE
    unphone.printStore();
 #endif
@@ -393,8 +400,8 @@ void setup()

 #if defined(ARCH_ESP32) && defined(BOARD_HAS_PSRAM)
 #ifndef SENSECAP_INDICATOR
-    // use PSRAM for malloc calls > 256 bytes
-    heap_caps_malloc_extmem_enable(256);
+    // use PSRAM for malloc calls > 2048 bytes
+    heap_caps_malloc_extmem_enable(2048);
 #endif
 #endif

@@ -465,6 +472,17 @@ void setup()

    fsInit();

+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+    EncryptedStorage::initLocked();
+    if (!EncryptedStorage::isUnlocked()) {
+        if (!EncryptedStorage::isProvisioned()) {
+            LOG_WARN("TAK: Device not provisioned — connect and set a passphrase to unlock storage");
+        } else {
+            LOG_WARN("TAK: Device locked — connect and provide passphrase to unlock storage");
+        }
+    }
+#endif
+
 #if !MESHTASTIC_EXCLUDE_I2C
 #if defined(I2C_SDA1) && defined(ARCH_RP2040)
    Wire1.setSDA(I2C_SDA1);
@@ -708,6 +726,9 @@ void setup()
    // We do this as early as possible because this loads preferences from flash
    // but we need to do this after main cpu init (esp32setup), because we need the random seed set
    nodeDB = new NodeDB;
+
+    // Initialize transmit history to persist broadcast throttle timers across reboots
+    TransmitHistory::getInstance()->loadFromDisk();
 #if HAS_TFT
    if (config.display.displaymode == meshtastic_Config_DisplayConfig_DisplayMode_COLOR) {
        tftSetup();
@@ -725,17 +746,15 @@ void setup()
        playStartMelody();

 #if HAS_SCREEN
-    // fixed screen override?
-    if (config.display.oled != meshtastic_Config_DisplayConfig_OledType_OLED_AUTO)
-        screen_model = config.display.oled;
-
+        // fixed screen override?
 #if defined(USE_SH1107)
    screen_model = meshtastic_Config_DisplayConfig_OledType_OLED_SH1107; // set dimension of 128x128
    screen_geometry = GEOMETRY_128_128;
-#endif
-
-#if defined(USE_SH1107_128_64)
+#elif defined(USE_SH1107_128_64)
    screen_model = meshtastic_Config_DisplayConfig_OledType_OLED_SH1107; // keep dimension of 128x64
+#else
+    if (config.display.oled != meshtastic_Config_DisplayConfig_OledType_OLED_AUTO)
+        screen_model = config.display.oled;
 #endif
 #endif

@@ -954,7 +973,7 @@ void setup()
 #endif
 #endif

-    initLoRa();
+    auto rIf = initLoRa();

    lateInitVariant(); // Do board specific init (see extra_variants/README.md for documentation)

@@ -1003,12 +1022,12 @@ void setup()
    if (!rIf)
        RECORD_CRITICALERROR(meshtastic_CriticalErrorCode_NO_RADIO);
    else {
-        router->addInterface(rIf);
-
        // Log bit rate to debug output
        LOG_DEBUG("LoRA bitrate = %f bytes / sec", (float(meshtastic_Constants_DATA_PAYLOAD_LEN) /
                                                    (float(rIf->getPacketTime(meshtastic_Constants_DATA_PAYLOAD_LEN)))) *
                                                       1000);
+
+        router->addInterface(std::move(rIf));
    }

    // This must be _after_ service.init because we need our preferences loaded from flash to have proper timeout values
@@ -1125,10 +1144,19 @@ void loop()
 #endif
    power->powerCommandsCheck();

-    if (RadioLibInterface::instance != nullptr && !Throttle::isWithinTimespanMs(last_listen, 1000 * 60) &&
-        !(RadioLibInterface::instance->isSending() || RadioLibInterface::instance->isActivelyReceiving())) {
-        RadioLibInterface::instance->startReceive();
-        LOG_DEBUG("attempting AGC reset");
+    if (RadioLibInterface::instance != nullptr) {
+        static uint32_t lastRadioMissedIrqPoll;
+        if (!Throttle::isWithinTimespanMs(lastRadioMissedIrqPoll, 1000)) {
+            lastRadioMissedIrqPoll = millis();
+            RadioLibInterface::instance->pollMissedIrqs();
+        }
+
+        // Periodic AGC reset — warm sleep + recalibrate to prevent stuck AGC gain
+        static uint32_t lastAgcReset;
+        if (!Throttle::isWithinTimespanMs(lastAgcReset, AGC_RESET_INTERVAL_MS)) {
+            lastAgcReset = millis();
+            RadioLibInterface::instance->resetAGC();
+        }
    }

 #ifdef DEBUG_STACK
@@ -1150,10 +1178,7 @@ void loop()
    }
    if (portduino_status.LoRa_in_error && rebootAtMsec == 0) {
        LOG_ERROR("LoRa in error detected, attempting to recover");
-        if (rIf != nullptr) {
-            delete rIf;
-            rIf = nullptr;
-        }
+        router->addInterface(nullptr);
        if (portduino_config.lora_spi_dev == "ch341") {
            if (ch341Hal != nullptr) {
                delete ch341Hal;
@@ -1169,8 +1194,9 @@ void loop()
                exit(EXIT_FAILURE);
            }
        }
-        if (initLoRa()) {
-            router->addInterface(rIf);
+        auto rIf = initLoRa();
+        if (rIf) {
+            router->addInterface(std::move(rIf));
            portduino_status.LoRa_in_error = false;
        } else {
            LOG_WARN("Reconfigure failed, rebooting");
@@ -33,7 +33,6 @@ extern ScanI2C::DeviceAddress cardkb_found;
 extern uint8_t kb_model;
 extern bool kb_found;
 extern bool osk_found;
-extern unsigned long last_listen;
 extern ScanI2C::DeviceAddress rtc_found;
 extern ScanI2C::DeviceAddress accelerometer_found;
 extern ScanI2C::FoundDevice rgb_found;
@@ -22,6 +22,8 @@ const char *Channels::serialChannel = "serial";
 const char *Channels::mqttChannel = "mqtt";
 #endif

