trunk

Wipe messages
Clamp position precision on public / known-keys (#10665 )
2026-06-15 10:23:27 -04:00 · 2026-06-15 10:14:38 -04:00 · 2026-06-14 18:53:18 -05:00 · 2026-06-14 06:38:49 -05:00 · 2026-06-14 06:30:20 -05:00 · 2026-06-13 21:14:47 -05:00
188 changed files with 11773 additions and 3567 deletions
@@ -0,0 +1,17 @@
+{
+  "hooks": {
+    "PostToolUse": [
+      {
+        "matcher": "Write|Edit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "f=$(tr -d '\\n' | grep -o '\"file_path\"[[:space:]]*:[[:space:]]*\"[^\"]*\"' | head -1 | sed 's/.*:[[:space:]]*\"//; s/\"$//'); [ -n \"$f\" ] && [ -f \"$f\" ] || exit 0; t=$(command -v trunk || echo \"$HOME/.cache/trunk/launcher/trunk\"); [ -x \"$t\" ] || { echo \"trunk-fmt hook: trunk not found; its launcher needs curl or wget to bootstrap the CLI (see 'Formatting & the trunk toolchain' in .github/copilot-instructions.md)\" >&2; exit 1; }; out=$(\"$t\" fmt --force \"$f\" 2>&1) || { echo \"trunk-fmt hook: trunk fmt failed on $f: $out\" >&2; exit 1; }",
+            "timeout": 120,
+            "statusMessage": "Formatting (trunk)..."
+          }
+        ]
+      }
+    ]
+  }
+}
@@ -18,7 +18,7 @@ ENV PIP_ROOT_USER_ACTION=ignore
 # trunk-ignore(hadolint/DL3008): apt packages are not pinned.
 # trunk-ignore(terrascan/AC_DOCKER_0002): apt packages are not pinned.
 RUN apt-get update && apt-get install --no-install-recommends -y \
-        cmake git zip libgpiod-dev libbluetooth-dev libi2c-dev \
+        cmake git zip libgpiod-dev libjsoncpp-dev libbluetooth-dev libi2c-dev \
        libunistring-dev libmicrohttpd-dev libgnutls28-dev libgcrypt20-dev \
        libusb-1.0-0-dev libssl-dev pkg-config libsqlite3-dev libsdl2-dev && \
    apt-get clean && rm -rf /var/lib/apt/lists/* && \
@@ -31,7 +31,7 @@ cmake --install "$WORK/ulfius/$SANITIZER" --prefix /usr
 cd "$SRC/firmware"

 PLATFORMIO_EXTRA_SCRIPTS=$(echo -e "pre:.clusterfuzzlite/platformio-clusterfuzzlite-pre.py\npost:.clusterfuzzlite/platformio-clusterfuzzlite-post.py")
-STATIC_LIBS=$(pkg-config --libs --static libulfius openssl libgpiod yaml-cpp bluez --silence-errors)
+STATIC_LIBS=$(pkg-config --libs --static libulfius openssl libgpiod yaml-cpp jsoncpp bluez --silence-errors)
 export PLATFORMIO_EXTRA_SCRIPTS
 export STATIC_LIBS
 export PLATFORMIO_WORKSPACE_DIR="$WORK/pio/$SANITIZER"
@@ -16,6 +16,7 @@ RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
    libssl-dev \
    libulfius-dev \
    libyaml-cpp-dev \
+    libjsoncpp-dev \
    pipx \
    pkg-config \
    python3 \
@@ -13,7 +13,7 @@ runs:
      shell: bash
      run: |
        sudo apt-get -y update --fix-missing
-        sudo apt-get install -y cppcheck libbluetooth-dev libgpiod-dev libyaml-cpp-dev lsb-release
+        sudo apt-get install -y cppcheck libbluetooth-dev libgpiod-dev libyaml-cpp-dev libjsoncpp-dev lsb-release

    - name: Setup Python
      uses: actions/setup-python@v6
@@ -11,4 +11,4 @@ runs:
    - name: Install libs needed for native build
      shell: bash
      run: |
-        sudo apt-get install -y libbluetooth-dev libgpiod-dev libyaml-cpp-dev openssl libssl-dev libulfius-dev liborcania-dev libusb-1.0-0-dev libi2c-dev libuv1-dev
+        sudo apt-get install -y libbluetooth-dev libgpiod-dev libyaml-cpp-dev libjsoncpp-dev openssl libssl-dev libulfius-dev liborcania-dev libusb-1.0-0-dev libi2c-dev libuv1-dev
@@ -283,6 +283,15 @@ firmware/

 ## Coding Conventions

+### Formatting & the trunk toolchain
+
+`trunk fmt` is the project formatter (`trunk_check` CI rejects unformatted code). For Claude Code users, `.claude/settings.json` ships a PostToolUse hook that runs `trunk fmt --force` on every file the agent writes or edits. The hook is pure sh/grep/sed — no python or jq required — but trunk itself must be able to run:
+
+- Trunk's launcher (`~/.cache/trunk/launcher/trunk`, or `trunk` on PATH) downloads the CLI version pinned in `.trunk/trunk.yaml` on first use and again whenever that pin is bumped. **The launcher needs `curl` or `wget`**; without one it fails with "Cannot download… please install curl or wget", and the hook surfaces that as a warning on every write.
+- No curl/wget available (e.g. a minimal WSL image)? Bootstrap by hand with any Python (PlatformIO bundles one at `~/.platformio/penv/bin/python`): download `https://trunk.io/releases/<ver>/trunk-<ver>-linux-x86_64.tar.gz` and place the `trunk` binary at `~/.cache/trunk/cli/<ver>-linux-x86_64/trunk` (chmod +x), where `<ver>` is the `cli.version` from `.trunk/trunk.yaml`.
+- The hook fails loudly by design (visible warning, non-blocking). Silent no-op formatting hooks hide real breakage — don't re-add `2>/dev/null || true` around the whole thing.
+- More generally: don't assume a stock Linux userland in hooks or helper scripts — minimal WSL/container images may lack `python3`, `curl`, `wget`, and `jq`. Prefer plain sh + coreutils, or PlatformIO's bundled Python for anything heavier.
+
 ### General Style

 - Follow existing code style - run `trunk fmt` before commits
@@ -609,20 +618,35 @@ Most workflows can be triggered manually via `workflow_dispatch` for testing.

 ### Native unit tests (C++)

-Unit tests in `test/` directory with 12 test suites:
+Unit tests in `test/` directory with 17 test suites:

- `test_crypto/` - Cryptography
- `test_mqtt/` - MQTT integration
- `test_radio/` - Radio interface
- `test_mesh_module/` - Module framework
- `test_meshpacket_serializer/` - Packet serialization
- `test_transmit_history/` - Retransmission tracking
+- `test_admin_radio/` - LoRa region/config validation and AdminModule dispatch
 - `test_atak/` - ATAK integration
+- `test_crypto/` - Cryptography
 - `test_default/` - Default configuration
 - `test_http_content_handler/` - HTTP handling
+- `test_mac_from_string/` - MAC address parsing
+- `test_mesh_module/` - Module framework
+- `test_meshpacket_serializer/` - Packet serialization
+- `test_mqtt/` - MQTT integration
+- `test_packet_history/` - Packet history tracking
+- `test_position_precision/` - Position precision helpers
+- `test_radio/` - Radio interface
 - `test_serial/` - Serial communication
+- `test_traffic_management/` - Traffic management
+- `test_transmit_history/` - Retransmission tracking
+- `test_type_conversions/` - NodeDB v25 type conversion (bitfield round-trips, NodeInfoLite)
+- `test_utf8/` - UTF-8 utilities

-Run with: `pio test -e native`
+Run command (preferred — avoids pipe-buffering and the Ubuntu externally-managed-environment error):
+
+```bash
+~/.platformio/penv/bin/python -m platformio test -e native -f test_your_suite > /tmp/test_out.txt 2>&1
+grep -E 'error:|PASS|FAIL|succeeded|failed' /tmp/test_out.txt
+tail -15 /tmp/test_out.txt
+```
+
+Do **not** use `pio test … | tail -N` — it discards build errors and shows stale cached results. Do **not** use `pio test … | grep` — line-buffering makes the terminal appear hung until the process exits. Redirect to a file first, then grep.

 Simulation testing: `bin/test-simulator.sh`

@@ -0,0 +1,62 @@
+name: Post Firmware Size Comment
+
+on:
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
+
+permissions:
+  pull-requests: write
+  actions: read
+
+jobs:
+  post-size-comment:
+    if: >
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion != 'cancelled' &&
+      github.repository == 'meshtastic/firmware'
+    continue-on-error: true
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download size report
+        id: download
+        uses: actions/download-artifact@v8
+        continue-on-error: true
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ github.event.workflow_run.id }}
+          name: size-report
+          path: ./
+
+      - name: Post or update PR comment
+        if: steps.download.outcome == 'success'
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const fs = require('fs');
+            const marker = '<!-- firmware-size-report -->';
+            const body = fs.readFileSync('./size-report.md', 'utf8');
+            const prNumber = parseInt(fs.readFileSync('./pr-number.txt', 'utf8').trim(), 10);
+
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: prNumber,
+            });
+
+            const existing = comments.find(c => c.body.includes(marker));
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: prNumber,
+                body,
+              });
+            }
@@ -0,0 +1,187 @@
+name: Post Web Flasher Link Comment
+
+on:
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
+
+permissions:
+  pull-requests: write
+  actions: read
+
+jobs:
+  post-flasher-link:
+    if: >
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion != 'cancelled' &&
+      github.repository == 'meshtastic/firmware'
+    continue-on-error: true
+    runs-on: ubuntu-latest
+    steps:
+      # Per-board manifests carry the firmware's own metadata (activelySupported,
+      # displayName, ...) generated from each target's custom_meshtastic_* config.
+      - name: Download board manifests
+        uses: actions/download-artifact@v8
+        continue-on-error: true
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ github.event.workflow_run.id }}
+          pattern: manifest-*
+          path: ./manifests
+          merge-multiple: true
+
+      - name: Post or update web flasher link comment
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const marker = '<!-- web-flasher-link -->';
+            const run = context.payload.workflow_run;
+            const { owner, repo } = context.repo;
+
+            // Resolve the PR by matching the run's head SHA against the repo's open
+            // PRs. workflow_run.pull_requests is empty for fork PRs, and
+            // listPullRequestsAssociatedWithCommit won't return an open fork PR by
+            // its head commit — but pulls.list includes fork PRs. Matching on head
+            // SHA also enforces that the run is for the PR's current commit, so stale
+            // re-runs of an outdated commit won't match.
+            const openPrs = await github.paginate(github.rest.pulls.list, {
+              owner, repo, state: 'open', per_page: 100,
+            });
+            const pr = openPrs.find((p) => p.head.sha === run.head_sha);
+            if (!pr) {
+              core.info(`No open pull request matches commit ${run.head_sha}; skipping.`);
+              return;
+            }
+            const prNumber = pr.number;
+
+            // Restrict to trusted authors. NOTE: author_association is computed for
+            // the GITHUB_TOKEN, which cannot see *private/concealed* org memberships —
+            // those members come back as CONTRIBUTOR, not MEMBER. So gating on MEMBER
+            // alone silently excludes most maintainers. We allow the trusted set the
+            // token can actually identify (members, collaborators, and anyone with a
+            // previously merged PR). For strict members-only you'd need an org-read
+            // App/PAT token to call orgs.checkMembershipForUser.
+            const allowedAssociations = ['OWNER', 'MEMBER', 'COLLABORATOR', 'CONTRIBUTOR'];
+            if (!allowedAssociations.includes(pr.author_association)) {
+              core.info(`Author association ${pr.author_association} is not trusted; skipping.`);
+              return;
+            }
+
+            // Require at least one per-arch firmware artifact from gather-artifacts
+            const artifacts = await github.paginate(github.rest.actions.listWorkflowRunArtifacts, {
+              owner, repo, run_id: run.id, per_page: 100,
+            });
+            const archRe = /^firmware-(esp32|esp32s3|esp32c3|esp32c6|nrf52840|rp2040|rp2350|stm32)-(\d+\.\d+\.\d+\.[0-9a-f]+)$/;
+            const archArtifacts = artifacts.filter((a) => archRe.test(a.name) && !a.expired);
+            if (archArtifacts.length === 0) {
+              core.info('No per-arch firmware artifacts found; skipping.');
+              return;
+            }
+
+            const version = archRe.exec(archArtifacts[0].name)[2];
+            const expiresAt = archArtifacts[0].expires_at
+              ? new Date(archArtifacts[0].expires_at).toISOString().slice(0, 10)
+              : null;
+
+            // Read each built board's manifest (.mt.json). activelySupported,
+            // displayName and architecture come straight from the board's
+            // custom_meshtastic_* platformio config, so the list is in sync with
+            // the firmware itself — no external device database needed.
+            const fs = require('fs');
+            let boards = [];
+            try {
+              boards = fs.readdirSync('./manifests')
+                .filter((f) => f.endsWith('.mt.json'))
+                .map((f) => {
+                  try { return JSON.parse(fs.readFileSync(`./manifests/${f}`, 'utf8')); }
+                  catch { return null; }
+                })
+                .filter((m) => m && m.activelySupported === true && m.platformioTarget)
+                .map((m) => ({
+                  board: m.platformioTarget,
+                  platform: m.architecture || '',
+                  // displayName is maintainer-authored text; escape table-breaking pipes
+                  displayName: String(m.displayName || m.platformioTarget).replace(/\|/g, '\\|'),
+                  image: Array.isArray(m.images) && m.images[0] ? String(m.images[0]) : '',
+                }))
+                .sort((a, b) => a.board.localeCompare(b.board));
+            } catch (e) {
+              core.warning(`Could not read board manifests: ${e.message}`);
+            }
+
+            const flasherUrl = `https://flasher.meshtastic.org/?pr=${prNumber}`;
+            // Device illustrations are served by the flasher from the same image
+            // names the manifest declares (custom_meshtastic_images). The flasher
+            // serves its SPA shell (HTML, 200) for unknown paths, so confirm each
+            // image really resolves to an image before linking it.
+            const imageBase = 'https://flasher.meshtastic.org/img/devices/';
+            await Promise.all(boards.map(async (b) => {
+              if (!b.image) return;
+              try {
+                const res = await fetch(`${imageBase}${encodeURIComponent(b.image)}`);
+                const type = res.headers.get('content-type') || '';
+                if (!res.ok || !type.startsWith('image/')) b.image = '';
+              } catch { b.image = ''; }
+            }));
+
+            const boardLines = boards
+              .map((b) => {
+                const img = b.image ? `<img src="${imageBase}${encodeURIComponent(b.image)}" alt="" height="34">` : '';
+                return `| ${img} | ${b.displayName} | [\`${b.board}\`](${flasherUrl}&device=${encodeURIComponent(b.board)}) | ${b.platform} |`;
+              })
+              .join('\n');
+
+            // Shields.io badges. Only non-user-controlled, charset-constrained values
+            // (version, commit sha, counts, dates) go into badge URLs — never board
+            // names or the PR title — so the rendered comment cannot be spoofed.
+            const shieldText = (s) =>
+              encodeURIComponent(String(s).replace(/-/g, '--').replace(/_/g, '__').replace(/ /g, '_'));
+            const shield = (label, message, color) =>
+              `https://img.shields.io/badge/${shieldText(label)}-${shieldText(message)}-${color}`;
+            const buttonUrl =
+              `https://img.shields.io/badge/${shieldText('Flash this PR in the Web Flasher')}-2C2D3C?style=for-the-badge`;
+            const badges = [
+              `![firmware](${shield('firmware', version, '67EA94')})`,
+              `![commit](${shield('commit', run.head_sha.slice(0, 7), '2C2D3C')})`,
+              `![boards](${shield('boards', boards.length, '5C6BC0')})`,
+            ];
+            if (expiresAt) badges.push(`![expires](${shield('expires', expiresAt, '9A4E00')})`);
+
+            // Only render the board table when there are supported boards to list
+            const boardTable = boards.length > 0 ? [
+              `<details><summary>Supported boards built by this PR (${boards.length})</summary>`,
+              '',
+              '| | Device | Board | Platform |',
+              '| --- | --- | --- | --- |',
+              boardLines,
+              '',
+              '</details>',
+              '',
+            ] : [];
+
+            const body = [
+              marker,
+              '## ⚡ Try this PR in the Web Flasher',
+              '',
+              `[![Flash this PR in the Web Flasher](${buttonUrl})](${flasherUrl})`,
+              '',
+              badges.join(' '),
+              '',
+              '> [!WARNING]',
+              '> This is an automated, unreviewed CI test build. Back up your device configuration',
+              '> before flashing, and only flash devices you are able to recover.',
+              '',
+              ...boardTable,
+              `*Build artifacts expire${expiresAt ? ` on ${expiresAt}` : ' after 30 days'}. Updated for \`${run.head_sha.slice(0, 7)}\`.*`,
+            ].join('\n');
+
+            // Sticky comment: update in place when the marker is found
+            const comments = await github.paginate(github.rest.issues.listComments, {
+              owner, repo, issue_number: prNumber, per_page: 100,
+            });
+            const existing = comments.find((c) => c.body?.includes(marker));
+            if (existing) {
+              await github.rest.issues.updateComment({ owner, repo, comment_id: existing.id, body });
+            } else {
+              await github.rest.issues.createComment({ owner, repo, issue_number: prNumber, body });
+            }
@@ -0,0 +1,62 @@
+name: Post Web Flasher Build Placeholder
+
+# Drops an immediate "build in progress" comment when a PR opens, so the web
+# flasher entry shows up right away. The real CI-driven workflow
+# (flasher-link-comment.yml) later replaces it in place via the shared marker.
+#
+# SECURITY: this uses pull_request_target (write token, runs for fork PRs) but is
+# safe because it never checks out or runs PR code and posts a fully static body
+# — no PR title, branch name, or other untrusted input is used anywhere.
+
+on:
+  pull_request_target:
+    types: [opened, reopened]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  post-placeholder:
+    if: github.repository == 'meshtastic/firmware'
+    continue-on-error: true
+    runs-on: ubuntu-latest
+    steps:
+      - name: Post web flasher build-in-progress placeholder
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const marker = '<!-- web-flasher-link -->';
+            const { owner, repo } = context.repo;
+            const pr = context.payload.pull_request;
+
+            // Trusted authors only (matches the real workflow). author_association
+            // can't reflect private org membership for the token, so concealed
+            // members appear as CONTRIBUTOR — include it, or maintainers are excluded.
+            const allowedAssociations = ['OWNER', 'MEMBER', 'COLLABORATOR', 'CONTRIBUTOR'];
+            if (!allowedAssociations.includes(pr.author_association)) {
+              core.info(`Author association ${pr.author_association} is not trusted; skipping.`);
+              return;
+            }
+
+            // Only seed a placeholder when no flasher comment exists yet — never
+            // overwrite a real (or existing placeholder) comment.
+            const comments = await github.paginate(github.rest.issues.listComments, {
+              owner, repo, issue_number: pr.number, per_page: 100,
+            });
+            if (comments.some((c) => c.body?.includes(marker))) {
+              core.info('Flasher comment already exists; nothing to do.');
+              return;
+            }
+
+            const body = [
+              marker,
+              '## ⚡ Try this PR in the Web Flasher',
+              '',
+              '> [!NOTE]',
+              '> Building this pull request… the flash button, badges and supported-board',
+              '> list will appear here automatically once CI finishes.',
+            ].join('\n');
+
+            await github.rest.issues.createComment({
+              owner, repo, issue_number: pr.number, body,
+            });
@@ -82,8 +82,9 @@ jobs:
      fail-fast: false
      matrix:
        check: ${{ fromJson(needs.setup.outputs.check) }}
-    # Use 'arctastic' self-hosted runner pool when checking in the main repo
-    runs-on: ${{ github.repository_owner == 'meshtastic' && 'arctastic' || 'ubuntu-latest' }}
+    # Runs on GitHub-hosted runners so checks don't compete with builds for the
+    # self-hosted 'arctastic' pool (which builds use).
+    runs-on: ubuntu-latest
    if: ${{ github.event_name != 'workflow_dispatch' && github.repository == 'meshtastic/firmware' }}
    steps:
      - uses: actions/checkout@v6
@@ -245,47 +246,126 @@ jobs:
          path: ./*.elf
          retention-days: 30

-  shame:
+  firmware-size-report:
    if: github.repository == 'meshtastic/firmware'
    continue-on-error: true
+    permissions:
+      contents: read
+      actions: read
    runs-on: ubuntu-latest
    needs: [build]
    steps:
      - uses: actions/checkout@v6
-        if: github.event_name == 'pull_request'
-        with:
-          filter: blob:none # means we download all the git history but none of the commit (except ones with checkout like the head)
-          fetch-depth: 0
-      - name: Download the current manifests
+
+      - name: Download current manifests
        uses: actions/download-artifact@v8
        with:
-          path: ./manifests-new/
+          path: ./manifests/
          pattern: manifest-*
          merge-multiple: true
-      - name: Upload combined manifests for later commit and global stats crunching.
+
+      - name: Collect current firmware sizes
+        run: python3 bin/collect_sizes.py ./manifests/ ./current-sizes.json
+
+      - name: Upload size report artifact
        uses: actions/upload-artifact@v7
-        id: upload-manifest
        with:
-          name: manifests-${{ github.sha }}
+          name: firmware-sizes-${{ github.sha }}
          overwrite: true
-          path: manifests-new/*.mt.json
-      - name: Find the merge base
+          path: ./current-sizes.json
+          retention-days: 90
+
+      - name: Download baseline sizes from develop
        if: github.event_name == 'pull_request'
-        run: echo "MERGE_BASE=$(git merge-base "origin/$base" "$head")" >> $GITHUB_ENV
+        continue-on-error: true
+        id: baseline-develop
        env:
-          base: ${{ github.base_ref }}
-          head: ${{ github.sha }}
-      # Currently broken (for-loop through EVERY artifact -- rate limiting)
-      # - name: Download the old manifests
-      #   if: github.event_name == 'pull_request'
-      #   run: gh run download -R "$repo" --name "manifests-$merge_base" --dir manifest-old/
-      #   env:
-      #     GH_TOKEN: ${{ github.token }}
-      #     merge_base: ${{ env.MERGE_BASE }}
-      #     repo: ${{ github.repository }}
-      # - name: Do scan and post comment
-      #   if: github.event_name == 'pull_request'
-      #   run: python3 bin/shame.py ${{ github.event.pull_request.number }} manifests-old/ manifests-new/
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          RUN_ID=$(gh run list -R "${{ github.repository }}" \
+            --workflow CI --branch develop --status success \
+            --limit 1 --json databaseId --jq '.[0].databaseId // empty')
+          if [ -n "$RUN_ID" ]; then
+            ARTIFACT_NAME=$(gh api "repos/${{ github.repository }}/actions/runs/${RUN_ID}/artifacts" \
+              --jq '.artifacts[] | select(.name | startswith("firmware-sizes-")) | select(.expired == false) | .name' | head -1)
+            if [ -n "$ARTIFACT_NAME" ]; then
+              gh run download "$RUN_ID" -R "${{ github.repository }}" \
+                --name "$ARTIFACT_NAME" --dir ./baseline-develop/
+              cp "./baseline-develop/current-sizes.json" ./develop-sizes.json
+              echo "found=true" >> "$GITHUB_OUTPUT"
+            else
+              echo "found=false" >> "$GITHUB_OUTPUT"
+            fi
+          else
+            echo "found=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Download baseline sizes from master
+        if: github.event_name == 'pull_request'
+        continue-on-error: true
+        id: baseline-master
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          RUN_ID=$(gh run list -R "${{ github.repository }}" \
+            --workflow CI --branch master --status success \
+            --limit 1 --json databaseId --jq '.[0].databaseId // empty')
+          if [ -n "$RUN_ID" ]; then
+            ARTIFACT_NAME=$(gh api "repos/${{ github.repository }}/actions/runs/${RUN_ID}/artifacts" \
+              --jq '.artifacts[] | select(.name | startswith("firmware-sizes-")) | select(.expired == false) | .name' | head -1)
+            if [ -n "$ARTIFACT_NAME" ]; then
+              gh run download "$RUN_ID" -R "${{ github.repository }}" \
+                --name "$ARTIFACT_NAME" --dir ./baseline-master/
+              cp "./baseline-master/current-sizes.json" ./master-sizes.json
+              echo "found=true" >> "$GITHUB_OUTPUT"
+            else
+              echo "found=false" >> "$GITHUB_OUTPUT"
+            fi
+          else
+            echo "found=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Generate size comparison report
+        if: github.event_name == 'pull_request'
+        id: report
+        run: |
+          ARGS="./current-sizes.json"
+          if [ -f ./develop-sizes.json ]; then
+            ARGS="$ARGS --baseline develop:./develop-sizes.json"
+          fi
+          if [ -f ./master-sizes.json ]; then
+            ARGS="$ARGS --baseline master:./master-sizes.json"
+          fi
+          REPORT=$(python3 bin/size_report.py $ARGS)
+          if [ -z "$REPORT" ]; then
+            echo "has_report=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_report=true" >> "$GITHUB_OUTPUT"
+            {
+              echo '<!-- firmware-size-report -->'
+              echo '# Firmware Size Report'
+              echo ''
+              echo "$REPORT"
+              echo ''
+              echo '---'
+              echo "*Updated for ${{ github.sha }}*"
+            } > ./size-report.md
+            cat ./size-report.md >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+      - name: Save PR number
+        if: github.event_name == 'pull_request' && steps.report.outputs.has_report == 'true'
+        run: echo "${{ github.event.pull_request.number }}" > ./pr-number.txt
+
+      - name: Upload size report
+        if: github.event_name == 'pull_request' && steps.report.outputs.has_report == 'true'
+        uses: actions/upload-artifact@v7
+        with:
+          name: size-report
+          path: |
+            ./size-report.md
+            ./pr-number.txt
+          retention-days: 5

  release-artifacts:
    permissions: # Needed for 'gh release upload'.
@@ -37,13 +37,33 @@ jobs:
          sed -i -e "s#${PWD}#.#" coverage_base.info # Make paths relative.

      - name: Integration test
+        # Cap the whole step: if the simulator ever fails to exit (e.g. the
+        # exit_simulator admin path regresses again) the job must fail fast,
+        # not run to GitHub's 6-hour limit.
+        timeout-minutes: 5
        run: |
          .pio/build/coverage/meshtasticd -s &
          PID=$!
+          trap 'kill "$PID" 2>/dev/null || true' EXIT
          timeout 20 bash -c "until ls -al /proc/$PID/fd | grep socket; do sleep 1; done"
          echo "Simulator started, launching python test..."
          python3 -c 'from meshtastic.test import testSimulator; testSimulator()'
-          wait
+          # The Python harness sends exit_simulator and exits; the simulator is
+          # expected to terminate on its own. Give it a moment, then verify.
+          # If it is still alive the exit handshake is broken — fail loudly and
+          # do NOT fall through to `wait`, which would otherwise block until the
+          # job's hard timeout.
+          for i in $(seq 1 10); do
+            kill -0 "$PID" 2>/dev/null || break
+            sleep 1
+          done
+          if kill -0 "$PID" 2>/dev/null; then
+            echo "::error title=Simulator did not exit::meshtasticd ignored exit_simulator and is still running after the integration test. The exit_simulator admin path is broken (see AdminModule::handleReceivedProtobuf, ARCH_PORTDUINO bypass). Killing it to avoid a 6-hour CI overrun."
+            kill -9 "$PID" 2>/dev/null || true
+            wait "$PID" 2>/dev/null || true
+            exit 1
+          fi
+          wait "$PID" 2>/dev/null || true

      - name: Capture coverage information
        if: always() # run this step even if previous step failed
@@ -16,13 +16,18 @@ jobs:
          submodules: true

      - name: Update submodule
-        if: ${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/develop' }}
+        if: ${{ github.ref_name == 'master' || github.ref_name == 'develop' }}
+        working-directory: protobufs
+        env:
+          # Use the branch that triggered the workflow as the protobuf branch.
+          GIT_BRANCH: ${{ github.ref_name }}
        run: |
-          git submodule update --remote protobufs
+          git fetch --prune origin $GIT_BRANCH
+          git checkout origin/$GIT_BRANCH

      - name: Download nanopb
        run: |
-          wget https://jpa.kapsi.fi/nanopb/download/nanopb-0.4.9.1-linux-x86.tar.gz
+          wget https://github.com/nanopb/nanopb/releases/download/nanopb-0.4.9.1/nanopb-0.4.9.1-linux-x86.tar.gz
          tar xvzf nanopb-0.4.9.1-linux-x86.tar.gz
          mv nanopb-0.4.9.1-linux-x86 nanopb-0.4.9

@@ -33,7 +38,7 @@ jobs:
      - name: Create pull request
        uses: peter-evans/create-pull-request@v8
        with:
-          branch: create-pull-request/update-protobufs
+          branch: create-pull-request/update-protobufs-${{ github.ref_name }}
          labels: submodules
          title: Update protobufs and classes
          commit-message: Update protobufs
@@ -10,18 +10,18 @@ This file (`AGENTS.md`) is a short pointer + quick reference for agents that don

 ## Quick command reference

-| Action                           | Command                                                                                                       |
-| -------------------------------- | ------------------------------------------------------------------------------------------------------------- |
-| Build a firmware variant         | `pio run -e <env>` (e.g. `pio run -e rak4631`, `pio run -e heltec-v3`)                                        |
-| Build native macOS host binary   | `pio run -e native-macos` (Homebrew prereqs + CH341 LoRa setup in `variants/native/portduino/platformio.ini`) |
-| Clean + rebuild                  | `pio run -e <env> -t clean && pio run -e <env>`                                                               |
-| Flash a device                   | `pio run -e <env> -t upload --upload-port <port>` (or use the `pio_flash` MCP tool)                           |
-| Run firmware unit tests (native) | `pio test -e native`                                                                                          |
-| Run MCP hardware tests           | `./mcp-server/run-tests.sh`                                                                                   |
-| Live TUI test runner             | `mcp-server/.venv/bin/meshtastic-mcp-test-tui`                                                                |
-| Format before commit             | `trunk fmt`                                                                                                   |
-| Regenerate protobuf bindings     | `bin/regen-protos.sh`                                                                                         |
-| Generate CI matrix               | `./bin/generate_ci_matrix.py all [--level pr]`                                                                |
+| Action                           | Command                                                                                                                                                                                                        |
+| -------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Build a firmware variant         | `pio run -e <env>` (e.g. `pio run -e rak4631`, `pio run -e heltec-v3`)                                                                                                                                         |
+| Build native macOS host binary   | `pio run -e native-macos` (Homebrew prereqs + CH341 LoRa setup in `variants/native/portduino/platformio.ini`)                                                                                                  |
+| Clean + rebuild                  | `pio run -e <env> -t clean && pio run -e <env>`                                                                                                                                                                |
+| Flash a device                   | `pio run -e <env> -t upload --upload-port <port>` (or use the `pio_flash` MCP tool)                                                                                                                            |
+| Run firmware unit tests (native) | `~/.platformio/penv/bin/python -m platformio test -e native > /tmp/test_out.txt 2>&1` then `grep -E 'error:\|PASS\|FAIL\|succeeded\|failed' /tmp/test_out.txt` (redirect first — piping causes line-buffering) |
+| Run MCP hardware tests           | `./mcp-server/run-tests.sh`                                                                                                                                                                                    |
+| Live TUI test runner             | `mcp-server/.venv/bin/meshtastic-mcp-test-tui`                                                                                                                                                                 |
+| Format before commit             | `trunk fmt`                                                                                                                                                                                                    |
+| Regenerate protobuf bindings     | `bin/regen-protos.sh`                                                                                                                                                                                          |
+| Generate CI matrix               | `./bin/generate_ci_matrix.py all [--level pr]`                                                                                                                                                                 |

 ## MCP server (device + test automation)

@@ -64,7 +64,7 @@ Key rotation to never trigger casually: only the **full** factory reset (`factor
 - **One MCP call per serial port at a time.** The port lock is exclusive; concurrent calls deadlock. Sequence: open → read/mutate → close, then next device.
 - **`userPrefs.jsonc` is session state during tests.** The `_session_userprefs` fixture snapshots + restores it; never edit it from inside a test.
 - **Don't speculate about firmware root causes.** When evidence doesn't support a classification, say "unknown" and list what would disambiguate.
- **Run `trunk fmt` before proposing a commit.** The `trunk_check` CI gate will reject unformatted code.
+- **Run `trunk fmt` before proposing a commit.** The `trunk_check` CI gate will reject unformatted code. Claude Code runs it automatically via the PostToolUse hook in `.claude/settings.json`; trunk's launcher needs `curl` or `wget` to bootstrap its pinned CLI — see **Formatting & the trunk toolchain** in `.github/copilot-instructions.md` for the no-curl bootstrap procedure.
 - **`confirm=True` on destructive MCP tools is a real gate, not a formality.** Don't bypass it via auto-approve settings.
 - **Keep code comments minimal — one or two lines, max.** Comment only when the _why_ isn't obvious from the code; never restate what the next line does. No multi-paragraph block comments explaining straightforward changes. The diff and commit message carry the rationale; the code carries the behavior.
 - **Use `Throttle` for time-based rate limiting, not raw `millis()` math.** `src/mesh/Throttle.h` provides `Throttle::isWithinTimespanMs(lastMs, intervalMs)` (returns true while inside the cooldown) and `Throttle::execute(&lastMs, intervalMs, func)` (function-pointer form that updates the timestamp on fire). Use these for any "did N ms pass since X" check — raw `millis() > lastMs + N` is rollover-unsafe (breaks after ~49.7 days) and inconsistent with the rest of the codebase. The helpers compute `now - lastMs` with unsigned subtraction, which wraps correctly.
@@ -108,7 +108,7 @@ Sequence these; don't parallelize on the same port.
 | `src/modules/`                    | Feature modules; `Telemetry/Sensor/` has 50+ I2C sensor drivers                                                          |
 | `variants/`                       | 200+ hardware variant definitions (`variant.h` + `platformio.ini` per board)                                             |
 | `protobufs/`                      | `.proto` definitions; regenerate with `bin/regen-protos.sh`                                                              |
-| `test/`                           | Firmware unit tests (12 suites; `pio test -e native`)                                                                    |
+| `test/`                           | Firmware unit tests (17 suites; `pio test -e native`)                                                                    |
 | `mcp-server/`                     | Python MCP server + pytest hardware integration tests                                                                    |
 | `mcp-server/tests/`               | Tiered pytest suite: `unit/`, `mesh/`, `telemetry/`, `monitor/`, `recovery/`, `ui/`, `fleet/`, `admin/`, `provisioning/` |
 | `.claude/commands/`               | Claude Code slash command bodies                                                                                         |
@@ -14,7 +14,7 @@ ENV PIP_BREAK_SYSTEM_PACKAGES=1
 RUN apt-get update && apt-get install --no-install-recommends -y \
        curl wget g++ zip git ca-certificates pkg-config \
        python3-pip python3-grpc-tools \
-        libgpiod-dev libyaml-cpp-dev libbluetooth-dev libi2c-dev libuv1-dev \
+        libgpiod-dev libyaml-cpp-dev libjsoncpp-dev libbluetooth-dev libi2c-dev libuv1-dev \
        libusb-1.0-0-dev libulfius-dev liborcania-dev libssl-dev \
        libx11-dev libinput-dev libxkbcommon-x11-dev libsqlite3-dev libsdl2-dev \
    && apt-get clean && rm -rf /var/lib/apt/lists/* \
@@ -53,7 +53,7 @@ ENV TZ=Etc/UTC
 USER root

 RUN apt-get update && apt-get --no-install-recommends -y install \
-        libc-bin libc6 libgpiod3 libyaml-cpp0.8 libi2c0 libuv1t64 libusb-1.0-0-dev \
+        libc-bin libc6 libgpiod3 libyaml-cpp0.8 libjsoncpp26 libi2c0 libuv1t64 libusb-1.0-0-dev \
        liborcania2.3 libulfius2.7t64 libssl3t64 \
        libx11-6 libinput10 libxkbcommon-x11-0 libsdl2-2.0-0 \
    && apt-get clean && rm -rf /var/lib/apt/lists/* \
@@ -7,7 +7,7 @@ ENV PIP_ROOT_USER_ACTION=ignore
 # hadolint ignore=DL3008
 RUN apt-get update && apt-get install --no-install-recommends -y \
        g++ git ca-certificates pkg-config \
-        libgpiod-dev libyaml-cpp-dev libbluetooth-dev libi2c-dev libuv1-dev \
+        libgpiod-dev libyaml-cpp-dev libjsoncpp-dev libbluetooth-dev libi2c-dev libuv1-dev \
        libusb-1.0-0-dev libulfius-dev liborcania-dev libssl-dev \
        libx11-dev libinput-dev libxkbcommon-x11-dev libsqlite3-dev libsdl2-dev \
    && apt-get clean && rm -rf /var/lib/apt/lists/* \
@@ -16,7 +16,7 @@ ENV PIP_BREAK_SYSTEM_PACKAGES=1
 RUN apk --no-cache add \
        bash g++ libstdc++-dev linux-headers zip git ca-certificates libbsd-dev \
        py3-pip py3-grpcio-tools \
-        libgpiod-dev yaml-cpp-dev bluez-dev \
+        libgpiod-dev yaml-cpp-dev jsoncpp-dev bluez-dev \
        libusb-dev i2c-tools-dev libuv-dev openssl-dev pkgconf argp-standalone \
        libx11-dev libinput-dev libxkbcommon-dev sqlite-dev sdl2-dev \
    && rm -rf /var/cache/apk/* \
@@ -48,7 +48,7 @@ LABEL org.opencontainers.image.title="Meshtastic" \
 USER root

 RUN apk --no-cache add \
-        shadow libstdc++ libbsd libgpiod yaml-cpp libusb \
+        shadow libstdc++ libbsd libgpiod yaml-cpp jsoncpp libusb \
        i2c-tools libuv libx11 libinput libxkbcommon sdl2 \
    && rm -rf /var/cache/apk/* \
    && mkdir -p /var/lib/meshtasticd \
@@ -0,0 +1,53 @@
+#!/usr/bin/env python3
+
+"""Collect firmware binary sizes from manifest (.mt.json) files into a single report."""
+
+import json
+import os
+import sys
+
+
+def collect_sizes(manifest_dir):
+    """Scan manifest_dir for .mt.json files and return {board: size_bytes} dict."""
+    sizes = {}
+    for fname in sorted(os.listdir(manifest_dir)):
+        if not fname.endswith(".mt.json"):
+            continue
+        path = os.path.join(manifest_dir, fname)
+        with open(path) as f:
+            data = json.load(f)
+        board = data.get("platformioTarget", fname.replace(".mt.json", ""))
+        # Find the main firmware .bin size (largest .bin, excluding OTA/littlefs/bleota)
+        bin_size = None
+        for entry in data.get("files", []):
+            name = entry.get("name", "")
+            if name.startswith("firmware-") and name.endswith(".bin"):
+                bin_size = entry["bytes"]
+                break
+        # Fallback: any .bin that isn't ota/littlefs/bleota
+        if bin_size is None:
+            for entry in data.get("files", []):
+                name = entry.get("name", "")
+                if name.endswith(".bin") and not any(
+                    x in name for x in ["littlefs", "bleota", "ota"]
+                ):
+                    bin_size = entry["bytes"]
+                    break
+        if bin_size is not None:
+            sizes[board] = bin_size
+    return sizes
+
+
+if __name__ == "__main__":
+    if len(sys.argv) != 3:
+        print(f"Usage: {sys.argv[0]} <manifest_dir> <output.json>", file=sys.stderr)
+        sys.exit(1)
+
+    manifest_dir = sys.argv[1]
+    output_path = sys.argv[2]
+
+    sizes = collect_sizes(manifest_dir)
+    with open(output_path, "w") as f:
+        json.dump(sizes, f, indent=2, sort_keys=True)
+
+    print(f"Collected sizes for {len(sizes)} targets -> {output_path}")
@@ -5,7 +5,9 @@ Meta:
    - raspberry-pi

 Lora:
-  ### RAK13300 in Slot 2 pins
+  
+  ### RAK13300 in Slot 2
+  Module: sx1262
  IRQ: 18 #IO6
  Reset: 24 # IO4
  Busy: 19 # IO5
@@ -13,5 +15,7 @@ Lora:
  Enable_Pins:
    - 26
    - 23
+  DIO3_TCXO_VOLTAGE: true
+  DIO2_AS_RF_SWITCH: true
  spidev: spidev0.1
  # CS: 7
@@ -5,14 +5,18 @@ Meta:
    - raspberry-pi

 Lora:
-  ### RAK13302 in Slot 2 pins
+
+  ### RAK13302 in Slot 2
+  Module: sx1262
  IRQ: 18 #IO6
  Reset: 24 # IO4
  Busy: 19 # IO5
-  # Ant_sw: 23 # IO3 
+  # Ant_sw: 23 # IO3
  Enable_Pins:
    - 26
    - 23
+  DIO3_TCXO_VOLTAGE: true
+  DIO2_AS_RF_SWITCH: true
  spidev: spidev0.1
  # CS: 7
  TX_GAIN_LORA: [9, 9, 10, 11, 9, 8, 9, 10, 10, 10, 11, 12, 12, 12, 12, 12, 12, 12, 12, 10, 9, 8]
@@ -1,95 +0,0 @@
-import sys
-import os
-import json
-from github import Github
-
-def parseFile(path):
-    with open(path, "r") as f:
-        data = json.loads(f)
-    for file in data["files"]:
-        if file["name"].endswith(".bin"):
-            return file["name"], file["bytes"]
-
-if len(sys.argv) != 4:
-    print(f"expected usage: {sys.argv[0]} <PR number> <path to old-manifests> <path to new-manifests>")
-    sys.exit(1)
-
-pr_number = int(sys.argv[1])
-
-token = os.getenv("GITHUB_TOKEN")
-if not token:
-    raise EnvironmentError("GITHUB_TOKEN not found in environment.")
-
-repo_name = os.getenv("GITHUB_REPOSITORY")  # "owner/repo"
-if not repo_name:
-    raise EnvironmentError("GITHUB_REPOSITORY not found in environment.")
-
-oldFiles = sys.argv[2]
-old = set(os.path.join(oldFiles, f) for f in os.listdir(oldFiles) if os.path.isfile(f))
-newFiles = sys.argv[3]
-new = set(os.path.join(newFiles, f) for f in os.listdir(newFiles) if os.path.isfile(f))
-
-startMarkdown = "# Target Size Changes\n\n"
-markdown = ""
-
-newlyIntroduced = new - old
-if len(newlyIntroduced) > 0:
-    markdown += "## Newly Introduced Targets\n\n"
-    # create a table
-    markdown += "| File | Size |\n"
-    markdown += "| ---- | ---- |\n"
-    for f in newlyIntroduced:
-        name, size = parseFile(f)
-        markdown += f"| `{name}` | {size}b |\n"
-
-# do not log removed targets
-# PRs only run a small subset of builds, so removed targets are not meaningful
-# since they are very likely to just be not ran in PR CI
-
-both = old & new
-degradations = []
-improvements = []
-for f in both:
-    oldName, oldSize = parseFile(f)
-    _, newSize = parseFile(f)
-    if oldSize != newSize:
-        if newSize < oldSize:
-            improvements.append((oldName, oldSize, newSize))
-        else:
-            degradations.append((oldName, oldSize, newSize))
-
-if len(degradations) > 0:
-    markdown += "\n## Degradation\n\n"
-    # create a table
-    markdown += "| File | Difference | Old Size | New Size |\n"
-    markdown += "| ---- | ---------- | -------- | -------- |\n"
-    for oldName, oldSize, newSize in degradations:
-        markdown += f"| `{oldName}` | **{oldSize - newSize}b** | {oldSize}b | {newSize}b |\n"
-
-if len(improvements) > 0:
-    markdown += "\n## Improvement\n\n"
-    # create a table
-    markdown += "| File | Difference | Old Size | New Size |\n"
-    markdown += "| ---- | ---------- | -------- | -------- |\n"
-    for oldName, oldSize, newSize in improvements:
-        markdown += f"| `{oldName}` | **{oldSize - newSize}b** | {oldSize}b | {newSize}b |\n"
-
-if len(markdown) == 0:
-    markdown = "No changes in target sizes detected."
-
-g = Github(token)
-repo = g.get_repo(repo_name)
-pr = repo.get_pull(pr_number)
-
-existing_comment = None
-for comment in pr.get_issue_comments():
-    if comment.body.startswith(startMarkdown):
-        existing_comment = comment
-        break
-
-final_markdown = startMarkdown + markdown
-
-if existing_comment:
-    existing_comment.edit(body=final_markdown)
-else:
-    pr.create_issue_comment(body=final_markdown)
@@ -0,0 +1,171 @@
+#!/usr/bin/env python3
+
+"""Compare firmware size reports and generate a markdown summary.
+
+Usage:
+    size_report.py <new_sizes.json> [--baseline <label>:<old_sizes.json>]...
+
+Examples:
+    # Compare PR against develop and master baselines
+    size_report.py pr.json --baseline develop:develop.json --baseline master:master.json
+
+    # Single baseline comparison
+    size_report.py pr.json --baseline develop:develop.json
+
+    # No baselines — shows sizes with blank delta columns
+    size_report.py pr.json
+"""
+
+import argparse
+import json
+import sys
+
+
+def load_sizes(path):
+    with open(path) as f:
+        return json.load(f)
+
+
+def format_delta(n):
+    """Format byte delta with sign and human-friendly suffix."""
+    sign = "+" if n > 0 else ""
+    if abs(n) >= 1024:
+        return f"{sign}{n:,} ({sign}{n / 1024:.1f} KB)"
+    return f"{sign}{n:,}"
+
+
+def generate_markdown(new_sizes, baselines, top_n=5):
+    """Generate a single table with current size and delta columns per baseline.
+
+    baselines: list of (label, old_sizes_dict), may be empty
+    """
+    labels = [label for label, _ in baselines]
+
+    # Build rows: (board, current_size, [(delta, abs_delta) per baseline])
+    rows = []
+    for board in sorted(new_sizes):
+        current = new_sizes[board]
+        deltas = []
+        for _, old_sizes in baselines:
+            old = old_sizes.get(board)
+            if old is not None:
+                d = current - old
+                deltas.append((d, abs(d)))
+            else:
+                deltas.append((None, 0))
+        # Sort key: max abs delta across baselines (biggest changes first)
+        max_abs = max((ad for _, ad in deltas), default=0)
+        rows.append((board, current, deltas, max_abs))
+
+    rows.sort(key=lambda r: r[3], reverse=True)
+
+    # Summary line
+    sections = []
+    summary_parts = [f"{len(new_sizes)} targets"]
+    for i, (label, old_sizes) in enumerate(baselines):
+        increases = sum(
+            1 for _, _, deltas, _ in rows if deltas[i][0] is not None and deltas[i][0] > 0
+        )
+        decreases = sum(
+            1 for _, _, deltas, _ in rows if deltas[i][0] is not None and deltas[i][0] < 0
+        )
+        net = sum(
+            deltas[i][0] for _, _, deltas, _ in rows if deltas[i][0] is not None
+        )
+        parts = []
+        if increases:
+            parts.append(f"{increases} increased")
+        if decreases:
+            parts.append(f"{decreases} decreased")
+        if parts:
+            parts.append(f"net {format_delta(net)}")
+            summary_parts.append(f"vs `{label}`: {', '.join(parts)}")
+        else:
+            summary_parts.append(f"vs `{label}`: no changes")
+
+    if not baselines:
+        summary_parts.append("no baseline available yet")
+
+    sections.append(f"**{' | '.join(summary_parts)}**\n")
+
+    # Table header
+    header = "| Target | Size |"
+    separator = "|--------|-----:|"
+    for label in labels:
+        header += f" vs `{label}` |"
+        separator += "----------:|"
+    sections.append(header)
+    sections.append(separator)
+
+    def format_row(board, current, deltas):
+        row = f"| `{board}` | {current:,} |"
+        for d, _ in deltas:
+            if d is None:
+                row += " |"
+            elif d == 0:
+                row += " 0 |"
+            else:
+                icon = "📈" if d > 0 else "📉"
+                row += f" {icon} {format_delta(d)} |"
+        return row
+
+    # Top N rows always visible
+    top = rows[:top_n]
+    for board, current, deltas, _ in top:
+        sections.append(format_row(board, current, deltas))
+
+    # Remaining rows in expandable section
+    rest = rows[top_n:]
+    if rest:
+        sections.append("")
+        sections.append(
+            f"<details><summary>Show {len(rest)} more target(s)</summary>\n"
+        )
+        sections.append(header)
+        sections.append(separator)
+        for board, current, deltas, _ in rest:
+            sections.append(format_row(board, current, deltas))
+        sections.append("\n</details>")
+
+    sections.append("")
+    return "\n".join(sections)
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Compare firmware size reports")
+    parser.add_argument("new_sizes", help="Path to new sizes JSON")
+    parser.add_argument(
+        "--baseline",
+        action="append",
+        default=[],
+        metavar="LABEL:PATH",
+        help="Baseline to compare against (e.g. develop:develop.json)",
+    )
+    parser.add_argument(
+        "--top",
+        type=int,
+        default=5,
+        help="Number of top changes to show before collapsing (default: 5)",
+    )
+    args = parser.parse_args()
+
+    new_sizes = load_sizes(args.new_sizes)
+
+    # Silence output when no targets were built — repo maintainer choice
+    if not new_sizes:
+        return
+
+    baselines = []
+    for b in args.baseline:
+        if ":" not in b:
+            print(f"Error: baseline must be LABEL:PATH, got '{b}'", file=sys.stderr)
+            sys.exit(1)
+        label, path = b.split(":", 1)
+        baselines.append((label, load_sizes(path)))
+
+    md = generate_markdown(new_sizes, baselines, top_n=args.top)
+    print(md)
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,262 @@
+#!/usr/bin/env python3
+
+"""Tests for bin/collect_sizes.py and bin/size_report.py."""
+
+import json
+import os
+import subprocess
+import sys
+import tempfile
+
+SCRIPTS_DIR = os.path.join(os.path.dirname(__file__), "..", "bin")
+
+
+def make_manifest(target, firmware_bytes, extra_files=None):
+    """Create a minimal .mt.json manifest dict."""
+    files = [{"name": f"firmware-{target}-2.6.0.bin", "bytes": firmware_bytes}]
+    if extra_files:
+        files.extend(extra_files)
+    return {
+        "platformioTarget": target,
+        "version": "2.6.0.test",
+        "files": files,
+    }
+
+
+def write_manifests(tmpdir, manifests):
+    """Write manifest dicts as .mt.json files into tmpdir."""
+    for target, data in manifests.items():
+        path = os.path.join(tmpdir, f"firmware-{target}.mt.json")
+        with open(path, "w") as f:
+            json.dump(data, f)
+
+
+def run_script(script, args):
+    """Run a Python script and return (returncode, stdout, stderr)."""
+    result = subprocess.run(
+        [sys.executable, os.path.join(SCRIPTS_DIR, script)] + args,
+        capture_output=True,
+        text=True,
+    )
+    return result.returncode, result.stdout, result.stderr
+
+
+def test_collect_sizes_basic():
+    """collect_sizes picks up firmware-*.bin entries from manifests."""
+    with tempfile.TemporaryDirectory() as tmpdir:
+        outfile = os.path.join(tmpdir, "sizes.json")
+        manifests = {
+            "heltec-v3": make_manifest("heltec-v3", 1048576),
+            "rak4631": make_manifest("rak4631", 524288),
+            "tbeam": make_manifest("tbeam", 786432),
+        }
+        write_manifests(tmpdir, manifests)
+
+        rc, stdout, stderr = run_script("collect_sizes.py", [tmpdir, outfile])
+        assert rc == 0, f"collect_sizes failed: {stderr}"
+        assert "3 targets" in stdout
+
+        with open(outfile) as f:
+            sizes = json.load(f)
+        assert sizes == {"heltec-v3": 1048576, "rak4631": 524288, "tbeam": 786432}
+
+
+def test_collect_sizes_fallback_bin():
+    """collect_sizes falls back to non-firmware-prefixed .bin if no firmware-*.bin."""
+    with tempfile.TemporaryDirectory() as tmpdir:
+        outfile = os.path.join(tmpdir, "sizes.json")
+        # Manifest with only a generic .bin (no firmware- prefix)
+        data = {
+            "platformioTarget": "custom-board",
+            "files": [
+                {"name": "littlefs-custom-board.bin", "bytes": 100000},
+                {"name": "custom-board.bin", "bytes": 500000},
+            ],
+        }
+        path = os.path.join(tmpdir, "firmware-custom-board.mt.json")
+        with open(path, "w") as f:
+            json.dump(data, f)
+
+        rc, stdout, stderr = run_script("collect_sizes.py", [tmpdir, outfile])
+        assert rc == 0, f"collect_sizes failed: {stderr}"
+
+        with open(outfile) as f:
+            sizes = json.load(f)
+        assert sizes == {"custom-board": 500000}
+
+
+def test_collect_sizes_skips_ota_littlefs():
+    """collect_sizes ignores ota/littlefs/bleota .bin files in fallback."""
+    with tempfile.TemporaryDirectory() as tmpdir:
+        outfile = os.path.join(tmpdir, "sizes.json")
+        data = {
+            "platformioTarget": "board-x",
+            "files": [
+                {"name": "littlefs-board-x.bin", "bytes": 100000},
+                {"name": "bleota-board-x.bin", "bytes": 50000},
+                {"name": "mt-board-x-ota.bin", "bytes": 60000},
+            ],
+        }
+        path = os.path.join(tmpdir, "firmware-board-x.mt.json")
+        with open(path, "w") as f:
+            json.dump(data, f)
+
+        rc, stdout, stderr = run_script("collect_sizes.py", [tmpdir, outfile])
+        assert rc == 0
+        with open(outfile) as f:
+            sizes = json.load(f)
+        # No valid firmware .bin found, board should be absent
+        assert sizes == {}
+
+
+def test_collect_sizes_ignores_non_mt_json():
+    """collect_sizes skips non .mt.json files."""
+    with tempfile.TemporaryDirectory() as tmpdir:
+        outfile = os.path.join(tmpdir, "sizes.json")
+        # Write a valid manifest
+        manifests = {"rak4631": make_manifest("rak4631", 500000)}
+        write_manifests(tmpdir, manifests)
+        # Write a decoy file
+        with open(os.path.join(tmpdir, "readme.txt"), "w") as f:
+            f.write("not a manifest")
+
+        rc, stdout, stderr = run_script("collect_sizes.py", [tmpdir, outfile])
+        assert rc == 0
+        with open(outfile) as f:
+            sizes = json.load(f)
+        assert list(sizes.keys()) == ["rak4631"]
+
+
+def test_size_report_no_baseline():
+    """size_report with no baselines shows sizes only."""
+    with tempfile.TemporaryDirectory() as tmpdir:
+        sizes_file = os.path.join(tmpdir, "new.json")
+        with open(sizes_file, "w") as f:
+            json.dump({"heltec-v3": 1000000, "rak4631": 500000}, f)
+
+        rc, stdout, stderr = run_script("size_report.py", [sizes_file])
+        assert rc == 0, f"size_report failed: {stderr}"
+        assert "2 targets" in stdout
+        assert "no baseline available yet" in stdout
+        assert "`heltec-v3`" in stdout
+        assert "`rak4631`" in stdout
+
+
+def test_size_report_with_baseline():
+    """size_report shows deltas against a baseline."""
+    with tempfile.TemporaryDirectory() as tmpdir:
+        new_file = os.path.join(tmpdir, "new.json")
+        old_file = os.path.join(tmpdir, "old.json")
+        with open(new_file, "w") as f:
+            json.dump({"heltec-v3": 1050000, "rak4631": 500000, "tbeam": 800000}, f)
+        with open(old_file, "w") as f:
+            json.dump({"heltec-v3": 1000000, "rak4631": 500000, "tbeam": 810000}, f)
+
+        rc, stdout, stderr = run_script(
+            "size_report.py", [new_file, "--baseline", f"develop:{old_file}"]
+        )
+        assert rc == 0, f"size_report failed: {stderr}"
+        assert "3 targets" in stdout
+        assert "1 increased" in stdout
+        assert "1 decreased" in stdout
+        # heltec-v3 grew by 50000
+        assert "📈" in stdout
+        # tbeam shrank by 10000
+        assert "📉" in stdout
+        # rak4631 unchanged
+        assert "vs `develop`" in stdout
+
+
+def test_size_report_multiple_baselines():
+    """size_report handles multiple baselines."""
+    with tempfile.TemporaryDirectory() as tmpdir:
+        new_file = os.path.join(tmpdir, "new.json")
+        dev_file = os.path.join(tmpdir, "develop.json")
+        master_file = os.path.join(tmpdir, "master.json")
+        with open(new_file, "w") as f:
+            json.dump({"board-a": 100000}, f)
+        with open(dev_file, "w") as f:
+            json.dump({"board-a": 95000}, f)
+        with open(master_file, "w") as f:
+            json.dump({"board-a": 90000}, f)
+
+        rc, stdout, stderr = run_script(
+            "size_report.py",
+            [new_file, "--baseline", f"develop:{dev_file}", "--baseline", f"master:{master_file}"],
+        )
+        assert rc == 0, f"size_report failed: {stderr}"
+        assert "vs `develop`" in stdout
+        assert "vs `master`" in stdout
+
+
+def test_size_report_new_target_no_baseline_entry():
+    """size_report handles targets not present in baseline (new boards)."""
+    with tempfile.TemporaryDirectory() as tmpdir:
+        new_file = os.path.join(tmpdir, "new.json")
+        old_file = os.path.join(tmpdir, "old.json")
+        with open(new_file, "w") as f:
+            json.dump({"new-board": 300000, "existing": 500000}, f)
+        with open(old_file, "w") as f:
+            json.dump({"existing": 500000}, f)
+
+        rc, stdout, stderr = run_script(
+            "size_report.py", [new_file, "--baseline", f"develop:{old_file}"]
+        )
+        assert rc == 0, f"size_report failed: {stderr}"
+        assert "`new-board`" in stdout
+        assert "no changes" in stdout  # only existing is compared, delta=0
+
+
+def test_size_report_all_unchanged():
+    """size_report shows 'no changes' when all sizes match."""
+    with tempfile.TemporaryDirectory() as tmpdir:
+        sizes_file = os.path.join(tmpdir, "sizes.json")
+        with open(sizes_file, "w") as f:
+            json.dump({"board-a": 100000, "board-b": 200000}, f)
+
+        rc, stdout, stderr = run_script(
+            "size_report.py", [sizes_file, "--baseline", f"develop:{sizes_file}"]
+        )
+        assert rc == 0, f"size_report failed: {stderr}"
+        assert "no changes" in stdout
+
+
+def test_collect_sizes_bad_args():
+    """collect_sizes exits with error on wrong arg count."""
+    rc, stdout, stderr = run_script("collect_sizes.py", [])
+    assert rc == 1
+    assert "Usage" in stderr
+
+
+def test_size_report_bad_baseline_format():
+    """size_report exits with error on malformed --baseline."""
+    with tempfile.TemporaryDirectory() as tmpdir:
+        sizes_file = os.path.join(tmpdir, "sizes.json")
+        with open(sizes_file, "w") as f:
+            json.dump({"x": 1}, f)
+
+        rc, stdout, stderr = run_script(
+            "size_report.py", [sizes_file, "--baseline", "no-colon-here"]
+        )
+        assert rc == 1
+        assert "LABEL:PATH" in stderr
+
+
+if __name__ == "__main__":
+    tests = [v for k, v in globals().items() if k.startswith("test_")]
+    passed = 0
+    failed = 0
+    for test in tests:
+        try:
+            test()
+            print(f"  PASS: {test.__name__}")
+            passed += 1
+        except AssertionError as e:
+            print(f"  FAIL: {test.__name__}: {e}")
+            failed += 1
+        except Exception as e:
+            print(f"  ERROR: {test.__name__}: {type(e).__name__}: {e}")
+            failed += 1
+
+    print(f"\n{passed} passed, {failed} failed out of {passed + failed}")
+    sys.exit(1 if failed else 0)
@@ -1,50 +0,0 @@
-{
-  "build": {
-    "arduino": {
-      "ldscript": "nrf52832_s132_v6.ld"
-    },
-    "core": "nRF5",
-    "cpu": "cortex-m4",
-    "extra_flags": "-DNRF52832_XXAA -DNRF52",
-    "f_cpu": "64000000L",
-    "hwids": [
-      ["0x239A", "0x8029"],
-      ["0x239A", "0x0029"],
-      ["0x239A", "0x002A"],
-      ["0x239A", "0x802A"]
-    ],
-    "usb_product": "Feather nRF52832 Express",
-    "mcu": "nrf52832",
-    "variant": "WisCore_RAK4600_Board",
-    "bsp": {
-      "name": "adafruit"
-    },
-    "softdevice": {
-      "sd_flags": "-DS132",
-      "sd_name": "s132",
-      "sd_version": "6.1.1",
-      "sd_fwid": "0x00B7"
-    },
-    "zephyr": {
-      "variant": "nrf52_adafruit_feather"
-    }
-  },
-  "connectivity": ["bluetooth"],
-  "debug": {
-    "jlink_device": "nRF52832_xxAA",
-    "svd_path": "nrf52.svd",
-    "openocd_target": "nrf52840-mdk-rs"
-  },
-  "frameworks": ["arduino", "zephyr"],
-  "name": "Adafruit Bluefruit nRF52832 Feather",
-  "upload": {
-    "maximum_ram_size": 65536,
-    "maximum_size": 524288,
-    "require_upload_port": true,
-    "speed": 115200,
-    "protocol": "nrfutil",
-    "protocols": ["jlink", "nrfjprog", "nrfutil", "stlink"]
-  },
-  "url": "https://www.adafruit.com/product/3406",
-  "vendor": "Adafruit"
-}
@@ -14,6 +14,7 @@ Build-Depends: debhelper-compat (= 13),
               g++,
               pkg-config,
               libyaml-cpp-dev,
+               libjsoncpp-dev,
               libgpiod-dev,
               libbluetooth-dev,
               libusb-1.0-0-dev,
@@ -0,0 +1,148 @@
+#!/usr/bin/env python3
+# trunk-ignore-all(ruff/F821)
+# trunk-ignore-all(flake8/F821)
+#
+# Whole-image LTO for nrf52840 (~-60KB; ~-23KB beyond src-only LTO), EXCEPT the objects
+# that own interrupt/exception handlers.
+#
+# Every ISR is referenced only from the assembly vector table (gcc_startup_nrf52840.S),
+# which LTO cannot see -> whole-program LTO judges the handlers dead, removes them, and
+# the weak `b .` Default_Handler stubs prevail -> the IRQ lands in an infinite loop and the
+# chip hangs (or the peripheral silently stalls). Compiling the handler-bearing objects
+# WITHOUT LTO lets ordinary linking keep the strong handlers; everything else stays LTO'd:
+#   - framework core (/FrameworkArduino/, /cores/nRF5/): every nrfx ISR + the FreeRTOS
+#     SVC/PendSV port.
+#   - TinyUSB nrf port (Adafruit_TinyUSB_nrf.cpp): USBD_IRQHandler (USB data path).
+#   - library .cpp files that own a vector ISR (would otherwise be silently dropped):
+#       bluefruit.cpp     -> SD_EVT/SWI2_EGU2  (SoftDevice BLE-event delivery -- advertising
+#                            hangs without it)
+#       Wire_nRF52.cpp    -> SPIM0/TWIM0 + SPIM1/TWIM1 (interrupt-driven I2C/SPI)
+#       PDM.cpp           -> PDM_IRQHandler   (PDM microphone)
+#       RotaryEncoder.cpp -> QDEC_IRQHandler  (hardware quadrature/rotary encoder)
+#
+# A post-link guard (bottom of this file) fails the build if a critical handler was dropped
+# anyway -- so a future deps bump or a new ISR-owning library becomes a red build, not a field
+# hang. To hunt a dropped ISR by hand: nm the .elf for `_IRQHandler$` symbols marked `W`, then
+# grep the libs/framework for who defines them.
+#
+# HW-validated: RAK4631 (SX1262) + muzi-base (LR1121).
+import glob
+import os
+
+Import("env")
+
+env.Append(LINKFLAGS=["-flto", "-flto-partition=1to1"])
+
+# The -fno-lto re-compiles below run with the global env, which lacks the framework's
+# bundled-library include dirs -- and those libs cross-include each other (Wire pulls in
+# Adafruit_TinyUSB.h, which pulls in SPI.h, ...). Add every bundled-lib dir (+ its src/) so
+# the re-compiles resolve without chasing headers one at a time.
+_fw = env.PioPlatform().get_package_dir("framework-arduinoadafruitnrf52") or ""
+_extra_inc = []
+for _d in sorted(glob.glob(os.path.join(_fw, "libraries", "*"))):
+    if os.path.isdir(_d):
+        _extra_inc.append(_d)
+        if os.path.isdir(os.path.join(_d, "src")):
+            _extra_inc.append(os.path.join(_d, "src"))
+
+FRAMEWORK = ("/FrameworkArduino/", "/cores/nRF5/")
+USB_ISR = "Adafruit_TinyUSB_nrf"  # USBD_IRQHandler
+# Library .cpp files that define vector-table ISRs (the rest of their lib stays LTO'd):
+LIB_ISR = ("/bluefruit.cpp", "/Wire_nRF52.cpp", "/PDM.cpp", "/RotaryEncoder.cpp")
+
+
+def _no_lto(node):
+    try:
+        path = node.get_abspath()
+    except Exception:
+        path = str(node)
+    path = path.replace(
+        "\\", "/"
+    )  # normalize Windows backslashes so matches work cross-platform
+    if (
+        USB_ISR in path
+        or any(s in path for s in FRAMEWORK)
+        or any(s in path for s in LIB_ISR)
+    ):
+        return env.Object(
+            node,
+            CCFLAGS=env["CCFLAGS"] + ["-fno-lto"],
+            CPPPATH=env["CPPPATH"] + _extra_inc,
+        )
+    return node
+
+
+env.AddBuildMiddleware(_no_lto)
+
+
+# --- post-link guard: catch a dropped ISR handler at build time (CI footgun protection) ----
+# After every link, fail the build if one of these critical vector-table handlers resolved to
+# the weak `b .` Default_Handler stub -- i.e. LTO (or a deps bump, or a new ISR-owning library
+# that nobody added to LIB_ISR) silently dropped it. A dropped handler hangs the chip the
+# instant that IRQ fires; this turns a field hang into a red build. CI builds every nrf52840
+# target, so this runs on every PR automatically. If a board deliberately stops using one of
+# these, edit the tuples on purpose.
+_REQUIRED_STRONG = (
+    "SWI2_EGU2_IRQHandler",  # SoftDevice BLE event (SD_EVT) -- advertising & connections
+    "GPIOTE_IRQHandler",  # GPIO interrupts: radio DIO + buttons
+    "RTC1_IRQHandler",  # FreeRTOS scheduler tick
+)
+# Owned by the TinyUSB stack, so only required when the board builds with USB at all.
+# Boards without native USB wiring (e.g. wio-sdk-wm1110's CH340 UART) strip TinyUSB via
+# disable_adafruit_usb.py / unflagging USE_TINYUSB, leaving these legitimately weak.
+_REQUIRED_STRONG_USB = (
+    "USBD_IRQHandler",  # USB CDC (serial console + 1200bps DFU trigger)
+    "POWER_CLOCK_IRQHandler",  # USB power events (VBUS detect/ready) via TinyUSB hal
+)
+
+_tc = env.PioPlatform().get_package_dir("toolchain-gccarmnoneeabi") or ""
+_NM = os.path.join(_tc, "bin", "arm-none-eabi-nm")
+if not os.path.isfile(_NM):
+    _NM = "arm-none-eabi-nm"  # fall back to PATH
+
+
+def _assert_isr_handlers_survived(source, target, env):
+    import subprocess
+    import sys
+
+    try:
+        # Resolve the ELF at build time; target[0] is the buildprog alias, not the file.
+        elf = env.subst("$BUILD_DIR/${PROGNAME}.elf")
+        out = subprocess.check_output([_NM, elf], universal_newlines=True)
+    except Exception as exc:  # tooling hiccup: warn loudly, don't wedge the build
+        print("nrf52_lto: WARNING - ISR-handler guard skipped (nm failed: %s)" % exc)
+        return
+    # nm line: "<addr> <type> <symbol>". type 'T'/'t' = strong (good); 'W'/'w' = weak stub.
+    kind = {}
+    for line in out.split("\n"):
+        f = line.split()
+        if len(f) >= 3 and f[-1].endswith("_IRQHandler"):
+            kind[f[-1]] = f[-2]
+    required = list(_REQUIRED_STRONG)
+    defines = [
+        str(d[0] if isinstance(d, tuple) else d) for d in env.get("CPPDEFINES", [])
+    ]
+    if "USE_TINYUSB" in defines:
+        required += _REQUIRED_STRONG_USB
+    dropped = [h for h in required if kind.get(h, "W").upper() != "T"]
+    if dropped:
+        sys.stderr.write(
+            "\n*** nrf52 LTO guard: interrupt handler(s) DROPPED: %s ***\n"
+            "Each resolved to the weak Default_Handler stub, so the chip hangs when that IRQ\n"
+            "fires. Compile the .cpp that defines the handler with -fno-lto by adding it to\n"
+            "LIB_ISR in extra_scripts/nrf52_lto.py. Find the owner of FOO_IRQHandler with:\n"
+            "  grep -rl FOO_IRQHandler <framework-arduinoadafruitnrf52>/{libraries,cores}\n\n"
+            % ", ".join(dropped)
+        )
+        from SCons.Script import Exit
+
+        Exit(1)  # canonical SCons build-abort -> red build
+    print(
+        "nrf52_lto: ISR-handler guard OK -- %d critical handlers strong" % len(required)
+    )
+
+
+# Attach to the phony "buildprog" alias, NOT the .elf file node: SCons can skip a post-action
+# on a file target during an incremental relink (observed), but the buildprog alias runs every
+# build -- so the guard fires on local incremental rebuilds and clean CI builds alike.
+env.AddPostAction("buildprog", _assert_isr_handlers_survived)
@@ -191,10 +191,12 @@ echo
 # PASS/FAIL — every hardware test would SKIP with "role not present". We
 # narrow to tests/unit explicitly so the summary reads as "no hardware,
 # unit suite only" instead of "big skip count looks suspicious".
+# Keep terminal output condensed (`-q -r fE`) so skip-heavy runs do not print
+# each skipped test in full; skip counts still appear in pytest's summary.
 if [[ -z $DETECTED && $# -eq 0 ]]; then
 	echo "[pre-flight] no supported devices detected; running unit tier only."
 	echo
-	exec "$VENV_PY" -m pytest tests/unit -v --report-log=tests/reportlog.jsonl
+	exec "$VENV_PY" -m pytest tests/unit -q -r fE --report-log=tests/reportlog.jsonl
 fi

 # Default pytest args when the user passed none. Power users can invoke
@@ -210,11 +212,13 @@ fi
 # skipping half the hardware tests with "not baked with session profile"
 # errors. Power users who know their hardware is current and want to shave
 # those seconds can pass `--assume-baked` explicitly.
+# Defaults also use condensed reporting (`-q -r fE`) to avoid listing every
+# skipped test verbatim while still surfacing failures/errors and summary data.
 if [[ $# -eq 0 ]]; then
 	set -- tests/ \
 		--html=tests/report.html --self-contained-html \
 		--junitxml=tests/junit.xml \
-		-v --tb=short
+		-q -r fE --tb=short
 fi

 # UI tier requires opencv-python-headless (and ideally easyocr). If it's
@@ -44,7 +44,7 @@ _ESP32_ARCHES = {
    "esp32-c6",
    "esp32c6",
 }
-_NRF52_ARCHES = {"nrf52", "nrf52840", "nrf52832"}
+_NRF52_ARCHES = {"nrf52", "nrf52840"}


 def _wait_port_free(port: str, *, timeout_s: float = 15.0, role: str = "") -> None:
@@ -34,6 +34,7 @@ BuildRequires: python3dist(grpcio-tools)
 BuildRequires: git-core
 BuildRequires: gcc-c++
 BuildRequires: pkgconfig(yaml-cpp)
+BuildRequires: pkgconfig(jsoncpp)
 BuildRequires: pkgconfig(libgpiod)
 BuildRequires: pkgconfig(bluez)
 BuildRequires: pkgconfig(libusb-1.0)
@@ -208,16 +208,10 @@ lib_deps =
 	https://github.com/adafruit/Adafruit_BMP3XX/archive/refs/tags/2.1.6.zip
 	# renovate: datasource=github-tags depName=Adafruit MAX1704X packageName=adafruit/Adafruit_MAX1704X
 	https://github.com/adafruit/Adafruit_MAX1704X/archive/refs/tags/1.0.3.zip
-	# renovate: datasource=github-tags depName=Adafruit SHTC3 packageName=adafruit/Adafruit_SHTC3
-	https://github.com/adafruit/Adafruit_SHTC3/archive/refs/tags/1.0.2.zip
 	# renovate: datasource=github-tags depName=Adafruit LPS2X packageName=adafruit/Adafruit_LPS2X
 	https://github.com/adafruit/Adafruit_LPS2X/archive/refs/tags/2.0.6.zip
-	# renovate: datasource=github-tags depName=Adafruit SHT31 packageName=adafruit/Adafruit_SHT31
-	https://github.com/adafruit/Adafruit_SHT31/archive/refs/tags/2.2.2.zip
 	# renovate: datasource=github-tags depName=Adafruit VEML7700 packageName=adafruit/Adafruit_VEML7700
 	https://github.com/adafruit/Adafruit_VEML7700/archive/refs/tags/2.1.6.zip
-	# renovate: datasource=github-tags depName=Adafruit SHT4x packageName=adafruit/Adafruit_SHT4X
-	https://github.com/adafruit/Adafruit_SHT4X/archive/refs/tags/1.0.5.zip
 	# renovate: datasource=github-tags depName=SparkFun Qwiic Scale NAU7802 packageName=sparkfun/SparkFun_Qwiic_Scale_NAU7802_Arduino_Library
 	https://github.com/sparkfun/SparkFun_Qwiic_Scale_NAU7802_Arduino_Library/archive/refs/tags/v1.0.6.zip
 	# renovate: datasource=custom.pio depName=ClosedCube OPT3001 packageName=closedcube/library/ClosedCube OPT3001
@@ -51,6 +51,12 @@ const char *DisplayFormatters::getModemPresetDisplayName(meshtastic_Config_LoRaC
    case PRESET(NARROW_SLOW):
        return useShortName ? "NarS" : "NarrowSlow";
        break;
+    case PRESET(TINY_FAST):
+        return useShortName ? "TinyF" : "TinyFast";
+        break;
+    case PRESET(TINY_SLOW):
+        return useShortName ? "TinyS" : "TinySlow";
+        break;
    default:
        return useShortName ? "Custom" : "Invalid";
        break;
@@ -14,8 +14,8 @@
 #define FILE_O_READ "r"
 #endif

-#if defined(ARCH_STM32WL)
-// STM32WL
+#if defined(ARCH_STM32)
+// STM32
 #include "LittleFS.h"
 #define FSCom InternalFS
 #define FSBegin() FSCom.begin()
@@ -14,6 +14,7 @@
 * For more information, see: https://meshtastic.org/
 */
 #include "power.h"
+#include "BluetoothCommon.h"
 #include "MessageStore.h"
 #include "NodeDB.h"
 #include "PowerFSM.h"
@@ -47,7 +48,7 @@
 #include "concurrency/LockGuard.h"
 #endif

-#if defined(ARCH_STM32WL) && defined(BATTERY_PIN)
+#if defined(ARCH_STM32) && defined(BATTERY_PIN)
 #include "stm32yyxx_ll_adc.h"

 /* Analog read resolution */
@@ -430,7 +431,7 @@ class AnalogBatteryLevel : public HasBatteryLevel
            float scaled = 0;

            battery_adcEnable();
-#ifdef ARCH_STM32WL
+#ifdef ARCH_STM32
            // STM32 ADC with VREFINT runtime calibration
            Vref = __LL_ADC_CALC_VREFANALOG_VOLTAGE(analogRead(AVREF), LL_ADC_RESOLUTION);
            raw = analogRead(BATTERY_PIN);
@@ -607,7 +608,7 @@ class AnalogBatteryLevel : public HasBatteryLevel
    bool initial_read_done = false;
    float last_read_value = (OCV[NUM_OCV_POINTS - 1] * NUM_CELLS);
    uint32_t last_read_time_ms = 0;
-#ifdef ARCH_STM32WL
+#ifdef ARCH_STM32
    // 3300mV placeholder for STM32 errata where VREFINT factory calibration may be missing
    // (e.g. STM32U0, see DS14756 Rev 3 §2.4.1 "VREFINT offset")
    uint32_t Vref = 3300;
@@ -717,7 +718,7 @@ bool Power::analogInit()
 #define BATTERY_SENSE_RESOLUTION_BITS 10
 #endif

-#ifdef ARCH_STM32WL
+#ifdef ARCH_STM32
    analogReadResolution(BATTERY_SENSE_RESOLUTION_BITS);
 #elif defined(ARCH_ESP32) // ESP32 needs special analog stuff
    adc_oneshot_unit_init_cfg_t init_config = {
@@ -748,7 +749,7 @@ bool Power::analogInit()

    // NRF52 ADC init moved to powerHAL_init in nrf52 platform

-#if !defined(ARCH_ESP32) && !defined(ARCH_STM32WL)
+#if !defined(ARCH_ESP32) && !defined(ARCH_STM32)
    analogReadResolution(BATTERY_SENSE_RESOLUTION_BITS);
 #endif

@@ -837,7 +838,7 @@ void Power::reboot()
    }
    LOG_DEBUG("final reboot!");
    ::reboot();
-#elif defined(ARCH_STM32WL)
+#elif defined(ARCH_STM32)
    HAL_NVIC_SystemReset();
 #else
    rebootAtMsec = -1;
@@ -962,6 +963,10 @@ void Power::readPowerStatus()
        lastLogTime = millis();
    }
    newStatus.notifyObservers(&powerStatus2);
+
+    // Mirror battery level to the BLE Battery Service (0x2A19); the platform layer clamps and dedupes.
+    if (hasBattery == OptTrue)
+        updateBatteryLevel(powerStatus2.getBatteryChargePercent());
 #ifdef DEBUG_HEAP
    if (lastheap != memGet.getFreeHeap()) {
        // Use stack-allocated buffer to avoid heap allocations in monitoring code
@@ -219,7 +219,11 @@ static void darkEnter()
 static void serialEnter()
 {
    LOG_POWERFSM("State: serialEnter");
+#ifndef ARCH_NRF52
+    // nRF52 runs BLE on SoftDevice independently of USB serial — no need to disable it.
+    // (Same rationale as nbEnter() which already guards this with #ifdef ARCH_ESP32)
    setBluetoothEnable(false);
+#endif
    if (screen) {
        screen->setOn(true);
    }
@@ -1,6 +1,16 @@
 // TODO refactor this out with better radio configuration system
 #ifdef USE_RF95
+
+#ifndef RF95_RESET
 #define RF95_RESET LORA_RESET
-#define RF95_IRQ LORA_DIO0  // on SX1262 version this is a no connect DIO0
+#endif
+
+#ifndef RF95_IRQ
+#define RF95_IRQ LORA_DIO0 // on SX1262 version this is a no connect DIO0
+#endif
+
+#ifndef RF95_DIO1
 #define RF95_DIO1 LORA_DIO1 // Note: not really used for RF95, but used for pure SX127x
 #endif
+
+#endif
@@ -51,7 +51,7 @@ size_t RedirectablePrint::write(uint8_t c)
 size_t RedirectablePrint::vprintf(const char *logLevel, const char *format, va_list arg)
 {
    va_list copy;
-#if ENABLE_JSON_LOGGING || ARCH_PORTDUINO
+#if ARCH_PORTDUINO
    static char printBuf[512];
 #else
    static char printBuf[160];
@@ -573,5 +573,94 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #define USE_ETHERNET_DEFAULT 0
 #endif