+meshtastic_Channel dummyChannel = {.index = -1};
+
 uint8_t xorHash(const uint8_t *p, size_t len)
 {
    uint8_t code = 0;
@@ -309,13 +311,7 @@ meshtastic_Channel &Channels::getByIndex(ChannelIndex chIndex)
        return *ch;
    } else {
        LOG_ERROR("Invalid channel index %d > %d, malformed packet received?", chIndex, channelFile.channels_count);
-
-        static meshtastic_Channel *ch = (meshtastic_Channel *)malloc(sizeof(meshtastic_Channel));
-        memset(ch, 0, sizeof(meshtastic_Channel));
-        // ch.index -1 means we don't know the channel locally and need to look it up by settings.name
-        // not sure this is handled right everywhere
-        ch->index = -1;
-        return *ch;
+        return dummyChannel;
    }
 }

@@ -1,6 +1,7 @@
 #include "CryptoEngine.h"
 // #include "NodeDB.h"
 #include "architecture.h"
+#include <memory>

 #if !(MESHTASTIC_EXCLUDE_PKI)
 #include "NodeDB.h"
@@ -169,10 +170,9 @@ void CryptoEngine::hash(uint8_t *bytes, size_t numBytes)

 void CryptoEngine::aesSetKey(const uint8_t *key_bytes, size_t key_len)
 {
-    delete aes;
    aes = nullptr;
    if (key_len != 0) {
-        aes = new AESSmall256();
+        aes = std::unique_ptr<AESSmall256>(new AESSmall256());
        aes->setKey(key_bytes, key_len);
    }
 }
@@ -231,12 +231,11 @@ void CryptoEngine::decrypt(uint32_t fromNode, uint64_t packetId, size_t numBytes
 // Generic implementation of AES-CTR encryption.
 void CryptoEngine::encryptAESCtr(CryptoKey _key, uint8_t *_nonce, size_t numBytes, uint8_t *bytes)
 {
-    delete ctr;
-    ctr = nullptr;
+    std::unique_ptr<CTRCommon> ctr;
    if (_key.length == 16)
-        ctr = new CTR<AES128>();
+        ctr = std::unique_ptr<CTRCommon>(new CTR<AES128>());
    else
-        ctr = new CTR<AES256>();
+        ctr = std::unique_ptr<CTRCommon>(new CTR<AES256>());
    ctr->setKey(_key.bytes, _key.length);
    static uint8_t scratch[MAX_BLOCKSIZE];
    memcpy(scratch, bytes, numBytes);
@@ -5,6 +5,7 @@
 #include "configuration.h"
 #include "mesh-pb-constants.h"
 #include <Arduino.h>
+#include <memory>

 extern concurrency::Lock *cryptLock;

@@ -48,7 +49,7 @@ class CryptoEngine
    virtual void aesSetKey(const uint8_t *key, size_t key_len);

    virtual void aesEncrypt(uint8_t *in, uint8_t *out);
-    AESSmall256 *aes = NULL;
+    std::unique_ptr<AESSmall256> aes = nullptr;

 #endif

@@ -77,7 +78,6 @@ class CryptoEngine
    /** Our per packet nonce */
    uint8_t nonce[16] = {0};
    CryptoKey key = {};
-    CTRCommon *ctr = NULL;
 #if !(MESHTASTIC_EXCLUDE_PKI)
    uint8_t shared_key[32] = {0};
    uint8_t private_key[32] = {0};
@@ -263,6 +263,7 @@ template <typename T> void LR11x0Interface<T>::startReceive()

    // Must be done AFTER, starting transmit, because startTransmit clears (possibly stale) interrupt pending register bits
    enableInterrupt(isrRxLevel0);
+    checkRxDoneIrqFlag();
 #endif
 }

@@ -298,6 +299,38 @@ template <typename T> bool LR11x0Interface<T>::isActivelyReceiving()
                           RADIOLIB_LR11X0_IRQ_PREAMBLE_DETECTED);
 }

+#ifdef LR11X0_AGC_RESET
+template <typename T> void LR11x0Interface<T>::resetAGC()
+{
+    // Safety: don't reset mid-packet
+    if (sendingPacket != NULL || (isReceiving && isActivelyReceiving()))
+        return;
+
+    LOG_DEBUG("LR11x0 AGC reset: warm sleep + Calibrate(0x3F)");
+
+    // 1. Warm sleep — powers down the analog frontend, resetting AGC state
+    lora.sleep(true, 0);
+
+    // 2. Wake to RC standby for stable calibration
+    lora.standby(RADIOLIB_LR11X0_STANDBY_RC, true);
+
+    // 3. Calibrate all blocks (PLL, ADC, image, RC oscillators)
+    //    calibrate() is protected on LR11x0, so use raw SPI (same as internal implementation)
+    uint8_t calData = RADIOLIB_LR11X0_CALIBRATE_ALL;
+    module.SPIwriteStream(RADIOLIB_LR11X0_CMD_CALIBRATE, &calData, 1, true, true);
+
+    // 4. Re-calibrate image rejection for actual operating frequency
+    //    Calibrate(0x3F) defaults to 902-928 MHz which is wrong for other regions.
+    lora.calibrateImageRejection(getFreq() - 4.0f, getFreq() + 4.0f);
+
+    // 5. Re-apply RX boosted gain mode
+    lora.setRxBoostedGainMode(config.lora.sx126x_rx_boosted_gain);
+
+    // 6. Resume receiving
+    startReceive();
+}
+#endif
+
 template <typename T> bool LR11x0Interface<T>::sleep()
 {
    // \todo Display actual typename of the adapter, not just `LR11x0`
@@ -27,6 +27,10 @@ template <class T> class LR11x0Interface : public RadioLibInterface