+// -----------------------------------------------------------------------------
+// MESHTASTIC_LOCKDOWN — runtime, client-toggleable hardening (nRF52 only)
+//
+// Lockdown/protect support is opt-in at build time. Builds that need it pass
+// -DMESHTASTIC_ENABLE_LOCKDOWN=1. When enabled on nRF52 (CC310 hardware
+// crypto), whether it is ACTIVE is decided entirely at runtime by
+// EncryptedStorage::isLockdownActive()
+// (== a passphrase has been provisioned, i.e. /prefs/.dek exists). A device
+// that has never been provisioned — or that the operator disabled from the
+// client app — behaves exactly like stock firmware: plaintext storage, no
+// redaction, normal logging, normal display.
+//
+// The operator toggles lockdown from the client app:
+//   off -> on : provision a passphrase (AdminMessage.lockdown_auth). The
+//               firmware generates a DEK, encrypts the stored config, and
+//               authorizes the connection.
+//   on -> off : AdminMessage.lockdown_auth { disable=true } with the
+//               passphrase — decrypts storage back to plaintext and removes
+//               the DEK / token / monotonic-counter / backoff files, then
+//               reboots into normal mode. APPROTECT is the one thing that
+//               does NOT revert (see below).
+//
+// MESHTASTIC_LOCKDOWN here is an INTERNAL capability marker. It gates the UI
+// bits (lock screen, pairing-PIN handling). Flash-constrained nRF52 variants
+// that genuinely cannot afford the ~tens-of-KB of crypto + access-control code
+// may also opt out with -DMESHTASTIC_EXCLUDE_LOCKDOWN=1.
+//
+//   MESHTASTIC_PHONEAPI_ACCESS_CONTROL — per-connection auth + redaction,
+//                                        gated at runtime on isLockdownActive()
+//   MESHTASTIC_ENCRYPTED_STORAGE       — AES-128-CTR + HMAC-SHA256 at-rest
+//   MESHTASTIC_ENABLE_APPROTECT        — UICR APPROTECT capability. The actual
+//                                        one-way burn happens at runtime, only
+//                                        once provisioned, only on non-vulnerable
+//                                        silicon, and is STICKY: disabling
+//                                        lockdown does NOT (cannot) reverse it.
+//
+// DEBUG_MUTE is intentionally NOT coupled to lockdown — a capable-but-off
+// device must log normally. Define DEBUG_MUTE separately for a silent build.
+//
+// -DMESHTASTIC_LOCKDOWN_DEBUG=1 keeps the irreversible APPROTECT burn disabled
+// even when provisioned — for development so dev boards never lose SWD.
+// -----------------------------------------------------------------------------
+#if defined(ARCH_NRF52)
+#ifndef MESHTASTIC_ENABLE_LOCKDOWN
+#define MESHTASTIC_ENABLE_LOCKDOWN 0
+#endif
+
+#if !MESHTASTIC_ENABLE_LOCKDOWN
+#undef MESHTASTIC_LOCKDOWN
+#undef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+#undef MESHTASTIC_ENCRYPTED_STORAGE
+#undef MESHTASTIC_ENABLE_APPROTECT
+#ifndef MESHTASTIC_EXCLUDE_LOCKDOWN
+#define MESHTASTIC_EXCLUDE_LOCKDOWN 1
+#endif
+#endif
+
+#if MESHTASTIC_ENABLE_LOCKDOWN && !defined(MESHTASTIC_EXCLUDE_LOCKDOWN)
+#define MESHTASTIC_LOCKDOWN 1
+#define MESHTASTIC_PHONEAPI_ACCESS_CONTROL 1
+#define MESHTASTIC_ENCRYPTED_STORAGE 1
+#ifndef MESHTASTIC_LOCKDOWN_DEBUG
+#define MESHTASTIC_ENABLE_APPROTECT 1
+#endif
+#endif
+#endif
+
+#ifdef MESHTASTIC_LOCKDOWN
+
+// Per-boot uptime cap on unlocked sessions. 0 = unlimited (token-only
+// enforcement, the existing behavior). When non-zero, every passphrase
+// unlock (and every token-auto-unlock that inherits the value) arms a
+// timer; on expiry the device lockNow()s and reboots into locked state.
+// Bounds the total exposure window to bootsRemaining * this value if an
+// attacker has physical possession but not the passphrase.
+//
+// Override at build time. Suggested:
+//   carry device:        3600  (1h sessions, periodic re-auth from phone)
+//   tower / infra node:  0     (default — relies on token TTLs only)
+//
+// A future LockdownAuth.max_session_seconds proto field will let the
+// client set this per-token; until that lands the build-time value is
+// the only source.
+#ifndef MESHTASTIC_LOCKDOWN_SESSION_DEFAULT_SECONDS
+#define MESHTASTIC_LOCKDOWN_SESSION_DEFAULT_SECONDS 0
+#endif
+
+#endif // MESHTASTIC_LOCKDOWN
+
 #include "DebugConfiguration.h"
 #include "RF95Configuration.h"
@@ -37,8 +37,8 @@ ScanI2C::FoundDevice ScanI2C::firstKeyboard() const

 ScanI2C::FoundDevice ScanI2C::firstAccelerometer() const
 {
-    ScanI2C::DeviceType types[] = {MPU6050, LIS3DH, BMA423, LSM6DS3, BMX160, STK8BAXX,
-                                   ICM20948, QMA6100P, BMM150,  BMI270,  ICM42607P};
+    ScanI2C::DeviceType types[] = {MPU6050,  LIS3DH,   BMA423, LSM6DS3, BMX160,   STK8BAXX,
+                                   ICM20948, QMA6100P, BMM150, BMI270,  ICM42607P};
    return firstOfOrNONE(11, types);
 }

@@ -8,7 +8,7 @@
 #if defined(ARCH_PORTDUINO)
 #include "linux/LinuxHardwareI2C.h"
 #endif
-#if !defined(ARCH_PORTDUINO) && !defined(ARCH_STM32WL)
+#if !defined(ARCH_PORTDUINO) && !defined(ARCH_STM32)
 #include "meshUtils.h" // vformat

 #endif
@@ -17,7 +17,10 @@
 #include "main.h" // pmu_found
 #include "sleep.h"

+#include "FSCommon.h"
 #include "GPSUpdateScheduling.h"
+#include "SPILock.h"
+#include "SafeFile.h"
 #include "cas.h"
 #include "ubx.h"

@@ -44,7 +47,7 @@ template <typename T, std::size_t N> std::size_t array_count(const T (&)[N])

 #if defined(ARCH_NRF52)
 Uart *GPS::_serial_gps = &GPS_SERIAL_PORT;
-#elif defined(ARCH_ESP32) || defined(ARCH_PORTDUINO) || defined(ARCH_STM32WL)
+#elif defined(ARCH_ESP32) || defined(ARCH_PORTDUINO) || defined(ARCH_STM32)
 HardwareSerial *GPS::_serial_gps = &GPS_SERIAL_PORT;
 #elif defined(ARCH_RP2040)
 SerialUART *GPS::_serial_gps = &GPS_SERIAL_PORT;
@@ -71,6 +74,112 @@ static struct uBloxGnssModelInfo {
 #define GPS_SOL_EXPIRY_MS 5000 // in millis. give 1 second time to combine different sentences. NMEA Frequency isn't higher anyway
 #define NMEA_MSG_GXGSA "GNGSA" // GSA message (GPGSA, GNGSA etc)

+namespace
+{
+// Versioned on-disk record for persisted GPS probe results.
+constexpr uint32_t GPS_PROBE_CACHE_MAGIC = 0x47504348UL; // "GPCH"
+constexpr uint16_t GPS_PROBE_CACHE_VERSION = 1;
+constexpr const char *GPS_PROBE_CACHE_FILE = "/prefs/gps_probe_cache.dat";
+constexpr int MIN_PLAUSIBLE_GPS_YEAR = 2020;
+constexpr int MAX_PLAUSIBLE_GPS_YEAR = 2100;
+#ifdef TRACKER_T1000_E
+constexpr uint32_t T1000_E_AIROHA_WAKE_MS = 1000;
+constexpr uint32_t T1000_E_AIROHA_WAKE_INTERVAL_MS = 40;
+#endif
+
+struct GPSProbeCacheRecord {
+    uint32_t magic;
+    uint16_t version;
+    uint16_t reserved;
+    uint32_t baud;
+    uint8_t model;
+};
+
+bool isValidGnssModel(uint8_t model)
+{
+    // Keep persisted values bounded to known enum range.
+    return model <= static_cast<uint8_t>(GNSS_MODEL_CM121);
+}
+
+bool isValidProbeBaud(uint32_t baud)
+{
+    // Conservative sanity range for UART baud values.
+    return baud >= 1200 && baud <= 921600;
+}
+
+template <typename T> void wakeAirohaForActiveProbe(T *serialGps)
+{
+#ifdef TRACKER_T1000_E
+    digitalWrite(PIN_GPS_EN, GPS_EN_ACTIVE);
+    digitalWrite(GPS_RTC_INT, HIGH);
+    delay(3);
+    digitalWrite(GPS_RTC_INT, LOW);
+    delay(50);
+
+    const uint32_t start = millis();
+    do {
+        serialGps->write("$PAIR382,1*2E\r\n");
+        delay(T1000_E_AIROHA_WAKE_INTERVAL_MS);
+    } while (Throttle::isWithinTimespanMs(start, T1000_E_AIROHA_WAKE_MS));
+#elif defined(GNSS_AIROHA)
+    serialGps->write("$PAIR382,1*2E\r\n");
+    delay(20);
+#else
+    (void)serialGps;
+#endif
+}
+
+bool isPlausibleNmeaTime(const struct tm &t)
+{
+    const int year = t.tm_year + 1900;
+    if (year < MIN_PLAUSIBLE_GPS_YEAR || year > MAX_PLAUSIBLE_GPS_YEAR) {
+        return false;
+    }
+
+#ifdef BUILD_EPOCH
+    const int64_t candidate = static_cast<int64_t>(gm_mktime(&t));
+    const int64_t minEpoch = static_cast<int64_t>(BUILD_EPOCH);
+    const int64_t maxEpoch = minEpoch + static_cast<int64_t>(FORTY_YEARS);
+    return candidate >= minEpoch && candidate <= maxEpoch;
+#else
+    return true;
+#endif
+}
+
+template <typename T> bool sawNmeaSentenceAtBaud(T *serialGps, uint32_t timeoutMs)
+{
+    // Lightweight passive check: look for at least one complete
+    // "$...,<field>\n" style NMEA sentence.
+    const uint32_t deadline = millis() + timeoutMs;
+    bool sawDollar = false;
+    bool sawComma = false;
+
+    while ((int32_t)(millis() - deadline) < 0) {
+        while (serialGps->available()) {
+            char c = static_cast<char>(serialGps->read());
+            if (c == '$') {
+                sawDollar = true;
+                sawComma = false;
+                continue;
+            }
+            if (c == ',') {
+                sawComma = true;
+            }
+            if (c == '\n' || c == '\r') {
+                if (sawDollar && sawComma) {
+                    return true;
+                }
+                sawDollar = false;
+                sawComma = false;
+            }
+        }
+        delay(10);
+    }
+
+    return false;
+}
+} // namespace
+
 // For logging
 static const char *getGPSPowerStateString(GPSPowerState state)
 {
@@ -492,6 +601,201 @@ static const int rareSerialSpeeds[3] = {4800, 57600, GPS_BAUDRATE};
 #define GPS_PROBETRIES 2
 #endif

+bool GPS::loadProbeCache()
+{
+#ifdef FSCom
+    // Load the last known-good GPS model/baud pair so we can avoid a full probe
+    // sweep on every boot.
+    triedProbeCache = true; // Latch this boot's load attempt, even if no cache.
+    GPSProbeCacheRecord record = {};
+    size_t bytesRead = 0;
+
+    spiLock->lock();
+    auto file = FSCom.open(GPS_PROBE_CACHE_FILE, FILE_O_READ);
+    if (!file) {
+        spiLock->unlock();
+        return false;
+    }
+    bytesRead = file.read(reinterpret_cast<uint8_t *>(&record), sizeof(record));
+    file.close();
+    spiLock->unlock();
+
+    const bool headerValid = (bytesRead == sizeof(record)) && (record.magic == GPS_PROBE_CACHE_MAGIC) &&
+                             (record.version == GPS_PROBE_CACHE_VERSION) && (record.reserved == 0U);
+    if (!headerValid || !isValidGnssModel(record.model) || !isValidProbeBaud(record.baud)) {
+        clearProbeCache(); // Drop corrupt/invalid cache so next boot can
+                           // recover.
+        return false;
+    }
+
+    cachedProbeBaud = static_cast<int32_t>(record.baud);
+    cachedProbeModel = static_cast<GnssModel_t>(record.model);
+    hasProbeCache = true;
+    triedProbeCache = false;
+    LOG_INFO("Loaded cached GPS probe: baud=%u", record.baud);
+    return true;
+#else
+    return false;
+#endif
+}
+
+void GPS::clearProbeCache()
+{
+    // Invalidate in-memory and on-disk cache so next boot is forced to do a
+    // full probe.
+    hasProbeCache = false;
+    triedProbeCache = true;
+    cachedProbeBaud = 0;
+    cachedProbeModel = GNSS_MODEL_UNKNOWN;
+#ifdef FSCom
+    spiLock->lock();
+    if (FSCom.exists(GPS_PROBE_CACHE_FILE)) {
+        FSCom.remove(GPS_PROBE_CACHE_FILE);
+    }
+    spiLock->unlock();
+#endif
+}
+
+bool GPS::saveProbeCache() const
+{
+#ifdef FSCom
+    if (gnssModel == GNSS_MODEL_UNKNOWN || !isValidGnssModel(static_cast<uint8_t>(gnssModel)) ||
+        !isValidProbeBaud(detectedBaud)) {
+        return false;
+    }
+
+    spiLock->lock();
+    FSCom.mkdir("/prefs");
+    spiLock->unlock();
+    GPSProbeCacheRecord record = {
+        GPS_PROBE_CACHE_MAGIC, GPS_PROBE_CACHE_VERSION, 0, static_cast<uint32_t>(detectedBaud), static_cast<uint8_t>(gnssModel),
+    };
+
+    auto file = SafeFile(GPS_PROBE_CACHE_FILE, true);
+    spiLock->lock();
+    const size_t written = file.write(reinterpret_cast<const uint8_t *>(&record), sizeof(record));
+    spiLock->unlock();
+    return (written == sizeof(record)) && file.close();
+#else
+    return false;
+#endif
+}
+
+bool GPS::verifyCachedProbePresence()
+{
+    if (!hasProbeCache || cachedProbeModel == GNSS_MODEL_UNKNOWN || !isValidProbeBaud(cachedProbeBaud)) {
+        return false;
+    }
+
+#if defined(ARCH_NRF52) || defined(ARCH_PORTDUINO) || defined(ARCH_STM32)
+    _serial_gps->end();
+    _serial_gps->begin(cachedProbeBaud);
+#elif defined(ARCH_RP2040)
+    _serial_gps->end();
+    _serial_gps->setFIFOSize(256);
+    _serial_gps->begin(cachedProbeBaud);
+#else
+    if (_serial_gps->baudRate() != cachedProbeBaud) {
+        LOG_DEBUG("Set GPS Baud to %i (cached verify)", cachedProbeBaud);
+        _serial_gps->updateBaudRate(cachedProbeBaud);
+    }
+#endif
+
+    // Before trusting cached model/baud, require either active model-specific
+    // response or passive NMEA flow.
+    clearBuffer();
+    bool present = false;
+
+    // Model-specific "active ping" checks to avoid false stale decisions on
+    // modules that start streaming late.
+    const char *cachedProbeModelName = "UNKNOWN";
+    switch (cachedProbeModel) {
+    case GNSS_MODEL_MTK:
+        cachedProbeModelName = "L76K/MTK";
+        _serial_gps->write("$PCAS06,0*1B\r\n");
+        present = (getACK("$GPTXT,01,01,02,SW=", 700) == GNSS_RESPONSE_OK);
+        break;
+    case GNSS_MODEL_MTK_L76B:
+        cachedProbeModelName = "L76B";
+    case GNSS_MODEL_MTK_PA1010D:
+        if (cachedProbeModel == GNSS_MODEL_MTK_PA1010D)
+            cachedProbeModelName = "PA1010D";
+    case GNSS_MODEL_MTK_PA1616S:
+        if (cachedProbeModel == GNSS_MODEL_MTK_PA1616S)
+            cachedProbeModelName = "PA1616S";
+    case GNSS_MODEL_LS20031:
+        if (cachedProbeModel == GNSS_MODEL_LS20031)
+            cachedProbeModelName = "LS20031";
+        _serial_gps->write("$PMTK605*31\r\n");
+        present = (getACK("$PMTK705", 900) == GNSS_RESPONSE_OK);
+        break;
+    case GNSS_MODEL_AG3335:
+        cachedProbeModelName = "AG3335";
+    case GNSS_MODEL_AG3352:
+        if (cachedProbeModel == GNSS_MODEL_AG3352)
+            cachedProbeModelName = "AG3352";
+        wakeAirohaForActiveProbe(_serial_gps);
+        _serial_gps->write("$PAIR021*39\r\n");
+        present = (getACK("$PAIR021,", 900) == GNSS_RESPONSE_OK);
+        break;
+    case GNSS_MODEL_ATGM336H:
+        cachedProbeModelName = "ATGM336H";
+        _serial_gps->write("$PCAS06,1*1A\r\n");
+        present = (getACK("$GPTXT,01,01,02,HW=ATGM", 900) == GNSS_RESPONSE_OK);
+        break;
+    case GNSS_MODEL_UC6580:
+        cachedProbeModelName = "UC6580/UM600";
+        _serial_gps->write("$PDTINFO\r\n");
+        present = (getACK("UC6580", 900) == GNSS_RESPONSE_OK) || (getACK("UM600", 900) == GNSS_RESPONSE_OK);
+        break;
+    case GNSS_MODEL_CM121:
+        cachedProbeModelName = "CM121";
+        _serial_gps->write("$PDTINFO\r\n");
+        present = (getACK("CM121", 900) == GNSS_RESPONSE_OK);
+        break;
+    case GNSS_MODEL_UBLOX6:
+    case GNSS_MODEL_UBLOX7:
+    case GNSS_MODEL_UBLOX8:
+    case GNSS_MODEL_UBLOX9:
+    case GNSS_MODEL_UBLOX10: {
+        if (cachedProbeModel == GNSS_MODEL_UBLOX6)
+            cachedProbeModelName = "U-blox 6";
+        else if (cachedProbeModel == GNSS_MODEL_UBLOX7)
+            cachedProbeModelName = "U-blox 7";
+        else if (cachedProbeModel == GNSS_MODEL_UBLOX8)
+            cachedProbeModelName = "U-blox 8";
+        else if (cachedProbeModel == GNSS_MODEL_UBLOX9)
+            cachedProbeModelName = "U-blox 9";
+        else if (cachedProbeModel == GNSS_MODEL_UBLOX10)
+            cachedProbeModelName = "U-blox 10";
+
+        uint8_t cfg_rate[] = {0xB5, 0x62, 0x06, 0x08, 0x00, 0x00, 0x00, 0x00};
+        UBXChecksum(cfg_rate, sizeof(cfg_rate));
+        _serial_gps->write(cfg_rate, sizeof(cfg_rate));
+        present = (getACK(0x06, 0x08, 900) != GNSS_RESPONSE_NONE);
+        break;
+    }
+    default:
+        break;
+    }
+
+    if (!present) {
+        // Some modules may not respond to probes while still streaming NMEA, so
+        // allow a passive fallback check.
+        present = sawNmeaSentenceAtBaud(_serial_gps, 3000);
+    }
+    if (!present) {
+        LOG_WARN("Cached GPS probe is stale (%s @ %d), clearing cache", cachedProbeModelName, cachedProbeBaud);
+        clearProbeCache();
+        return false;
+    }
+
+    detectedBaud = cachedProbeBaud;
+    gnssModel = cachedProbeModel;
+    LOG_INFO("Using cached GPS probe: %s @ %d", cachedProbeModelName, detectedBaud);
+    return true;
+}
+
 /**
 * @brief  Setup the GPS based on the model detected.
 *  We detect the GPS by cycling through a set of baud rates, first common then rare.
@@ -504,24 +808,39 @@ bool GPS::setup()
    if (!didSerialInit) {
        int msglen = 0;
        if (tx_gpio && gnssModel == GNSS_MODEL_UNKNOWN) {
-            if (probeTries < GPS_PROBETRIES) {
+            if (!hasProbeCache && !triedProbeCache) {
+                (void)loadProbeCache();
+            }
+
+            if (hasProbeCache && !triedProbeCache) {
+                triedProbeCache = true;
+                if (!verifyCachedProbePresence()) {
+                    currentStep = 0;
+                    speedSelect = 0;
+                    probeTries = 0;
+                }
+            }
+
+            if (gnssModel == GNSS_MODEL_UNKNOWN && probeTries < GPS_PROBETRIES) {
+                // No usable cache: walk common baud rates first.
                gnssModel = probe(serialSpeeds[speedSelect]);
-                if (gnssModel == GNSS_MODEL_UNKNOWN) {
-                    if (currentStep == 0 && ++speedSelect == array_count(serialSpeeds)) {
-                        speedSelect = 0;
-                        ++probeTries;
-                    }
+                if (gnssModel != GNSS_MODEL_UNKNOWN) {
+                    detectedBaud = serialSpeeds[speedSelect];
+                } else if (currentStep == 0 && ++speedSelect == array_count(serialSpeeds)) {
+                    speedSelect = 0;
+                    ++probeTries;
                }
            }
            // Rare Serial Speeds
 #ifndef CONFIG_IDF_TARGET_ESP32C6
-            if (probeTries == GPS_PROBETRIES) {
+            else if (gnssModel == GNSS_MODEL_UNKNOWN && probeTries == GPS_PROBETRIES) {
+                // Then try less common baud rates before giving up.
                gnssModel = probe(rareSerialSpeeds[speedSelect]);
-                if (gnssModel == GNSS_MODEL_UNKNOWN) {
-                    if (currentStep == 0 && ++speedSelect == array_count(rareSerialSpeeds)) {
-                        LOG_WARN("Give up on GPS probe and set to %d", GPS_BAUDRATE);
-                        return true;
-                    }
+                if (gnssModel != GNSS_MODEL_UNKNOWN) {
+                    detectedBaud = rareSerialSpeeds[speedSelect];
+                } else if (currentStep == 0 && ++speedSelect == array_count(rareSerialSpeeds)) {
+                    LOG_WARN("Give up on GPS probe and set to %d", GPS_BAUDRATE);
+                    return true;
                }
            }
 #endif
@@ -529,6 +848,7 @@ bool GPS::setup()

        if (gnssModel != GNSS_MODEL_UNKNOWN) {
            setConnected();
+            (void)saveProbeCache();
        } else {
            return false;
        }
@@ -844,6 +1164,15 @@ void GPS::setPowerState(GPSPowerState newState, uint32_t sleepTime)
            break;
        if (oldState != GPS_ACTIVE && oldState != GPS_IDLE) // If hardware just waking now, clear buffer
            clearBuffer();
+#ifdef TRACKER_T1000_E
+        pinMode(GPS_VRTC_EN, OUTPUT);
+        digitalWrite(GPS_VRTC_EN, HIGH);
+        pinMode(GPS_SLEEP_INT, OUTPUT);
+        digitalWrite(GPS_SLEEP_INT, HIGH);
+        pinMode(GPS_RTC_INT, OUTPUT);
+        digitalWrite(GPS_RTC_INT, LOW);
+        pinMode(GPS_RESETB_OUT, INPUT_PULLUP);
+#endif
        powerMon->setState(meshtastic_PowerMon_State_GPS_Active); // Report change for power monitoring (during testing)
        writePinEN(true);                                         // Power (EN pin): on
        setPowerPMU(true);                                        // Power (PMU): on
@@ -1102,6 +1431,11 @@ int32_t GPS::runOnce()
        if (!setup())
            return currentDelay; // Setup failed, re-run in two seconds

+        if (gnssModel == GNSS_MODEL_UNKNOWN) {
+            LOG_WARN("GPS not detected; marked not present for this boot");
+            return disable();
+        }
+
        // We have now loaded our saved preferences from flash
        if (config.position.gps_mode != meshtastic_Config_PositionConfig_GpsMode_ENABLED) {
            return disable();
@@ -1277,7 +1611,7 @@ GnssModel_t GPS::probe(int serialSpeed)

    switch (currentStep) {
    case 0: {
-#if defined(ARCH_NRF52) || defined(ARCH_PORTDUINO) || defined(ARCH_STM32WL)
+#if defined(ARCH_NRF52) || defined(ARCH_PORTDUINO) || defined(ARCH_STM32)
        _serial_gps->end();
        _serial_gps->begin(serialSpeed);
 #elif defined(ARCH_RP2040)
@@ -1298,6 +1632,9 @@ GnssModel_t GPS::probe(int serialSpeed)
        digitalWrite(PIN_GPS_RESET, GPS_RESET_MODE); // assert for 10ms
        delay(10);
        digitalWrite(PIN_GPS_RESET, !GPS_RESET_MODE);
+#ifdef TRACKER_T1000_E
+        delay(100);
+#endif

        // attempt to detect the chip based on boot messages
        std::vector<ChipInfo> passive_detect = {
@@ -1350,6 +1687,7 @@ GnssModel_t GPS::probe(int serialSpeed)
    }
    case 3: {
        /* Airoha (Mediatek) AG3335A/M/S, A3352Q, Quectel L89 2.0, SimCom SIM65M */
+        wakeAirohaForActiveProbe(_serial_gps);
        _serial_gps->write("$PAIR062,2,0*3C\r\n"); // GSA OFF to reduce volume
        _serial_gps->write("$PAIR062,3,0*3D\r\n"); // GSV OFF to reduce volume
        _serial_gps->write("$PAIR513*3D\r\n");     // save configuration
@@ -1634,7 +1972,7 @@ std::unique_ptr<GPS> GPS::createGps()
 #elif defined(ARCH_NRF52)
        _serial_gps->setPins(new_gps->rx_gpio, new_gps->tx_gpio);
        _serial_gps->begin(GPS_BAUDRATE);
-#elif defined(ARCH_STM32WL)
+#elif defined(ARCH_STM32)
        _serial_gps->setTx(new_gps->tx_gpio);
        _serial_gps->setRx(new_gps->rx_gpio);
        _serial_gps->begin(GPS_BAUDRATE);
@@ -1681,6 +2019,9 @@ The Unix epoch (or Unix time or POSIX time or Unix timestamp) is the number of s
        t.tm_year = d.year() - 1900;
        t.tm_isdst = false;
        if (t.tm_mon > -1) {
+            if (!isPlausibleNmeaTime(t)) {
+                return false;
+            }
            if (perhapsSetRTC(RTCQualityGPS, t) == RTCSetResultSuccess) {
                LOG_DEBUG("NMEA GPS time set %02d-%02d-%02d %02d:%02d:%02d age %d", d.year(), d.month(), t.tm_mday, t.tm_hour,
                          t.tm_min, t.tm_sec, ti.age());
@@ -155,8 +155,19 @@ class GPS : private concurrency::OSThread
     * @return true if we've acquired a new location
     */
    virtual bool lookForLocation();
+    // Load persisted GPS model+baud from /prefs.
+    bool loadProbeCache();
+    // Clear persisted GPS model+baud cache.
+    void clearProbeCache();
+    // Persist the currently detected GPS model+baud.
+    bool saveProbeCache() const;
+    // Verify the cached model+baud still maps to a live GPS device.
+    bool verifyCachedProbePresence();

    GnssModel_t gnssModel = GNSS_MODEL_UNKNOWN;
+    int32_t detectedBaud = GPS_BAUDRATE;
+    int32_t cachedProbeBaud = 0;
+    GnssModel_t cachedProbeModel = GNSS_MODEL_UNKNOWN;

    TinyGPSPlus reader;
    uint8_t fixQual = 0; // fix quality from GPGGA
@@ -178,6 +189,10 @@ class GPS : private concurrency::OSThread

    uint8_t speedSelect = 0;
    uint8_t probeTries = 0;
+    // Cache file is successfully loaded.
+    bool hasProbeCache = false;
+    // Ensures cached probe is attempted once per boot.
+    bool triedProbeCache = false;

    /**
     * hasValidLocation - indicates that the position variables contain a complete
@@ -41,6 +41,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #include "draw/UIRenderer.h"
 #include "graphics/TFTColorRegions.h"
 #include "modules/CannedMessageModule.h"
+#include "security/LockdownDisplay.h"

 #if !MESHTASTIC_EXCLUDE_GPS
 #include "GPS.h"
@@ -50,6 +51,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #include "MeshService.h"
 #include "MessageStore.h"
 #include "RadioLibInterface.h"
+#include "SPILock.h"
 #include "error.h"
 #include "gps/GeoCoord.h"
 #include "gps/RTC.h"
@@ -118,8 +120,76 @@ static inline void prepareFrameColorRegions()
 }
 #endif

+#ifdef MESHTASTIC_LOCKDOWN
+// Static lock screen drawn in place of normal frames when
+// meshtastic_security::shouldRedactDisplay() returns true. Renders centered
+// "LOCKED" plus battery so the operator can see the device is alive and
+// charged without leaking any node/channel/message/position content.
+// Draw the LOCKED frame into the host-side framebuffer. Does NOT commit
+// to the panel — the caller is responsible for calling display->display()
+// once it has composited any overlays on top. Committing here would cause
+// visible flicker between "just LOCKED" and "LOCKED + banner overlay" when
+// the pairing-PIN special-case in updateUiFrame paints the overlay after
+// this returns.
+static void drawLockdownLockScreenIntoBuffer(OLEDDisplay *display)
+{
+    display->clear();
+
+    const int w = display->getWidth();
+    const int h = display->getHeight();
+
+    display->setTextAlignment(TEXT_ALIGN_CENTER);
+    display->setFont(FONT_LARGE);
+    display->drawString(w / 2, h / 2 - FONT_HEIGHT_LARGE, "LOCKED");
+
+    display->setFont(FONT_SMALL);
+    char status[32] = "Connect to unlock";
+    if (powerStatus && powerStatus->getHasBattery()) {
+        int pct = powerStatus->getBatteryChargePercent();
+        snprintf(status, sizeof(status), "Battery %d%%", pct);
+    }
+    display->drawString(w / 2, h / 2 + 2, status);
+}
+
+// Convenience wrapper for callers that want the LOCKED frame committed
+// to the panel immediately and have no overlay to compose on top.
+static void drawLockdownLockScreen(OLEDDisplay *display)
+{
+    drawLockdownLockScreenIntoBuffer(display);
+    display->display();
+}
+#endif
+
 static inline void updateUiFrame(OLEDDisplayUi *ui)
 {
+#ifdef MESHTASTIC_LOCKDOWN
+    if (meshtastic_security::shouldRedactDisplay() && screen != nullptr) {
+        OLEDDisplay *display = screen->getDisplayDevice();
+        // Paint LOCKED into the framebuffer WITHOUT committing. We commit
+        // exactly once at the bottom — after any overlay has been composed
+        // on top — so the panel never visibly transitions from "just LOCKED"
+        // to "LOCKED + overlay" mid-frame. Committing twice per cycle was
+        // the source of the H13 flicker.
+        drawLockdownLockScreenIntoBuffer(display);
+        // Special-case the BLE pairing PIN banner. The PIN is needed to
+        // complete first-pair against a locked device, but the lockdown
+        // short-circuit would otherwise hide the PIN entirely. The PIN is
+        // a per-attempt ephemeral pair-handshake artifact, not operator
+        // content, so compositing it over the LOCKED frame is safe.
+        //
+        // Calling ui->update() here would be wrong: it redraws the current
+        // carousel frame (the dashboard) into the framebuffer before the
+        // overlay paints, leaving operator content visible underneath the
+        // banner. Instead we invoke the banner overlay callback directly,
+        // which paints only the banner box on top of the LOCKED pixels we
+        // already have in the framebuffer.
+        if (NotificationRenderer::current_notification_type == notificationTypeEnum::pairing_pin) {
+            NotificationRenderer::drawBannercallback(display, ui->getUiState());
+        }
+        display->display();
+        return;
+    }
+#endif
 #if GRAPHICS_TFT_COLORING_ENABLED
    prepareFrameColorRegions();
 #endif
@@ -163,6 +233,16 @@ static inline float wrapHeading360(float heading)
    return heading;
 }

+static inline float wrapDelta180(float delta)
+{
+    if (delta > 180.0f) {
+        delta -= 360.0f;
+    } else if (delta < -180.0f) {
+        delta += 360.0f;
+    }
+    return delta;
+}
+
 void Screen::setHeading(float heading)
 {
    const float wrappedHeading = wrapHeading360(heading);
@@ -174,37 +254,30 @@ void Screen::setHeading(float heading)
    }

    // Interpolate using shortest-path angular delta to avoid jumps around 0/360.
-    float delta = wrappedHeading - compassHeading;
-    if (delta > 180.0f) {
-        delta -= 360.0f;
-    } else if (delta < -180.0f) {
-        delta += 360.0f;
-    }
+    float delta = wrapDelta180(wrappedHeading - compassHeading);

    // Adaptive filtering:
    // - Strong damping for tiny deltas (jitter)
    // - Faster response for larger turns
    const float absDelta = (delta >= 0.0f) ? delta : -delta;
-    if (absDelta < 1.0f) {
-        return;
-    }
+    if (absDelta >= 1.0f) {
+        float alpha = 0.35f;
+        if (absDelta > 25.0f) {
+            alpha = 0.85f;
+        } else if (absDelta > 10.0f) {
+            alpha = 0.65f;
+        }

-    float alpha = 0.35f;
-    if (absDelta > 25.0f) {
-        alpha = 0.85f;
-    } else if (absDelta > 10.0f) {
-        alpha = 0.65f;
-    }
+        float step = delta * alpha;
+        const float maxStep = 12.0f;
+        if (step > maxStep) {
+            step = maxStep;
+        } else if (step < -maxStep) {
+            step = -maxStep;
+        }

-    float step = delta * alpha;
-    const float maxStep = 12.0f;
-    if (step > maxStep) {
-        step = maxStep;
-    } else if (step < -maxStep) {
-        step = -maxStep;
+        compassHeading = wrapHeading360(compassHeading + step);
    }
-
-    compassHeading = wrapHeading360(compassHeading + step);
 }

 // ==============================
@@ -582,6 +655,21 @@ void Screen::handleSetOn(bool on, FrameCallback einkScreensaver)
            setScreensaverFrames(einkScreensaver);
 #endif

+#ifdef MESHTASTIC_LOCKDOWN
+            // M19: before turning the panel off, paint a safe frame into the
+            // OLED's GDDRAM. The panel retains whatever was last written even
+            // while powered down, so when displayOn() is called later the
+            // screen would otherwise flash the previous frame's content for
+            // 16-50 ms before the next ui->update() lands. Painting the
+            // LOCKED frame now ensures the only thing the operator (or
+            // someone over their shoulder) can see on wake is the redacted
+            // view. Gated on lockdown — non-lockdown builds keep the
+            // previous frame as a UX cue that the display is just dimmed.
+            // dispdev is dereferenced unguarded throughout this file (incl.
+            // displayOff() just below), so no null check here.
+            drawLockdownLockScreen(dispdev);
+#endif
+
 #ifdef PIN_EINK_EN
            digitalWrite(PIN_EINK_EN, LOW);
 #elif defined(PCA_PIN_EINK_EN)
@@ -655,6 +743,10 @@ void Screen::setup()
        brightness = uiconfig.screen_brightness;
    }

+    // Restore which frames the user has hidden (persisted across reboots).
+    // Must happen before the first setFrames().
+    loadFrameVisibility();
+
    // Detect OLED subtype (if supported by board variant)
 #ifdef AutoOLEDWire_h
    if (isAUTOOled)
@@ -697,6 +789,27 @@ void Screen::setup()
 #endif
    LOG_INFO("Applied screen brightness: %d", brightness);

+#if defined(MESHTASTIC_LOCKDOWN) && defined(USE_EINK)
+    // M20: e-ink panels physically retain the last-rendered image without
+    // power, so a power-cycled lockdown handheld would keep showing
+    // operator-identifying content (position, messages, node info) until
+    // the firmware's first natural refresh — which on e-ink can be seconds
+    // into boot. Force a full refresh to the LOCKED frame here, immediately
+    // after the display is initialised and before any other rendering, so
+    // the persistent pixels are wiped to the redacted view before an
+    // observer can see them.
+    if (meshtastic_security::shouldRedactDisplay()) {
+        drawLockdownLockScreen(dispdev);
+#if defined(USE_EINK_PARALLELDISPLAY)
+        // Parallel-display variants drive refresh through a different path;
+        // a bare drawLockdownLockScreen above lands the frame into the
+        // panel buffer and the next ui->update() commits it as normal.
+#else
+        static_cast<EInkDisplay *>(dispdev)->forceDisplay();
+#endif
+    }
+#endif
+
    // Set custom overlay callbacks
    static OverlayCallback overlays[] = {
        graphics::UIRenderer::drawNavigationBar // Custom indicator icons for each frame
@@ -804,10 +917,16 @@ void Screen::setOn(bool on, FrameCallback einkScreensaver)
    if (cardKbI2cImpl)
        cardKbI2cImpl->toggleBacklight(on);
 #endif
-    if (!on)
+    if (!on) {
+#ifdef MESHTASTIC_LOCKDOWN
+        // Screen powering off (idle timeout, shutdown, deep sleep) latches
+        // the screen-lock. Next time the display wakes it shows the LOCKED
+        // frame until a client authenticates with the passphrase.
+        meshtastic_security::lockScreen();
+#endif
        // We handle off commands immediately, because they might be called because the CPU is shutting down
        handleSetOn(false, einkScreensaver);
-    else
+    } else
        enqueueCmd(ScreenCmd{.cmd = Cmd::SET_ON});
 }

@@ -914,7 +1033,17 @@ int32_t Screen::runOnce()
 #endif

 #ifndef DISABLE_WELCOME_UNSET
-    if (!NotificationRenderer::isOverlayBannerShowing() && config.lora.region == meshtastic_Config_LoRaConfig_RegionCode_UNSET) {
+    bool suppressRegionOnboard = false;
+#ifdef MESHTASTIC_LOCKDOWN
+    // While lockdown is active and storage is still locked, config.lora.region
+    // is a deliberate UNSET placeholder — the real region lives in encrypted
+    // storage and is restored on unlock (see NodeDB's locked-boot path). Don't
+    // pop the region picker over the lock screen: it would trap input, and the
+    // operator can't set a region until they unlock anyway.
+    suppressRegionOnboard = meshtastic_security::shouldRedactDisplay();
+#endif
+    if (!suppressRegionOnboard && !NotificationRenderer::isOverlayBannerShowing() &&
+        config.lora.region == meshtastic_Config_LoRaConfig_RegionCode_UNSET) {
 #if defined(OLED_TINY)
        menuHandler::LoraRegionPicker();
 #else
@@ -1416,6 +1545,9 @@ void Screen::toggleFrameVisibility(const std::string &frameName)
    if (frameName == "chirpy") {
        hiddenFrames.chirpy = !hiddenFrames.chirpy;
    }
+
+    // Save the new visibility state so it survives a reboot.
+    saveFrameVisibility();
 }

 bool Screen::isFrameHidden(const std::string &frameName) const
@@ -1454,6 +1586,167 @@ bool Screen::isFrameHidden(const std::string &frameName) const
    return false;
 }