    bool isIRQPending() override { return lora.getIrqFlags() != 0; }

+#ifdef LR11X0_AGC_RESET
+    void resetAGC() override;
+#endif
+
  protected:
    /**
     * Specific module instance
@@ -106,6 +106,18 @@ class MeshModule
    /* We allow modules to ignore a request without sending an error if they have a specific reason for it. */
    bool ignoreRequest = false;

+    /**
+     * Check if the current request is a multi-hop broadcast. Modules should call this in allocReply()
+     * and return NULL to prevent reply storms from broadcast requests that have already been relayed.
+     */
+    bool isMultiHopBroadcastRequest()
+    {
+        if (currentRequest && isBroadcast(currentRequest->to) && currentRequest->hop_limit < currentRequest->hop_start) {
+            return true;
+        }
+        return false;
+    }
+
    /** If a bound channel name is set, we will only accept received packets that come in on that channel.
     * A special exception (FIXME, not sure if this is a good idea) - packets that arrive on the local interface
     * are allowed on any channel (this lets the local user do anything).
@@ -184,6 +184,29 @@ bool MeshPacketQueue::replaceLowerPriorityPacket(meshtastic_MeshPacket *p)
        }
    }

+    if (backPacket->tx_after) {
+        // Check if there's a late packet at the queue end
+        auto now = millis();
+        if (backPacket->tx_after < now && (!p->tx_after || backPacket->tx_after > p->tx_after)) {
+            int32_t dt = (int32_t)(backPacket->tx_after - now);
+            if (p->tx_after) {
+                LOG_WARN("Dropping late packet 0x%08x with TX delay %dms to make room in the TX queue for packet 0x%08x with "
+                         "TX delay %ums",
+                         backPacket->id, dt, p->id, p->tx_after - now);
+
+            } else {
+                LOG_WARN("Dropping late packet 0x%08x with TX delay %dms to make room in the TX queue for packet 0x%08x "
+                         "with no TX delay",
+                         backPacket->id, dt, p->id);
+            }
+            queue.pop_back();
+            packetPool.release(backPacket);
+            // Insert the new packet in the correct order
+            enqueue(p);
+            return true;
+        }
+    }
+
    // If the back packet's priority is not lower, no replacement occurs
    return false;
 }
@@ -30,6 +30,10 @@
 #include <power/PowerHAL.h>
 #include <vector>

+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+#include "security/EncryptedStorage.h"
+#endif
+
 #ifdef ARCH_ESP32
 #if HAS_WIFI
 #include "mesh/wifi/WiFiAPClient.h"
@@ -143,9 +147,8 @@ uint32_t get_st7789_id(uint8_t cs, uint8_t sck, uint8_t mosi, uint8_t dc, uint8_
    digitalWrite(rst, HIGH);
    delay(10);

-    uint32_t ID = 0;
-    ID = readwrite8(0x04, 24, 1, cs, sck, mosi, dc, rst);
-    ID = readwrite8(0x04, 24, 1, cs, sck, mosi, dc, rst); // ST7789 needs twice
+    readwrite8(0x04, 24, 1, cs, sck, mosi, dc, rst);
+    uint32_t ID = readwrite8(0x04, 24, 1, cs, sck, mosi, dc, rst); // ST7789 needs twice
    return ID;
 }

@@ -322,9 +325,9 @@ NodeDB::NodeDB()
    // Uncomment below to always enable UDP broadcasts
    // config.network.enabled_protocols = meshtastic_Config_NetworkConfig_ProtocolFlags_UDP_BROADCAST;