+// ---------------------------------------------------------------------------
+// Frame visibility persistence
+//
+// The set of hideable frames varies by build (USE_EINK, HAS_GPS, ...), so we
+// serialize to a fixed bitmask where each frame name owns a permanent bit
+// position. Bits for frames that don't exist in the current build are simply
+// left untouched, which keeps the saved file portable across firmware variants.
+// ---------------------------------------------------------------------------
+namespace
+{
+static const char *frameVisibilityFileName = "/prefs/framevis";
+constexpr uint32_t FRAMEVIS_MAGIC = 0x53495646; // "FVIS" little-endian
+constexpr uint8_t FRAMEVIS_VERSION = 1;
+
+// Permanent bit assignments. Never renumber these; only append new ones.
+enum FrameVisBit : uint8_t {
+    FVBIT_TEXT_MESSAGE = 0,
+    FVBIT_WAYPOINT = 1,
+    FVBIT_WIFI = 2,
+    FVBIT_SYSTEM = 3,
+    FVBIT_HOME = 4,
+    FVBIT_CLOCK = 5,
+    FVBIT_NODELIST_NODES = 6,
+    FVBIT_NODELIST_LOCATION = 7,
+    FVBIT_NODELIST_LASTHEARD = 8,
+    FVBIT_NODELIST_HOPSIGNAL = 9,
+    FVBIT_NODELIST_DISTANCE = 10,
+    FVBIT_NODELIST_BEARINGS = 11,
+    FVBIT_GPS = 12,
+    FVBIT_LORA = 13,
+    FVBIT_SHOW_FAVORITES = 14,
+    FVBIT_CHIRPY = 15,
+};
+
+struct __attribute__((packed)) FrameVisFile {
+    uint32_t magic;
+    uint8_t version;
+    uint32_t mask;
+};
+
+inline void setBit(uint32_t &mask, uint8_t bit, bool value)
+{
+    if (value)
+        mask |= (1UL << bit);
+    else
+        mask &= ~(1UL << bit);
+}
+
+inline bool getBit(uint32_t mask, uint8_t bit)
+{
+    return (mask & (1UL << bit)) != 0;
+}
+} // namespace
+
+uint32_t Screen::packHiddenFrames() const
+{
+    uint32_t mask = 0;
+    setBit(mask, FVBIT_TEXT_MESSAGE, hiddenFrames.textMessage);
+    setBit(mask, FVBIT_WAYPOINT, hiddenFrames.waypoint);
+    setBit(mask, FVBIT_WIFI, hiddenFrames.wifi);
+    setBit(mask, FVBIT_SYSTEM, hiddenFrames.system);
+    setBit(mask, FVBIT_HOME, hiddenFrames.home);
+    setBit(mask, FVBIT_CLOCK, hiddenFrames.clock);
+#ifndef USE_EINK
+    setBit(mask, FVBIT_NODELIST_NODES, hiddenFrames.nodelist_nodes);
+    setBit(mask, FVBIT_NODELIST_LOCATION, hiddenFrames.nodelist_location);
+#endif
+#ifdef USE_EINK
+    setBit(mask, FVBIT_NODELIST_LASTHEARD, hiddenFrames.nodelist_lastheard);
+    setBit(mask, FVBIT_NODELIST_HOPSIGNAL, hiddenFrames.nodelist_hopsignal);
+    setBit(mask, FVBIT_NODELIST_DISTANCE, hiddenFrames.nodelist_distance);
+#endif
+#if HAS_GPS
+#ifdef USE_EINK
+    setBit(mask, FVBIT_NODELIST_BEARINGS, hiddenFrames.nodelist_bearings);
+#endif
+    setBit(mask, FVBIT_GPS, hiddenFrames.gps);
+#endif
+    setBit(mask, FVBIT_LORA, hiddenFrames.lora);
+    setBit(mask, FVBIT_SHOW_FAVORITES, hiddenFrames.show_favorites);
+    setBit(mask, FVBIT_CHIRPY, hiddenFrames.chirpy);
+    return mask;
+}
+
+void Screen::applyHiddenFramesMask(uint32_t mask)
+{
+    hiddenFrames.textMessage = getBit(mask, FVBIT_TEXT_MESSAGE);
+    hiddenFrames.waypoint = getBit(mask, FVBIT_WAYPOINT);
+    hiddenFrames.wifi = getBit(mask, FVBIT_WIFI);
+    hiddenFrames.system = getBit(mask, FVBIT_SYSTEM);
+    hiddenFrames.home = getBit(mask, FVBIT_HOME);
+    hiddenFrames.clock = getBit(mask, FVBIT_CLOCK);
+#ifndef USE_EINK
+    hiddenFrames.nodelist_nodes = getBit(mask, FVBIT_NODELIST_NODES);
+    hiddenFrames.nodelist_location = getBit(mask, FVBIT_NODELIST_LOCATION);
+#endif
+#ifdef USE_EINK
+    hiddenFrames.nodelist_lastheard = getBit(mask, FVBIT_NODELIST_LASTHEARD);
+    hiddenFrames.nodelist_hopsignal = getBit(mask, FVBIT_NODELIST_HOPSIGNAL);
+    hiddenFrames.nodelist_distance = getBit(mask, FVBIT_NODELIST_DISTANCE);
+#endif
+#if HAS_GPS
+#ifdef USE_EINK
+    hiddenFrames.nodelist_bearings = getBit(mask, FVBIT_NODELIST_BEARINGS);
+#endif
+    hiddenFrames.gps = getBit(mask, FVBIT_GPS);
+#endif
+    hiddenFrames.lora = getBit(mask, FVBIT_LORA);
+    hiddenFrames.show_favorites = getBit(mask, FVBIT_SHOW_FAVORITES);
+    hiddenFrames.chirpy = getBit(mask, FVBIT_CHIRPY);
+}
+
+void Screen::loadFrameVisibility()
+{
+#ifdef FSCom
+    spiLock->lock();
+    auto file = FSCom.open(frameVisibilityFileName, FILE_O_READ);
+    if (file) {
+        FrameVisFile data{};
+        bool ok = file.read((uint8_t *)&data, sizeof(data)) == sizeof(data) && data.magic == FRAMEVIS_MAGIC &&
+                  data.version == FRAMEVIS_VERSION;
+        file.close();
+        spiLock->unlock();
+        if (ok) {
+            applyHiddenFramesMask(data.mask);
+            LOG_INFO("Loaded frame visibility (mask 0x%08x)", data.mask);
+        } else {
+            LOG_WARN("Frame visibility file invalid, keeping defaults");
+        }
+        return;
+    }
+    spiLock->unlock();
+    LOG_DEBUG("No saved frame visibility, using defaults");
+#endif
+}
+
+void Screen::saveFrameVisibility()
+{
+#ifdef FSCom
+    spiLock->lock();
+    FSCom.mkdir("/prefs");
+    if (FSCom.exists(frameVisibilityFileName))
+        FSCom.remove(frameVisibilityFileName);
+
+    auto file = FSCom.open(frameVisibilityFileName, FILE_O_WRITE);
+    if (file) {
+        FrameVisFile data{};
+        data.magic = FRAMEVIS_MAGIC;
+        data.version = FRAMEVIS_VERSION;
+        data.mask = packHiddenFrames();
+        file.write((uint8_t *)&data, sizeof(data));
+        file.flush();
+        file.close();
+        LOG_INFO("Saved frame visibility (mask 0x%08x)", data.mask);
+    } else {
+        LOG_WARN("Failed to open %s for writing", frameVisibilityFileName);
+    }
+    spiLock->unlock();
+#endif
+}
+
 void Screen::handleStartFirmwareUpdateScreen()
 {
    LOG_DEBUG("Show firmware screen");
@@ -1466,6 +1759,15 @@ void Screen::handleStartFirmwareUpdateScreen()

 void Screen::blink()
 {
+#ifdef MESHTASTIC_LOCKDOWN
+    // L4: defensive guard. blink() paints arbitrary geometry, not node
+    // data, so it doesn't actually leak today. But it bypasses the normal
+    // ui->update() path that the lockdown short-circuit gates, so any
+    // future change that puts content into blink would silently leak past
+    // redaction. Refuse to draw when the redaction latch is set.
+    if (meshtastic_security::shouldRedactDisplay())
+        return;
+#endif
    setFastFramerate();
    uint8_t count = 10;
    dispdev->setBrightness(254);
@@ -12,7 +12,21 @@
 #define getStringCenteredX(s) ((SCREEN_WIDTH - display->getStringWidth(s)) / 2)
 namespace graphics
 {
-enum notificationTypeEnum { none, text_banner, selection_picker, node_picker, number_picker, text_input };
+enum notificationTypeEnum {
+    none,
+    text_banner,
+    selection_picker,
+    node_picker,
+    number_picker,
+    hex_picker,
+    text_input,
+    // BLE pairing PIN banner. Treated specially by the lockdown short-circuit
+    // in Screen.cpp: the PIN is ephemeral (regenerated per pair attempt) and
+    // not a real secret, so we allow ui->update() to composite it over the
+    // LOCKED frame. Without this, a first-pair on a locked device cannot
+    // complete because the PIN never renders.
+    pairing_pin,
+};

 struct BannerOverlayOptions {
    const char *message;
@@ -623,6 +637,11 @@ class Screen : public concurrency::OSThread
    void toggleFrameVisibility(const std::string &frameName);
    bool isFrameHidden(const std::string &frameName) const;

+    // Persist / restore which frames are hidden, across reboots.
+    // Stored as a single uint32 bitmask in /prefs (see Screen.cpp for the format).
+    void loadFrameVisibility();
+    void saveFrameVisibility();
+
 #ifdef USE_EINK
    /// Draw an image to remain on E-Ink display after screen off
    void setScreensaverFrames(FrameCallback einkScreensaver = NULL);
@@ -738,6 +757,11 @@ class Screen : public concurrency::OSThread
        bool chirpy = true;
    } hiddenFrames;

+    // Convert hiddenFrames to a uint32 bitmask. Bit positions are fixed per
+    // frame name (see Screen.cpp).
+    uint32_t packHiddenFrames() const;
+    void applyHiddenFramesMask(uint32_t mask);
+
    /// Try to start drawing ASAP
    void setFastFramerate();

@@ -578,7 +578,11 @@ void drawCommonFooter(OLEDDisplay *display, int16_t x, int16_t y)
 #endif

    display->setColor(BLACK);
+#if GRAPHICS_TFT_COLORING_ENABLED
    display->fillRect(0, footerY, SCREEN_WIDTH, footerH);
+#else
+    display->fillRect(0, footerY, connection_icon_width + 1, footerH);
+#endif
    display->setColor(WHITE);
    if (currentResolution == ScreenResolution::High) {
        const int bytesPerRow = (connection_icon_width + 7) / 8;
@@ -1533,8 +1533,7 @@ bool TFTDisplay::hasTouch(void)
 {
 #ifdef RAK14014
    return true;
-#elif !defined(M5STACK) && !defined(HACKADAY_COMMUNICATOR) && !defined(HELTEC_MESH_NODE_T096) &&                                 \
-    !defined(HELTEC_MESH_NODE_T1)
+#elif !defined(M5STACK) && !defined(HACKADAY_COMMUNICATOR) && !defined(HELTEC_MESH_NODE_T096) && !defined(HELTEC_MESH_NODE_T1)
    return tft->touch() != nullptr;
 #else
    return false;
@@ -1553,8 +1552,7 @@ bool TFTDisplay::getTouch(int16_t *x, int16_t *y)
    } else {
        return false;
    }
-#elif !defined(M5STACK) && !defined(HACKADAY_COMMUNICATOR) && !defined(HELTEC_MESH_NODE_T096) &&                                 \
-    !defined(HELTEC_MESH_NODE_T1)
+#elif !defined(M5STACK) && !defined(HACKADAY_COMMUNICATOR) && !defined(HELTEC_MESH_NODE_T096) && !defined(HELTEC_MESH_NODE_T1)
    return tft->getTouch(x, y);
 #else
    return false;
@@ -183,9 +183,13 @@ void drawDigitalClockFrame(OLEDDisplay *display, OLEDDisplayUiState *state, int1
    static float segmentHeight = SEGMENT_HEIGHT * 0.75f;

    if (!scaleInitialized) {
+#ifdef DISPLAY_FORCE_SMALL_FONTS
+        float screenwidth_target_ratio = 0.70f; // Target 70% of display width (adjustable)
+#else
        float screenwidth_target_ratio = 0.80f; // Target 80% of display width (adjustable)
-        float max_scale = 3.5f;                 // Safety limit to avoid runaway scaling
-        float step = 0.05f;                     // Step increment per iteration
+#endif
+        float max_scale = 3.5f; // Safety limit to avoid runaway scaling
+        float step = 0.05f;     // Step increment per iteration

        float target_width = display->getWidth() * screenwidth_target_ratio;
        float target_height =
@@ -126,6 +126,7 @@ void launchReplyForMessage(const StoredMessage &message, bool freetext)

 menuHandler::screenMenus menuHandler::menuQueue = MenuNone;
 uint32_t menuHandler::pickedNodeNum = 0;
+meshtastic_Config_LoRaConfig_RegionCode menuHandler::pendingRegion = meshtastic_Config_LoRaConfig_RegionCode_UNSET;
 bool test_enabled = false;
 uint8_t test_count = 0;

@@ -174,6 +175,48 @@ void menuHandler::OnboardMessage()
    screen->showOverlayBanner(bannerOptions);
 }

+static void applyLoraRegion(meshtastic_Config_LoRaConfig_RegionCode region, bool isHam)
+{
+    config.lora.region = region;
+    config.lora.channel_num = 0; // Reset to default channel
+
+    // Reconcile the preset with the explicitly chosen region: a preset locked to another
+    // region would leave config.lora invalid until applyModemConfig() repairs it with
+    // error/critical-error side effects — or, for the swappable EU trio, the clamp would
+    // flip the region right back. The user picked the region, so the preset follows it.
+    const RegionInfo *newRegion = getRegion(region);
+    if (config.lora.use_preset && !newRegion->supportsPreset(config.lora.modem_preset)) {
+        LOG_INFO("Preset %s not available in %s, using default %s",
+                 DisplayFormatters::getModemPresetDisplayName(config.lora.modem_preset, false, true), newRegion->name,
+                 DisplayFormatters::getModemPresetDisplayName(newRegion->getDefaultPreset(), false, true));
+        config.lora.modem_preset = newRegion->getDefaultPreset();
+    }
+
+    if (isHam && adminModule) {
+        meshtastic_HamParameters hamParams = meshtastic_HamParameters_init_zero;
+        strncpy(hamParams.call_sign, "N0CALL", sizeof(hamParams.call_sign) - 1);
+        strncpy(hamParams.short_name, "N0CL", sizeof(hamParams.short_name));
+        hamParams.tx_power = config.lora.tx_power;
+        hamParams.frequency = config.lora.override_frequency;
+        adminModule->handleSetHamMode(hamParams);
+    }
+    auto changes = SEGMENT_CONFIG;
+#if !(MESHTASTIC_EXCLUDE_PKI_KEYGEN || MESHTASTIC_EXCLUDE_PKI)
+    if (crypto) {
+        crypto->ensurePkiKeys(config.security, owner);
+    }
+#endif
+    initRegion();
+    if (getEffectiveDutyCycle() < 100) {
+        config.lora.ignore_mqtt = true;
+    }
+    if (strncmp(moduleConfig.mqtt.root, default_mqtt_root, strlen(default_mqtt_root)) == 0) {
+        snprintf(moduleConfig.mqtt.root, sizeof(moduleConfig.mqtt.root), "%s/%s", default_mqtt_root, myRegion->name);
+        changes |= SEGMENT_MODULECONFIG;
+    }
+    service->reloadConfig(changes);
+}
+
 void menuHandler::LoraRegionPicker(uint32_t duration)
 {
    static const LoraRegionOption regionOptions[] = {
@@ -206,6 +249,10 @@ void menuHandler::LoraRegionPicker(uint32_t duration)
        {"KZ_863", OptionsAction::Select, meshtastic_Config_LoRaConfig_RegionCode_KZ_863},
        {"NP_865", OptionsAction::Select, meshtastic_Config_LoRaConfig_RegionCode_NP_865},
        {"BR_902", OptionsAction::Select, meshtastic_Config_LoRaConfig_RegionCode_BR_902},
+        {"ITU1_2M (144-146)", OptionsAction::Select, meshtastic_Config_LoRaConfig_RegionCode_ITU1_2M},
+        {"ITU2_2M (144-148)", OptionsAction::Select, meshtastic_Config_LoRaConfig_RegionCode_ITU2_2M},
+        {"ITU3_2M (144-148)", OptionsAction::Select, meshtastic_Config_LoRaConfig_RegionCode_ITU3_2M},
+        {"ITU2_125CM (220-225)", OptionsAction::Select, meshtastic_Config_LoRaConfig_RegionCode_ITU2_125CM},

    };

@@ -228,37 +275,34 @@ void menuHandler::LoraRegionPicker(uint32_t duration)
                return;
            }

-            // Guard: without a reboot, reconfigure() applies the region directly.
-            // Reject LORA_24 on sub-GHz-only hardware — getRadio() used to catch this post-reboot.
-            // TODO: change this to either use the validateLoraConfig() logic or at least check the region for wideLora
-            // rather than a hardcoded check for LORA_24.
-            if (selectedRegion == meshtastic_Config_LoRaConfig_RegionCode_LORA_24 &&
-                !(RadioLibInterface::instance && RadioLibInterface::instance->wideLora())) {
-                LOG_WARN("Radio hardware does not support 2.4 GHz; ignoring region selection");
+            // Guard: without a reboot, reconfigure() applies the region directly, so reject
+            // regions this node can't use up front: unrecognized codes, licensed-only regions,
+            // and radio hardware mismatches (2.4 GHz vs sub-GHz) — the same checks the admin
+            // set-config path applies, but side-effect-free: ignoring a menu selection should
+            // not record a critical error or notify clients. getRadio() used to catch hardware
+            // mismatches post-reboot only.
+            auto candidateLora = config.lora;
+            candidateLora.region = selectedRegion;
+            char regionErr[160];
+            if (!RadioInterface::checkConfigRegion(candidateLora, regionErr, sizeof(regionErr))) {
+                LOG_WARN("Ignoring region selection: %s", regionErr);
                return;
            }

-            config.lora.region = selectedRegion;
-            auto changes = SEGMENT_CONFIG;
-
-#if !(MESHTASTIC_EXCLUDE_PKI_KEYGEN || MESHTASTIC_EXCLUDE_PKI)
-            if (crypto) {
-                crypto->ensurePkiKeys(config.security, owner);
+            bool hamMode = getRegion(selectedRegion)->profile->licensedOnly;
+            if (hamMode) {
+                LOG_INFO("User chose an amateur radio mode region");
+                pendingRegion = selectedRegion;
+                menuQueue = HamModeConfirm;
+                screen->runNow();
+            } else if (owner.is_licensed) {
+                LOG_INFO("Licensed user chose a non-ham region; prompting to revert licensed mode");
+                pendingRegion = selectedRegion;
+                menuQueue = LicensedToNormalConfirm;
+                screen->runNow();
+            } else {
+                applyLoraRegion(selectedRegion, false);
            }
-#endif
-            config.lora.tx_enabled = true;
-            initRegion();
-            if (getEffectiveDutyCycle() < 100) {
-                config.lora.ignore_mqtt = true; // Ignore MQTT by default if region has a duty cycle limit
-            }
-
-            if (strncmp(moduleConfig.mqtt.root, default_mqtt_root, strlen(default_mqtt_root)) == 0) {
-                //  Default broker is in use, so subscribe to the appropriate MQTT root topic for this region
-                sprintf(moduleConfig.mqtt.root, "%s/%s", default_mqtt_root, myRegion->name);
-                changes |= SEGMENT_MODULECONFIG;
-            }
-
-            service->reloadConfig(changes);
        });

    bannerOptions.durationMs = duration;
@@ -275,6 +319,38 @@ void menuHandler::LoraRegionPicker(uint32_t duration)
    screen->showOverlayBanner(bannerOptions);
 }

+void menuHandler::hamModeConfirmMenu()
+{
+    static const char *confirmOptions[] = {"No", "Yes"};
+    BannerOverlayOptions confirmBanner;
+    confirmBanner.message = "I confirm I am a\nlicensed amateur\nradio operator";
+    confirmBanner.optionsArrayPtr = confirmOptions;
+    confirmBanner.optionsCount = 2;
+    confirmBanner.bannerCallback = [](int selected) {
+        if (selected == 1)
+            applyLoraRegion(pendingRegion, true);
+    };
+    screen->showOverlayBanner(confirmBanner);
+}
+
+void menuHandler::licensedToNormalConfirmMenu()
+{
+    static const char *confirmOptions[] = {"Keep licensed", "Revert to Normal"};
+    BannerOverlayOptions confirmBanner;
+    confirmBanner.message = "Revert licensed\nmode? This will\nre-enable encryption.";
+    confirmBanner.optionsArrayPtr = confirmOptions;
+    confirmBanner.optionsCount = 2;
+    confirmBanner.bannerCallback = [](int selected) {
+        if (selected == 1) {
+            owner.is_licensed = false;
+            config.lora.override_duty_cycle = false;
+            service->reloadOwner(false);
+        }
+        applyLoraRegion(pendingRegion, false);
+    };
+    screen->showOverlayBanner(confirmBanner);
+}
+
 void menuHandler::deviceRolePicker()
 {
    static const char *optionsArray[] = {"Back", "Client", "Client Mute", "Lost and Found", "Tracker"};
@@ -2818,6 +2894,12 @@ void menuHandler::handleMenuSwitch(OLEDDisplay *display)
    case ThemeMenu:
        themeMenu();
        break;
+    case HamModeConfirm:
+        hamModeConfirmMenu();
+        break;
+    case LicensedToNormalConfirm:
+        licensedToNormalConfirmMenu();
+        break;
    }
    menuQueue = MenuNone;
 }
@@ -55,10 +55,13 @@ class menuHandler
        FrameToggles,
        DisplayUnits,
        MessageBubblesMenu,
-        ThemeMenu
+        ThemeMenu,
+        HamModeConfirm,
+        LicensedToNormalConfirm
    };
    static screenMenus menuQueue;
    static uint32_t pickedNodeNum; // node selected by NodePicker for ManageNodeMenu
+    static meshtastic_Config_LoRaConfig_RegionCode pendingRegion;

    static void OnboardMessage();
    static void LoraRegionPicker(uint32_t duration = 30000);
@@ -111,6 +114,8 @@ class menuHandler
    static void messageBubblesMenu();
    static void themeMenu();
    static void textMessageMenu();
+    static void hamModeConfirmMenu();
+    static void licensedToNormalConfirmMenu();

  private:
    static void saveUIConfig();
@@ -66,6 +66,15 @@ uint32_t pow_of_10(uint32_t n)
    return ret;
 }

+uint64_t pow_of_16(uint32_t n)
+{
+    uint64_t ret = 1;
+    for (uint32_t i = 0; i < n; i++) {
+        ret *= 16ULL;
+    }
+    return ret;
+}
+
 char graphics::NotificationRenderer::alertBannerLines[MAX_LINES + 1][64] = {};
 uint8_t graphics::NotificationRenderer::alertBannerLineCount = 0;
 graphics::NotificationRenderer::BannerFont graphics::NotificationRenderer::alertBannerLineFonts[MAX_LINES + 1] = {};
@@ -251,6 +260,12 @@ void NotificationRenderer::drawBannercallback(OLEDDisplay *display, OLEDDisplayU
        break;
    case notificationTypeEnum::text_banner:
    case notificationTypeEnum::selection_picker:
+    case notificationTypeEnum::pairing_pin:
+        // pairing_pin is rendered the same as text_banner — it's just a
+        // text banner. The split type exists only so the lockdown UI
+        // short-circuit in Screen.cpp can recognise the BLE pair-PIN
+        // banner as the one safe banner to composite over the LOCKED
+        // frame.
        drawAlertBannerOverlay(display, state);
        break;
    case notificationTypeEnum::node_picker:
@@ -259,6 +274,9 @@ void NotificationRenderer::drawBannercallback(OLEDDisplay *display, OLEDDisplayU
    case notificationTypeEnum::number_picker:
        drawNumberPicker(display, state);
        break;
+    case notificationTypeEnum::hex_picker:
+        drawHexPicker(display, state);
+        break;
    }
 }

@@ -345,6 +363,105 @@ void NotificationRenderer::drawNumberPicker(OLEDDisplay *display, OLEDDisplayUiS
    drawNotificationBox(display, state, linePointers, totalLines, 0);
 }

+void NotificationRenderer::drawHexPicker(OLEDDisplay *display, OLEDDisplayUiState *state)
+{
+    const char *lineStarts[MAX_LINES + 1] = {0};
+    uint16_t lineCount = 0;
+
+    // Parse lines
+    char *alertEnd = alertBannerMessage + strnlen(alertBannerMessage, sizeof(alertBannerMessage));
+    lineStarts[lineCount] = alertBannerMessage;
+
+    // Find lines
+    while ((lineCount < MAX_LINES) && (lineStarts[lineCount] < alertEnd)) {
+        lineStarts[lineCount + 1] = std::find((char *)lineStarts[lineCount], alertEnd, '\n');
+        if (lineStarts[lineCount + 1][0] == '\n')
+            lineStarts[lineCount + 1] += 1;
+        lineCount++;
+    }
+    // modulo to extract
+    uint8_t this_digit = (currentNumber % (pow_of_16(numDigits - curSelected))) / (pow_of_16(numDigits - curSelected - 1));
+    // Handle input
+    if (inEvent.inputEvent == INPUT_BROKER_UP || inEvent.inputEvent == INPUT_BROKER_ALT_PRESS ||
+        inEvent.inputEvent == INPUT_BROKER_UP_LONG) {
+        if (this_digit == 15) {
+            currentNumber -= 15 * (pow_of_16(numDigits - curSelected - 1));
+        } else {
+            currentNumber += (pow_of_16(numDigits - curSelected - 1));
+        }
+    } else if (inEvent.inputEvent == INPUT_BROKER_DOWN || inEvent.inputEvent == INPUT_BROKER_USER_PRESS ||
+               inEvent.inputEvent == INPUT_BROKER_DOWN_LONG) {
+        if (this_digit == 0) {
+            currentNumber += 15 * (pow_of_16(numDigits - curSelected - 1));
+        } else {
+            currentNumber -= (pow_of_16(numDigits - curSelected - 1));
+        }
+    } else if (inEvent.inputEvent == INPUT_BROKER_ANYKEY) {
+        if (inEvent.kbchar > 47 && inEvent.kbchar < 58) { // have a digit
+            currentNumber -= this_digit * (pow_of_16(numDigits - curSelected - 1));
+            currentNumber += (inEvent.kbchar - 48) * (pow_of_16(numDigits - curSelected - 1));
+            curSelected++;
+        }
+    } else if (inEvent.inputEvent == INPUT_BROKER_SELECT || inEvent.inputEvent == INPUT_BROKER_RIGHT) {
+        curSelected++;
+    } else if (inEvent.inputEvent == INPUT_BROKER_LEFT) {
+        curSelected--;
+    } else if ((inEvent.inputEvent == INPUT_BROKER_CANCEL || inEvent.inputEvent == INPUT_BROKER_ALT_LONG) &&
+               alertBannerUntil != 0) {
+        resetBanner();
+        return;
+    }
+    if (curSelected == static_cast<int8_t>(numDigits)) {
+        alertBannerCallback(currentNumber);
+        resetBanner();
+        return;
+    }
+
+    inEvent.inputEvent = INPUT_BROKER_NONE;
+    if (alertBannerMessage[0] == '\0')
+        return;
+
+    uint16_t totalLines = lineCount + 2;
+    const char *linePointers[totalLines + 1] = {0}; // this is sort of a dynamic allocation
+
+    // copy the linestarts to display to the linePointers holder
+    for (uint16_t i = 0; i < lineCount; i++) {
+        linePointers[i] = lineStarts[i];
+    }
+    std::string digits = " ";
+    std::string arrowPointer = " ";
+    for (uint16_t i = 0; i < numDigits; i++) {
+        // Modulo minus modulo to return just the current number
+        uint8_t digitValue = (currentNumber % (pow_of_16(numDigits - i))) / (pow_of_16(numDigits - i - 1));
+        if (digitValue < 10) {
+            digits += std::to_string(digitValue) + " ";
+        } else if (digitValue == 10) {
+            digits += "A ";
+        } else if (digitValue == 11) {
+            digits += "B ";
+        } else if (digitValue == 12) {
+            digits += "C ";
+        } else if (digitValue == 13) {
+            digits += "D ";
+        } else if (digitValue == 14) {
+            digits += "E ";
+        } else if (digitValue == 15) {
+            digits += "F ";
+        }
+
+        if (curSelected == i) {
+            arrowPointer += "^ ";
+        } else {
+            arrowPointer += "_ ";
+        }
+    }
+
+    linePointers[lineCount++] = digits.c_str();
+    linePointers[lineCount++] = arrowPointer.c_str();
+
+    drawNotificationBox(display, state, linePointers, totalLines, 0);
+}
+
 void NotificationRenderer::drawNodePicker(OLEDDisplay *display, OLEDDisplayUiState *state)
 {
    static uint32_t selectedNodenum = 0;
@@ -42,6 +42,7 @@ class NotificationRenderer
    static void drawBannercallback(OLEDDisplay *display, OLEDDisplayUiState *state);
    static void drawAlertBannerOverlay(OLEDDisplay *display, OLEDDisplayUiState *state);
    static void drawNumberPicker(OLEDDisplay *display, OLEDDisplayUiState *state);
+    static void drawHexPicker(OLEDDisplay *display, OLEDDisplayUiState *state);
    static void drawNodePicker(OLEDDisplay *display, OLEDDisplayUiState *state);
    static void drawTextInput(OLEDDisplay *display, OLEDDisplayUiState *state);
    static void drawNotificationBox(OLEDDisplay *display, OLEDDisplayUiState *state, const char *lines[MAX_LINES + 1],
@@ -79,10 +79,12 @@ static inline void transformNeedlePoint(float localX, float localY, float sinHea
    outY = static_cast<int16_t>(y);
 }

+#if GRAPHICS_TFT_COLORING_ENABLED
 static float getCompassRingAngleOffset(float heading)
 {
    return (uiconfig.compass_mode != meshtastic_CompassMode_FIXED_RING) ? -heading : 0.0f;
 }
+#endif

 static inline StandardCompassNeedlePoints computeStandardCompassNeedlePoints(int16_t compassX, int16_t compassY,
                                                                             uint16_t compassDiam, float headingRadian,
@@ -1142,11 +1144,16 @@ void UIRenderer::drawDeviceFocused(OLEDDisplay *display, OLEDDisplayUiState *sta
    bool origBold = config.display.heading_bold;
    config.display.heading_bold = false;

-    // Display Region and Channel Utilization
-    if (currentResolution == ScreenResolution::UltraLow) {
-        drawNodes(display, x, getTextPositions(display)[line] + 2, nodeStatus, -1, false, "online");
+    if (!config.lora.tx_enabled) {
+        const char *txdisabled = "Transmit Disabled";
+        display->drawString(x, getTextPositions(display)[line], txdisabled);
    } else {
-        drawNodes(display, x + 1, getTextPositions(display)[line] + 2, nodeStatus, -1, false, "online");
+        // Display Region and Channel Utilization
+        if (currentResolution == ScreenResolution::UltraLow) {
+            drawNodes(display, x, getTextPositions(display)[line] + 2, nodeStatus, -1, false, "online");
+        } else {
+            drawNodes(display, x + 1, getTextPositions(display)[line] + 2, nodeStatus, -1, false, "online");
+        }
    }
    char uptimeStr[32] = "";
    if (currentResolution != ScreenResolution::UltraLow) {
@@ -6,15 +6,12 @@
    FastEPD buffer format: 1bpp, horizontal bytes, MSB = leftmost pixel, 1 = white

    Both formats share the same pixel layout and polarity (1 = white, 0 = black).
-    The InkHUD safe-area buffer (944×523) is copied into the centre of the physical
+    The InkHUD safe-area buffer (928×508) is copied into the centre of the physical
    960×540 FastEPD buffer so content clears the panel's inactive edge border.
    See ED047TC1.h for the H_OFFSET_BYTES / V_OFFSET_TOP / V_OFFSET_BOTTOM constants.

 */

-// Ruler diagnostic — uncomment to draw calibration lines at each physical edge.
-// #define EINK_EDGE_LINES
-
 #ifdef MESHTASTIC_INCLUDE_NICHE_GRAPHICS
 #ifdef T5_S3_EPAPER_PRO

@@ -212,35 +209,6 @@ void ED047TC1::update(uint8_t *imageData, UpdateTypes type)
        memcpy(dstRow, srcRow, srcRowBytes);
    }

-#ifdef EINK_EDGE_LINES
-    // Draw a 1px black box at the exact boundary of the safe area within the
-    // physical buffer. If the margins are correct, all 4 lines should be
-    // fully visible and right at the edge of the usable display area.
-
-    auto setPixelBlack = [&](uint32_t col, uint32_t row) { cur[row * dstRowBytes + col / 8] &= ~(0x80 >> (col % 8)); };
-
-    const uint32_t safeX = H_OFFSET_BYTES * 8;
-    const uint32_t safeY = V_OFFSET_TOP;
-    const uint32_t safeW = DISPLAY_WIDTH;
-    const uint32_t safeH = DISPLAY_HEIGHT;
-
-    // Top edge: horizontal line at safeY
-    for (uint32_t col = safeX; col < safeX + safeW; col++)
-        setPixelBlack(col, safeY);
-
-    // Bottom edge: horizontal line at safeY + safeH - 1
-    for (uint32_t col = safeX; col < safeX + safeW; col++)
-        setPixelBlack(col, safeY + safeH - 1);
-
-    // Left edge: vertical line at safeX
-    for (uint32_t row = safeY; row < safeY + safeH; row++)
-        setPixelBlack(safeX, row);
-
-    // Right edge: vertical line at safeX + safeW - 1
-    for (uint32_t row = safeY; row < safeY + safeH; row++)
-        setPixelBlack(safeX + safeW - 1, row);
-#endif
-
    if (type == FULL) {
        epaper->fullUpdate(CLEAR_SLOW, false);
        epaper->backupPlane(); // Sync pPrevious so next partialUpdate has a correct baseline
@@ -18,9 +18,9 @@
    V_OFFSET_TOP and V_OFFSET_BOTTOM (vertical, pixel rows) to position it.

    Changing these constants shifts content inward from each physical edge:
-        H_OFFSET_BYTES = 1  →  8px left margin, 8px right margin   (960 – 8 – 8   = 944)
-        V_OFFSET_TOP   = 9  →  9px top margin  (asymmetric: top ≠ bottom)
-        V_OFFSET_BOTTOM = 8 →  8px bottom margin                    (540 – 9 – 8   = 523)
+        H_OFFSET_BYTES = 2   →  16px left margin, 16px right margin  (960 – 16 – 16 = 928)
+        V_OFFSET_TOP   = 16  →  16px top margin
+        V_OFFSET_BOTTOM = 16 →  16px bottom margin                   (540 – 16 – 16 = 508)

 */

@@ -61,13 +61,13 @@ class ED047TC1 : public EInk
    //
    // Calibrated by flashing a 1px border box and adjusting until all 4 sides are visible.

-    static constexpr uint16_t DISPLAY_WIDTH = 944;  // 960 − H_OFFSET_BYTES×8 − right_margin (8+8 = 16px)
-    static constexpr uint16_t DISPLAY_HEIGHT = 523; // 540 − V_OFFSET_TOP − V_OFFSET_BOTTOM (9+8 = 17px)
+    static constexpr uint16_t DISPLAY_WIDTH = 928;  // 960 − H_OFFSET_BYTES×8 − right_margin (16+16 = 32px)
+    static constexpr uint16_t DISPLAY_HEIGHT = 508; // 540 − V_OFFSET_TOP − V_OFFSET_BOTTOM (16+16 = 32px)

-    static constexpr uint8_t H_OFFSET_BYTES = 1;  // visual TOP  : 8px physical left margin
-                                                  // visual BOTTOM: 960−8−944=8px physical right margin
-    static constexpr uint8_t V_OFFSET_TOP = 9;    // visual RIGHT : CONFIRMED OK
-    static constexpr uint8_t V_OFFSET_BOTTOM = 8; // visual LEFT  : 8px physical bottom margin
+    static constexpr uint8_t H_OFFSET_BYTES = 2;   // visual TOP  : 16px physical left margin
+                                                   // visual BOTTOM: 960−16−928=16px physical right margin
+    static constexpr uint8_t V_OFFSET_TOP = 16;    // visual RIGHT : 16px physical top margin
+    static constexpr uint8_t V_OFFSET_BOTTOM = 16; // visual LEFT  : 16px physical bottom margin

    static constexpr UpdateTypes supported = static_cast<UpdateTypes>(FULL | FAST);

@@ -66,6 +66,10 @@ enum MenuAction {
    SET_REGION_BR_902,
    SET_REGION_EU_866,
    SET_REGION_NARROW_868,
+    SET_REGION_ITU1_2M,
+    SET_REGION_ITU2_2M,
+    SET_REGION_ITU3_2M,
+    SET_REGION_ITU2_125CM,
    // Device Roles
    SET_ROLE_CLIENT,
    SET_ROLE_CLIENT_MUTE,
@@ -84,6 +88,8 @@ enum MenuAction {
    SET_PRESET_LITE_FAST,
    SET_PRESET_NARROW_SLOW,
    SET_PRESET_NARROW_FAST,
+    SET_PRESET_TINY_SLOW,
+    SET_PRESET_TINY_FAST,
    SET_PRESET_FROM_REGION, // Dynamic: preset chosen from region-available list
    // Timezones
    SET_TZ_US_HAWAII,
@@ -123,6 +129,7 @@ enum MenuAction {
    // Administration
    RESET_NODEDB_ALL,
    RESET_NODEDB_KEEP_FAVORITES,
+    WIPE_MESSAGES_ALL,
 };

 } // namespace NicheGraphics::InkHUD
@@ -6,6 +6,7 @@
 #include "GPS.h"
 #include "MeshRadio.h"
 #include "MeshService.h"
+#include "MessageStore.h"
 #include "RTC.h"
 #include "Router.h"
 #include "airtime.h"
@@ -287,7 +288,7 @@ static void applyLoRaRegion(meshtastic_Config_LoRaConfig_RegionCode region)
    }

    if (strncmp(moduleConfig.mqtt.root, default_mqtt_root, strlen(default_mqtt_root)) == 0) {
-        sprintf(moduleConfig.mqtt.root, "%s/%s", default_mqtt_root, myRegion->name);
+        snprintf(moduleConfig.mqtt.root, sizeof(moduleConfig.mqtt.root), "%s/%s", default_mqtt_root, myRegion->name);
        changes |= SEGMENT_MODULECONFIG;
    }
    // Notify UI that changes are being applied
@@ -784,6 +785,22 @@ void InkHUD::MenuApplet::execute(MenuItem item)
        applyLoRaRegion(meshtastic_Config_LoRaConfig_RegionCode_EU_N_868);
        break;

+    case SET_REGION_ITU1_2M:
+        applyLoRaRegion(meshtastic_Config_LoRaConfig_RegionCode_ITU1_2M);
+        break;
+
+    case SET_REGION_ITU2_2M:
+        applyLoRaRegion(meshtastic_Config_LoRaConfig_RegionCode_ITU2_2M);
+        break;
+
+    case SET_REGION_ITU3_2M:
+        applyLoRaRegion(meshtastic_Config_LoRaConfig_RegionCode_ITU3_2M);
+        break;
+
+    case SET_REGION_ITU2_125CM:
+        applyLoRaRegion(meshtastic_Config_LoRaConfig_RegionCode_ITU2_125CM);
+        break;
+
    // Roles
    case SET_ROLE_CLIENT:
        applyDeviceRole(meshtastic_Config_DeviceConfig_Role_CLIENT);
@@ -834,6 +851,22 @@ void InkHUD::MenuApplet::execute(MenuItem item)
        applyLoRaPreset(PRESET(SHORT_TURBO));
        break;

+    case SET_PRESET_NARROW_SLOW:
+        applyLoRaPreset(PRESET(NARROW_SLOW));
+        break;
+
+    case SET_PRESET_NARROW_FAST:
+        applyLoRaPreset(PRESET(NARROW_FAST));
+        break;
+
+    case SET_PRESET_TINY_SLOW:
+        applyLoRaPreset(PRESET(TINY_SLOW));
+        break;
+
+    case SET_PRESET_TINY_FAST:
+        applyLoRaPreset(PRESET(TINY_FAST));
+        break;
+
    case SET_PRESET_FROM_REGION: {
        // cursor - 1 because index 0 is "Back"
        const uint8_t index = cursor - 1;
@@ -981,6 +1014,13 @@ void InkHUD::MenuApplet::execute(MenuItem item)
        rebootAtMsec = millis() + DEFAULT_REBOOT_SECONDS * 1000;
        break;

+    case WIPE_MESSAGES_ALL:
+        LOG_INFO("Wiping all messages from menu");
+        messageStore.clearAllMessages();
+        inkhud->persistence->loadLatestMessage();
+        inkhud->forceUpdate(Drivers::EInk::UpdateTypes::FULL, true);
+        break;
+
    default:
        LOG_WARN("Action not implemented");
    }
@@ -1098,6 +1138,7 @@ void InkHUD::MenuApplet::showPage(MenuPage page)
        // Administration Section
        items.push_back(MenuItem::Header("Administration"));
        items.push_back(MenuItem("Reset NodeDB", MenuPage::NODE_CONFIG_ADMIN_RESET));
+        items.push_back(MenuItem("Wipe Messages", MenuPage::NODE_CONFIG_ADMIN_MESSAGES));

        // Exit
        items.push_back(MenuItem("Exit", MenuPage::EXIT));
@@ -1469,6 +1510,10 @@ void InkHUD::MenuApplet::showPage(MenuPage page)
        items.push_back(MenuItem("KZ 863", MenuAction::SET_REGION_KZ_863, MenuPage::EXIT));
        items.push_back(MenuItem("NP 865", MenuAction::SET_REGION_NP_865, MenuPage::EXIT));
        items.push_back(MenuItem("BR 902", MenuAction::SET_REGION_BR_902, MenuPage::EXIT));
+        items.push_back(MenuItem("ITU1_2M (144-146)", MenuAction::SET_REGION_ITU1_2M, MenuPage::EXIT));
+        items.push_back(MenuItem("ITU2_2M (144-148)", MenuAction::SET_REGION_ITU2_2M, MenuPage::EXIT));
+        items.push_back(MenuItem("ITU3_2M (144-148)", MenuAction::SET_REGION_ITU3_2M, MenuPage::EXIT));
+        items.push_back(MenuItem("ITU2_125CM (220-225)", MenuAction::SET_REGION_ITU2_125CM, MenuPage::EXIT));
        items.push_back(MenuItem("Exit", MenuPage::EXIT));
        break;

@@ -1498,6 +1543,13 @@ void InkHUD::MenuApplet::showPage(MenuPage page)
        items.push_back(MenuItem("Exit", MenuPage::EXIT));
        break;

+    case NODE_CONFIG_ADMIN_MESSAGES:
+        previousPage = MenuPage::NODE_CONFIG;
+        items.push_back(MenuItem("Back", previousPage));
+        items.push_back(MenuItem("Wipe All Messages", MenuAction::WIPE_MESSAGES_ALL, MenuPage::EXIT));
+        items.push_back(MenuItem("Exit", MenuPage::EXIT));
+        break;
+
    // Exit
    case EXIT:
        sendToBackground(); // Menu applet dismissed, allow normal behavior to resume
@@ -36,6 +36,7 @@ enum MenuPage : uint8_t {
    NODE_CONFIG_BLUETOOTH,
    NODE_CONFIG_POSITION,
    NODE_CONFIG_ADMIN_RESET,
+    NODE_CONFIG_ADMIN_MESSAGES,
    TIMEZONE,
    APPLETS,
    AUTOSHOW,
@@ -22,6 +22,8 @@ void InkHUD::Persistence::loadSettings()
 // are immediately available to applets (DMApplet, AllMessageApplet, NotificationApplet).
 void InkHUD::Persistence::loadLatestMessage()
 {
+    latestMessage = LatestMessage();
+
    int lastBroadcastPos = -1, lastDMPos = -1, pos = 0;
    for (const StoredMessage &m : messageStore.getLiveMessages()) {
        if (m.type == MessageType::BROADCAST) {
@@ -75,4 +77,4 @@ void InkHUD::Persistence::printSettings(Settings *settings)
 }
 */

-#endif
+#endif
@@ -3,6 +3,9 @@
 #include "configuration.h"
 #include "graphics/Screen.h"
 #include "modules/ExternalNotificationModule.h"
+#ifdef MESHTASTIC_LOCKDOWN
+#include "security/LockdownDisplay.h"
+#endif

 #if ARCH_PORTDUINO
 #include "input/LinuxInputImpl.h"
@@ -122,6 +125,22 @@ int InputBroker::handleInputEvent(const InputEvent *event)
    }
 #endif

+#ifdef MESHTASTIC_LOCKDOWN
+    // Lockdown: when the display is redacted (storage locked, or screen-lock
+    // latch set after idle) the screen content is hidden, but local input
+    // would otherwise still flow into UI handlers — letting an operator
+    // drive menus, fire canned messages, change settings etc. blind. Eat
+    // the event here so input is no-op until the redaction clears.
+    // The latch is cleared only by unlockScreen() on a successful
+    // passphrase auth (see PhoneAPI::handleLockdownAuthInline) — local
+    // input does not clear it, even if storage happens to be unlocked.
+    // PowerFSM was already triggered above, so the backlight still wakes
+    // to show the LOCKED frame — the input just doesn't act on anything.
+    if (meshtastic_security::shouldRedactDisplay()) {
+        return 0;
+    }
+#endif
+
    this->notifyObservers(event);
    return 0;
 }
@@ -68,6 +68,19 @@ void nrf54l15Loop();
 NRF54L15Bluetooth *nrf54l15Bluetooth = nullptr;
 #endif

+#ifdef MESHTASTIC_ENABLE_APPROTECT
+#include "security/APProtect.h"
+#endif
+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+#include "security/EncryptedStorage.h"
+#endif
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+#include "mesh/PhoneAPI.h"
+#endif
+#ifdef MESHTASTIC_LOCKDOWN
+#include "security/LockdownDisplay.h"
+#endif
+
 #if HAS_WIFI || defined(USE_WS5500) || defined(USE_CH390D)
 #include "mesh/api/WiFiServerAPI.h"
 #include "mesh/wifi/WiFiAPClient.h"
@@ -379,6 +392,14 @@ void setup()
    consoleInit(); // Set serial baud rate and init our mesh console
 #endif

+    // M23 (audit): APPROTECT engagement moved below fsInit() so we can gate
+    // on EncryptedStorage::isProvisioned(). Engaging on an unprovisioned dev
+    // board permanently locks SWD before the operator has even set a
+    // passphrase — a misconfigured CI build flashed to a developer device
+    // would brick its debug port on first boot. Now we only engage when the
+    // device has a DEK file on flash, i.e. the operator has explicitly
+    // committed to lockdown via passphrase provisioning.
+
 #ifdef UNPHONE
    unphone.printStore();
 #endif
@@ -409,7 +430,12 @@ void setup()
 #endif
 #endif

-#if defined(DEBUG_MUTE) && defined(DEBUG_PORT)
+    // The DEBUG_MUTE "we are muted, FYI" banner spills APP_VERSION / APP_ENV /
+    // APP_REPO out the USB CDC even with logging otherwise suppressed — a free
+    // firmware-fingerprinting primitive for an attacker holding the cable.
+    // Under MESHTASTIC_LOCKDOWN we want the device to look uniformly silent
+    // until the operator authenticates, so skip the banner entirely there.
+#if defined(DEBUG_MUTE) && defined(DEBUG_PORT) && !defined(MESHTASTIC_LOCKDOWN)
    DEBUG_PORT.printf("\r\n\r\n//\\ E S H T /\\ S T / C\r\n");
    DEBUG_PORT.printf("Version %s for %s from %s\r\n", optstr(APP_VERSION), optstr(APP_ENV), optstr(APP_REPO));
    DEBUG_PORT.printf("Debug mute is enabled, there will be no serial output.\r\n");
@@ -481,6 +507,38 @@ void setup()

    fsInit();

+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+    EncryptedStorage::initLocked();
+    if (!EncryptedStorage::isUnlocked()) {
+        if (!EncryptedStorage::isProvisioned()) {
+            LOG_WARN("Lockdown: Device not provisioned — connect and set a passphrase to unlock storage");
+        } else {
+            LOG_WARN("Lockdown: Device locked — connect and provide passphrase to unlock storage");
+        }
+    }
+#endif
+
+#if defined(MESHTASTIC_ENABLE_APPROTECT) && defined(MESHTASTIC_ENCRYPTED_STORAGE)
+    // M23 (audit): only engage the irreversible UICR APPROTECT lockout once
+    // the device has been provisioned with a passphrase. A misconfigured
+    // CI build of a lockdown variant flashed to a developer board would
+    // otherwise burn SWD on first boot before the operator has even set a
+    // passphrase, taking the board out of the dev/recovery workflow with
+    // no real security benefit (there's no DEK to protect yet). Once a
+    // DEK file exists, the operator has committed to lockdown — engaging
+    // APPROTECT then is the protection they asked for.
+    if (EncryptedStorage::isProvisioned()) {
+        enableAPProtect();
+    } else {
+        LOG_INFO("APPROTECT deferred: device not yet provisioned");
+    }
+#elif defined(MESHTASTIC_ENABLE_APPROTECT)
+    // Lockdown without encrypted storage shouldn't be reachable per
+    // configuration.h, but if it ever is, fall back to the unconditional
+    // engagement.
+    enableAPProtect();
+#endif
+
 #if !MESHTASTIC_EXCLUDE_I2C
 #if defined(I2C_SDA1) && defined(ARCH_RP2040)
    Wire1.setSDA(I2C_SDA1);
@@ -1077,6 +1135,11 @@ uint32_t rebootAtMsec;     // If not zero we will reboot at this time (used to r
 uint32_t shutdownAtMsec;   // If not zero we will shutdown at this time (used to shutdown from python or mobile client)
 bool suppressRebootBanner; // If true, suppress "Rebooting..." overlay (used for OTA handoff)

+#if defined(MESHTASTIC_ENCRYPTED_STORAGE) && defined(MESHTASTIC_PHONEAPI_ACCESS_CONTROL)
+volatile bool lockdownReloadPending;  // see main.h — deferred NodeDB reload after lockdown unlock
+volatile bool lockdownDisablePending; // see main.h — deferred decrypt-revert after lockdown disable
+#endif
+
 // If a thread does something that might need for it to be rescheduled ASAP it can set this flag
 // This will suppress the current delay and instead try to run ASAP.
 bool runASAP;
@@ -1128,7 +1191,7 @@ extern meshtastic_DeviceMetadata getDeviceMetadata()
 // No bluetooth on these targets (yet):
 // Pico W / 2W may get it at some point
 // Portduino and ESP32-C6 are excluded because we don't have a working bluetooth stacks integrated yet.
-#if defined(ARCH_RP2040) || defined(ARCH_PORTDUINO) || defined(ARCH_STM32WL) || defined(CONFIG_IDF_TARGET_ESP32C6)
+#if defined(ARCH_RP2040) || defined(ARCH_PORTDUINO) || defined(ARCH_STM32) || defined(CONFIG_IDF_TARGET_ESP32C6)
    deviceMetadata.excluded_modules |= meshtastic_ExcludedModules_BLUETOOTH_CONFIG;
 #endif

@@ -1161,6 +1224,85 @@ void loop()
 {
    runASAP = false;

+#if defined(MESHTASTIC_ENCRYPTED_STORAGE) && defined(MESHTASTIC_PHONEAPI_ACCESS_CONTROL)
+    if (lockdownDisablePending) {
+        lockdownDisablePending = false;
+        LOG_INFO("Lockdown: disabling — reverting encrypted storage to plaintext");
+        if (nodeDB->disableLockdownToPlaintext()) {
+            LOG_INFO("Lockdown: disabled, rebooting into normal mode");
+            PhoneAPI::broadcastLockdownStatus(meshtastic_LockdownStatus_State_DISABLED, "", 0, 0, 0);
+            rebootAtMsec = millis() + DEFAULT_REBOOT_SECONDS * 1000;
+        } else {
+            // Revert failed mid-way (a file couldn't be decrypted/rewritten).
+            // The DEK file is still present (it's deleted last), so the device
+            // stays in lockdown and the operator can retry disable. Surface
+            // the failure rather than leaving the client hanging.
+            LOG_ERROR("Lockdown: disable revert failed — device remains in lockdown");
+            PhoneAPI::broadcastLockdownStatus(meshtastic_LockdownStatus_State_LOCKED, "disable_failed", 0, 0, 0);
+        }
+    }
+
+    if (lockdownReloadPending) {
+        lockdownReloadPending = false;
+        LOG_INFO("Lockdown: reloading config from disk after unlock");
+        bool reloadOk = nodeDB->reloadFromDisk();
+        if (!reloadOk) {
+            // Storage decrypt/decode failed during reload. Treat as
+            // unrecoverable for this boot: lock storage, revoke any
+            // auth that managed to slip through (defense in depth — the
+            // cold-unlock path doesn't authorize until completion, but
+            // a concurrent re-verify-path call from another connection
+            // might have), and notify clients. Storage will be locked
+            // on next boot anyway; deferring to the user-visible
+            // notification path is sufficient for now.
+            LOG_ERROR("Lockdown: reload failed — locking and notifying clients");
+            EncryptedStorage::lockNow();
+            PhoneAPI::revokeAllAuth();
+        }
+        PhoneAPI::completePendingUnlocks(reloadOk);
+    }
+
+    // Periodic session-expiry check. Cheap — millis() comparison. Don't
+    // hammer it every loop tick; once a second is plenty.
+    static uint32_t lastSessionCheckMs = 0;
+    if (millis() - lastSessionCheckMs > 1000) {
+        lastSessionCheckMs = millis();
+        if (rebootAtMsec == 0 && EncryptedStorage::isUnlocked() && EncryptedStorage::isSessionExpired()) {
+            // The session expired. Two paths:
+            //   1. Budget remains (bootsRemaining > 0): decrement the
+            //      on-flash boot count in place, revoke per-connection
+            //      auth, re-engage screen redaction, re-arm the uptime
+            //      timer — all WITHOUT rebooting. Storage stays unlocked
+            //      so the mesh keeps routing. Clients must re-authenticate
+            //      to see content again. The decrement is what enforces
+            //      the rollback ceiling — bootsRemaining ticks down
+            //      monotonically whether the device reboots or not.
+            //   2. Budget exhausted (bootsRemaining == 0): no more
+            //      sessions to grant. Hard lock (token deleted, DEK
+            //      zeroed) and reboot. Operator must re-enter passphrase.
+            if (EncryptedStorage::getBootsRemaining() == 0) {
+                LOG_WARN("Lockdown: session limit reached and boot budget exhausted, locking and rebooting");
+                EncryptedStorage::lockNow();
+                PhoneAPI::revokeAllAuth();
+                PhoneAPI::broadcastLockdownStatus(meshtastic_LockdownStatus_State_LOCKED, "session_budget_exhausted", 0, 0, 0);
+                rebootAtMsec = millis() + DEFAULT_REBOOT_SECONDS * 1000;
+            } else {
+                uint8_t newBoots = EncryptedStorage::consumeSessionBoot();
+                LOG_WARN("Lockdown: session expired, rolled to next budget slot (boots=%u remaining)", newBoots);
+                PhoneAPI::revokeAllAuth();
+                meshtastic_security::lockScreen();
+                // Signal clients that they need to re-auth on this
+                // connection. Storage is still unlocked (DEK in RAM,
+                // mesh keeps routing) but per-connection auth is gone.
+                // Reusing the LOCKED(needs_auth) post-config emission
+                // pattern so existing clients don't need a new state.
+                PhoneAPI::broadcastLockdownStatus(meshtastic_LockdownStatus_State_LOCKED, "needs_auth", newBoots,
+                                                  EncryptedStorage::getValidUntilEpoch(), 0);
+            }
+        }
+    }
+#endif
+
 #ifdef ARCH_ESP32
    esp32Loop();
 #endif
@@ -92,6 +92,19 @@ extern uint32_t rebootAtMsec;
 extern uint32_t shutdownAtMsec;
 extern bool suppressRebootBanner;

+#if defined(MESHTASTIC_ENCRYPTED_STORAGE) && defined(MESHTASTIC_PHONEAPI_ACCESS_CONTROL)
+// Set by PhoneAPI::handleLockdownAuthInline after a successful unlock.
+// Serviced on the main loop thread because NodeDB::reloadFromDisk() is
+// too heavy for the BLE/serial transport callback stack.
+extern volatile bool lockdownReloadPending;
+
+// Set by PhoneAPI::handleLockdownAuthInline on a disable request (after the
+// passphrase is verified). Serviced on the main loop thread: decrypt every
+// pref back to plaintext, remove the lockdown artifacts, reboot. Heavy file
+// IO, same reason as lockdownReloadPending.
+extern volatile bool lockdownDisablePending;
+#endif
+
 extern uint32_t serialSinceMsec;

 // If a thread does something that might need for it to be rescheduled ASAP it can set this flag
@@ -14,7 +14,7 @@
 #include <malloc.h>
 #include <unistd.h> // sbrk

-#ifdef ARCH_STM32WL
+#if defined(ARCH_STM32)
 // Returns the uncommitted sbrk headroom: addressable space between the current heap
 // break and the stack pointer that has not yet been committed to the arena.
 static uint32_t sbrkHeadroom()
@@ -404,6 +404,42 @@ bool Channels::isDefaultChannel(ChannelIndex chIndex)
    return false;
 }

+bool cryptoKeyIsPublic(const CryptoKey &key)
+{
+    if (key.length == 0)
+        return true; // encryption disabled
+    // Match the defaultpsk family ignoring its last byte (getKey() bumps only that byte per 1-byte index).
+    if (key.length == (int)sizeof(defaultpsk) && memcmp(key.bytes, defaultpsk, sizeof(defaultpsk) - 1) == 0)
+        return true;
+    return false;
+}
+
+bool Channels::usesPublicKey(ChannelIndex chIndex)
+{
+    const meshtastic_Channel &ch = getByIndex(chIndex);
+    if (!ch.has_settings || ch.role == meshtastic_Channel_Role_DISABLED)
+        return false;
+
+    const auto &psk = ch.settings.psk;
+    if (psk.size == 0) {
+        // Secondary channels inherit the primary key when unset; primary size==0 means encryption disabled.
+        if (ch.role == meshtastic_Channel_Role_SECONDARY) {
+            // Guard against malformed configs with no PRIMARY channel (primaryIndex could point back to us).
+            if (primaryIndex == chIndex)
+                return true; // fail closed: treat as public
+            return usesPublicKey(primaryIndex);
+        }
+        return true;
+    }
+
+    if (psk.size == 1) {
+        // Short PSK aliases: 0 disables encryption; 1..255 are the public defaultpsk family.
+        return true;
+    }
+
+    return (psk.size == sizeof(defaultpsk) && memcmp(psk.bytes, defaultpsk, sizeof(defaultpsk) - 1) == 0);
+}
+
 bool Channels::hasDefaultChannel()
 {
    // If we don't use a preset or the default frequency slot, or we override the frequency, we don't have a default channel
@@ -86,6 +86,9 @@ class Channels
    // Returns true if the channel has the default name and PSK
    bool isDefaultChannel(ChannelIndex chIndex);

+    // Returns true if this channel's effective key is publicly decryptable (open or well-known/default PSK).
+    bool usesPublicKey(ChannelIndex chIndex);
+
    // Returns true if we can be reached via a channel with the default settings given a region and modem preset
    bool hasDefaultChannel();

@@ -144,6 +147,9 @@ extern Channels channels;
 static const uint8_t defaultpsk[] = {0xd4, 0xf1, 0xbb, 0x3a, 0x20, 0x29, 0x07, 0x59,
                                     0xf0, 0xbc, 0xff, 0xab, 0xcf, 0x4e, 0x69, 0x01};

+/// True if a getKey()-resolved key offers no privacy: length 0 (off) or the public defaultpsk family. Pure; for tests.
+bool cryptoKeyIsPublic(const CryptoKey &key);
+
 static const uint8_t eventpsk[] = {0x38, 0x4b, 0xbc, 0xc0, 0x1d, 0xc0, 0x22, 0xd1, 0x81, 0xbf, 0x36,
                                   0xb8, 0x61, 0x21, 0xe1, 0xfb, 0x96, 0xb7, 0x2e, 0x55, 0xbf, 0x74,
                                   0x22, 0x7e, 0x9d, 0x6a, 0xfb, 0x48, 0xd6, 0x4c, 0xb1, 0xa1};
@@ -12,10 +12,18 @@
 #include <Curve25519.h>
 #include <RNG.h>
 #include <SHA256.h>
-#if !(MESHTASTIC_EXCLUDE_PKI_KEYGEN)
-#if !defined(ARCH_STM32WL)
-#define CryptRNG RNG
+
+#if !(MESHTASTIC_EXCLUDE_XEDDSA)
+#include "XEdDSA.h"
+#include <Ed25519.h>
+
+#ifndef NUM_LIMBS_256BIT
+#define NUM_LIMBS_BITS(n) (((n) + sizeof(limb_t) * 8 - 1) / (8 * sizeof(limb_t)))
+#define NUM_LIMBS_256BIT NUM_LIMBS_BITS(256)
 #endif
+#endif
+
+#if !(MESHTASTIC_EXCLUDE_PKI_KEYGEN)

 /**
 * Create a public/private key pair with Curve25519.
@@ -46,6 +54,9 @@ void CryptoEngine::generateKeyPair(uint8_t *pubKey, uint8_t *privKey)
    Curve25519::dh1(public_key, private_key);
    memcpy(pubKey, public_key, sizeof(public_key));
    memcpy(privKey, private_key, sizeof(private_key));
+#if !(MESHTASTIC_EXCLUDE_XEDDSA)
+    XEdDSA::priv_curve_to_ed_keys(private_key, xeddsa_private_key, xeddsa_public_key);
+#endif
 }

 /**
@@ -65,6 +76,9 @@ bool CryptoEngine::regeneratePublicKey(uint8_t *pubKey, uint8_t *privKey)
        }
        memcpy(private_key, privKey, sizeof(private_key));
        memcpy(public_key, pubKey, sizeof(public_key));
+#if !(MESHTASTIC_EXCLUDE_XEDDSA)
+        XEdDSA::priv_curve_to_ed_keys(private_key, xeddsa_private_key, xeddsa_public_key);
+#endif
    } else {
        LOG_WARN("X25519 key generation failed due to blank private key");
        return false;
@@ -72,6 +86,97 @@ bool CryptoEngine::regeneratePublicKey(uint8_t *pubKey, uint8_t *privKey)
    return true;
 }

+#if !(MESHTASTIC_EXCLUDE_XEDDSA)
+/**
+ * Build a signing buffer that covers packet metadata and payload:
+ *   [fromNode(4) | packetId(4) | portnum(4) | payload(N)]
+ * This prevents replay, reattribution, and portnum redirection attacks.
+ */
+static size_t buildSigningBuffer(uint8_t *buf, size_t bufSize, uint32_t fromNode, uint32_t packetId, uint32_t portnum,
+                                 const uint8_t *payload, size_t payloadLen)
+{
+    const size_t headerLen = sizeof(uint32_t) * 3;
+    size_t totalLen = headerLen + payloadLen;
+    if (totalLen > bufSize)
+        return 0;
+    // May need endian conversion for oddball platforms.
+    memcpy(buf, &fromNode, sizeof(uint32_t));
+    memcpy(buf + sizeof(uint32_t), &packetId, sizeof(uint32_t));
+    memcpy(buf + sizeof(uint32_t) * 2, &portnum, sizeof(uint32_t));
+    memcpy(buf + headerLen, payload, payloadLen);
+    return totalLen;
+}
+
+bool CryptoEngine::xeddsa_sign(uint32_t fromNode, uint32_t packetId, uint32_t portnum, const uint8_t *payload, size_t payloadLen,
+                               uint8_t *signature)
+{
+    if (memfll(xeddsa_private_key, 0, sizeof(xeddsa_private_key)))
+        return false;
+    uint8_t sigBuf[MAX_BLOCKSIZE];
+    size_t sigLen = buildSigningBuffer(sigBuf, sizeof(sigBuf), fromNode, packetId, portnum, payload, payloadLen);
+    if (sigLen == 0)
+        return false;
+    // the XEdDSA::sign function requires at least the first 32 bytes of signature to be pre-filled with randomness
+    HardwareRNG::fill(signature, 32);
+    XEdDSA::sign(signature, xeddsa_private_key, xeddsa_public_key, sigBuf, sigLen);
+    return true;
+}
+
+bool CryptoEngine::xeddsa_verify(const uint8_t *pubKey, uint32_t fromNode, uint32_t packetId, uint32_t portnum,
+                                 const uint8_t *payload, size_t payloadLen, const uint8_t *signature)
+{
+    // Use cached Ed25519 key if the Curve25519 key matches, avoiding expensive field inversion
+    if (memcmp(pubKey, cached_curve_pubkey, 32) != 0) {
+        curve_to_ed_pub(pubKey, cached_ed_pubkey);
+        memcpy(cached_curve_pubkey, pubKey, 32);
+    }
+    uint8_t sigBuf[MAX_BLOCKSIZE];
+    size_t sigLen = buildSigningBuffer(sigBuf, sizeof(sigBuf), fromNode, packetId, portnum, payload, payloadLen);
+    if (sigLen == 0)
+        return false;
+    return XEdDSA::verify(signature, cached_ed_pubkey, sigBuf, sigLen);
+}
+
+void CryptoEngine::curve_to_ed_pub(const uint8_t *curve_pubkey, uint8_t *ed_pubkey)
+{
+
+    // Apply the birational map defined in RFC 7748, section 4.1 "Curve25519" to calculate an Ed25519 public
+    // key from a Curve25519 public key. Because the serialization format of Curve25519 public keys only
+    // contains the u coordinate, the x coordinate of the corresponding Ed25519 public key can't be uniquely
+    // calculated as defined by the birational map. The x coordinate is represented in the serialization
+    // format of Ed25519 public keys only in a single sign bit. XEdDSA always normalizes the Ed25519 public
+    // key to a sign bit of zero (the signer negates its key pair when needed), so this function clears the
+    // sign bit unconditionally below instead of taking it as an input.
+    fe u, y;
+    fe one;
+    fe u_minus_one, u_plus_one, u_plus_one_inv;
+
+    // Parse the Curve25519 public key input as a field element containing the u coordinate. RFC 7748,
+    // section 5 "The X25519 and X448 Functions", mandates that the most significant bit of the Curve25519
+    // public key has to be zeroized. This is handled by fe_frombytes internally.
+    fe_frombytes(u, curve_pubkey);
+
+    // Calculate the parameters (u - 1) and (u + 1)
+    fe_1(one);
+    fe_sub(u_minus_one, u, one);
+    fe_add(u_plus_one, u, one);
+
+    // Invert u + 1
+    fe_invert(u_plus_one_inv, u_plus_one);
+
+    // Calculate y = (u - 1) * inv(u + 1) (mod p)
+    fe_mul(y, u_minus_one, u_plus_one_inv);
+
+    // Serialize the field element containing the y coordinate to the Ed25519 public key output
+    fe_tobytes(ed_pubkey, y);
+
+    // Set the sign bit to zero
+    ed_pubkey[31] &= 0x7f;
+
+    // need to convert the pubkey y = ( u - 1) * inv( u + 1) (mod p).
+}
+#endif
+
 bool CryptoEngine::ensurePkiKeys(meshtastic_Config_SecurityConfig &security, meshtastic_User &user)
 {
    if (user.is_licensed) {
@@ -23,6 +23,7 @@ struct CryptoKey {

 #define MAX_BLOCKSIZE 256
 #define TEST_CURVE25519_FIELD_OPS // Exposes Curve25519::isWeakPoint() for testing keys
+#define XEDDSA_SIGNATURE_SIZE 64

 class CryptoEngine
 {
@@ -37,7 +38,12 @@ class CryptoEngine
    virtual void generateKeyPair(uint8_t *pubKey, uint8_t *privKey);
    virtual bool regeneratePublicKey(uint8_t *pubKey, uint8_t *privKey);
    virtual bool ensurePkiKeys(meshtastic_Config_SecurityConfig &security, meshtastic_User &user);
-
+#endif
+#if !(MESHTASTIC_EXCLUDE_XEDDSA)
+    bool xeddsa_sign(uint32_t fromNode, uint32_t packetId, uint32_t portnum, const uint8_t *payload, size_t payloadLen,
+                     uint8_t *signature);
+    bool xeddsa_verify(const uint8_t *pubKey, uint32_t fromNode, uint32_t packetId, uint32_t portnum, const uint8_t *payload,
+                       size_t payloadLen, const uint8_t *signature);
 #endif
    void setDHPrivateKey(uint8_t *_private_key);
    // The remotePublic key parameter takes the public_key bytes container from
@@ -85,6 +91,14 @@ class CryptoEngine
 #if !(MESHTASTIC_EXCLUDE_PKI)
    uint8_t shared_key[32] = {0};
    uint8_t private_key[32] = {0};
+#if !(MESHTASTIC_EXCLUDE_XEDDSA)
+    uint8_t xeddsa_public_key[32] = {0};
+    uint8_t xeddsa_private_key[32] = {0};
+    void curve_to_ed_pub(const uint8_t *curve_pubkey, uint8_t *ed_pubkey);
+    // Single-entry cache for curve_to_ed_pub conversion (avoids expensive field inversion per packet)
+    uint8_t cached_curve_pubkey[32] = {0};
+    uint8_t cached_ed_pubkey[32] = {0};
+#endif
 #endif
    /**
     * Init our 128 bit nonce for a new packet
@@ -37,6 +37,12 @@ enum class TrafficType { POSITION, TELEMETRY };
 #define default_traffic_mgmt_position_precision_bits 24               // ~10m grid cells
 #define default_traffic_mgmt_position_min_interval_secs (ONE_DAY / 2) // 12 hours between identical positions

+// Hop scaling defaults
+#define default_hop_scaling_min_target_nodes 40          // walk threshold: first hop reaching this cumulative count
+#define default_hop_scaling_max_target_nodes 80          // generous extension ceiling (2 × min)
+#define default_hop_scaling_min_target_nodes_floor 5     // minimum allowed min_target_nodes
+#define default_hop_scaling_max_target_nodes_ceiling 512 // maximum allowed max_target_nodes
+
 #ifdef USERPREFS_RINGTONE_NAG_SECS
 #define default_ringtone_nag_secs USERPREFS_RINGTONE_NAG_SECS
 #else
@@ -2,11 +2,58 @@
 #include "LoRaFEMInterface.h"

 #if defined(ARCH_ESP32)
+#include <driver/gpio.h>
 #include <driver/rtc_io.h>
 #include <esp_sleep.h>
 #endif

 LoRaFEMInterface loraFEMInterface;
+
+static void enableFEMPower()
+{
+    bool wasOff = digitalRead(LORA_PA_POWER) != HIGH;
+    digitalWrite(LORA_PA_POWER, HIGH);
+    if (wasOff) {
+        delay(5); // This is an arbitrary 5ms for FEM rail power-up.
+    }
+}
+
+#if defined(ARCH_ESP32)
+static void releasePinHold(int pin)
+{
+    if (pin < 0) {
+        return;
+    }
+
+    gpio_num_t gpio = (gpio_num_t)pin;
+
+#if SOC_RTCIO_HOLD_SUPPORTED
+    if (rtc_gpio_is_valid_gpio(gpio)) {
+        rtc_gpio_hold_dis(gpio);
+        return;
+    }
+#endif
+    if (GPIO_IS_VALID_OUTPUT_GPIO(gpio)) {
+        gpio_hold_dis(gpio);
+    }
+}
+
+static void releaseSleepHolds()
+{
+    releasePinHold(LORA_PA_POWER);
+#ifdef HELTEC_V4
+    releasePinHold(LORA_KCT8103L_PA_CSD);
+    releasePinHold(LORA_KCT8103L_PA_CTX);
+#elif defined(USE_GC1109_PA)
+    releasePinHold(LORA_GC1109_PA_EN);
+    releasePinHold(LORA_GC1109_PA_TX_EN);
+#elif defined(USE_KCT8103L_PA)
+    releasePinHold(LORA_KCT8103L_PA_CSD);
+    releasePinHold(LORA_KCT8103L_PA_CTX);
+#endif
+}
+#endif
+
 void LoRaFEMInterface::init(void)
 {
    setLnaCanControl(false); // Default is uncontrollable
@@ -21,6 +68,7 @@ void LoRaFEMInterface::init(void)
    if (digitalRead(LORA_KCT8103L_PA_CSD) == HIGH) {
        // FEM is KCT8103L
        fem_type = KCT8103L_PA;
+        LOG_INFO("Detected KCT8103L LoRa FEM");
        rtc_gpio_hold_dis((gpio_num_t)LORA_KCT8103L_PA_CTX);
        pinMode(LORA_KCT8103L_PA_CSD, OUTPUT);
        digitalWrite(LORA_KCT8103L_PA_CSD, HIGH);
@@ -30,6 +78,7 @@ void LoRaFEMInterface::init(void)
    } else if (digitalRead(LORA_KCT8103L_PA_CSD) == LOW) {
        // FEM is GC1109
        fem_type = GC1109_PA;
+        LOG_INFO("Detected GC1109 LoRa FEM");
        // LORA_GC1109_PA_EN and LORA_KCT8103L_PA_CSD are the same pin and do not need to be repeatedly turned off and held.
        //  rtc_gpio_hold_dis((gpio_num_t)LORA_GC1109_PA_EN);
        pinMode(LORA_GC1109_PA_EN, OUTPUT);
@@ -41,6 +90,7 @@ void LoRaFEMInterface::init(void)
    }
 #elif defined(USE_GC1109_PA)
    fem_type = GC1109_PA;
+    LOG_INFO("Using GC1109 LoRa FEM");
    pinMode(LORA_PA_POWER, OUTPUT);
    digitalWrite(LORA_PA_POWER, HIGH);
 #if defined(ARCH_ESP32)
@@ -55,6 +105,7 @@ void LoRaFEMInterface::init(void)
    digitalWrite(LORA_GC1109_PA_TX_EN, LOW);
 #elif defined(USE_KCT8103L_PA)
    fem_type = KCT8103L_PA;
+    LOG_INFO("Using KCT8103L LoRa FEM");
    pinMode(LORA_PA_POWER, OUTPUT);
    digitalWrite(LORA_PA_POWER, HIGH);
 #if defined(ARCH_ESP32)
@@ -73,6 +124,10 @@ void LoRaFEMInterface::init(void)

 void LoRaFEMInterface::setSleepModeEnable(void)
 {
+#if defined(ARCH_ESP32)
+    releaseSleepHolds();
+#endif
+
 #ifdef HELTEC_V4
    if (fem_type == GC1109_PA) {
        /*
@@ -84,6 +139,7 @@ void LoRaFEMInterface::setSleepModeEnable(void)
    } else if (fem_type == KCT8103L_PA) {
        // shutdown the PA
        digitalWrite(LORA_KCT8103L_PA_CSD, LOW);
+        digitalWrite(LORA_PA_POWER, LOW);
    }
 #elif defined(USE_GC1109_PA)
    digitalWrite(LORA_GC1109_PA_EN, LOW);
@@ -91,16 +147,22 @@ void LoRaFEMInterface::setSleepModeEnable(void)
 #elif defined(USE_KCT8103L_PA)
    // shutdown the PA
    digitalWrite(LORA_KCT8103L_PA_CSD, LOW);
+    digitalWrite(LORA_PA_POWER, LOW);
 #endif
 }

 void LoRaFEMInterface::setTxModeEnable(void)
 {
+#if defined(ARCH_ESP32)
+    releaseSleepHolds();
+#endif
+
 #ifdef HELTEC_V4
    if (fem_type == GC1109_PA) {
        digitalWrite(LORA_GC1109_PA_EN, HIGH);    // CSD=1: Chip enabled
        digitalWrite(LORA_GC1109_PA_TX_EN, HIGH); // CPS: 1=full PA, 0=bypass (for RX, CPS is don't care)
    } else if (fem_type == KCT8103L_PA) {
+        enableFEMPower();
        digitalWrite(LORA_KCT8103L_PA_CSD, HIGH);
        digitalWrite(LORA_KCT8103L_PA_CTX, HIGH);
    }
@@ -108,6 +170,7 @@ void LoRaFEMInterface::setTxModeEnable(void)
    digitalWrite(LORA_GC1109_PA_EN, HIGH);    // CSD=1: Chip enabled
    digitalWrite(LORA_GC1109_PA_TX_EN, HIGH); // CPS: 1=full PA, 0=bypass (for RX, CPS is don't care)
 #elif defined(USE_KCT8103L_PA)
+    enableFEMPower();
    digitalWrite(LORA_KCT8103L_PA_CSD, HIGH);
    digitalWrite(LORA_KCT8103L_PA_CTX, HIGH);
 #endif
@@ -115,11 +178,16 @@ void LoRaFEMInterface::setTxModeEnable(void)

 void LoRaFEMInterface::setRxModeEnable(void)
 {
+#if defined(ARCH_ESP32)
+    releaseSleepHolds();
+#endif
+
 #ifdef HELTEC_V4
    if (fem_type == GC1109_PA) {
        digitalWrite(LORA_GC1109_PA_EN, HIGH); // CSD=1: Chip enabled
        digitalWrite(LORA_GC1109_PA_TX_EN, LOW);
    } else if (fem_type == KCT8103L_PA) {
+        enableFEMPower();
        digitalWrite(LORA_KCT8103L_PA_CSD, HIGH);
        if (lna_enabled) {
            digitalWrite(LORA_KCT8103L_PA_CTX, LOW);
@@ -131,6 +199,7 @@ void LoRaFEMInterface::setRxModeEnable(void)
    digitalWrite(LORA_GC1109_PA_EN, HIGH);    // CSD=1: Chip enabled
    digitalWrite(LORA_GC1109_PA_TX_EN, LOW);
 #elif defined(USE_KCT8103L_PA)
+    enableFEMPower();
    digitalWrite(LORA_KCT8103L_PA_CSD, HIGH);
    if (lna_enabled) {
        digitalWrite(LORA_KCT8103L_PA_CTX, LOW);
@@ -142,12 +211,14 @@ void LoRaFEMInterface::setRxModeEnable(void)

 void LoRaFEMInterface::setRxModeEnableWhenMCUSleep(void)
 {
+#if defined(ARCH_ESP32)
+    releaseSleepHolds();
+#endif

 #ifdef HELTEC_V4
-    // Keep GC1109 FEM powered during deep sleep so LNA remains active for RX wake.
-    // Set PA_POWER and PA_EN HIGH (overrides SX126xInterface::sleep() shutdown),
-    // then latch with RTC hold so the state survives deep sleep.
-    digitalWrite(LORA_PA_POWER, HIGH);
+    // Keep FEM rail powered during deep sleep so LoRa RX wake can work (GC1109 keeps LNA active; KCT8103L uses RX bypass).
+    // Set PA_POWER HIGH (overrides SX126xInterface::sleep() shutdown), then latch with RTC hold so the state survives deep sleep.
+    enableFEMPower();
    rtc_gpio_hold_en((gpio_num_t)LORA_PA_POWER);
    if (fem_type == GC1109_PA) {
        digitalWrite(LORA_GC1109_PA_EN, HIGH);
@@ -156,15 +227,11 @@ void LoRaFEMInterface::setRxModeEnableWhenMCUSleep(void)
    } else if (fem_type == KCT8103L_PA) {
        digitalWrite(LORA_KCT8103L_PA_CSD, HIGH);
        rtc_gpio_hold_en((gpio_num_t)LORA_KCT8103L_PA_CSD);
-        if (lna_enabled) {
-            digitalWrite(LORA_KCT8103L_PA_CTX, LOW);
-        } else {
-            digitalWrite(LORA_KCT8103L_PA_CTX, HIGH);
-        }
+        digitalWrite(LORA_KCT8103L_PA_CTX, HIGH); // RX bypass while MCU sleeps
        rtc_gpio_hold_en((gpio_num_t)LORA_KCT8103L_PA_CTX);
    }
 #elif defined(USE_GC1109_PA)
-    digitalWrite(LORA_PA_POWER, HIGH);
+    enableFEMPower();
    digitalWrite(LORA_GC1109_PA_EN, HIGH);
 #if defined(ARCH_ESP32)
    rtc_gpio_hold_en((gpio_num_t)LORA_PA_POWER);
@@ -172,13 +239,11 @@ void LoRaFEMInterface::setRxModeEnableWhenMCUSleep(void)
    gpio_pulldown_en((gpio_num_t)LORA_GC1109_PA_TX_EN);
 #endif
 #elif defined(USE_KCT8103L_PA)
+    enableFEMPower();
    digitalWrite(LORA_KCT8103L_PA_CSD, HIGH);
-    if (lna_enabled) {
-        digitalWrite(LORA_KCT8103L_PA_CTX, LOW);
-    } else {
-        digitalWrite(LORA_KCT8103L_PA_CTX, HIGH);
-    }
+    digitalWrite(LORA_KCT8103L_PA_CTX, HIGH); // RX bypass while MCU sleeps
 #if defined(ARCH_ESP32)
+    rtc_gpio_hold_en((gpio_num_t)LORA_PA_POWER);
    rtc_gpio_hold_en((gpio_num_t)LORA_KCT8103L_PA_CSD);
    rtc_gpio_hold_en((gpio_num_t)LORA_KCT8103L_PA_CTX);
 #endif
@@ -227,4 +292,4 @@ int8_t LoRaFEMInterface::powerConversion(int8_t loraOutputPower)
    return loraOutputPower;
 }

-#endif
+#endif
@@ -44,7 +44,8 @@ extern const RegionProfile PROFILE_EU868;
 extern const RegionProfile PROFILE_UNDEF;
 extern const RegionProfile PROFILE_LITE;
 extern const RegionProfile PROFILE_NARROW;
-// extern const RegionProfile  PROFILE_HAM;
+extern const RegionProfile PROFILE_HAM_20KHZ;
+extern const RegionProfile PROFILE_HAM_100KHZ;

 // Map from old region names to new region enums
 struct RegionInfo {
@@ -64,6 +65,14 @@ struct RegionInfo {
    // Preset accessors (delegate through profile)
    meshtastic_Config_LoRaConfig_ModemPreset getDefaultPreset() const { return defaultPreset; }
    const meshtastic_Config_LoRaConfig_ModemPreset *getAvailablePresets() const { return profile->presets; }
+    bool supportsPreset(meshtastic_Config_LoRaConfig_ModemPreset preset) const
+    {
+        for (size_t i = 0; profile->presets[i] != MODEM_PRESET_END; i++) {
+            if (profile->presets[i] == preset)
+                return true;
+        }
+        return false;
+    }
    size_t getNumPresets() const
    {
        size_t n = 0;
@@ -77,6 +86,7 @@ extern const RegionInfo regions[];
 extern const RegionInfo *myRegion;

 extern void initRegion();
+extern const RegionInfo *getRegion(meshtastic_Config_LoRaConfig_RegionCode code);

 // Valid LoRa spread factor range and defaults
 constexpr uint8_t LORA_SF_MIN = 5;
@@ -123,8 +133,18 @@ static inline float clampBandwidthKHz(float bwKHz)

 static inline float bwCodeToKHz(uint16_t bwCode)
 {
+    if (bwCode == 8)
+        return 7.8f;
+    if (bwCode == 10)
+        return 10.4f;
+    if (bwCode == 16)
+        return 15.6f;
+    if (bwCode == 21)
+        return 20.8f;
    if (bwCode == 31)
        return 31.25f;
+    if (bwCode == 42)
+        return 41.7f;
    if (bwCode == 62)
        return 62.5f;
    if (bwCode == 200)
@@ -140,8 +160,18 @@ static inline float bwCodeToKHz(uint16_t bwCode)

 static inline uint16_t bwKHzToCode(float bwKHz)
 {
+    if (bwKHz > 7.7f && bwKHz < 7.9f)
+        return 8;
+    if (bwKHz > 10.3f && bwKHz < 10.5f)
+        return 10;
+    if (bwKHz > 15.5f && bwKHz < 15.7f)
+        return 16;
+    if (bwKHz > 20.7f && bwKHz < 20.9f)
+        return 21;
    if (bwKHz > 31.24f && bwKHz < 31.26f)
        return 31;
+    if (bwKHz > 41.6f && bwKHz < 41.8f)
+        return 42;
    if (bwKHz > 62.49f && bwKHz < 62.51f)
        return 62;
    if (bwKHz > 203.12f && bwKHz < 203.13f)
@@ -219,6 +249,16 @@ static inline void modemPresetToParams(meshtastic_Config_LoRaConfig_ModemPreset
        cr = 6;
        sf = 8;
        break;
+    case PRESET(TINY_FAST):
+        bwKHz = 15.6f;
+        cr = 5;
+        sf = 7;
+        break;
+    case PRESET(TINY_SLOW):
+        bwKHz = 15.6f;
+        cr = 6;
+        sf = 8;
+        break;
    default: // LONG_FAST (or illegal)
        bwKHz = wideLora ? 812.5f : 250.0f;
        cr = 5;
@@ -141,6 +141,12 @@ class MeshService
    /// Release the next ClientNotification packet to pool.
    void releaseClientNotificationToPool(meshtastic_ClientNotification *p) { clientNotificationPool.release(p); }