-    // If we are setup to broadcast on the default channel, ensure that the telemetry intervals are coerced to the minimum value
-    // of 30 minutes or more
-    if (channels.isDefaultChannel(channels.getPrimaryIndex())) {
+    // If we are setup to broadcast on any default channel slot (with default frequency slot semantics),
+    // ensure that the telemetry intervals are coerced to the minimum value of 30 minutes or more.
+    if (channels.hasDefaultChannel()) {
        LOG_DEBUG("Coerce telemetry to min of 30 minutes on defaults");
        moduleConfig.telemetry.device_update_interval = Default::getConfiguredOrMinimumValue(
            moduleConfig.telemetry.device_update_interval, min_default_telemetry_interval_secs);
@@ -646,6 +649,20 @@ void NodeDB::installDefaultConfig(bool preserveKey = false)
        config.security.private_key.size = 0;
    }
    config.security.public_key.size = 0;
+
+#ifdef HARDENED_DEFAULTS
+    config.security.serial_enabled = false;          // Disable USB serial PhoneAPI — no auth, physical access only
+    config.security.debug_log_api_enabled = false;   // No debug log leaks
+    config.security.admin_channel_enabled = false;   // No legacy admin channel
+    config.security.is_managed = true;               // Block all from=0 admin when unlocked;
+                                                     // operator must use PKC admin key to configure.
+                                                     // Passphrase delivery still works when locked
+                                                     // (AdminModule special-cases !isUnlocked()).
+    config.device.rebroadcast_mode = meshtastic_Config_DeviceConfig_RebroadcastMode_LOCAL_ONLY;
+    // FIXED_PIN allows the operator to connect via BLE and provision the passphrase.
+    config.bluetooth.mode = meshtastic_Config_BluetoothConfig_PairingMode_FIXED_PIN;
+#endif
+
 #ifdef PIN_GPS_EN
    config.position.gps_en_gpio = PIN_GPS_EN;
 #endif
@@ -711,7 +728,9 @@ void NodeDB::installDefaultConfig(bool preserveKey = false)
 #ifdef USERPREFS_FIXED_BLUETOOTH
    config.bluetooth.fixed_pin = USERPREFS_FIXED_BLUETOOTH;
    config.bluetooth.mode = meshtastic_Config_BluetoothConfig_PairingMode_FIXED_PIN;
-#else
+#elif !defined(HARDENED_DEFAULTS)
+    // Default: use RANDOM_PIN only if device has a screen (to display the PIN).
+    // set FIXED_PIN in the HARDENED_DEFAULTS block above.
    config.bluetooth.mode = hasScreen ? meshtastic_Config_BluetoothConfig_PairingMode_RANDOM_PIN
                                      : meshtastic_Config_BluetoothConfig_PairingMode_FIXED_PIN;
 #endif
@@ -814,26 +833,28 @@ void NodeDB::installDefaultModuleConfig()
    moduleConfig.has_store_forward = true;
    moduleConfig.has_telemetry = true;
    moduleConfig.has_external_notification = true;
-#if defined(PIN_BUZZER)
+#if defined(PIN_BUZZER) || defined(PIN_VIBRATION) || defined(LED_NOTIFICATION)
    moduleConfig.external_notification.enabled = true;
+#endif
+#if defined(PIN_BUZZER)
    moduleConfig.external_notification.output_buzzer = PIN_BUZZER;
    moduleConfig.external_notification.use_pwm = true;
    moduleConfig.external_notification.alert_message_buzzer = true;
-    moduleConfig.external_notification.nag_timeout = default_ringtone_nag_secs;
 #endif
 #if defined(PIN_VIBRATION)
-    moduleConfig.external_notification.enabled = true;
    moduleConfig.external_notification.output_vibra = PIN_VIBRATION;
    moduleConfig.external_notification.alert_message_vibra = true;
    moduleConfig.external_notification.output_ms = 500;
-    moduleConfig.external_notification.nag_timeout = 2;
 #endif
 #if defined(LED_NOTIFICATION)
-    moduleConfig.external_notification.enabled = true;
    moduleConfig.external_notification.output = LED_NOTIFICATION;
    moduleConfig.external_notification.active = LED_STATE_ON;
    moduleConfig.external_notification.alert_message = true;
    moduleConfig.external_notification.output_ms = 1000;
+#endif
+#if defined(PIN_VIBRATION)
+    moduleConfig.external_notification.nag_timeout = 2;
+#elif defined(PIN_BUZZER) || defined(LED_NOTIFICATION)
    moduleConfig.external_notification.nag_timeout = default_ringtone_nag_secs;
 #endif

@@ -1147,6 +1168,37 @@ LoadFileResult NodeDB::loadProto(const char *filename, size_t protoSize, size_t
                                 void *dest_struct)
 {
    LoadFileResult state = LoadFileResult::OTHER_FAILURE;
+
+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+    // check if the file is encrypted and decrypt before protobuf decode
+    if (EncryptedStorage::isEncrypted(filename)) {
+        uint8_t *decBuf = new uint8_t[protoSize];
+        if (!decBuf) {
+            LOG_ERROR("OOM decrypting %s", filename);
+            return LoadFileResult::OTHER_FAILURE;
+        }
+        size_t decLen = 0;
+        if (EncryptedStorage::readAndDecrypt(filename, decBuf, protoSize, decLen)) {
+            LOG_INFO("Load encrypted %s", filename);
+            pb_istream_t stream = pb_istream_from_buffer(decBuf, decLen);
+            if (fields != &meshtastic_NodeDatabase_msg)
+                memset(dest_struct, 0, objSize);
+            if (!pb_decode(&stream, fields, dest_struct)) {
+                LOG_ERROR("Error: can't decode protobuf %s", PB_GET_ERROR(&stream));
+                state = LoadFileResult::DECODE_FAILED;
+            } else {
+                LOG_INFO("Loaded encrypted %s successfully", filename);
+                state = LoadFileResult::LOAD_SUCCESS;
+            }
+        } else {
+            LOG_ERROR("Decrypt failed for %s, treating as corrupt", filename);
+            state = LoadFileResult::DECODE_FAILED;
+        }
+        delete[] decBuf;
+        return state;
+    }
+#endif
+
 #ifdef FSCom
    concurrency::LockGuard g(spiLock);

@@ -1223,6 +1275,21 @@ void NodeDB::loadFromDisk()
    }

 #endif
+
+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+    if (!EncryptedStorage::isUnlocked()) {
+        // Encrypted storage is locked — install defaults and wait for passphrase via BLE/serial.
+        // reloadFromDisk() will be called by AdminModule once the device is unlocked.
+        LOG_WARN("NodeDB: Encrypted storage locked, using default config until unlocked");
+        installDefaultNodeDatabase();
+        installDefaultDeviceState();
+        installDefaultConfig();
+        installDefaultModuleConfig();
+        installDefaultChannels();
+        return;
+    }
+#endif
+
    auto state = loadProto(nodeDatabaseFileName, getMaxNodesAllocatedSize(), sizeof(meshtastic_NodeDatabase),
                           &meshtastic_NodeDatabase_msg, &nodeDatabase);
    if (nodeDatabase.version < DEVICESTATE_MIN_VER) {
@@ -1384,6 +1451,35 @@ void NodeDB::loadFromDisk()
        LOG_INFO("Loaded UIConfig");
    }