+    /// Bump fromNum to signal connected clients to poll for new FromRadio data.
+    /// Used by code paths (e.g. lockdown status queueing) that surface a new
+    /// FromRadio variant without going through one of the existing pool-backed
+    /// senders.
+    void nudgeFromNum() { fromNum++; }
+
    /**
     *  Given a ToRadio buffer parse it and properly handle it (setup radio, owner or send packet into the mesh)
     * Called by PhoneAPI.handleToRadio.  Note: p is a scratch buffer, this function is allowed to write to it but it can not keep
@@ -25,6 +25,9 @@
 #include "mesh/generated/meshtastic/deviceonly_legacy.pb.h"
 #include "meshUtils.h"
 #include "modules/NeighborInfoModule.h"
+#if HAS_VARIABLE_HOPS
+#include "modules/HopScalingModule.h"
+#endif
 #include "xmodem.h"
 #include <ErriezCRC32.h>
 #include <algorithm>
@@ -33,6 +36,11 @@
 #include <power/PowerHAL.h>
 #include <vector>

+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+#include "security/EncryptedStorage.h"
+#include "security/SecureZero.h"
+#endif
+
 #ifdef ARCH_ESP32
 #if HAS_WIFI
 #include "mesh/wifi/WiFiAPClient.h"
@@ -362,6 +370,15 @@ extern void getMacAddr(uint8_t *dmac);
 * we use !macaddr (no colons).
 */
 meshtastic_User &owner = devicestate.owner;
+
+// The slim NodeInfoLite header defines the local long_name cap; the wire-facing
+// meshtastic_User stays wider so names from senders built against the older
+// 39-byte limit still decode (nanopb halts on string overflow).
+static_assert(MAX_LONG_NAME_BYTES + 1 == sizeof(meshtastic_NodeInfoLite::long_name),
+              "MAX_LONG_NAME_BYTES must match the NodeInfoLite storage width");
+static_assert(sizeof(meshtastic_User::long_name) > MAX_LONG_NAME_BYTES,
+              "wire User.long_name must be wider than the local cap so clampLongName stays in bounds");
+
 meshtastic_Position localPosition = meshtastic_Position_init_default;
 meshtastic_CriticalErrorCode error_code =
    meshtastic_CriticalErrorCode_NONE; // For the error code, only show values from this boot (discard value from flash)
@@ -431,8 +448,6 @@ NodeDB::NodeDB()

    // likewise - we always want the app requirements to come from the running appload
    myNodeInfo.min_app_version = 30200; // format is Mmmss (where M is 1+the numeric major number. i.e. 30200 means 2.2.00
-    // Note! We do this after loading saved settings, so that if somehow an invalid nodenum was stored in preferences we won't
-    // keep using that nodenum forever. Crummy guess at our nodenum (but we will check against the nodedb to avoid conflicts)
    pickNewNodeNum();

    // Set our board type so we can share it with others
@@ -452,31 +467,18 @@ NodeDB::NodeDB()
    }

 #if !(MESHTASTIC_EXCLUDE_PKI_KEYGEN || MESHTASTIC_EXCLUDE_PKI)
-
-    if (!owner.is_licensed && config.lora.region != meshtastic_Config_LoRaConfig_RegionCode_UNSET) {
-        bool keygenSuccess = false;
-        keyIsLowEntropy = checkLowEntropyPublicKey(config.security.public_key);
-        if (config.security.private_key.size == 32 && !keyIsLowEntropy) {
-            if (crypto->regeneratePublicKey(config.security.public_key.bytes, config.security.private_key.bytes)) {
-                keygenSuccess = true;
-            }
-        } else {
-            crypto->generateKeyPair(config.security.public_key.bytes, config.security.private_key.bytes);
-            keygenSuccess = true;
-        }
-        if (keygenSuccess) {
-            config.security.public_key.size = 32;
-            config.security.private_key.size = 32;
-            owner.public_key.size = 32;
-            memcpy(owner.public_key.bytes, config.security.public_key.bytes, 32);
-        }
-    }
+    // Generate crypto keys if needed using consolidated function
+    // Set my node num uint32 value to bytes from the public key (if we have one)
+    // Generate identity and crypto keys if needed; this will create a new identity if one does not exist
+    generateCryptoKeyPair(nullptr);
 #elif !(MESHTASTIC_EXCLUDE_PKI)
    // Calculate Curve25519 public and private keys
    if (config.security.private_key.size == 32 && config.security.public_key.size == 32) {
        owner.public_key.size = config.security.public_key.size;
        memcpy(owner.public_key.bytes, config.security.public_key.bytes, config.security.public_key.size);
        crypto->setDHPrivateKey(config.security.private_key.bytes);
+        // Set my node num uint32 value to bytes from the new public key
+        myNodeInfo.my_node_num = crc32Buffer(config.security.public_key.bytes, config.security.public_key.size);
    }
 #endif
    // Include our owner in the node db under our nodenum
@@ -896,6 +898,7 @@ void NodeDB::installDefaultConfig(bool preserveKey = false)
        config.security.private_key.size = 0;
    }
    config.security.public_key.size = 0;
+
 #ifdef PIN_GPS_EN
    config.position.gps_en_gpio = PIN_GPS_EN;
 #endif
@@ -1511,6 +1514,7 @@ void NodeDB::installDefaultDeviceState()
 #else
    snprintf(owner.long_name, sizeof(owner.long_name), "Meshtastic %04x", getNodeNum() & 0x0ffff);
 #endif
+    clampLongName(owner.long_name); // vendor userprefs may exceed the local cap
 #ifdef USERPREFS_CONFIG_OWNER_SHORT_NAME
    snprintf(owner.short_name, sizeof(owner.short_name), (const char *)USERPREFS_CONFIG_OWNER_SHORT_NAME);
 #else
@@ -1565,6 +1569,41 @@ LoadFileResult NodeDB::loadProto(const char *filename, size_t protoSize, size_t
                                 void *dest_struct)
 {
    LoadFileResult state = LoadFileResult::OTHER_FAILURE;
+
+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+    // check if the file is encrypted and decrypt before protobuf decode
+    if (EncryptedStorage::isEncrypted(filename)) {
+        // ZeroizingArrayPtr wipes the decrypted plaintext (which contains config
+        // secrets — channel PSKs, security private_key, etc.) before delete[],
+        // so it isn't recoverable from the heap after this function returns.
+        auto decBuf = meshtastic_security::make_zeroizing_array(protoSize);
+        if (!decBuf) {
+            LOG_ERROR("OOM decrypting %s", filename);
+            return LoadFileResult::OTHER_FAILURE;
+        }
+        size_t decLen = 0;
+        if (EncryptedStorage::readAndDecrypt(filename, decBuf.get(), protoSize, decLen)) {
+            LOG_INFO("Load encrypted %s", filename);
+            pb_istream_t stream = pb_istream_from_buffer(decBuf.get(), decLen);
+            if (fields != &meshtastic_NodeDatabase_msg)
+                memset(dest_struct, 0, objSize);
+            if (!pb_decode(&stream, fields, dest_struct)) {
+                LOG_ERROR("Error: can't decode protobuf %s", PB_GET_ERROR(&stream));
+                state = LoadFileResult::DECODE_FAILED;
+                storageCorruptThisLoad = true;
+            } else {
+                LOG_INFO("Loaded encrypted %s successfully", filename);
+                state = LoadFileResult::LOAD_SUCCESS;
+            }
+        } else {
+            LOG_ERROR("Decrypt failed for %s, treating as corrupt", filename);
+            state = LoadFileResult::DECODE_FAILED;
+            storageCorruptThisLoad = true;
+        }
+        return state;
+    }
+#endif
+
 #ifdef FSCom
    concurrency::LockGuard g(spiLock);

@@ -1599,6 +1638,13 @@ void NodeDB::loadFromDisk()
    // Mark the current device state as completely unusable, so that if we fail reading the entire file from
    // disk we will still factoryReset to restore things.
    devicestate.version = 0;
+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+    // Reset the per-load decrypt-failure tracker. Set by loadProto on any
+    // encrypted file that fails to decrypt or proto-decode; consumed by
+    // reloadFromDisk to surface storage corruption to the operator instead
+    // of silently falling back to defaults.
+    storageCorruptThisLoad = false;
+#endif

    meshtastic_Config_SecurityConfig backupSecurity = meshtastic_Config_SecurityConfig_init_zero;

@@ -1642,6 +1688,39 @@ void NodeDB::loadFromDisk()
    }

 #endif
+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+    // Only take the locked-boot defaults path when lockdown is ACTIVE (the
+    // device is provisioned) AND storage is still locked. A lockdown-capable
+    // build that has never been provisioned — or that was disabled — falls
+    // through to the normal plaintext load below and behaves like stock.
+    if (EncryptedStorage::isLockdownActive() && !EncryptedStorage::isUnlocked()) {
+        // Encrypted storage is locked. Install defaults and wait for the
+        // passphrase over BLE/serial; PhoneAPI::handleLockdownAuthInline
+        // calls reloadFromDisk() once the storage is unlocked.
+        LOG_WARN("NodeDB: Encrypted storage locked, using default config until unlocked");
+        installDefaultNodeDatabase();
+        installDefaultDeviceState();
+        installDefaultConfig();
+        installDefaultModuleConfig();
+        installDefaultChannels();
+
+        // Hold the radio silent until the operator unlocks. installDefaultConfig
+        // would otherwise honour USERPREFS_CONFIG_LORA_REGION (the common shape
+        // for managed deployments) and the LongFast default channel synthesised
+        // by installDefaultChannels, so the device would beacon nodeinfo /
+        // telemetry on the public default PSK before any unlock — and process
+        // incoming default-channel packets the same way. Forcing region=UNSET
+        // gates both TX and RX in RadioLibInterface (see the region==UNSET
+        // checks in startSend and readData); tx_enabled=false is belt-and-
+        // suspenders for any code path that does not consult region directly.
+        // reloadFromDisk() restores the persisted lora config when the
+        // operator unlocks.
+        config.lora.region = meshtastic_Config_LoRaConfig_RegionCode_UNSET;
+        config.lora.tx_enabled = false;
+        return;
+    }
+#endif
+
    // Arm the direct-into-map decode so satellite entries skip the temp vectors.
    {
        concurrency::LockGuard guard(&satelliteMutex);
@@ -1724,8 +1803,9 @@ void NodeDB::loadFromDisk()
        if (nodeInfoLiteHasUser(us)) {
            LOG_WARN("Restoring owner fields (long_name/short_name/is_licensed/is_unmessagable) from NodeDB for our node 0x%08x",
                     us->num);
-            memcpy(owner.long_name, us->long_name, sizeof(owner.long_name));
-            owner.long_name[sizeof(owner.long_name) - 1] = '\0';
+            // owner.long_name (40) is wider than the lite source (25); bound by the source
+            memcpy(owner.long_name, us->long_name, sizeof(us->long_name));
+            owner.long_name[sizeof(us->long_name) - 1] = '\0';
            memcpy(owner.short_name, us->short_name, sizeof(owner.short_name));
            owner.short_name[sizeof(owner.short_name) - 1] = '\0';
            owner.is_licensed = nodeInfoLiteIsLicensed(us);
@@ -1739,6 +1819,10 @@ void NodeDB::loadFromDisk()
        LOG_INFO("Loaded saved devicestate version %d", devicestate.version);
    }

+    // Devicestate saved by firmware that allowed 39-byte names gets clamped on
+    // first load; from here on owner never carries more than the local cap.
+    clampLongName(owner.long_name);
+
    state = loadProto(configFileName, meshtastic_LocalConfig_size, sizeof(meshtastic_LocalConfig), &meshtastic_LocalConfig_msg,
                      &config);
    if (state != LoadFileResult::LOAD_SUCCESS) {
@@ -1873,6 +1957,40 @@ void NodeDB::loadFromDisk()
        LOG_INFO("Loaded UIConfig");
    }

+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+    // Ensure all config segments are persisted to encrypted storage.
+    // installDefaultConfig/installDefaultModuleConfig only set in-memory structs
+    // without saving to disk, so we force a save here to ensure encrypted files exist.
+    //
+    // Only when lockdown is ACTIVE. A capable-but-off device must leave its
+    // files as plaintext — encryptAndWrite would fail anyway (no DEK), but
+    // skipping the whole block avoids the wasted attempts and error logs.
+    if (EncryptedStorage::isLockdownActive()) {
+        const char *filesToCheck[] = {configFileName, moduleConfigFileName, channelFileName, deviceStateFileName,
+                                      nodeDatabaseFileName};
+        const int segments[] = {SEGMENT_CONFIG, SEGMENT_MODULECONFIG, SEGMENT_CHANNELS, SEGMENT_DEVICESTATE,
+                                SEGMENT_NODEDATABASE};
+        int toSave = 0;
+        for (int i = 0; i < 5; i++) {
+            if (!EncryptedStorage::isEncrypted(filesToCheck[i])) {
+                toSave |= segments[i];
+            }
+        }
+        if (toSave) {
+            LOG_INFO("Lockdown: Saving unencrypted segments to encrypted storage (mask=0x%x)", toSave);
+            saveToDisk(toSave);
+        }
+
+        // Migrate any remaining plaintext proto files (from standard firmware upgrade)
+        for (const char *fn : filesToCheck) {
+            if (!EncryptedStorage::isEncrypted(fn)) {
+                LOG_INFO("Migrating %s to encrypted storage", fn);
+                EncryptedStorage::migrateFile(fn);
+            }
+        }
+    }
+#endif
+
    // 2.4.X - configuration migration to update new default intervals
    if (moduleConfig.version < 23) {
        LOG_DEBUG("ModuleConfig version %d is stale, upgrading to new default intervals", moduleConfig.version);
@@ -1910,6 +2028,87 @@ void NodeDB::loadFromDisk()
 #endif
 }

+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+// Serializes reloadFromDisk against itself. Other readers of config /
+// channelFile / nodeDatabase don't take this lock today, so this only
+// prevents reload-vs-reload races (e.g. fast successive unlocks). It is
+// not a full data-race fix for those structs — that would require
+// thread-shared locking discipline across the whole codebase, beyond
+// the audit's M7 scope. The radio standby+reconfigure below keeps the
+// radio out of the window where SX12xx registers are mid-swap.
+static concurrency::Lock g_reloadFromDiskMutex;
+
+/**
+ * Re-run loadFromDisk() after encrypted storage is unlocked at runtime.
+ * Holds the radio in standby across the file IO + proto decode so the
+ * SX12xx is not mid-RX/TX when config.lora is overwritten, then calls
+ * reconfigure() to push the now-real settings to the chip.
+ *
+ * Returns true iff every encrypted file decrypted and decoded cleanly.
+ * On false the caller MUST treat storage as corrupt — see header.
+ */
+bool NodeDB::reloadFromDisk()
+{
+    concurrency::LockGuard guard(&g_reloadFromDiskMutex);
+    LOG_INFO("NodeDB: Reloading config from encrypted storage after unlock");
+
+    RadioInterface *rIface = router ? router->getRadioIface() : nullptr;
+
+    // Park the radio while config.lora / channelFile swap. Without this,
+    // a concurrent send or receive can read half-old / half-new state
+    // (channel keys, region, modem preset) and the SX12xx ends up in
+    // an inconsistent register set that only a reboot recovers from.
+    if (rIface)
+        rIface->sleep();
+
+    loadFromDisk();
+
+    if (storageCorruptThisLoad) {
+        LOG_ERROR("NodeDB: storage decrypt/decode failed during reload — surfacing as corrupt");
+        // Leave the radio sleeping. Caller will lock storage and emit
+        // a LOCKED(storage_corrupt) status; we must not reconfigure
+        // the chip with the locked-default placeholder values still
+        // sitting in config.lora.
+        return false;
+    }
+
+    // Push the now-real config to the radio.
+    if (rIface) {
+        channels.onConfigChanged();
+        rIface->reconfigure();
+    }
+    return true;
+}
+
+bool NodeDB::disableLockdownToPlaintext()
+{
+    concurrency::LockGuard guard(&g_reloadFromDiskMutex);
+    if (!EncryptedStorage::isUnlocked()) {
+        LOG_ERROR("NodeDB: disable requested but storage not unlocked");
+        return false;
+    }
+    LOG_INFO("NodeDB: reverting encrypted prefs to plaintext for lockdown disable");
+
+    // Decrypt each encrypted pref back to plaintext IN PLACE. Mirror of the
+    // plaintext->encrypted migrate loop above. Order does not matter here;
+    // EncryptedStorage::removeLockdownArtifacts() (which deletes the DEK,
+    // the commit point) only runs after every file is confirmed plaintext.
+    const char *filesToCheck[] = {configFileName, moduleConfigFileName, channelFileName, deviceStateFileName,
+                                  nodeDatabaseFileName};
+    for (const char *fn : filesToCheck) {
+        if (!EncryptedStorage::migrateFileToPlaintext(fn)) {
+            LOG_ERROR("NodeDB: failed to revert %s to plaintext; aborting disable (device stays in lockdown)", fn);
+            return false;
+        }
+    }
+
+    // All files are plaintext now — remove the lockdown artifacts. Deleting
+    // /prefs/.dek is the atomic commit: after it, isLockdownActive() is false.
+    EncryptedStorage::removeLockdownArtifacts();
+    return true;
+}
+#endif
+
 /** Save a protobuf from a file, return true for success */
 bool NodeDB::saveProto(const char *filename, size_t protoSize, const pb_msgdesc_t *fields, const void *dest_struct,
                       bool fullAtomic)
@@ -1922,6 +2121,38 @@ bool NodeDB::saveProto(const char *filename, size_t protoSize, const pb_msgdesc_
        return false;
    }

+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+    // Encrypt all files except uiconfig (no secrets) and the DEK file (self-encrypted).
+    // Only when lockdown is ACTIVE (provisioned). A lockdown-capable but DISABLED
+    // device has no DEK, so encryptAndWrite would fail and config would never
+    // persist — it must save plaintext exactly like stock firmware. Once enabled,
+    // the reloadFromDisk migrate pass re-saves these plaintext files encrypted.
+    if (EncryptedStorage::isLockdownActive() && strcmp(filename, uiconfigFileName) != 0) {
+        // ZeroizingArrayPtr wipes the unencrypted protobuf encoding (which contains
+        // config secrets — channel PSKs, security private_key, etc.) before delete[],
+        // so plaintext copies aren't left in heap memory after encryption completes.
+        auto pbBuf = meshtastic_security::make_zeroizing_array(protoSize);
+        if (!pbBuf) {
+            LOG_ERROR("OOM encoding %s for encryption", filename);
+            return false;
+        }
+
+        pb_ostream_t stream = pb_ostream_from_buffer(pbBuf.get(), protoSize);
+        if (!pb_encode(&stream, fields, dest_struct)) {
+            LOG_ERROR("Error: can't encode protobuf %s", PB_GET_ERROR(&stream));
+            return false;
+        }
+
+        size_t encodedSize = stream.bytes_written;
+        bool ok = EncryptedStorage::encryptAndWrite(filename, pbBuf.get(), encodedSize, fullAtomic);
+
+        if (!ok) {
+            LOG_ERROR("EncryptedStorage: Failed to encrypt and write %s", filename);
+        }
+        return ok;
+    }
+#endif
+
    bool okay = false;
 #ifdef FSCom
    auto f = SafeFile(filename, fullAtomic);
@@ -1986,6 +2217,14 @@ bool NodeDB::saveDeviceStateToDisk()

 bool NodeDB::saveNodeDatabaseToDisk()
 {
+    // Don't persist the node DB until this device has a PKI keypair
+    // TODO: revisit when https://github.com/meshtastic/firmware/pull/10478 lands
+#if !(MESHTASTIC_EXCLUDE_PKI_KEYGEN || MESHTASTIC_EXCLUDE_PKI)
+    if (owner.public_key.size != 32 && !owner.is_licensed) {
+        LOG_DEBUG("Skip NodeDB without key");
+        return true;
+    }
+#endif

    // do not try to save anything if power level is not safe. In many cases flash will be lock-protected
    // and all writes will fail anyway. Device should be sleeping at this point anyway.
@@ -2089,6 +2328,22 @@ bool NodeDB::saveToDiskNoRetry(int saveWhat)
        return false;
    }

+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+    // When lockdown is ACTIVE but storage is still locked, encryptAndWrite()
+    // returns false for every file. That would cause saveToDisk()'s nRF52 retry
+    // path to call FSCom.format(), wiping all encrypted proto files from flash.
+    // Return true here — "nothing to save, not an error."
+    //
+    // Gate on isLockdownActive(): a lockdown-capable but DISABLED device (never
+    // provisioned) also has isUnlocked()==false, but it must persist plaintext
+    // normally — skipping here would silently drop every config write (e.g. the
+    // LoRa region) until the device is provisioned.
+    if (EncryptedStorage::isLockdownActive() && !EncryptedStorage::isUnlocked()) {
+        LOG_WARN("NodeDB: saveToDisk skipped — encrypted storage locked");
+        return true;
+    }
+#endif
+
    bool success = true;
 #ifdef FSCom
    spiLock->lock();
@@ -2538,6 +2793,14 @@ void NodeDB::updateFrom(const meshtastic_MeshPacket &mp)
        nodeInfoLiteSetBit(info, NODEINFO_BITFIELD_VIA_MQTT_MASK,
                           mp.via_mqtt); // Store if we received this packet via MQTT

+#if HAS_VARIABLE_HOPS
+        // Only sample packets that arrived over LoRa.
+        if (mp.transport_mechanism == meshtastic_MeshPacket_TransportMechanism_TRANSPORT_LORA && hopScalingModule) {
+            uint8_t hopCount = std::max(int8_t(0), getHopsAway(mp));
+            hopScalingModule->samplePacketForHistogram(mp.from, hopCount);
+        }
+#endif
+
        // If hopStart was set and there wasn't someone messing with the limit in the middle, add hopsAway
        const int8_t hopsAway = getHopsAway(mp);
        if (hopsAway >= 0) {
@@ -2781,6 +3044,99 @@ bool NodeDB::checkLowEntropyPublicKey(const meshtastic_Config_SecurityConfig_pub
 }
 #endif

+bool NodeDB::generateCryptoKeyPair(const uint8_t *privateKey)
+{
+#if !(MESHTASTIC_EXCLUDE_PKI_KEYGEN || MESHTASTIC_EXCLUDE_PKI)
+    // Only generate keys for non-licensed users and if LoRa region is set
+    if (owner.is_licensed || config.lora.region == meshtastic_Config_LoRaConfig_RegionCode_UNSET) {
+        return false;
+    }
+
+    bool keygenSuccess = false;
+    // Record whether the stored key is a known compromised/low-entropy key so main.cpp can warn the
+    // user. A detected low-entropy key is regenerated below, but the flag stays set so the
+    // "Compromised keys were detected and regenerated" notification still fires.
+    keyIsLowEntropy = checkLowEntropyPublicKey(config.security.public_key);
+
+    // If a specific private key was provided, use it
+    if (privateKey != nullptr) {
+        LOG_INFO("Using provided private key for PKI");
+        memcpy(config.security.private_key.bytes, privateKey, 32);
+        config.security.private_key.size = 32;
+        config.security.public_key.size = 32;
+
+        // Generate public key from the provided private key
+        if (crypto->regeneratePublicKey(config.security.public_key.bytes, config.security.private_key.bytes)) {
+            keygenSuccess = true;
+        } else {
+            LOG_ERROR("Failed to generate public key from provided private key");
+            return false;
+        }
+    }
+    // Try to regenerate public key from existing private key if it's valid and not low entropy
+    else if (config.security.private_key.size == 32 && !keyIsLowEntropy) {
+        config.security.public_key.size = 32;
+        LOG_DEBUG("Regenerate PKI public key from existing private key");
+        if (crypto->regeneratePublicKey(config.security.public_key.bytes, config.security.private_key.bytes)) {
+            keygenSuccess = true;
+        }
+    } else {
+        // Generate a new key pair
+        LOG_INFO("Generate new PKI keys");
+        config.security.public_key.size = 32;
+        config.security.private_key.size = 32;
+        crypto->generateKeyPair(config.security.public_key.bytes, config.security.private_key.bytes);
+        keygenSuccess = true;
+    }
+
+    // Update sizes and copy to owner if successful
+    if (keygenSuccess) {
+        owner.public_key.size = 32;
+        memcpy(owner.public_key.bytes, config.security.public_key.bytes, 32);
+
+        // Set the DH private key for crypto operations
+        LOG_DEBUG("Set DH private key for crypto operations");
+        crypto->setDHPrivateKey(config.security.private_key.bytes);
+
+        // Conditionally create new identity based on parameter
+        createNewIdentity();
+    }
+    return keygenSuccess;
+#else
+    return false;
+#endif
+}
+
+bool NodeDB::createNewIdentity()
+{
+    uint32_t oldNodeNum = getNodeNum();
+    uint32_t newNodeNum = crc32Buffer(config.security.public_key.bytes, config.security.public_key.size);
+
+    // If the key hasn't changed, nothing to do
+    if (newNodeNum == oldNodeNum)
+        return false;
+
+    // Retire the old node entry
+    meshtastic_NodeInfoLite *node = getMeshNode(oldNodeNum);
+    if (node != NULL) {
+        LOG_DEBUG("Old node num %u is now %u", oldNodeNum, newNodeNum);
+        nodeInfoLiteSetBit(node, NODEINFO_BITFIELD_IS_IGNORED_MASK, true);
+        node->public_key.size = 0;
+        memset(node->public_key.bytes, 0, sizeof(node->public_key.bytes));
+    }
+
+    // Drop satellite-store entries (position/telemetry/environment/status) keyed by the retired
+    // node number so stale data isn't left attached to the old identity.
+    eraseNodeSatellites(oldNodeNum);
+
+    myNodeInfo.my_node_num = newNodeNum;
+
+    meshtastic_NodeInfoLite *info = getOrCreateMeshNode(getNodeNum());
+    TypeConversions::CopyUserToNodeInfoLite(info, owner);
+
+    return true;
+}
+
 bool NodeDB::backupPreferences(meshtastic_AdminMessage_BackupLocation location)
 {
    bool success = false;
@@ -376,6 +376,12 @@ class NodeDB
    bool checkLowEntropyPublicKey(const meshtastic_Config_SecurityConfig_public_key_t &keyToTest);
 #endif

+    /// Consolidate crypto key generation logic used across multiple modules
+    /// @param privateKey Optional 32-byte private key to use. If nullptr, generates new random keys.
+    bool generateCryptoKeyPair(const uint8_t *privateKey = nullptr);
+
+    bool createNewIdentity();
+
    bool backupPreferences(meshtastic_AdminMessage_BackupLocation location);
    bool restorePreferences(meshtastic_AdminMessage_BackupLocation location,
                            int restoreWhat = SEGMENT_CONFIG | SEGMENT_MODULECONFIG | SEGMENT_DEVICESTATE | SEGMENT_CHANNELS);
@@ -388,6 +394,38 @@ class NodeDB
        newStatus.notifyObservers(&status);
    }

+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+    /// Re-run loadFromDisk() after the encrypted storage is unlocked at runtime.
+    /// Trigger: PhoneAPI::handleLockdownAuthInline sets lockdownReloadPending
+    /// on a successful provisionPassphrase / unlockWithPassphrase; the main
+    /// loop in main.cpp services the flag and calls this method on the main
+    /// thread. The transport callback stack (BLE/USB) is too small for the
+    /// file IO + MAX_NUM_NODES vector reserve + proto decode this triggers.
+    ///
+    /// Returns true iff every encrypted file decrypted and decoded cleanly.
+    /// On false the caller MUST treat the storage as corrupt: leave the
+    /// connection unauthenticated, emit a LOCKED(storage_corrupt) status,
+    /// and refuse to call setAdminAuthorized — otherwise a subsequent
+    /// set_config would re-encrypt a wrong baseline (the locked-default
+    /// values still resident in `config` / `channelFile` / `nodeDatabase`)
+    /// and overwrite the operator's persisted state.
+    bool reloadFromDisk();
+
+    /// Disable lockdown: decrypt every encrypted pref file back to plaintext,
+    /// then remove the DEK / token / counter / backoff artifacts. Requires
+    /// EncryptedStorage to be unlocked (DEK in RAM). Returns false if any
+    /// file failed to revert — in which case the DEK is still present and the
+    /// device remains in lockdown so the operator can retry. APPROTECT is not
+    /// reversed. Called from the main loop via lockdownDisablePending.
+    bool disableLockdownToPlaintext();
+
+    /// Set by loadProto when any encrypted file fails to decrypt or decode.
+    /// Tracked across an entire loadFromDisk pass so reloadFromDisk can
+    /// surface the condition without callers re-walking each loadProto
+    /// result. Cleared at the top of every loadFromDisk run.
+    bool storageCorruptThisLoad = false;
+#endif
+
  private:
    mutable concurrency::Lock satelliteMutex;
    bool duplicateWarned = false;
@@ -487,7 +525,9 @@ extern uint32_t error_address;
 #define NODEINFO_BITFIELD_IS_UNMESSAGABLE_MASK (1u << NODEINFO_BITFIELD_IS_UNMESSAGABLE_SHIFT)
 #define NODEINFO_BITFIELD_HAS_IS_UNMESSAGABLE_SHIFT 8
 #define NODEINFO_BITFIELD_HAS_IS_UNMESSAGABLE_MASK (1u << NODEINFO_BITFIELD_HAS_IS_UNMESSAGABLE_SHIFT)
-// Bits 9..31 reserved for future single-bit flags.
+#define NODEINFO_BITFIELD_HAS_XEDDSA_SIGNED_SHIFT 9
+#define NODEINFO_BITFIELD_HAS_XEDDSA_SIGNED_MASK (1u << NODEINFO_BITFIELD_HAS_XEDDSA_SIGNED_SHIFT)
+// Bits 10..31 reserved for future single-bit flags.

 // Convenience accessors so call sites read like the old struct fields.
 inline bool nodeInfoLiteHasUser(const meshtastic_NodeInfoLite *n)
@@ -526,6 +566,10 @@ inline bool nodeInfoLiteIsKeyManuallyVerified(const meshtastic_NodeInfoLite *n)
 {
    return n && (n->bitfield & NODEINFO_BITFIELD_IS_KEY_MANUALLY_VERIFIED_MASK);
 }
+inline bool nodeInfoLiteHasXeddsaSigned(const meshtastic_NodeInfoLite *n)
+{
+    return n && (n->bitfield & NODEINFO_BITFIELD_HAS_XEDDSA_SIGNED_MASK);
+}

 inline void nodeInfoLiteSetBit(meshtastic_NodeInfoLite *n, uint32_t mask, bool value)
 {
@@ -3,6 +3,12 @@
 #include "GPS.h"
 #endif

+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+#include "security/EncryptedStorage.h"
+#endif
+#ifdef MESHTASTIC_LOCKDOWN
+#include "security/LockdownDisplay.h"
+#endif
 #include "Channels.h"
 #include "Default.h"
 #include "FSCommon.h"
@@ -36,6 +42,194 @@
 // Flag to indicate a heartbeat was received and we should send queue status
 bool heartbeatReceived = false;

+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+// Auth-slot table and status-slot table are both sized to the typical
+// SerialConsole + BluetoothPhoneAPI footprint plus room for WiFi/TCP
+// transports. Sized together so both tables are keyed identically.
+static constexpr size_t MAX_AUTH_SLOTS = 6;
+
+// Per-PhoneAPI pending LockdownStatus. One slot per connection so a
+// status produced for connection A (e.g. UNLOCKED with the active TTL,
+// or UNLOCK_FAILED with a backoff) cannot be drained by connection B,
+// which would otherwise learn that A just authenticated or just failed
+// — a real information leak across local clients.
+//
+// File-scope rather than a per-PhoneAPI member because adding any
+// non-trivial state directly to PhoneAPI broke USB-CDC enumeration on
+// the current nRF52 framework; the auth-slot table next door uses the
+// same workaround. Lifecycle is tied to the auth slot table — both are
+// keyed by PhoneAPI*, both are cleared together in clearAuthSlot_LH,
+// and both share g_authSlotsMutex.
+struct PendingStatusSlot {
+    PhoneAPI *who = nullptr;
+    meshtastic_LockdownStatus status = {};
+    bool hasPending = false;
+    // True between a successful passphrase verify and the main-loop
+    // reloadFromDisk that follows. While set, the connection is NOT
+    // yet authorized and no UNLOCKED status has been emitted — the
+    // client still sees LOCKED, and any admin op it tries is dropped
+    // by the existing unauth gates. Cleared either way by
+    // completePendingUnlocks once reload finishes.
+    bool pendingUnlockAfterReload = false;
+};
+static PendingStatusSlot g_statusSlots[MAX_AUTH_SLOTS];
+
+// Lock-held helpers ---------------------------------------------------------
+
+static PendingStatusSlot *findOrAllocStatusSlot_LH(PhoneAPI *p)
+{
+    if (!p)
+        return nullptr;
+    for (auto &s : g_statusSlots)
+        if (s.who == p)
+            return &s;
+    for (auto &s : g_statusSlots) {
+        if (s.who == nullptr) {
+            s.who = p;
+            s.hasPending = false;
+            s.pendingUnlockAfterReload = false;
+            memset(&s.status, 0, sizeof(s.status));
+            return &s;
+        }
+    }
+    // Mirror the auth-slot eviction policy: stale slots can be reused.
+    // A connection that lost its auth slot has nothing meaningful to be
+    // told via a pending status anyway. Never evict a slot mid-unlock
+    // (pendingUnlockAfterReload set) — completing that flow on the
+    // wrong PhoneAPI would authorize the wrong connection.
+    for (auto &s : g_statusSlots) {
+        if (!s.hasPending && !s.pendingUnlockAfterReload) {
+            s.who = p;
+            memset(&s.status, 0, sizeof(s.status));
+            return &s;
+        }
+    }
+    return nullptr;
+}
+
+static void clearStatusSlot_LH(const PhoneAPI *p)
+{
+    if (!p)
+        return;
+    for (auto &s : g_statusSlots) {
+        if (s.who == p) {
+            s.who = nullptr;
+            s.hasPending = false;
+            s.pendingUnlockAfterReload = false;
+            memset(&s.status, 0, sizeof(s.status));
+            return;
+        }
+    }
+}
+
+// Build a LockdownStatus message under lock from the supplied fields,
+// applying the audit's M13 redaction so token_* tamper-detection
+// strings are not leaked to unauth clients over the wire.
+static void buildStatus_LH(meshtastic_LockdownStatus &out, meshtastic_LockdownStatus_State state, const char *lock_reason,
+                           uint8_t boots_remaining, uint32_t valid_until_epoch, uint32_t backoff_seconds)
+{
+    memset(&out, 0, sizeof(out));
+    out.state = state;
+    // Collapse the specific token_* reasons to a generic "locked" over
+    // the wire — full detail still goes to local logs. An unauth client
+    // does not need to know whether HMAC failed vs the boot count
+    // hit zero vs the file was the wrong size; all of those mean the
+    // same thing to the client ("locked, ask for passphrase") but
+    // telling them apart over the network lets an attacker confirm
+    // that their tampering or rollback attempt was noticed.
+    const char *wireReason = lock_reason;
+    if (state == meshtastic_LockdownStatus_State_LOCKED && wireReason && wireReason[0] != '\0') {
+        if (strncmp(wireReason, "token_", 6) == 0)
+            wireReason = "locked";
+    }
+    if (wireReason && wireReason[0] != '\0')
+        strncpy(out.lock_reason, wireReason, sizeof(out.lock_reason) - 1);
+    out.boots_remaining = boots_remaining;
+    out.valid_until_epoch = valid_until_epoch;
+    out.backoff_seconds = backoff_seconds;
+}
+
+// Per-connection auth state table keyed by PhoneAPI*. Searched linearly;
+// cost is negligible compared to the redaction gates that call it.
+struct PhoneAuthSlot {
+    PhoneAPI *who = nullptr;
+    bool authorized = false;
+    uint32_t epoch = 0;
+};
+static PhoneAuthSlot g_authSlots[MAX_AUTH_SLOTS];
+
+// Global auth epoch. Lock Now bumps it; per-slot `epoch` compared against
+// this. Wraps at 2^32 revocations — practically unreachable; on wrap the
+// only behavioral effect is that any slot whose epoch happens to match the
+// new low value would be treated as authorized again, which requires a
+// pre-existing authorized slot to survive 2^32 lockNow events on the same
+// boot.
+static uint32_t g_authEpoch = 1;
+
+// Single mutex guarding g_authSlots and g_authEpoch. All readers and
+// writers — including const getters like getAdminAuthorized — must take
+// it. Granularity is fine because the critical sections are short (a
+// fixed-size linear scan over 6 entries) and contention is dominated by
+// getFromRadio's per-call redaction checks, which tolerate brief
+// blocking.
+static concurrency::Lock g_authSlotsMutex;
+
+// Find or allocate the auth slot for `p`. Caller must hold g_authSlotsMutex.
+// When the table is full of *unauthorized* slots from prior dead PhoneAPIs,
+// evicts the first unauthorized slot found. Refuses to evict an authorized
+// slot (those represent a live operator session and must outlive the table
+// pressure of reconnect churn). Returns nullptr only if every slot is
+// occupied by a different live, authorized PhoneAPI — practically only
+// reachable as a DoS via 7+ simultaneous authed connections, in which
+// case fail-closed and log.
+static PhoneAuthSlot *findOrAllocSlot_LH(PhoneAPI *p)
+{
+    if (!p)
+        return nullptr;
+    for (auto &s : g_authSlots)
+        if (s.who == p)
+            return &s;
+    // First pass: free (who==nullptr) slot.
+    for (auto &s : g_authSlots) {
+        if (s.who == nullptr) {
+            s.who = p;
+            s.authorized = false;
+            s.epoch = 0;
+            return &s;
+        }
+    }
+    // Second pass: evict an unauthorized stale slot. Don't touch authorized
+    // ones — those still represent an operator-authenticated session.
+    for (auto &s : g_authSlots) {
+        if (!s.authorized) {
+            s.who = p;
+            s.epoch = 0;
+            LOG_WARN("Lockdown: auth slot table full, evicted stale unauthorized slot for new PhoneAPI %p", p);
+            return &s;
+        }
+    }
+    LOG_WARN("Lockdown: auth slot table full of authorized sessions, refusing new PhoneAPI %p (fail-closed)", p);
+    return nullptr;
+}
+
+// Drop p's slot from both the auth table and the status-queue table.
+// Lock-held variant.
+static void clearAuthSlot_LH(const PhoneAPI *p)
+{
+    if (!p)
+        return;
+    for (auto &s : g_authSlots) {
+        if (s.who == p) {
+            s.authorized = false;
+            s.epoch = 0;
+            s.who = nullptr;
+            break;
+        }
+    }
+    clearStatusSlot_LH(p);
+}
+#endif
+
 PhoneAPI::PhoneAPI()
 {
    lastContactMsec = millis();
@@ -45,6 +239,17 @@ PhoneAPI::PhoneAPI()
 PhoneAPI::~PhoneAPI()
 {
    close();
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+    // Free the auth slot unconditionally, regardless of whether close()'s
+    // slot-clear branch ran (it skips when state == STATE_SEND_NOTHING).
+    // Leaving a stale slot.who pointing at freed memory lets a future
+    // PhoneAPI heap-allocated at the same address inherit the prior
+    // session's authorization through findOrAllocSlot.
+    {
+        concurrency::LockGuard g(&g_authSlotsMutex);
+        clearAuthSlot_LH(this);
+    }
+#endif
 }

 void PhoneAPI::handleStartConfig()
@@ -55,6 +260,28 @@ void PhoneAPI::handleStartConfig()
        observe(&service->fromNumChanged);
 #ifdef FSCom
        observe(&xModem.packetReady);
+#endif
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+        // New physical connection: clear this PhoneAPI's auth slot so the new
+        // client must present a passphrase or PKC admin signature before
+        // seeing full config. Do NOT reset on a subsequent want_config_id
+        // within the same connection: after a successful unlock the client
+        // re-requests config to pull the now-unredacted values, and re-locking
+        // that same-link re-fetch would strip the auth it just earned (config
+        // comes back redacted and set_config writes get dropped).
+        //
+        // The security boundary is therefore the physical connection, not the
+        // want_config handshake. For BLE that boundary is enforced in
+        // onConnect() (which fires once per link and also resets the slot), so
+        // a reconnect re-locks even if this !isConnected() transition was
+        // missed because the prior link's close() raced the new config burst.
+        {
+            concurrency::LockGuard g(&g_authSlotsMutex);
+            if (auto *slot = findOrAllocSlot_LH(this)) {
+                slot->authorized = false;
+                slot->epoch = 0;
+            }
+        }
 #endif
    }

@@ -157,6 +384,12 @@ void PhoneAPI::close()
        config_state = 0;
        pauseBluetoothLogging = false;
        heartbeatReceived = false;
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+        {
+            concurrency::LockGuard g(&g_authSlotsMutex);
+            clearAuthSlot_LH(this);
+        }
+#endif
    }
 }

@@ -185,6 +418,26 @@ bool PhoneAPI::handleToRadio(const uint8_t *buf, size_t bufLength)
    if (pb_decode_from_bytes(buf, bufLength, &meshtastic_ToRadio_msg, &toRadioScratch)) {
        switch (toRadioScratch.which_payload_variant) {
        case meshtastic_ToRadio_packet_tag:
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+            if (!getAdminAuthorized()) {
+                // Allow admin messages addressed to this device — passphrase delivery must get through.
+                // AdminModule handles its own is_managed gate for those.
+                // Block everything else — unauthorized clients cannot inject mesh traffic.
+                // Require the packet to carry a decoded (not encrypted) payload so portnum is valid.
+                // Refuse to match when our own node number is still 0 (NodeDB
+                // not yet loaded — happens during the locked-default boot path
+                // before reloadFromDisk). Otherwise a packet with to==0 would
+                // satisfy the equality and bypass the gate.
+                NodeNum ourNum = nodeDB->getNodeNum();
+                bool isLocalAdmin =
+                    ourNum != 0 && toRadioScratch.packet.which_payload_variant == meshtastic_MeshPacket_decoded_tag &&
+                    toRadioScratch.packet.decoded.portnum == meshtastic_PortNum_ADMIN_APP && toRadioScratch.packet.to == ourNum;
+                if (!isLocalAdmin) {
+                    LOG_INFO("Lockdown: Dropping non-admin ToRadio packet from unauthorized client");
+                    return false;
+                }
+            }
+#endif
            return handleToRadioPacket(toRadioScratch.packet);
        case meshtastic_ToRadio_want_config_id_tag:
            config_nonce = toRadioScratch.want_config_id;
@@ -196,6 +449,12 @@ bool PhoneAPI::handleToRadio(const uint8_t *buf, size_t bufLength)
            close();
            break;
        case meshtastic_ToRadio_xmodemPacket_tag:
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+            if (!getAdminAuthorized()) {
+                LOG_INFO("Lockdown: Dropping xmodem packet from unauthorized client");
+                break;
+            }
+#endif
            LOG_INFO("Got xmodem packet");
 #ifdef FSCom
            xModem.handlePacket(toRadioScratch.xmodemPacket);
@@ -298,6 +557,21 @@ size_t PhoneAPI::getFromRadio(uint8_t *buf)
        strncpy(myNodeInfo.pio_env, optstr(APP_ENV), sizeof(myNodeInfo.pio_env));
        myNodeInfo.nodedb_count = static_cast<uint16_t>(nodeDB->getNumMeshNodes());
        fromRadioScratch.my_info = myNodeInfo;
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+        if (!getAdminAuthorized()) {
+            // device_id is a stable hardware identifier — useful for an attacker
+            // to fingerprint / correlate the device across observations. Strip it
+            // for unauthenticated clients. my_node_num is kept (it's broadcast
+            // on the mesh anyway). pio_env / min_app_version reveal the exact
+            // build flavour, useful only for picking which known-CVE to try.
+            // nodedb_count stays — clients need it to decide whether to pull
+            // the node DB after unlocking.
+            fromRadioScratch.my_info.device_id.size = 0;
+            memset(fromRadioScratch.my_info.device_id.bytes, 0, sizeof(fromRadioScratch.my_info.device_id.bytes));
+            memset(fromRadioScratch.my_info.pio_env, 0, sizeof(fromRadioScratch.my_info.pio_env));
+            fromRadioScratch.my_info.min_app_version = 0;
+        }
+#endif
        state = STATE_SEND_UIDATA;

        service->refreshLocalMeshNode(); // Update my NodeInfo because the client will be asking for it soon.
@@ -331,8 +605,15 @@ size_t PhoneAPI::getFromRadio(uint8_t *buf)
        }
        if (config_nonce == SPECIAL_NONCE_ONLY_NODES) {
            // If client only wants node info, jump directly to sending nodes
-            state = STATE_SEND_OTHER_NODEINFOS;
-            onNowHasData(0);
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+            if (!getAdminAuthorized()) {
+                state = STATE_SEND_COMPLETE_ID; // Unauthorized: skip node DB
+            } else
+#endif
+            {
+                state = STATE_SEND_OTHER_NODEINFOS;
+                onNowHasData(0);
+            }
        } else {
            state = STATE_SEND_METADATA;
        }
@@ -343,12 +624,35 @@ size_t PhoneAPI::getFromRadio(uint8_t *buf)
        LOG_DEBUG("Send device metadata");
        fromRadioScratch.which_payload_variant = meshtastic_FromRadio_metadata_tag;
        fromRadioScratch.metadata = getDeviceMetadata();
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+        if (!getAdminAuthorized()) {
+            // DeviceMetadata is one large fingerprint vector for an unauth
+            // client: firmware_version, device_state_version, hw_model,
+            // hw_model_string, has_bluetooth/has_wifi/has_ethernet, role,
+            // position_flags, excluded_modules, optionsCount. None of it
+            // is needed to drive lockdown_auth, and most of it tells an
+            // attacker which CVE / behavior quirks to probe. Wipe the
+            // whole struct — clients re-fetch once authenticated.
+            memset(&fromRadioScratch.metadata, 0, sizeof(fromRadioScratch.metadata));
+        }
+#endif
        state = STATE_SEND_CHANNELS;
        break;

    case STATE_SEND_CHANNELS:
        fromRadioScratch.which_payload_variant = meshtastic_FromRadio_channel_tag;
-        fromRadioScratch.channel = channels.getByIndex(config_state);
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+        if (!getAdminAuthorized()) {
+            // Unauthenticated: emit a zero-initialized Channel. fromRadioScratch
+            // was memset(0) at the top of getFromRadio(), so leaving .channel
+            // untouched gives the client an empty entry — no name, no PSK, no
+            // role. Advances the state machine normally so config_complete_id
+            // still fires.
+        } else
+#endif
+        {
+            fromRadioScratch.channel = channels.getByIndex(config_state);
+        }
        config_state++;
        // Advance when we have sent all of our Channels
        if (config_state >= MAX_NUM_CHANNELS) {
@@ -380,7 +684,15 @@ size_t PhoneAPI::getFromRadio(uint8_t *buf)
        case meshtastic_Config_network_tag:
            LOG_DEBUG("Send config: network");
            fromRadioScratch.config.which_payload_variant = meshtastic_Config_network_tag;
-            fromRadioScratch.config.payload_variant.network = config.network;
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+            if (!getAdminAuthorized()) {
+                // Unauthenticated: emit an empty NetworkConfig (zero-init from the
+                // top-of-loop memset). No wifi_psk, no SSID, no static IP info.
+            } else
+#endif
+            {
+                fromRadioScratch.config.payload_variant.network = config.network;
+            }
            break;
        case meshtastic_Config_display_tag:
            LOG_DEBUG("Send config: display");
@@ -390,7 +702,28 @@ size_t PhoneAPI::getFromRadio(uint8_t *buf)
        case meshtastic_Config_lora_tag:
            LOG_DEBUG("Send config: lora");
            fromRadioScratch.config.which_payload_variant = meshtastic_Config_lora_tag;
-            fromRadioScratch.config.payload_variant.lora = config.lora;
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+            if (!getAdminAuthorized()) {
+                // Whitelist only the spec-mandated radio identity fields that
+                // are intrinsically observable on the air anyway: region,
+                // modem_preset, use_preset, channel_num, hop_limit. Operator-
+                // private knobs (ignore_incoming list, override_duty_cycle,
+                // override_frequency, sx126x_rx_boosted_gain, tx_power,
+                // ignore_mqtt, fem_lna_mode, config_ok_to_mqtt, ...) stay
+                // hidden — they tell an attacker how the operator has tuned
+                // the device but are not needed by an unauth client.
+                meshtastic_Config_LoRaConfig whitelist = {};
+                whitelist.use_preset = config.lora.use_preset;
+                whitelist.modem_preset = config.lora.modem_preset;
+                whitelist.region = config.lora.region;
+                whitelist.channel_num = config.lora.channel_num;
+                whitelist.hop_limit = config.lora.hop_limit;
+                fromRadioScratch.config.payload_variant.lora = whitelist;
+            } else
+#endif
+            {
+                fromRadioScratch.config.payload_variant.lora = config.lora;
+            }
            break;
        case meshtastic_Config_bluetooth_tag:
            LOG_DEBUG("Send config: bluetooth");
@@ -400,7 +733,21 @@ size_t PhoneAPI::getFromRadio(uint8_t *buf)
        case meshtastic_Config_security_tag:
            LOG_DEBUG("Send config: security");
            fromRadioScratch.config.which_payload_variant = meshtastic_Config_security_tag;
-            fromRadioScratch.config.payload_variant.security = config.security;
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+            if (!getAdminAuthorized()) {
+                // Unauthenticated: emit an empty SecurityConfig (zero-init from
+                // the top-of-loop memset). No private_key, no admin_keys, no
+                // public_key — nothing for an attacker to inspect.
+                //
+                // Provisioning state (NEEDS_PROVISION vs LOCKED) is conveyed via
+                // the FromRadio.lockdown_status proto sent post-config; clients
+                // should consume that rather than inferring from this empty
+                // security config.
+            } else
+#endif
+            {
+                fromRadioScratch.config.payload_variant.security = config.security;
+            }
            break;
        case meshtastic_Config_sessionkey_tag:
            LOG_DEBUG("Send config: sessionkey");
@@ -430,7 +777,17 @@ size_t PhoneAPI::getFromRadio(uint8_t *buf)
        case meshtastic_ModuleConfig_mqtt_tag:
            LOG_DEBUG("Send module config: mqtt");
            fromRadioScratch.moduleConfig.which_payload_variant = meshtastic_ModuleConfig_mqtt_tag;
-            fromRadioScratch.moduleConfig.payload_variant.mqtt = moduleConfig.mqtt;
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+            if (!getAdminAuthorized()) {
+                // Unauthenticated: emit an empty MQTTConfig (zero-init from
+                // the top-of-loop memset). MQTT broker username/password, the
+                // server address, and root_topic are credentials/config that
+                // shouldn't be visible to an unauth client.
+            } else
+#endif
+            {
+                fromRadioScratch.moduleConfig.payload_variant.mqtt = moduleConfig.mqtt;
+            }
            break;
        case meshtastic_ModuleConfig_serial_tag:
            LOG_DEBUG("Send module config: serial");
@@ -509,15 +866,21 @@ size_t PhoneAPI::getFromRadio(uint8_t *buf)
        config_state++;
        // Advance when we have sent all of our ModuleConfig objects
        if (config_state > (_meshtastic_AdminMessage_ModuleConfigType_MAX + 1)) {
-            // Handle special nonce behaviors:
-            // - SPECIAL_NONCE_ONLY_CONFIG: Skip node info, go directly to file manifest
-            // - SPECIAL_NONCE_ONLY_NODES: After sending nodes, skip to complete
-            if (config_nonce == SPECIAL_NONCE_ONLY_CONFIG) {
-                state = STATE_SEND_FILEMANIFEST;
-            } else {
-                state = STATE_SEND_OTHER_NODEINFOS;
-                onNowHasData(0);
-            }
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+            if (!getAdminAuthorized()) {
+                // Unauthorized client: skip node DB and file manifest — only send config complete
+                state = STATE_SEND_COMPLETE_ID;
+            } else
+#endif
+                // Handle special nonce behaviors:
+                // - SPECIAL_NONCE_ONLY_CONFIG: Skip node info, go directly to file manifest
+                // - SPECIAL_NONCE_ONLY_NODES: After sending nodes, skip to complete
+                if (config_nonce == SPECIAL_NONCE_ONLY_CONFIG) {
+                    state = STATE_SEND_FILEMANIFEST;
+                } else {
+                    state = STATE_SEND_OTHER_NODEINFOS;
+                    onNowHasData(0);
+                }
            config_state = 0;
        }
        break;
@@ -590,24 +953,58 @@ size_t PhoneAPI::getFromRadio(uint8_t *buf)
            fromRadioScratch.queueStatus = *queueStatusPacketForPhone;
            releaseQueueStatusPhonePacket();
        } else if (mqttClientProxyMessageForPhone) {
-            fromRadioScratch.which_payload_variant = meshtastic_FromRadio_mqttClientProxyMessage_tag;
-            fromRadioScratch.mqttClientProxyMessage = *mqttClientProxyMessageForPhone;
-            releaseMqttClientProxyPhonePacket();
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+            if (!getAdminAuthorized()) {
+                releaseMqttClientProxyPhonePacket(); // Discard — unauthorized client
+            } else
+#endif
+            {
+                fromRadioScratch.which_payload_variant = meshtastic_FromRadio_mqttClientProxyMessage_tag;
+                fromRadioScratch.mqttClientProxyMessage = *mqttClientProxyMessageForPhone;
+                releaseMqttClientProxyPhonePacket();
+            }
        } else if (xmodemPacketForPhone.control != meshtastic_XModem_Control_NUL) {
-            fromRadioScratch.which_payload_variant = meshtastic_FromRadio_xmodemPacket_tag;
-            fromRadioScratch.xmodemPacket = xmodemPacketForPhone;
-            xmodemPacketForPhone = meshtastic_XModem_init_zero;
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+            if (!getAdminAuthorized()) {
+                xmodemPacketForPhone = meshtastic_XModem_init_zero; // Discard — unauthorized client
+            } else
+#endif
+            {
+                fromRadioScratch.which_payload_variant = meshtastic_FromRadio_xmodemPacket_tag;
+                fromRadioScratch.xmodemPacket = xmodemPacketForPhone;
+                xmodemPacketForPhone = meshtastic_XModem_init_zero;
+            }
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+        } else if (hasPendingLockdownStatus()) {
+            concurrency::LockGuard guard(&g_authSlotsMutex);
+            // Look up our own slot only — never another connection's. Re-check
+            // hasPending under the lock since a concurrent drain on the same
+            // connection (unlikely but possible if multiple transport
+            // callbacks race against one PhoneAPI) may have grabbed it.
+            if (auto *slot = findOrAllocStatusSlot_LH(this); slot && slot->hasPending) {
+                fromRadioScratch.which_payload_variant = meshtastic_FromRadio_lockdown_status_tag;
+                fromRadioScratch.lockdown_status = slot->status;
+                memset(&slot->status, 0, sizeof(slot->status));
+                slot->hasPending = false;
+            }
+#endif
        } else if (clientNotification) {
            fromRadioScratch.which_payload_variant = meshtastic_FromRadio_clientNotification_tag;
            fromRadioScratch.clientNotification = *clientNotification;
            releaseClientNotification();
        } else if (packetForPhone) {
-            printPacket("phone downloaded packet", packetForPhone);
-
-            // Encapsulate as a FromRadio packet
-            fromRadioScratch.which_payload_variant = meshtastic_FromRadio_packet_tag;
-            fromRadioScratch.packet = *packetForPhone;
-            releasePhonePacket();
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+            if (!getAdminAuthorized()) {
+                releasePhonePacket(); // Discard mesh traffic — unauthorized client
+            } else
+#endif
+            {
+                printPacket("phone downloaded packet", packetForPhone);
+                // Encapsulate as a FromRadio packet
+                fromRadioScratch.which_payload_variant = meshtastic_FromRadio_packet_tag;
+                fromRadioScratch.packet = *packetForPhone;
+                releasePhonePacket();
+            }
        } else if (replayPending()) {
            // No live packet pending — feed the phone one cached satellite-DB packet.
            // popReplayPacket advances through positions->telemetry->environment->status,
@@ -669,6 +1066,29 @@ void PhoneAPI::sendConfigComplete()
        service->api_state = service->STATE_ETH;
    }

+#if defined(MESHTASTIC_ENCRYPTED_STORAGE) && defined(MESHTASTIC_PHONEAPI_ACCESS_CONTROL)
+    if (!EncryptedStorage::isLockdownActive()) {
+        // Lockdown-capable firmware, but lockdown is not active on this
+        // device (never provisioned, or disabled). Tell the client so its
+        // "lockdown mode" toggle renders OFF. Note getAdminAuthorized()
+        // returns true in this state, so the redaction gates are no-ops and
+        // the client just received the full, unredacted config above.
+        queueLockdownStatus(meshtastic_LockdownStatus_State_DISABLED, "", 0, 0, 0);
+        LOG_INFO("PhoneAPI: DISABLED (lockdown not active) sent to client");
+    } else if (!getAdminAuthorized()) {
+        if (!EncryptedStorage::isProvisioned()) {
+            queueLockdownStatus(meshtastic_LockdownStatus_State_NEEDS_PROVISION, "", 0, 0, 0);
+            LOG_INFO("PhoneAPI: NEEDS_PROVISION sent to client");
+        } else if (!EncryptedStorage::isUnlocked()) {
+            queueLockdownStatus(meshtastic_LockdownStatus_State_LOCKED, EncryptedStorage::getLockReason(), 0, 0, 0);
+            LOG_INFO("PhoneAPI: LOCKED (%s) sent to client", EncryptedStorage::getLockReason());
+        } else {
+            queueLockdownStatus(meshtastic_LockdownStatus_State_LOCKED, "needs_auth", 0, 0, 0);
+            LOG_INFO("PhoneAPI: LOCKED (needs_auth) sent to client");
+        }
+    }
+#endif
+
    // Allow subclasses to know we've entered steady-state so they can lower power consumption
    onConfigComplete();

@@ -1121,6 +1541,10 @@ bool PhoneAPI::available()
        if (!clientNotification)
            clientNotification = service->getClientNotificationForPhone();
        bool hasPacket = !!queueStatusPacketForPhone || !!mqttClientProxyMessageForPhone || !!clientNotification;
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+        if (hasPendingLockdownStatus())
+            hasPacket = true;
+#endif
        if (hasPacket)
            return true;

@@ -1192,6 +1616,46 @@ bool PhoneAPI::handleToRadioPacket(meshtastic_MeshPacket &p)
 {
    printPacket("PACKET FROM PHONE", &p);

+#if defined(MESHTASTIC_ENCRYPTED_STORAGE) && defined(MESHTASTIC_PHONEAPI_ACCESS_CONTROL)
+    // Local admin gating happens here, synchronously on the dispatching
+    // task. Two distinct cases:
+    //
+    //   (a) lockdown_auth: handled inline. Passphrase never enters the
+    //       routed MeshPacket queue, and authorize-this-connection
+    //       runs while `this` is still on the call stack.
+    //
+    //   (b) Any other admin payload from an unauthorized connection:
+    //       dropped here. The previous design relied on AdminModule
+    //       to apply isLocalAdminAuthorized() during dispatch, but
+    //       AdminModule runs on the Router task — by then the
+    //       PhoneAPI dispatching task has already exited and the
+    //       per-connection auth context is unrecoverable. Putting
+    //       the gate here closes that race and covers H6/H7 from the
+    //       audit: get_config_request and set_config from unauthed
+    //       clients no longer reach AdminModule at all.
+    if (p.from == 0 && p.which_payload_variant == meshtastic_MeshPacket_decoded_tag &&
+        p.decoded.portnum == meshtastic_PortNum_ADMIN_APP) {
+        meshtastic_AdminMessage admin = meshtastic_AdminMessage_init_zero;
+        if (pb_decode_from_bytes(p.decoded.payload.bytes, p.decoded.payload.size, &meshtastic_AdminMessage_msg, &admin)) {
+            if (admin.which_payload_variant == meshtastic_AdminMessage_lockdown_auth_tag) {
+                handleLockdownAuthInline(admin.lockdown_auth);
+                // Wipe the decoded passphrase scratch — the byte array in
+                // p.decoded.payload.bytes is wiped by handleLockdownAuthInline.
+                volatile uint8_t *adminVol = const_cast<volatile uint8_t *>(admin.lockdown_auth.passphrase.bytes);
+                for (size_t i = 0; i < sizeof(admin.lockdown_auth.passphrase.bytes); i++)
+                    adminVol[i] = 0;
+                return true;
+            }
+            if (!getAdminAuthorized()) {
+                LOG_WARN("Lockdown: dropping admin payload variant=%d from unauthorized connection", admin.which_payload_variant);
+                return false;
+            }
+        }
+        // pb_decode failure: fall through to normal handling so the
+        // regular Router/AdminModule reject path can respond.
+    }
+#endif
+
 #if defined(ARCH_PORTDUINO)
    // For use with the simulator, we should not ignore duplicate packets from the phone
    if (SimRadio::instance == nullptr)
@@ -1260,3 +1724,314 @@ int PhoneAPI::onNotify(uint32_t newValue)

    return timeout ? -1 : 0; // If we timed out, MeshService should stop iterating through observers as we just removed one
 }
+
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+bool PhoneAPI::getAdminAuthorized() const
+{
+    // Runtime-toggle model: when lockdown is NOT active (a lockdown-capable
+    // build that hasn't been provisioned, or that was disabled), there is
+    // nothing to protect — every connection is implicitly authorized, so
+    // all the `if (!getAdminAuthorized())` redaction gates throughout
+    // getFromRadio() / handleToRadio() become no-ops and the device serves
+    // config exactly like stock firmware. Only once provisioned (lockdown
+    // active) do we consult the per-connection auth slot table.
+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+    if (!EncryptedStorage::isLockdownActive())
+        return true;
+#endif
+    concurrency::LockGuard g(&g_authSlotsMutex);
+    // const_cast is safe — findOrAllocSlot_LH only mutates the slot table,
+    // not the PhoneAPI itself, and the table key is just the pointer.
+    const auto *slot = findOrAllocSlot_LH(const_cast<PhoneAPI *>(this));
+    return slot && slot->authorized && slot->epoch == g_authEpoch;
+}
+
+void PhoneAPI::setAdminAuthorized(bool authorized)
+{
+    concurrency::LockGuard g(&g_authSlotsMutex);
+    auto *slot = findOrAllocSlot_LH(this);
+    if (!slot)
+        return; // slot table full — fail-closed
+    if (authorized) {
+        slot->epoch = g_authEpoch;
+        slot->authorized = true;
+    } else {
+        slot->authorized = false;
+        slot->epoch = 0;
+    }
+}
+
+void PhoneAPI::revokeAllAuth()
+{
+    {
+        concurrency::LockGuard g(&g_authSlotsMutex);
+        g_authEpoch++;
+    }
+    LOG_INFO("Lockdown: All connection auth revoked (Lock Now)");
+}
+
+void PhoneAPI::completePendingUnlocks(bool reloadOk)
+{
+    // Snapshot fields that we'll need outside the lock (we cannot call
+    // EncryptedStorage / setAdminAuthorized / unlockScreen while holding
+    // g_authSlotsMutex without risking re-entry — setAdminAuthorized
+    // itself takes the same lock).
+    constexpr size_t kMaxSnapshots = MAX_AUTH_SLOTS;
+    PhoneAPI *targets[kMaxSnapshots] = {};
+    size_t targetCount = 0;
+    {
+        concurrency::LockGuard guard(&g_authSlotsMutex);
+        for (auto &s : g_statusSlots) {
+            if (!s.pendingUnlockAfterReload || !s.who)
+                continue;
+            if (targetCount < kMaxSnapshots)
+                targets[targetCount++] = s.who;
+            // Clear the pending flag either way — failure path must not
+            // leave it set so a subsequent successful reload retries
+            // against the wrong PhoneAPI.
+            s.pendingUnlockAfterReload = false;
+        }
+    }
+
+    if (reloadOk) {
+        uint8_t boots = EncryptedStorage::getBootsRemaining();
+        uint32_t until = EncryptedStorage::getValidUntilEpoch();
+        for (size_t i = 0; i < targetCount; i++) {
+            PhoneAPI *p = targets[i];
+            p->setAdminAuthorized(true);
+            p->queueLockdownStatus(meshtastic_LockdownStatus_State_UNLOCKED, "", boots, until, 0);
+        }
+        // Screen-lock latch is cleared once any client successfully
+        // unlocks — the operator has proven the passphrase. Matches the
+        // re-verify path's behavior.
+        if (targetCount > 0)
+            meshtastic_security::unlockScreen();
+        LOG_INFO("Lockdown: post-reload completion: authorized %u connection(s)", (unsigned)targetCount);
+    } else {
+        // Storage corrupt — emit LOCKED(storage_corrupt) to every slot
+        // that was awaiting the unlock. setAdminAuthorized is NOT called
+        // so the connection stays redacted and any set_config it sends
+        // is dropped at the existing unauth gates. Caller (main.cpp) has
+        // already lockNow'd storage and broadcast-revoked.
+        for (size_t i = 0; i < targetCount; i++) {
+            targets[i]->queueLockdownStatus(meshtastic_LockdownStatus_State_LOCKED, "storage_corrupt", 0, 0, 0);
+        }
+        LOG_ERROR("Lockdown: post-reload completion: storage corrupt, notified %u connection(s)", (unsigned)targetCount);
+    }
+}
+
+void PhoneAPI::queueLockdownStatus(meshtastic_LockdownStatus_State state, const char *lock_reason, uint8_t boots_remaining,
+                                   uint32_t valid_until_epoch, uint32_t backoff_seconds)
+{
+    {
+        concurrency::LockGuard guard(&g_authSlotsMutex);
+        auto *slot = findOrAllocStatusSlot_LH(this);
+        if (!slot)
+            return; // slot table exhausted — fail-closed, no status delivered
+        buildStatus_LH(slot->status, state, lock_reason, boots_remaining, valid_until_epoch, backoff_seconds);
+        slot->hasPending = true;
+    }
+    if (service)
+        service->nudgeFromNum();
+}
+
+void PhoneAPI::broadcastLockdownStatus(meshtastic_LockdownStatus_State state, const char *lock_reason, uint8_t boots_remaining,
+                                       uint32_t valid_until_epoch, uint32_t backoff_seconds)
+{
+    bool anyOverwritten = false;
+    {
+        concurrency::LockGuard guard(&g_authSlotsMutex);
+        for (auto &s : g_statusSlots) {
+            if (s.who) {
+                buildStatus_LH(s.status, state, lock_reason, boots_remaining, valid_until_epoch, backoff_seconds);
+                s.hasPending = true;
+                anyOverwritten = true;
+            }
+        }
+    }
+    // Service nudge is shared across connections; one nudge wakes every
+    // drainer. Skip if no connection currently has a slot.
+    if (anyOverwritten && service)
+        service->nudgeFromNum();
+}
+
+bool PhoneAPI::hasPendingLockdownStatus() const
+{
+    concurrency::LockGuard guard(&g_authSlotsMutex);
+    for (const auto &s : g_statusSlots) {
+        if (s.who == this && s.hasPending)
+            return true;
+    }
+    return false;
+}
+
+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+bool PhoneAPI::handleLockdownAuthInline(const meshtastic_LockdownAuth &la)
+{
+    // Wipe passphrase bytes in the caller's decoded scratch on every exit.
+    auto zeroPassphrase = [&]() {
+        volatile uint8_t *ppVol = const_cast<volatile uint8_t *>(la.passphrase.bytes);
+        for (pb_size_t zi = 0; zi < la.passphrase.size; zi++)
+            ppVol[zi] = 0;
+    };
+
+    // Lock Now — only honored from a connection that has already proven
+    // the passphrase. Unauthenticated clients used to be able to trigger
+    // a reboot, which was a trivial local-presence DoS (any BLE/USB
+    // attacker could brick-loop the device). Now lock_now requires
+    // prior auth on this connection.
+    if (la.lock_now) {
+        if (!getAdminAuthorized()) {
+            LOG_WARN("Lockdown: LOCK NOW from unauthorized connection — denied");
+            queueLockdownStatus(meshtastic_LockdownStatus_State_UNLOCK_FAILED, "", 0, 0, 0);
+            zeroPassphrase();
+            return true;
+        }
+        LOG_INFO("Lockdown: LOCK NOW command received from authorized connection");
+        EncryptedStorage::lockNow();
+        revokeAllAuth();
+        queueLockdownStatus(meshtastic_LockdownStatus_State_LOCKED, "", 0, 0, 0);
+        zeroPassphrase();
+        rebootAtMsec = millis() + DEFAULT_REBOOT_SECONDS * 1000;
+        return true;
+    }
+
+    // Disable lockdown entirely. Requires the passphrase (must prove
+    // ownership before reverting at-rest encryption). We verify it here to
+    // load the DEK, then hand the heavy decrypt-revert work to the main
+    // loop via lockdownDisablePending — exactly like the unlock reload
+    // path, because decrypting + rewriting nodes.proto is too heavy for
+    // this transport-callback stack. APPROTECT is NOT reversed.
+    if (la.disable) {
+        if (la.passphrase.size < 1) {
+            LOG_WARN("Lockdown: disable with empty passphrase — rejecting");
+            queueLockdownStatus(meshtastic_LockdownStatus_State_UNLOCK_FAILED, "", 0, 0, 0);
+            zeroPassphrase();
+            return true;
+        }
+        if (!EncryptedStorage::isLockdownActive()) {
+            // Already off — nothing to do; report DISABLED so the client UI settles.
+            LOG_INFO("Lockdown: disable requested but lockdown is not active");
+            queueLockdownStatus(meshtastic_LockdownStatus_State_DISABLED, "", 0, 0, 0);
+            zeroPassphrase();
+            return true;
+        }
+        // Re-verify the passphrase (loads the DEK needed to decrypt files).
+        bool ok = EncryptedStorage::unlockWithPassphrase(la.passphrase.bytes, la.passphrase.size,
+                                                         EncryptedStorage::TOKEN_DEFAULT_BOOTS, 0, 0);
+        if (!ok) {
+            uint32_t backoff = EncryptedStorage::getBackoffSecondsRemaining();
+            queueLockdownStatus(meshtastic_LockdownStatus_State_UNLOCK_FAILED, "", 0, 0, backoff);
+            LOG_WARN("Lockdown: disable passphrase verification failed");
+            zeroPassphrase();
+            return true;
+        }
+        setAdminAuthorized(true);
+        lockdownDisablePending = true; // main loop runs nodeDB->disableLockdownToPlaintext() then reboots
+        LOG_INFO("Lockdown: disable authorized, deferring decrypt-revert to main loop");
+        zeroPassphrase();
+        return true;
+    }
+
+    // Empty-passphrase auth was previously a silent success — clients
+    // got no feedback and the device looked the same as it would after
+    // an actual no-op. Emit UNLOCK_FAILED with no backoff so honest
+    // clients can detect their own bug and an attacker still learns
+    // nothing they wouldn't from any other failed attempt.
+    if (la.passphrase.size < 1) {
+        LOG_WARN("Lockdown: lockdown_auth with empty passphrase and lock_now=false — rejecting");
+        queueLockdownStatus(meshtastic_LockdownStatus_State_UNLOCK_FAILED, "", 0, 0, 0);
+        zeroPassphrase();
+        return true;
+    }
+
+    // boots_remaining is uint32 on the wire but the token field is uint8.
+    // Silently truncating (256 -> 0 -> default 50) hides a real client
+    // bug. Reject explicitly so the client can correct its request.
+    if (la.boots_remaining > 255) {
+        LOG_WARN("Lockdown: boots_remaining=%u exceeds uint8 cap, rejecting", la.boots_remaining);
+        queueLockdownStatus(meshtastic_LockdownStatus_State_UNLOCK_FAILED, "", 0, 0, 0);
+        zeroPassphrase();
+        return true;
+    }
+
+    uint8_t boots = la.boots_remaining != 0 ? (uint8_t)la.boots_remaining : EncryptedStorage::TOKEN_DEFAULT_BOOTS;
+    uint32_t validUntilEpoch = la.valid_until_epoch;
+    // Client-supplied session cap when present; otherwise the
+    // firmware-side default. 0 from the client means "use firmware
+    // default", consistent with the boots_remaining sentinel.
+    uint32_t sessionMaxSeconds =
+        la.max_session_seconds != 0 ? la.max_session_seconds : MESHTASTIC_LOCKDOWN_SESSION_DEFAULT_SECONDS;
+
+    bool ok = false;
+    bool needsReload = false;
+    if (!EncryptedStorage::isUnlocked()) {
+        if (!EncryptedStorage::isProvisioned()) {
+            LOG_INFO("Lockdown: first-time provisioning with passphrase");
+            ok = EncryptedStorage::provisionPassphrase(la.passphrase.bytes, la.passphrase.size, boots, validUntilEpoch,
+                                                       sessionMaxSeconds);
+        } else {
+            LOG_INFO("Lockdown: unlock with passphrase");
+            ok = EncryptedStorage::unlockWithPassphrase(la.passphrase.bytes, la.passphrase.size, boots, validUntilEpoch,
+                                                        sessionMaxSeconds);
+        }
+        if (ok) {
+            needsReload = true;
+            // Mark this slot for the main-loop completion handler. Don't
+            // authorize or emit UNLOCKED yet — `config` / `channelFile`
+            // / `nodeDatabase` still hold the locked-default placeholders
+            // installed by loadFromDisk()'s !isUnlocked() branch. If we
+            // flipped the connection to authorized here, the client could
+            // read those placeholders as if they were the operator's real
+            // settings, or set_config write a corrupted baseline that
+            // overwrites the real config when reloadFromDisk swaps them
+            // in. completePendingUnlocks() runs on the main thread after
+            // reloadFromDisk has populated the real values and the radio
+            // has been reconfigured.
+            {
+                concurrency::LockGuard guard(&g_authSlotsMutex);
+                if (auto *slot = findOrAllocStatusSlot_LH(this))
+                    slot->pendingUnlockAfterReload = true;
+            }
+            lockdownReloadPending = true;
+            LOG_INFO("Lockdown: storage unlocked, awaiting reload before client visibility");
+        }
+    } else {
+        LOG_INFO("Lockdown: passphrase re-verify for admin authorization");
+        ok = EncryptedStorage::unlockWithPassphrase(la.passphrase.bytes, la.passphrase.size, boots, validUntilEpoch,
+                                                    sessionMaxSeconds);
+        if (ok) {
+            // Storage was already unlocked — no reload needed. Authorize
+            // and surface UNLOCKED to the client immediately.
+            setAdminAuthorized(true);
+            LOG_INFO("Lockdown: passphrase verified, this connection authorized");
+        }
+    }
+
+    if (ok && !needsReload) {
+        // Re-verify path: storage was already unlocked. Clear the screen
+        // latch and emit UNLOCKED now. The cold-unlock path defers both
+        // of these to completePendingUnlocks() once reloadFromDisk finishes.
+        meshtastic_security::unlockScreen();
+        queueLockdownStatus(meshtastic_LockdownStatus_State_UNLOCKED, "", EncryptedStorage::getBootsRemaining(),
+                            EncryptedStorage::getValidUntilEpoch(), 0);
+    } else if (ok && needsReload) {
+        // Cold-unlock path: deliberately no status emission yet — the
+        // client keeps seeing LOCKED until completePendingUnlocks()
+        // runs after a successful reload.
+    } else {
+        uint32_t backoff = EncryptedStorage::getBackoffSecondsRemaining();
+        queueLockdownStatus(meshtastic_LockdownStatus_State_UNLOCK_FAILED, "", 0, 0, backoff);
+        // Don't log backoff seconds — the client receives it in the
+        // UNLOCK_FAILED status anyway, and in non-DEBUG_MUTE builds the
+        // numeric value would otherwise spill onto a USB-attached
+        // attacker's serial terminal alongside other diagnostic noise.
+        LOG_WARN("Lockdown: passphrase verification failed");
+        (void)backoff;
+    }
+
+    zeroPassphrase();
+    return true;
+}
+#endif // MESHTASTIC_ENCRYPTED_STORAGE
+#endif // MESHTASTIC_PHONEAPI_ACCESS_CONTROL
@@ -4,6 +4,7 @@
 #include "concurrency/Lock.h"
 #include "mesh-pb-constants.h"
 #include "meshtastic/portnums.pb.h"
+#include <atomic>
 #include <cstdint>
 #include <deque>
 #include <iterator>
@@ -170,6 +171,49 @@ class PhoneAPI
    bool isConnected() { return state != STATE_SEND_NOTHING; }
    bool isSendingPackets() { return state == STATE_SEND_PACKETS; }

+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+    /// Per-connection auth: tracked in a small file-scope slot table keyed
+    /// by PhoneAPI*. Adding state members directly to PhoneAPI broke
+    /// USB-CDC enumeration on current nRF52 framework — even one extra
+    /// per-instance uint32_t was enough. Keeping all state out-of-line
+    /// avoids the issue.
+    void setAdminAuthorized(bool authorized);
+    bool getAdminAuthorized() const;
+
+    /// Lock Now: O(1) invalidation of every connection's auth by advancing
+    /// the global epoch. Subsequent gate checks see slot.myEpoch != epoch
+    /// and treat the connection as unauthenticated.
+    static void revokeAllAuth();
+
+    /// Called from the main loop after NodeDB::reloadFromDisk() finishes.
+    /// On reloadOk=true: any connection marked pending-unlock-after-reload
+    /// is promoted to authorized and receives an UNLOCKED status; the
+    /// screen-lock latch clears. On reloadOk=false: those connections
+    /// receive a LOCKED(storage_corrupt) status and remain unauthorized
+    /// so they cannot drive set_config against the corrupt baseline.
+    static void completePendingUnlocks(bool reloadOk);
+
+    /// Queue a LockdownStatus FromRadio for THIS connection only. Each
+    /// PhoneAPI owns its own pending-status slot in a file-scope table
+    /// (file-scope because adding fields directly to PhoneAPI broke
+    /// USB-CDC enumeration on nRF52); a status produced here will not
+    /// be delivered to any other connection. `lock_reason` may be
+    /// nullptr / empty for non-LOCKED states.
+    void queueLockdownStatus(meshtastic_LockdownStatus_State state, const char *lock_reason, uint8_t boots_remaining,
+                             uint32_t valid_until_epoch, uint32_t backoff_seconds);
+
+    /// Queue the same LockdownStatus on every active connection's slot.
+    /// Use for events with no specific originating connection (session
+    /// expiry tick in main.cpp, broadcast revocations, etc.). Per-
+    /// connection callers should prefer the instance method above to
+    /// avoid leaking one client's auth state to another.
+    static void broadcastLockdownStatus(meshtastic_LockdownStatus_State state, const char *lock_reason, uint8_t boots_remaining,
+                                        uint32_t valid_until_epoch, uint32_t backoff_seconds);
+
+    /// True iff this connection has a pending lockdown_status drain.
+    bool hasPendingLockdownStatus() const;
+#endif
+
  protected:
    /// Our fromradio packet while it is being assembled
    meshtastic_FromRadio fromRadioScratch = {};
@@ -211,6 +255,20 @@ class PhoneAPI

    APIType api_type = TYPE_NONE;

+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+    // No per-instance auth members — see method-level note. All state lives
+    // in a file-scope slot table in PhoneAPI.cpp keyed by `this` pointer.
+
+    // Pending LockdownStatus storage is NOT a class member — having a
+    // meshtastic_LockdownStatus (~50 bytes with the char[33] lock_reason)
+    // as a PhoneAPI member broke USB-CDC enumeration on the nRF52 Adafruit
+    // framework. The exact mechanism wasn't pinned down, but moving the
+    // storage to a file-scope static in PhoneAPI.cpp side-steps it cleanly.
+    // Trade-off: all PhoneAPI instances share one pending slot. Acceptable
+    // because only one transport delivers a lockdown command at a time in
+    // any realistic scenario.
+#endif
+
  private:
    void releasePhonePacket();

@@ -248,6 +306,16 @@ class PhoneAPI
     */
    bool handleToRadioPacket(meshtastic_MeshPacket &p);

+#if defined(MESHTASTIC_ENCRYPTED_STORAGE) && defined(MESHTASTIC_PHONEAPI_ACCESS_CONTROL)
+    /// Synchronously handle a lockdown_auth AdminMessage from the local
+    /// client. Runs inside handleToRadioPacket so the originating
+    /// connection is reachable via `this` — avoids the async context
+    /// loss that broke the previous AdminModule path. Always consumes the
+    /// packet (returns true): lockdown_auth is local-only and must not be
+    /// forwarded to the mesh router.
+    bool handleLockdownAuthInline(const meshtastic_LockdownAuth &la);
+#endif
+
    /// If the mesh service tells us fromNum has changed, tell the phone
    virtual int onNotify(uint32_t newValue) override;
 };
@@ -16,7 +16,16 @@ uint32_t getPositionPrecisionForChannel(const meshtastic_Channel &channel)

 uint32_t getPositionPrecisionForChannel(uint8_t channelIndex)
 {
-    return getPositionPrecisionForChannel(channels.getByIndex(channelIndex));
+    const meshtastic_Channel &ch = channels.getByIndex(channelIndex);
+    if (ch.role == meshtastic_Channel_Role_DISABLED)
+        return 0;
+    uint32_t precision = getPositionPrecisionForChannel(ch);
+
+    // Never send a precise position on a publicly-decryptable channel (key check is gated on > ceiling).
+    if (precision > MAX_POSITION_PRECISION_PUBLIC_KEY && channels.usesPublicKey(channelIndex)) {
+        precision = MAX_POSITION_PRECISION_PUBLIC_KEY;
+    }
+    return precision;
 }

 static int32_t truncateCoordinate(int32_t coordinate, uint32_t precision)
@@ -4,7 +4,16 @@
 #include "meshtastic/mesh.pb.h"
 #include <stdint.h>