+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+    // Ensure all config segments are persisted to encrypted storage.
+    // installDefaultConfig/installDefaultModuleConfig only set in-memory structs
+    // without saving to disk, so we force a save here to ensure encrypted files exist.
+    {
+        const char *filesToCheck[] = {configFileName, moduleConfigFileName, channelFileName, deviceStateFileName,
+                                      nodeDatabaseFileName};
+        int segments[] = {SEGMENT_CONFIG, SEGMENT_MODULECONFIG, SEGMENT_CHANNELS, SEGMENT_DEVICESTATE, SEGMENT_NODEDATABASE};
+        int toSave = 0;
+        for (int i = 0; i < 5; i++) {
+            if (!EncryptedStorage::isEncrypted(filesToCheck[i])) {
+                toSave |= segments[i];
+            }
+        }
+        if (toSave) {
+            LOG_INFO("TAK: Saving unencrypted segments to encrypted storage (mask=0x%x)", toSave);
+            saveToDisk(toSave);
+        }
+
+        // Migrate any remaining plaintext proto files (from standard firmware upgrade)
+        for (const char *fn : filesToCheck) {
+            if (!EncryptedStorage::isEncrypted(fn)) {
+                LOG_INFO("Migrating %s to encrypted storage", fn);
+                EncryptedStorage::migrateFile(fn);
+            }
+        }
+    }
+#endif
+
    // 2.4.X - configuration migration to update new default intervals
    if (moduleConfig.version < 23) {
        LOG_DEBUG("ModuleConfig version %d is stale, upgrading to new default intervals", moduleConfig.version);
@@ -1419,8 +1515,21 @@ void NodeDB::loadFromDisk()
    }

 #endif
+
 }

+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+/**
+ * Re-run loadFromDisk() after encrypted storage is unlocked at runtime.
+ * Called by AdminModule after a successful provisionPassphrase / unlockWithPassphrase.
+ */
+void NodeDB::reloadFromDisk()
+{
+    LOG_INFO("NodeDB: Reloading config from encrypted storage after unlock");
+    loadFromDisk();
+}
+#endif
+
 /** Save a protobuf from a file, return true for success */
 bool NodeDB::saveProto(const char *filename, size_t protoSize, const pb_msgdesc_t *fields, const void *dest_struct,
                       bool fullAtomic)
@@ -1433,6 +1542,34 @@ bool NodeDB::saveProto(const char *filename, size_t protoSize, const pb_msgdesc_
        return false;
    }

+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+    // Encrypt all files except uiconfig (no secrets) and the DEK file (self-encrypted)
+    if (strcmp(filename, uiconfigFileName) != 0) {
+        // First encode protobuf to a temporary buffer
+        uint8_t *pbBuf = new uint8_t[protoSize];
+        if (!pbBuf) {
+            LOG_ERROR("OOM encoding %s for encryption", filename);
+            return false;
+        }
+
+        pb_ostream_t stream = pb_ostream_from_buffer(pbBuf, protoSize);
+        if (!pb_encode(&stream, fields, dest_struct)) {
+            LOG_ERROR("Error: can't encode protobuf %s", PB_GET_ERROR(&stream));
+            delete[] pbBuf;
+            return false;
+        }
+
+        size_t encodedSize = stream.bytes_written;
+        bool ok = EncryptedStorage::encryptAndWrite(filename, pbBuf, encodedSize, fullAtomic);
+        delete[] pbBuf;
+
+        if (!ok) {
+            LOG_ERROR("EncryptedStorage: Failed to encrypt and write %s", filename);
+        }
+        return ok;
+    }
+#endif
+
    bool okay = false;
 #ifdef FSCom
    auto f = SafeFile(filename, fullAtomic);
@@ -1525,6 +1662,16 @@ bool NodeDB::saveToDiskNoRetry(int saveWhat)
        return false;
    }

+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+    // When encrypted storage is locked, encryptAndWrite() returns false for every file.
+    // That would cause saveToDisk()'s nRF52 retry path to call FSCom.format(), wiping all
+    // encrypted proto files from flash. Return true here — "nothing to save, not an error."
+    if (!EncryptedStorage::isUnlocked()) {
+        LOG_WARN("NodeDB: saveToDisk skipped — encrypted storage locked");
+        return true;
+    }
+#endif
+
    bool success = true;
 #ifdef FSCom
    spiLock->lock();
@@ -307,6 +307,12 @@ class NodeDB
        newStatus.notifyObservers(&status);
    }

+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+    /// Re-run loadFromDisk() after the encrypted storage is unlocked at runtime.
+    /// Called by AdminModule after a successful provisionPassphrase / unlockWithPassphrase.
+    void reloadFromDisk();
+#endif
+
  private:
    bool duplicateWarned = false;
    bool localPositionUpdatedSinceBoot = false;
@@ -439,7 +439,7 @@ void PacketHistory::removeRelayer(const uint8_t relayer, const uint32_t id, cons
 }

 // Getters and setters for hop limit fields packed in hop_limit
-inline uint8_t PacketHistory::getHighestHopLimit(PacketRecord &r)
+inline uint8_t PacketHistory::getHighestHopLimit(const PacketRecord &r)
 {
    return r.hop_limit & HOP_LIMIT_HIGHEST_MASK;
 }
@@ -449,7 +449,7 @@ inline void PacketHistory::setHighestHopLimit(PacketRecord &r, uint8_t hopLimit)
    r.hop_limit = (r.hop_limit & ~HOP_LIMIT_HIGHEST_MASK) | (hopLimit & HOP_LIMIT_HIGHEST_MASK);
 }

-inline uint8_t PacketHistory::getOurTxHopLimit(PacketRecord &r)
+inline uint8_t PacketHistory::getOurTxHopLimit(const PacketRecord &r)
 {
    return (r.hop_limit & HOP_LIMIT_OUR_TX_MASK) >> HOP_LIMIT_OUR_TX_SHIFT;
 }
@@ -43,9 +43,9 @@ class PacketHistory
     * @return true if node was indeed a relayer, false if not */
    bool wasRelayer(const uint8_t relayer, const PacketRecord &r, bool *wasSole = nullptr);

-    uint8_t getHighestHopLimit(PacketRecord &r);
+    uint8_t getHighestHopLimit(const PacketRecord &r);
    void setHighestHopLimit(PacketRecord &r, uint8_t hopLimit);
-    uint8_t getOurTxHopLimit(PacketRecord &r);
+    uint8_t getOurTxHopLimit(const PacketRecord &r);
    void setOurTxHopLimit(PacketRecord &r, uint8_t hopLimit);

    PacketHistory(const PacketHistory &);            // non construction-copyable
@@ -3,6 +3,9 @@
 #include "GPS.h"
 #endif

+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+#include "security/EncryptedStorage.h"
+#endif
 #include "Channels.h"
 #include "Default.h"
 #include "FSCommon.h"
@@ -54,6 +57,16 @@ void PhoneAPI::handleStartConfig()
        observe(&service->fromNumChanged);
 #ifdef FSCom
        observe(&xModem.packetReady);
+#endif
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+        // New physical connection: reset per-connection PKC auth.
+        // Do NOT reset here on re-requests (want_config_id sent again within the same
+        // connection after auth) — that would strip auth from a client who just unlocked
+        // and is re-fetching the full unredacted config.
+        isAdminAuthorized = false;
+        // MED-2: s_localAdminAuthorized (device-level passphrase auth) is intentionally
+        // NOT reset here. It persists until an explicit Lock Now (revokeAllAuth()).
+        // Resetting it on every new connection would cause an auth DoS.
 #endif
    }

@@ -127,6 +140,13 @@ void PhoneAPI::close()
        config_state = 0;
        pauseBluetoothLogging = false;
        heartbeatReceived = false;
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+        isAdminAuthorized = false;
+        // MED-2: do NOT reset s_localAdminAuthorized on disconnect.
+        // It represents device-level passphrase auth and must persist across connections
+        // until an explicit Lock Now (revokeAllAuth()). Resetting it here would revoke
+        // any passphrase-authenticated session the moment a second client connects.
+#endif
    }
 }

@@ -155,6 +175,21 @@ bool PhoneAPI::handleToRadio(const uint8_t *buf, size_t bufLength)
    if (pb_decode_from_bytes(buf, bufLength, &meshtastic_ToRadio_msg, &toRadioScratch)) {
        switch (toRadioScratch.which_payload_variant) {
        case meshtastic_ToRadio_packet_tag:
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+            if (!isAdminAuthorized && !s_localAdminAuthorized) {
+                // Allow admin messages addressed to this device — passphrase delivery must get through.
+                // AdminModule handles its own is_managed gate for those.
+                // Block everything else — unauthorized clients cannot inject mesh traffic.
+                // Require the packet to carry a decoded (not encrypted) payload so portnum is valid.
+                bool isLocalAdmin = toRadioScratch.packet.which_payload_variant == meshtastic_MeshPacket_decoded_tag &&
+                                    toRadioScratch.packet.decoded.portnum == meshtastic_PortNum_ADMIN_APP &&
+                                    toRadioScratch.packet.to == nodeDB->getNodeNum();
+                if (!isLocalAdmin) {
+                    LOG_INFO("TAK: Dropping non-admin ToRadio packet from unauthorized client");
+                    return false;
+                }
+            }
+#endif
            return handleToRadioPacket(toRadioScratch.packet);
        case meshtastic_ToRadio_want_config_id_tag:
            config_nonce = toRadioScratch.want_config_id;
@@ -166,6 +201,12 @@ bool PhoneAPI::handleToRadio(const uint8_t *buf, size_t bufLength)
            close();
            break;
        case meshtastic_ToRadio_xmodemPacket_tag:
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+            if (!isAdminAuthorized && !s_localAdminAuthorized) {
+                LOG_INFO("TAK: Dropping xmodem packet from unauthorized client");
+                break;
+            }
+#endif
            LOG_INFO("Got xmodem packet");
 #ifdef FSCom
            xModem.handlePacket(toRadioScratch.xmodemPacket);
@@ -286,8 +327,15 @@ size_t PhoneAPI::getFromRadio(uint8_t *buf)
        }
        if (config_nonce == SPECIAL_NONCE_ONLY_NODES) {
            // If client only wants node info, jump directly to sending nodes
-            state = STATE_SEND_OTHER_NODEINFOS;
-            onNowHasData(0);
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+            if (!isAdminAuthorized && !s_localAdminAuthorized) {
+                state = STATE_SEND_COMPLETE_ID; // Unauthorized: skip node DB
+            } else
+#endif
+            {
+                state = STATE_SEND_OTHER_NODEINFOS;
+                onNowHasData(0);
+            }
        } else {
            state = STATE_SEND_METADATA;
        }
@@ -303,7 +351,17 @@ size_t PhoneAPI::getFromRadio(uint8_t *buf)

    case STATE_SEND_CHANNELS:
        fromRadioScratch.which_payload_variant = meshtastic_FromRadio_channel_tag;
-        fromRadioScratch.channel = channels.getByIndex(config_state);
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+        if (!isAdminAuthorized && !s_localAdminAuthorized) {
+            // Send channel structure but zero out PSK to prevent key extraction
+            fromRadioScratch.channel = channels.getByIndex(config_state);
+            memset(fromRadioScratch.channel.settings.psk.bytes, 0, sizeof(fromRadioScratch.channel.settings.psk.bytes));
+            fromRadioScratch.channel.settings.psk.size = 0;
+        } else
+#endif
+        {
+            fromRadioScratch.channel = channels.getByIndex(config_state);
+        }
        config_state++;
        // Advance when we have sent all of our Channels
        if (config_state >= MAX_NUM_CHANNELS) {
@@ -336,6 +394,13 @@ size_t PhoneAPI::getFromRadio(uint8_t *buf)
            LOG_DEBUG("Send config: network");
            fromRadioScratch.config.which_payload_variant = meshtastic_Config_network_tag;
            fromRadioScratch.config.payload_variant.network = config.network;
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+            if (!isAdminAuthorized && !s_localAdminAuthorized) {
+                // Redact wifi PSK
+                memset(fromRadioScratch.config.payload_variant.network.wifi_psk, 0,
+                       sizeof(fromRadioScratch.config.payload_variant.network.wifi_psk));
+            }
+#endif
            break;
        case meshtastic_Config_display_tag:
            LOG_DEBUG("Send config: display");
@@ -356,6 +421,30 @@ size_t PhoneAPI::getFromRadio(uint8_t *buf)
            LOG_DEBUG("Send config: security");
            fromRadioScratch.config.which_payload_variant = meshtastic_Config_security_tag;
            fromRadioScratch.config.payload_variant.security = config.security;
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+            if (!isAdminAuthorized && !s_localAdminAuthorized) {
+                // Redact private key
+                memset(fromRadioScratch.config.payload_variant.security.private_key.bytes, 0,
+                       sizeof(fromRadioScratch.config.payload_variant.security.private_key.bytes));
+                fromRadioScratch.config.payload_variant.security.private_key.size = 0;
+                // Redact admin keys
+                for (int i = 0; i < 3; i++) {
+                    memset(fromRadioScratch.config.payload_variant.security.admin_key[i].bytes, 0,
+                           sizeof(fromRadioScratch.config.payload_variant.security.admin_key[i].bytes));
+                    fromRadioScratch.config.payload_variant.security.admin_key[i].size = 0;
+                }
+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+                // Signal provisioning state via admin_key[0] so the client knows
+                // whether to show "Set passphrase" vs "Enter passphrase":
+                //   admin_key[0].size == 0 → not provisioned (first time setup)
+                //   admin_key[0].size == 1, bytes[0] == 0x01 → provisioned, locked
+                if (EncryptedStorage::isProvisioned()) {
+                    fromRadioScratch.config.payload_variant.security.admin_key[0].bytes[0] = 0x01;
+                    fromRadioScratch.config.payload_variant.security.admin_key[0].size = 1;
+                }
+#endif
+            }
+#endif
            break;
        case meshtastic_Config_sessionkey_tag:
            LOG_DEBUG("Send config: sessionkey");
@@ -454,6 +543,12 @@ size_t PhoneAPI::getFromRadio(uint8_t *buf)
        config_state++;
        // Advance when we have sent all of our ModuleConfig objects
        if (config_state > (_meshtastic_AdminMessage_ModuleConfigType_MAX + 1)) {
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+            if (!isAdminAuthorized && !s_localAdminAuthorized) {
+                // Unauthorized client: skip node DB and file manifest — only send config complete
+                state = STATE_SEND_COMPLETE_ID;
+            } else
+#endif
            // Handle special nonce behaviors:
            // - SPECIAL_NONCE_ONLY_CONFIG: Skip node info, go directly to file manifest
            // - SPECIAL_NONCE_ONLY_NODES: After sending nodes, skip to complete
@@ -544,24 +639,46 @@ size_t PhoneAPI::getFromRadio(uint8_t *buf)
            fromRadioScratch.queueStatus = *queueStatusPacketForPhone;
            releaseQueueStatusPhonePacket();
        } else if (mqttClientProxyMessageForPhone) {
-            fromRadioScratch.which_payload_variant = meshtastic_FromRadio_mqttClientProxyMessage_tag;
-            fromRadioScratch.mqttClientProxyMessage = *mqttClientProxyMessageForPhone;
-            releaseMqttClientProxyPhonePacket();
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+            if (!isAdminAuthorized && !s_localAdminAuthorized) {
+                releaseMqttClientProxyPhonePacket(); // Discard — unauthorized client
+            } else
+#endif
+            {
+                fromRadioScratch.which_payload_variant = meshtastic_FromRadio_mqttClientProxyMessage_tag;
+                fromRadioScratch.mqttClientProxyMessage = *mqttClientProxyMessageForPhone;
+                releaseMqttClientProxyPhonePacket();
+            }
        } else if (xmodemPacketForPhone.control != meshtastic_XModem_Control_NUL) {
-            fromRadioScratch.which_payload_variant = meshtastic_FromRadio_xmodemPacket_tag;
-            fromRadioScratch.xmodemPacket = xmodemPacketForPhone;
-            xmodemPacketForPhone = meshtastic_XModem_init_zero;
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+            if (!isAdminAuthorized && !s_localAdminAuthorized) {
+                xmodemPacketForPhone = meshtastic_XModem_init_zero; // Discard — unauthorized client
+            } else
+#endif
+            {
+                fromRadioScratch.which_payload_variant = meshtastic_FromRadio_xmodemPacket_tag;
+                fromRadioScratch.xmodemPacket = xmodemPacketForPhone;
+                xmodemPacketForPhone = meshtastic_XModem_init_zero;
+            }
        } else if (clientNotification) {
+            // Always deliver clientNotification — required for TAK_UNLOCKED/TAK_LOCKED to reach client
            fromRadioScratch.which_payload_variant = meshtastic_FromRadio_clientNotification_tag;
            fromRadioScratch.clientNotification = *clientNotification;
            releaseClientNotification();
        } else if (packetForPhone) {
-            printPacket("phone downloaded packet", packetForPhone);
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+            if (!isAdminAuthorized && !s_localAdminAuthorized) {
+                releasePhonePacket(); // Discard mesh traffic — unauthorized client
+            } else
+#endif
+            {
+                printPacket("phone downloaded packet", packetForPhone);

-            // Encapsulate as a FromRadio packet
-            fromRadioScratch.which_payload_variant = meshtastic_FromRadio_packet_tag;
-            fromRadioScratch.packet = *packetForPhone;
-            releasePhonePacket();
+                // Encapsulate as a FromRadio packet
+                fromRadioScratch.which_payload_variant = meshtastic_FromRadio_packet_tag;
+                fromRadioScratch.packet = *packetForPhone;
+                releasePhonePacket();
+            }
        }
        break;

@@ -604,6 +721,28 @@ void PhoneAPI::sendConfigComplete()
        service->api_state = service->STATE_ETH;
    }

+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+    // Immediately after config_complete_id, notify the client if it hasn't authenticated.
+    // Gate on client auth state (not storage lock state) — storage may be auto-unlocked via
+    // boot token, but each new BLE/USB connection must still present the passphrase.
+    if (!isAdminAuthorized && !s_localAdminAuthorized) {
+        char msg[48];
+        if (!EncryptedStorage::isProvisioned()) {
+            strncpy(msg, "TAK_NEEDS_PROVISION", sizeof(msg));
+        } else {
+            // Provisioned: client must authenticate. Use lock reason if storage is hard-locked,
+            // otherwise signal that passphrase auth is required for this connection.
+            if (!EncryptedStorage::isUnlocked()) {
+                snprintf(msg, sizeof(msg), "TAK_LOCKED:%s", EncryptedStorage::getLockReason());
+            } else {
+                strncpy(msg, "TAK_LOCKED:needs_auth", sizeof(msg));
+            }
+        }
+        sendNotification(meshtastic_LogRecord_Level_WARNING, 0, msg);
+        LOG_INFO("PhoneAPI: sent %s to client", msg);
+    }
+#endif
+
    // Allow subclasses to know we've entered steady-state so they can lower power consumption
    onConfigComplete();

@@ -842,3 +981,25 @@ int PhoneAPI::onNotify(uint32_t newValue)

    return timeout ? -1 : 0; // If we timed out, MeshService should stop iterating through observers as we just removed one
 }
+
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+// HIGH-3: static atomic so BLE-task writes and main-loop reads are race-free.
+std::atomic<bool> PhoneAPI::s_localAdminAuthorized{false};
+
+void PhoneAPI::authorizeLocalAdmin()
+{
+    s_localAdminAuthorized.store(true);
+    LOG_INFO("TAK: Local admin authorized via PKC");
+}
+
+bool PhoneAPI::isLocalAdminAuthorized()
+{
+    return s_localAdminAuthorized.load();
+}
+
+void PhoneAPI::revokeAllAuth()
+{
+    s_localAdminAuthorized.store(false);
+    LOG_INFO("TAK: All connection auth revoked (Lock Now)");
+}
+#endif
@@ -4,6 +4,7 @@
 #include "concurrency/Lock.h"
 #include "mesh-pb-constants.h"
 #include "meshtastic/portnums.pb.h"
+#include <atomic>
 #include <deque>
 #include <iterator>
 #include <string>
@@ -138,6 +139,19 @@ class PhoneAPI
    bool isConnected() { return state != STATE_SEND_NOTHING; }
    bool isSendingPackets() { return state == STATE_SEND_PACKETS; }

+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+    /// Set by AdminModule after successful PKC admin key validation.
+    /// When true, config dumps include full unredacted secrets.
+    void setAdminAuthorized(bool authorized) { isAdminAuthorized = authorized; }
+    bool getAdminAuthorized() const { return isAdminAuthorized; }
+
+    /// Static: authorize all local PhoneAPI instances (called by AdminModule)
+    static void authorizeLocalAdmin();
+    static bool isLocalAdminAuthorized();
+    /// Static: immediately revoke all connection-level auth (called on Lock Now)
+    static void revokeAllAuth();
+#endif
+
  protected:
    /// Our fromradio packet while it is being assembled
    meshtastic_FromRadio fromRadioScratch = {};
@@ -179,6 +193,13 @@ class PhoneAPI

    APIType api_type = TYPE_NONE;

+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+    // HIGH-3: both flags are accessed from multiple tasks (main loop + NimBLE BLE callback
+    // task), so they must be atomic to prevent data races on read-modify-write sequences.
+    std::atomic<bool> isAdminAuthorized{false};
+    static std::atomic<bool> s_localAdminAuthorized;
+#endif
+
  private:
    void releasePhonePacket();

@@ -301,6 +301,7 @@ void RF95Interface::startReceive()

    // Must be done AFTER, starting receive, because startReceive clears (possibly stale) interrupt pending register bits
    enableInterrupt(isrRxLevel0);
+    checkRxDoneIrqFlag();
 }

 bool RF95Interface::isChannelActive()
--- a/Show More
+++ b/Show More