+// Max precision on a publicly-decryptable channel. CCPA "precise geolocation" = within a ~564m (1,850ft) radius.
+// Precision is bit-truncation of latitude_i/longitude_i: the latitude cell stays ~constant in meters worldwide
+// (~700m at 15 bits), while only the longitude cell varies — widest at the equator, narrowing toward the poles.
+// 15 also matches the MQTT map-report public precision ceiling.
+#define MAX_POSITION_PRECISION_PUBLIC_KEY 15
+
+// Configured precision as-is; does NOT apply the public-key clamp -- use the channelIndex overload for the on-wire value.
 uint32_t getPositionPrecisionForChannel(const meshtastic_Channel &channel);
+
+// Configured precision, clamped to MAX_POSITION_PRECISION_PUBLIC_KEY when the channel's effective key is publicly decryptable.
 uint32_t getPositionPrecisionForChannel(uint8_t channelIndex);
 void applyPositionPrecision(meshtastic_Position &position, uint32_t precision);
 bool applyPositionPrecision(meshtastic_MeshPacket &packet, uint32_t precision);
@@ -49,6 +49,8 @@ static const meshtastic_Config_LoRaConfig_ModemPreset PRESETS_LITE[] = {PRESET(L
 static const meshtastic_Config_LoRaConfig_ModemPreset PRESETS_NARROW[] = {PRESET(NARROW_FAST), PRESET(NARROW_SLOW),
                                                                          MODEM_PRESET_END};

+static const meshtastic_Config_LoRaConfig_ModemPreset PRESETS_TINY[] = {PRESET(TINY_FAST), PRESET(TINY_SLOW), MODEM_PRESET_END};
+
 // Region profiles: bundle preset list + regulatory parameters shared across regions
 // presets, spacing, padding, audio, licensed, text throttle, position throttle, telemetry throttle
 const RegionProfile PROFILE_STD = {PRESETS_STD, 0, 0, true, false, 0, 1, 1};
@@ -56,6 +58,12 @@ const RegionProfile PROFILE_EU868 = {PRESETS_EU_868, 0, 0, false, false, 0, 1, 1
 const RegionProfile PROFILE_UNDEF = {PRESETS_UNDEF, 0, 0, true, false, 0, 1, 1};
 const RegionProfile PROFILE_LITE = {PRESETS_LITE, 0.4, 0.0375f, false, false, 0, 10, 10};
 const RegionProfile PROFILE_NARROW = {PRESETS_NARROW, 0, 0.0104f, true, false, 0, 1, 1};
+// Ham '20kHz' profile. 15.6kHz bandwidth coerced to 20kHz via padding.
+const RegionProfile PROFILE_HAM_20KHZ = {PRESETS_TINY, 0, 0.0022f, false, true, 0, 2, 2};
+// Ham '100kHz' profile. 62.5kHz bandwidth coerced to 100kHz via padding.
+const RegionProfile PROFILE_HAM_100KHZ = {PRESETS_NARROW, 0, 0.01875f, false, true, 0, 1, 1};
+
+Observable<uint32_t> RadioInterface::loraRxPacketObservable;

 #define RDEF(name, freq_start, freq_end, duty_cycle, power_limit, frequency_switching, wide_lora, profile_ptr, default_preset,   \
             override_slot)                                                                                                      \
@@ -79,20 +87,30 @@ const RegionInfo regions[] = {
     */
    RDEF(EU_433, 433.0f, 434.0f, 10, 10, false, false, PROFILE_STD, PRESET(LONG_FAST), 0),
    /*
-       https://www.thethingsnetwork.org/docs/lorawan/duty-cycle/
-       https://www.thethingsnetwork.org/docs/lorawan/regional-parameters/
-       https://www.legislation.gov.uk/uksi/1999/930/schedule/6/part/III/made/data.xht?view=snippet&wrap=true
+        https://www.thethingsnetwork.org/docs/lorawan/duty-cycle/
+        https://www.thethingsnetwork.org/docs/lorawan/regional-parameters/
+        https://www.legislation.gov.uk/uksi/1999/930/schedule/6/part/III/made/data.xht?view=snippet&wrap=true

-       audio_permitted = false per regulation
+        audio_permitted = false per regulation

-       Special Note:
-       The link above describes LoRaWAN's band plan, stating a power limit of 16 dBm. This is their own suggested specification,
-       we do not need to follow it. The European Union regulations clearly state that the power limit for this frequency range is
-       500 mW, or 27 dBm. It also states that we can use interference avoidance and spectrum access techniques (such as LBT +
-       AFA) to avoid a duty cycle. (Please refer to line P page 22 of this document.)
-       https://www.etsi.org/deliver/etsi_en/300200_300299/30022002/03.01.01_60/en_30022002v030101p.pdf
-     */
+        Special Note:
+        The link above describes LoRaWAN's band plan, stating a power limit of 16 dBm. This is their own suggested specification,
+        we do not need to follow it. The European Union regulations clearly state that the power limit for this frequency range is
+        500 mW, or 27 dBm. It also states that we can use interference avoidance and spectrum access techniques (such as LBT +
+        AFA) to avoid a duty cycle. (Please refer to line P page 22 of this document.)
+        https://www.etsi.org/deliver/etsi_en/300200_300299/30022002/03.01.01_60/en_30022002v030101p.pdf
+
+        EU 866MHz band (Band no. 46b of 2006/771/EC and subsequent amendments) for Non-specific short-range devices (SRD)
+        Gives 4 channels at 865.7/866.3/866.9/867.5 MHz, 400 kHz gap plus 37.5 kHz padding between channels, 27 dBm,
+        duty cycle 2.5% (mobile) or 10% (fixed) https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02006D0771(01)-20250123
+
+        EU 868MHz band: 3 channels at 869.410/869.4625/869.577 MHz
+        Channel centres at 869.442/869.525/869.608 MHz,
+        10.4 kHz padding on channels, 27 dBm, duty cycle 10%
+    */
    RDEF(EU_868, 869.4f, 869.65f, 10, 27, false, false, PROFILE_EU868, PRESET(LONG_FAST), 0),
+    RDEF(EU_866, 865.6f, 867.6f, 2.5, 27, false, false, PROFILE_LITE, PRESET(LITE_FAST), 0),
+    RDEF(EU_N_868, 869.4f, 869.65f, 10, 27, false, false, PROFILE_NARROW, PRESET(NARROW_SLOW), 1),

    /*
        https://lora-alliance.org/wp-content/uploads/2020/11/lorawan_regional_parameters_v1.0.3reva_0.pdf
@@ -226,25 +244,50 @@ const RegionInfo regions[] = {
    */
    RDEF(BR_902, 902.0f, 907.5f, 100, 30, false, false, PROFILE_STD, PRESET(LONG_FAST), 0),

+    /*
+        ITU Region 1 (Europe, Africa, Middle East, former USSR) amateur 2m allocation: 144.000 - 146.000 MHz.
+        Power limit is the regulatory ceiling (1 W / 30 dBm) — individual hardware will cap below this
+        via its own PA curve; the field here is just the legal upper bound.
+
+        Default slot: 26 (144.510 MHz)
+        https://www.iaru-r1.org/wp-content/uploads/2020/12/VHF-Bandplan.pdf
+    */
+    RDEF(ITU1_2M, 144.0f, 146.0f, 100, 30, false, false, PROFILE_HAM_20KHZ, PRESET(TINY_FAST), 26),
+
+    /*
+        ITU Region 2 (Americas) amateur 2m allocation: 144.000 - 148.000 MHz.
+        Typical admin rules (e.g. US FCC Part 97) allow well above 30 dBm for licensed operators.
+
+        Default slot: 51 (145.010 MHz)
+        https://www.arrl.org/band-plan
+    */
+    RDEF(ITU2_2M, 144.0f, 148.0f, 100, 30, false, false, PROFILE_HAM_20KHZ, PRESET(TINY_FAST), 51),
+
+    /*
+        ITU Region 3 (Asia/Pacific) amateur 2m allocation: 144.000 - 148.000 MHz.
+        Typical admin rules allow well above 30 dBm for licensed operators.
+
+        Default slot: 33 (144.650 MHz)
+        https://www.iaru.org/wp-content/uploads/2020/01/R3-004-IARU-Region-3-Bandplan-rev.2.pdf
+        https://www.wia.org.au/members/bandplans/data/documents/WIA%20Australian%20Band%20Plan%202026.pdf
+    */
+    RDEF(ITU3_2M, 144.0f, 148.0f, 100, 30, false, false, PROFILE_HAM_20KHZ, PRESET(TINY_FAST), 33),
+
+    /*
+        ITU Region 2 (Americas) amateur 1.25m '125cm' allocation: 220.000 - 225.000 MHz.
+        Typical admin rules (e.g. US FCC Part 97) allow well above 30 dBm for licensed operators.
+        Note: Some countries do not allocate 220-222 MHz (e.g. USA, Canada). Check local law!
+
+        Default slot: 37 (223.650 MHz)
+        https://www.arrl.org/band-plan
+    */
+    RDEF(ITU2_125CM, 220.0f, 225.0f, 100, 30, false, false, PROFILE_HAM_100KHZ, PRESET(NARROW_SLOW), 37),
+
    /*
       2.4 GHZ WLAN Band equivalent. Only for SX128x chips.
    */
    RDEF(LORA_24, 2400.0f, 2483.5f, 100, 10, false, true, PROFILE_STD, PRESET(LONG_FAST), 0),

-    /*
-        EU 866MHz band (Band no. 46b of 2006/771/EC and subsequent amendments) for Non-specific short-range devices (SRD)
-        Gives 4 channels at 865.7/866.3/866.9/867.5 MHz, 400 kHz gap plus 37.5 kHz padding between channels, 27 dBm,
-        duty cycle 2.5% (mobile) or 10% (fixed) https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02006D0771(01)-20250123
-    */
-    RDEF(EU_866, 865.6f, 867.6f, 2.5, 27, false, false, PROFILE_LITE, PRESET(LITE_FAST), 0),
-
-    /*
-        EU 868MHz band: 3 channels at 869.410/869.4625/869.577 MHz
-        Channel centres at 869.442/869.525/869.608 MHz,
-        10.4 kHz padding on channels, 27 dBm, duty cycle 10%
-    */
-    RDEF(EU_N_868, 869.4f, 869.65f, 10, 27, false, false, PROFILE_NARROW, PRESET(NARROW_SLOW), 1),
-
    /*
        This needs to be last. Same as US.
    */
@@ -812,43 +855,116 @@ uint32_t RadioInterface::getChannelNum()
 }

 /**
- * Send an error-level client notification. Safe to call when service is null (e.g. in tests).
+ * Send a client notification (error level unless specified). Safe to call when service is null (e.g. in tests).
 */
-static void sendErrorNotification(const char *msg)
+static void sendErrorNotification(const char *msg, meshtastic_LogRecord_Level level = meshtastic_LogRecord_Level_ERROR)
 {
    if (!service)
        return;
    meshtastic_ClientNotification *cn = clientNotificationPool.allocZeroed();
    if (!cn)
        return;
-    cn->level = meshtastic_LogRecord_Level_ERROR;
+    cn->level = level;
    snprintf(cn->message, sizeof(cn->message), "%s", msg);
    service->sendClientNotification(cn);
 }

+// The EU_868/EU_866/EU_N_868 trio own mutually exclusive preset lists. Selecting a preset
+// locked to a sibling means the user wants that sibling region, not the default preset.
+static const meshtastic_Config_LoRaConfig_RegionCode SWAPPABLE_EU_REGIONS[] = {
+    meshtastic_Config_LoRaConfig_RegionCode_EU_868,
+    meshtastic_Config_LoRaConfig_RegionCode_EU_866,
+    meshtastic_Config_LoRaConfig_RegionCode_EU_N_868,
+};
+
 /**
- * Checks if a region is valid for the current settings.
+ * If currentRegion is one of the swappable EU regions and preset belongs to a sibling in
+ * that trio, return the sibling region that owns the preset. Returns nullptr otherwise.
+ */
+const RegionInfo *RadioInterface::regionSwapForPreset(meshtastic_Config_LoRaConfig_RegionCode currentRegion,
+                                                      meshtastic_Config_LoRaConfig_ModemPreset preset)
+{
+    bool currentIsSwappable = false;
+    for (auto code : SWAPPABLE_EU_REGIONS) {
+        if (code == currentRegion)
+            currentIsSwappable = true;
+    }
+    if (!currentIsSwappable)
+        return nullptr;
+
+    for (auto code : SWAPPABLE_EU_REGIONS) {
+        if (code == currentRegion)
+            continue;
+        const RegionInfo *sibling = getRegion(code);
+        if (sibling->supportsPreset(preset))
+            return sibling;
+    }
+    return nullptr;
+}
+
+/**
+ * Checks if a region is valid for the current settings, with no side effects.
+ * Safe to call speculatively (e.g. from UI pickers). When errBuf is given, it
+ * receives the human-readable failure reason.
 * Returns false if not compatible.
 */
-bool RadioInterface::validateConfigRegion(const meshtastic_Config_LoRaConfig &loraConfig)
+bool RadioInterface::checkConfigRegion(const meshtastic_Config_LoRaConfig &loraConfig, char *errBuf, size_t errLen)
 {
    const RegionInfo *newRegion = getRegion(loraConfig.region);

+    // Reject unrecognized region codes (getRegion returns UNSET sentinel for unknown codes)
+    if (newRegion->code != loraConfig.region) {
+        if (errBuf)
+            snprintf(errBuf, errLen, "Region code %d is not recognized", loraConfig.region);
+        return false;
+    }
+
    // If you are not licensed, you can't use ham regions.
    if (newRegion->profile->licensedOnly && !devicestate.owner.is_licensed) {
-        char err_string[160];
-        snprintf(err_string, sizeof(err_string), "Region %s requires licensed mode", newRegion->name);
-        LOG_ERROR("%s", err_string);
-        RECORD_CRITICALERROR(meshtastic_CriticalErrorCode_INVALID_RADIO_SETTING);
-        sendErrorNotification(err_string);
+        if (errBuf)
+            snprintf(errBuf, errLen, "Region %s requires licensed mode", newRegion->name);
        return false;
    }

+    // Hardware compatibility: wide-LoRa (2.4 GHz) regions need a wide-capable radio, and
+    // sub-GHz regions need a radio that can tune below 2.4 GHz (SX128x cannot). UNSET is
+    // always allowed since it is the "no region" state.
+    if (newRegion->code != meshtastic_Config_LoRaConfig_RegionCode_UNSET && RadioLibInterface::instance) {
+        const char *unsupported = nullptr;
+        if (newRegion->wideLora && !RadioLibInterface::instance->wideLora()) {
+            unsupported = "2.4 GHz";
+        } else if (!newRegion->wideLora && !RadioLibInterface::instance->supportsSubGhz()) {
+            unsupported = "sub-GHz";
+        }
+        if (unsupported) {
+            if (errBuf)
+                snprintf(errBuf, errLen, "Region %s needs %s, which this radio does not support", newRegion->name, unsupported);
+            return false;
+        }
+    }
+
    return true;
 }

 /**
- * Internal helper: validate or clamp a LoRa config against its region.
+ * Checks if a region is valid for the current settings. On failure, logs at ERROR,
+ * records a critical error, and sends a client notification.
+ * Returns false if not compatible.
+ */
+bool RadioInterface::validateConfigRegion(const meshtastic_Config_LoRaConfig &loraConfig)
+{
+    char err_string[160];
+    if (checkConfigRegion(loraConfig, err_string, sizeof(err_string)))
+        return true;
+
+    LOG_ERROR("%s", err_string);
+    RECORD_CRITICALERROR(meshtastic_CriticalErrorCode_INVALID_RADIO_SETTING);
+    sendErrorNotification(err_string);
+    return false;
+}
+
+/**
+ * Internal helper: check or clamp a LoRa config against its region.
 * When clamp==false, returns false on first error (pure validation).
 * When clamp==true, fixes invalid settings in-place and returns true.
 */
@@ -865,11 +981,29 @@ bool RadioInterface::checkOrClampConfigLora(meshtastic_Config_LoRaConfig &loraCo
    if (loraConfig.use_preset) {
        check_bw = modemPresetToBwKHz(loraConfig.modem_preset, newRegion->wideLora);

-        bool preset_valid = false;
-        for (size_t i = 0; i < newRegion->getNumPresets(); i++) {
-            if (loraConfig.modem_preset == newRegion->getAvailablePresets()[i]) {
+        bool preset_valid = newRegion->supportsPreset(loraConfig.modem_preset);
+        if (!preset_valid) {
+            // A preset locked to a sibling of the swappable EU regions swaps the region instead
+            // of clamping the preset, as long as the previous region was itself one of the trio.
+            const RegionInfo *swapRegion = regionSwapForPreset(loraConfig.region, loraConfig.modem_preset);
+            if (swapRegion) {
+                if (!clamp) {
+                    // Validation must still fail so callers route into the clamp, but quietly:
+                    // the clamp will accept this config by swapping regions, so don't record a
+                    // critical error or alarm the user over a change that is about to succeed.
+                    LOG_INFO("Preset %s implies region swap %s to %s, deferring to clamp", presetName, newRegion->name,
+                             swapRegion->name);
+                    return false;
+                }
+                snprintf(err_string, sizeof(err_string), "Preset %s swaps region %s to %s", presetName, newRegion->name,
+                         swapRegion->name);
+                LOG_INFO("%s", err_string);
+                sendErrorNotification(err_string, meshtastic_LogRecord_Level_INFO);
+
+                loraConfig.region = swapRegion->code;
+                newRegion = swapRegion;
+                check_bw = modemPresetToBwKHz(loraConfig.modem_preset, newRegion->wideLora);
                preset_valid = true;
-                break;
            }
        }
        if (!preset_valid) {
@@ -1233,4 +1367,4 @@ size_t RadioInterface::beginSending(meshtastic_MeshPacket *p)

    sendingPacket = p;
    return p->encrypted.size + sizeof(PacketHeader);
-}
+}
@@ -128,6 +128,9 @@ class RadioInterface

    virtual ~RadioInterface() {}

+    /// Fires once per valid received LoRa packet (arg = sender NodeNum). Used e.g. to flash LED_LORA.
+    static Observable<uint32_t> loraRxPacketObservable;
+
    /**
     * Coerce LoRa config fields (bandwidth/spread_factor) derived from presets.
     * This is used during early bootstrapping so UIs that display these fields directly remain consistent.
@@ -143,6 +146,10 @@ class RadioInterface

    virtual bool wideLora() { return false; }

+    /// Whether the radio can tune sub-GHz bands. False for 2.4 GHz-only chips (SX128x);
+    /// multiband chips like the LR1121 keep the default.
+    virtual bool supportsSubGhz() { return true; }
+
    /// Prepare hardware for sleep.  Call this _only_ for deep sleep, not needed for light sleep.
    virtual bool sleep() { return true; }

@@ -244,7 +251,12 @@ class RadioInterface

    static bool checkOrClampConfigLora(meshtastic_Config_LoRaConfig &loraConfig, bool clamp);

-    // Check if a candidate region is compatible and valid.
+    // Check if a candidate region is compatible and valid, with no side effects (safe for
+    // speculative UI checks). errBuf, if given, receives the failure reason.
+    static bool checkConfigRegion(const meshtastic_Config_LoRaConfig &loraConfig, char *errBuf = nullptr, size_t errLen = 0);
+
+    // Check if a candidate region is compatible and valid. On failure, logs at ERROR,
+    // records a critical error, and sends a client notification.
    static bool validateConfigRegion(const meshtastic_Config_LoRaConfig &loraConfig);

    // Check if a candidate radio configuration is valid.
@@ -253,6 +265,11 @@ class RadioInterface
    // Make a candidate radio configuration valid, even if it isn't.
    static void clampConfigLora(meshtastic_Config_LoRaConfig &loraConfig);

+    // If preset is locked to a sibling of currentRegion among the swappable EU regions
+    // (EU_868/EU_866/EU_N_868), return the sibling region owning the preset, else nullptr.
+    static const RegionInfo *regionSwapForPreset(meshtastic_Config_LoRaConfig_RegionCode currentRegion,
+                                                 meshtastic_Config_LoRaConfig_ModemPreset preset);
+
  protected:
    int8_t power = 17; // Set by applyModemConfig()

@@ -614,6 +614,10 @@ void RadioLibInterface::handleReceiveInterrupt()

            printPacket("Lora RX", mp);

+#ifdef LED_LORA
+            loraRxPacketObservable.notifyObservers(mp->from);
+#endif
+
            airTime->logAirtime(RX_LOG, rxMsec);

            deliverToReceiver(mp);
@@ -15,6 +15,9 @@
 #if HAS_TRAFFIC_MANAGEMENT
 #include "modules/TrafficManagementModule.h"
 #endif
+#if HAS_VARIABLE_HOPS
+#include "modules/HopScalingModule.h"
+#endif
 #if !MESHTASTIC_EXCLUDE_MQTT
 #include "mqtt/MQTT.h"
 #endif
@@ -22,8 +25,6 @@
 #if ARCH_PORTDUINO
 #include "Throttle.h"
 #include "platform/portduino/PortduinoGlue.h"
-#endif
-#if ENABLE_JSON_LOGGING || ARCH_PORTDUINO
 #include "serialization/MeshPacketSerializer.h"
 #endif

@@ -357,6 +358,30 @@ ErrorCode Router::send(meshtastic_MeshPacket *p)
    p->from = getFrom(p);

    p->relay_node = nodeDB->getLastByteOfNodeNum(getNodeNum()); // set the relayer to us
+
+#if HAS_VARIABLE_HOPS
+    // Apply HopScaling hop recommendation to routine outgoing broadcasts
+    if (isFromUs(p) && isBroadcast(p->to) && hopScalingModule && p->which_payload_variant == meshtastic_MeshPacket_decoded_tag) {
+        switch (p->decoded.portnum) {
+        case meshtastic_PortNum_POSITION_APP:
+        case meshtastic_PortNum_TELEMETRY_APP:
+        case meshtastic_PortNum_NODEINFO_APP:
+        case meshtastic_PortNum_NEIGHBORINFO_APP: {
+            uint8_t variableHopLimit = hopScalingModule->getLastRequiredHop();
+
+            // Never exceed user-configured hop_limit
+            if (variableHopLimit < p->hop_limit) {
+                LOG_DEBUG("[HOPSCALE] hop_limit %u -> %u for portnum %u", p->hop_limit, variableHopLimit, p->decoded.portnum);
+                p->hop_limit = variableHopLimit;
+            }
+            break;
+        }
+        default:
+            break;
+        }
+    }
+#endif
+
    // If we are the original transmitter, set the hop limit with which we start
    if (isFromUs(p))
        p->hop_start = p->hop_limit;
@@ -534,6 +559,38 @@ DecodeState perhapsDecode(meshtastic_MeshPacket *p)
        if (p->decoded.has_bitfield)
            p->decoded.want_response |= p->decoded.bitfield & BITFIELD_WANT_RESPONSE_MASK;

+#if !(MESHTASTIC_EXCLUDE_PKI) && !(MESHTASTIC_EXCLUDE_XEDDSA)
+        if (p->decoded.xeddsa_signature.size == XEDDSA_SIGNATURE_SIZE) {
+            meshtastic_NodeInfoLite *node = nodeDB->getMeshNode(p->from);
+            if (node && node->public_key.size == 32) {
+                p->xeddsa_signed =
+                    crypto->xeddsa_verify(node->public_key.bytes, p->from, p->id, p->decoded.portnum, p->decoded.payload.bytes,
+                                          p->decoded.payload.size, p->decoded.xeddsa_signature.bytes);
+                if (p->xeddsa_signed) {
+                    // Mark this node as a signer so future unsigned packets from it are rejected
+                    nodeInfoLiteSetBit(node, NODEINFO_BITFIELD_HAS_XEDDSA_SIGNED_MASK, true);
+                    LOG_DEBUG("Verified XEdDSA signature from 0x%08x", p->from);
+                } else {
+                    LOG_WARN("XEdDSA signature verification failed from 0x%08x, dropping", p->from);
+                    return DecodeState::DECODE_FAILURE;
+                }
+            } else {
+                LOG_DEBUG("No public key for 0x%08x, cannot verify XEdDSA signature", p->from);
+            }
+        } else {
+            // Unsigned packet — only reject the class of packet a signing node always signs:
+            // an unencrypted broadcast small enough to also carry a signature (see perhapsEncode()).
+            // Unicast packets and oversized broadcasts are never signed, so they must not be
+            // hard-failed here even if this node has signed before.
+            const meshtastic_NodeInfoLite *node = nodeDB->getMeshNode(p->from);
+            if (node && nodeInfoLiteHasXeddsaSigned(node) && isBroadcast(p->to) &&
+                p->decoded.payload.size + XEDDSA_SIGNATURE_SIZE < meshtastic_Constants_DATA_PAYLOAD_LEN) {
+                LOG_WARN("Dropping unsigned broadcast from 0x%08x that previously signed", p->from);
+                return DecodeState::DECODE_FAILURE;
+            }
+        }
+#endif
+
        /* Not actually ever used.
        // Decompress if needed. jm
        if (p->decoded.portnum == meshtastic_PortNum_TEXT_MESSAGE_COMPRESSED_APP) {
@@ -555,9 +612,7 @@ DecodeState perhapsDecode(meshtastic_MeshPacket *p)
        } */

        printPacket("decoded message", p);
-#if ENABLE_JSON_LOGGING
-        LOG_TRACE("%s", MeshPacketSerializer::JsonSerialize(p, false).c_str());
-#elif ARCH_PORTDUINO
+#if ARCH_PORTDUINO
        if (portduino_config.traceFilename != "" || portduino_config.logoutputlevel == level_trace) {
            LOG_TRACE("%s", MeshPacketSerializer::JsonSerialize(p, false).c_str());
        } else if (portduino_config.JSONFilename != "") {
@@ -606,6 +661,18 @@ meshtastic_Routing_Error perhapsEncode(meshtastic_MeshPacket *p)
            p->decoded.has_bitfield = true;
            p->decoded.bitfield |= (config.lora.config_ok_to_mqtt << BITFIELD_OK_TO_MQTT_SHIFT);
            p->decoded.bitfield |= (p->decoded.want_response << BITFIELD_WANT_RESPONSE_SHIFT);
+#if !(MESHTASTIC_EXCLUDE_PKI) && !(MESHTASTIC_EXCLUDE_XEDDSA)
+            // Sign broadcast packets if payload + signature fits within the max Data payload.
+            // The actual encoded size is checked after pb_encode (TOO_LARGE).
+            if (!p->pki_encrypted && isBroadcast(p->to) &&
+                p->decoded.payload.size + XEDDSA_SIGNATURE_SIZE < meshtastic_Constants_DATA_PAYLOAD_LEN) {
+                if (crypto->xeddsa_sign(p->from, p->id, p->decoded.portnum, p->decoded.payload.bytes, p->decoded.payload.size,
+                                        p->decoded.xeddsa_signature.bytes)) {
+                    p->decoded.xeddsa_signature.size = XEDDSA_SIGNATURE_SIZE;
+                    LOG_DEBUG("XEdDSA signed packet 0x%08x", p->id);
+                }
+            }
+#endif
        }

        size_t numbytes = pb_encode_to_bytes(bytes, sizeof(bytes), &meshtastic_Data_msg, &p->decoded);
@@ -852,11 +919,7 @@ void Router::handleReceived(meshtastic_MeshPacket *p, RxSource src)

 void Router::perhapsHandleReceived(meshtastic_MeshPacket *p)
 {
-#if ENABLE_JSON_LOGGING
-    // Even ignored packets get logged in the trace
-    p->rx_time = getValidTime(RTCQualityFromNet); // store the arrival timestamp for the phone
-    LOG_TRACE("%s", MeshPacketSerializer::JsonSerializeEncrypted(p).c_str());
-#elif ARCH_PORTDUINO
+#if ARCH_PORTDUINO
    // Even ignored packets get logged in the trace
    if (portduino_config.traceFilename != "" || portduino_config.logoutputlevel == level_trace) {
        p->rx_time = getValidTime(RTCQualityFromNet); // store the arrival timestamp for the phone
@@ -35,6 +35,14 @@ class Router : protected concurrency::OSThread, protected PacketHistory
     */
    void addInterface(std::unique_ptr<RadioInterface> _iface) { iface = std::move(_iface); }

+    /**
+     * Borrowed (non-owning) access to the radio interface — used by NodeDB
+     * after a lockdown unlock so it can push the freshly-loaded config to
+     * the SX12xx via reconfigure(). Returns nullptr when no radio has been
+     * attached (e.g. ARCH_PORTDUINO simulator before SimRadio bind).
+     */
+    RadioInterface *getRadioIface() { return iface.get(); }
+
    /**
     * do idle processing
     * Mostly looking in our incoming rxPacket queue and calling handleReceived.
@@ -19,6 +19,9 @@ template <class T> class SX128xInterface : public RadioLibInterface

    virtual bool wideLora() override;

+    /// SX128x is a 2.4 GHz-only chip; it cannot tune sub-GHz regions
+    virtual bool supportsSubGhz() override { return false; }
+
    /// Apply any radio provisioning changes
    /// Make sure the Driver is properly configured before calling init().
    /// \return true if initialisation succeeded.
@@ -18,6 +18,7 @@ meshtastic_NodeInfo TypeConversions::ConvertToNodeInfo(const meshtastic_NodeInfo
    info.is_ignored = nodeInfoLiteIsIgnored(lite);
    info.is_key_manually_verified = nodeInfoLiteIsKeyManuallyVerified(lite);
    info.is_muted = nodeInfoLiteIsMuted(lite);
+    info.has_xeddsa_signed = nodeInfoLiteHasXeddsaSigned(lite);

    if (lite->has_hops_away) {
        info.has_hops_away = true;
@@ -198,6 +198,28 @@ typedef struct _meshtastic_LockdownAuth {
 way to reset the session clock is a reboot, which costs a boot
 from the on-flash, HMAC-bound counter. */
    uint32_t max_session_seconds;
+    /* Disable lockdown mode. Requires a valid passphrase in the same
+ message (the device must prove the operator owns it before
+ reverting at-rest encryption). On success the firmware decrypts
+ every stored config / channel / nodedb file back to plaintext,
+ removes the wrapped DEK, unlock token, monotonic-counter, and
+ backoff files, and reboots out of lockdown.
+
+ This is the inverse of the provision/unlock path: it is how the
+ client app's "lockdown mode" toggle returns a device to normal
+ operation.
+
+ NOT reversed by this operation: APPROTECT. Once the debug port
+ lockout has been burned (on silicon where it is effective) it is
+ permanent — disabling lockdown decrypts your data and removes the
+ access gates, but the SWD/JTAG port stays locked for the life of
+ the device (recoverable only via a full chip erase over a debug
+ probe, which destroys all data). Clients should make this
+ irreversibility clear at the moment lockdown is first enabled.
+
+ When true the passphrase field is still required; boots_remaining,
+ valid_until_epoch, max_session_seconds, and lock_now are ignored. */
+    bool disable;
 } meshtastic_LockdownAuth;

 /* Parameters for setting up Meshtastic for ameteur radio usage */
@@ -212,6 +234,9 @@ typedef struct _meshtastic_HamParameters {
    float frequency;
    /* Optional short name of user */
    char short_name[5];
+    /* Optional long name of user
+ Appended to callsign */
+    char long_name[15];
 } meshtastic_HamParameters;

 /* Response envelope for node_remote_hardware_pins */
@@ -521,8 +546,8 @@ extern "C" {
 #define meshtastic_AdminMessage_init_default     {0, {0}, {0, {0}}}
 #define meshtastic_AdminMessage_InputEvent_init_default {0, 0, 0, 0}
 #define meshtastic_AdminMessage_OTAEvent_init_default {_meshtastic_OTAMode_MIN, {0, {0}}}
-#define meshtastic_LockdownAuth_init_default     {{0, {0}}, 0, 0, 0, 0}
-#define meshtastic_HamParameters_init_default    {"", 0, 0, ""}
+#define meshtastic_LockdownAuth_init_default     {{0, {0}}, 0, 0, 0, 0, 0}
+#define meshtastic_HamParameters_init_default    {"", 0, 0, "", ""}
 #define meshtastic_NodeRemoteHardwarePinsResponse_init_default {0, {meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default}}
 #define meshtastic_SharedContact_init_default    {0, false, meshtastic_User_init_default, 0, 0}
 #define meshtastic_KeyVerificationAdmin_init_default {_meshtastic_KeyVerificationAdmin_MessageType_MIN, 0, 0, false, 0}
@@ -534,8 +559,8 @@ extern "C" {
 #define meshtastic_AdminMessage_init_zero        {0, {0}, {0, {0}}}
 #define meshtastic_AdminMessage_InputEvent_init_zero {0, 0, 0, 0}
 #define meshtastic_AdminMessage_OTAEvent_init_zero {_meshtastic_OTAMode_MIN, {0, {0}}}
-#define meshtastic_LockdownAuth_init_zero        {{0, {0}}, 0, 0, 0, 0}
-#define meshtastic_HamParameters_init_zero       {"", 0, 0, ""}
+#define meshtastic_LockdownAuth_init_zero        {{0, {0}}, 0, 0, 0, 0, 0}
+#define meshtastic_HamParameters_init_zero       {"", 0, 0, "", ""}
 #define meshtastic_NodeRemoteHardwarePinsResponse_init_zero {0, {meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero}}
 #define meshtastic_SharedContact_init_zero       {0, false, meshtastic_User_init_zero, 0, 0}
 #define meshtastic_KeyVerificationAdmin_init_zero {_meshtastic_KeyVerificationAdmin_MessageType_MIN, 0, 0, false, 0}
@@ -557,10 +582,12 @@ extern "C" {
 #define meshtastic_LockdownAuth_valid_until_epoch_tag 3
 #define meshtastic_LockdownAuth_lock_now_tag     4
 #define meshtastic_LockdownAuth_max_session_seconds_tag 5
+#define meshtastic_LockdownAuth_disable_tag      6
 #define meshtastic_HamParameters_call_sign_tag   1
 #define meshtastic_HamParameters_tx_power_tag    2
 #define meshtastic_HamParameters_frequency_tag   3
 #define meshtastic_HamParameters_short_name_tag  4
+#define meshtastic_HamParameters_long_name_tag   5
 #define meshtastic_NodeRemoteHardwarePinsResponse_node_remote_hardware_pins_tag 1
 #define meshtastic_SharedContact_node_num_tag    1
 #define meshtastic_SharedContact_user_tag        2
@@ -754,7 +781,8 @@ X(a, STATIC,   SINGULAR, BYTES,    passphrase,        1) \
 X(a, STATIC,   SINGULAR, UINT32,   boots_remaining,   2) \
 X(a, STATIC,   SINGULAR, UINT32,   valid_until_epoch,   3) \
 X(a, STATIC,   SINGULAR, BOOL,     lock_now,          4) \
-X(a, STATIC,   SINGULAR, UINT32,   max_session_seconds,   5)
+X(a, STATIC,   SINGULAR, UINT32,   max_session_seconds,   5) \
+X(a, STATIC,   SINGULAR, BOOL,     disable,           6)
 #define meshtastic_LockdownAuth_CALLBACK NULL
 #define meshtastic_LockdownAuth_DEFAULT NULL

@@ -762,7 +790,8 @@ X(a, STATIC,   SINGULAR, UINT32,   max_session_seconds,   5)
 X(a, STATIC,   SINGULAR, STRING,   call_sign,         1) \
 X(a, STATIC,   SINGULAR, INT32,    tx_power,          2) \
 X(a, STATIC,   SINGULAR, FLOAT,    frequency,         3) \
-X(a, STATIC,   SINGULAR, STRING,   short_name,        4)
+X(a, STATIC,   SINGULAR, STRING,   short_name,        4) \
+X(a, STATIC,   SINGULAR, STRING,   long_name,         5)
 #define meshtastic_HamParameters_CALLBACK NULL
 #define meshtastic_HamParameters_DEFAULT NULL

@@ -867,9 +896,9 @@ extern const pb_msgdesc_t meshtastic_SHTXX_config_msg;
 #define meshtastic_AdminMessage_InputEvent_size  14
 #define meshtastic_AdminMessage_OTAEvent_size    36
 #define meshtastic_AdminMessage_size             511
-#define meshtastic_HamParameters_size            31
+#define meshtastic_HamParameters_size            47
 #define meshtastic_KeyVerificationAdmin_size     25
-#define meshtastic_LockdownAuth_size             54
+#define meshtastic_LockdownAuth_size             56
 #define meshtastic_NodeRemoteHardwarePinsResponse_size 496
 #define meshtastic_SCD30_config_size             27
 #define meshtastic_SCD4X_config_size             29
@@ -17,7 +17,7 @@
 typedef struct _meshtastic_DeviceProfile {
    /* Long name for the node */
    bool has_long_name;
-    char long_name[40];
+    char long_name[25];
    /* Short name of the node */
    bool has_short_name;
    char short_name[5];
@@ -309,7 +309,11 @@ typedef enum _meshtastic_Config_LoRaConfig_RegionCode {
    meshtastic_Config_LoRaConfig_RegionCode_ITU2_70CM = 35,
    /* ITU Region 3 Amateur Radio 70cm band (430-450 MHz)
 Note: Some countries do not allocate 440-450 MHz. Check local law! */
-    meshtastic_Config_LoRaConfig_RegionCode_ITU3_70CM = 36
+    meshtastic_Config_LoRaConfig_RegionCode_ITU3_70CM = 36,
+    /* ITU Region 2 Amateur Radio 1.25m '125cm' band (220-225 MHz)
+ Note: Some countries do not allocate 220-222 MHz (Ex: USA/Canada).
+ Check local law! */
+    meshtastic_Config_LoRaConfig_RegionCode_ITU2_125CM = 37
 } meshtastic_Config_LoRaConfig_RegionCode;

 /* Standard predefined channel settings
@@ -356,7 +360,21 @@ typedef enum _meshtastic_Config_LoRaConfig_ModemPreset {
    /* Narrow Slow
 Moderate range preset optimized for EU 868MHz band with 62.5kHz bandwidth.
 Comparable link budget and data rate to LONG_FAST. */
-    meshtastic_Config_LoRaConfig_ModemPreset_NARROW_SLOW = 13
+    meshtastic_Config_LoRaConfig_ModemPreset_NARROW_SLOW = 13,
+    /* Tiny Fast
+ Preset optimized for compliance with Amateur Radio restrictions with 20kHz bandwidth.
+ Many regions limit data transmission bandwidth in lower amateur bands (2 Meter).
+ Note: TCXO with tight tolerances (±5 ppm or better) is *absolutely required* at these narrow bandwidths.
+ Only compatible with SX127x and SX126x chipsets.
+ Comparable link budget and data rate to LONG_FAST. */
+    meshtastic_Config_LoRaConfig_ModemPreset_TINY_FAST = 14,
+    /* Tiny Slow
+ Preset optimized for compliance with Amateur Radio restrictions with 20kHz bandwidth.
+ Many regions limit data transmission bandwidth in lower amateur bands (2 Meter).
+ Note: TCXO with tight tolerances (±5 ppm or better) is *absolutely required* at these narrow bandwidths.
+ Only compatible with SX127x and SX126x chipsets.
+ Comparable link budget and data rate to LONG_MODERATE. */
+    meshtastic_Config_LoRaConfig_ModemPreset_TINY_SLOW = 15
 } meshtastic_Config_LoRaConfig_ModemPreset;

 typedef enum _meshtastic_Config_LoRaConfig_FEM_LNA_Mode {
@@ -745,12 +763,12 @@ extern "C" {
 #define _meshtastic_Config_DisplayConfig_CompassOrientation_ARRAYSIZE ((meshtastic_Config_DisplayConfig_CompassOrientation)(meshtastic_Config_DisplayConfig_CompassOrientation_DEGREES_270_INVERTED+1))

 #define _meshtastic_Config_LoRaConfig_RegionCode_MIN meshtastic_Config_LoRaConfig_RegionCode_UNSET
-#define _meshtastic_Config_LoRaConfig_RegionCode_MAX meshtastic_Config_LoRaConfig_RegionCode_ITU3_70CM
-#define _meshtastic_Config_LoRaConfig_RegionCode_ARRAYSIZE ((meshtastic_Config_LoRaConfig_RegionCode)(meshtastic_Config_LoRaConfig_RegionCode_ITU3_70CM+1))
+#define _meshtastic_Config_LoRaConfig_RegionCode_MAX meshtastic_Config_LoRaConfig_RegionCode_ITU2_125CM
+#define _meshtastic_Config_LoRaConfig_RegionCode_ARRAYSIZE ((meshtastic_Config_LoRaConfig_RegionCode)(meshtastic_Config_LoRaConfig_RegionCode_ITU2_125CM+1))

 #define _meshtastic_Config_LoRaConfig_ModemPreset_MIN meshtastic_Config_LoRaConfig_ModemPreset_LONG_FAST
-#define _meshtastic_Config_LoRaConfig_ModemPreset_MAX meshtastic_Config_LoRaConfig_ModemPreset_NARROW_SLOW
-#define _meshtastic_Config_LoRaConfig_ModemPreset_ARRAYSIZE ((meshtastic_Config_LoRaConfig_ModemPreset)(meshtastic_Config_LoRaConfig_ModemPreset_NARROW_SLOW+1))
+#define _meshtastic_Config_LoRaConfig_ModemPreset_MAX meshtastic_Config_LoRaConfig_ModemPreset_TINY_SLOW
+#define _meshtastic_Config_LoRaConfig_ModemPreset_ARRAYSIZE ((meshtastic_Config_LoRaConfig_ModemPreset)(meshtastic_Config_LoRaConfig_ModemPreset_TINY_SLOW+1))

 #define _meshtastic_Config_LoRaConfig_FEM_LNA_Mode_MIN meshtastic_Config_LoRaConfig_FEM_LNA_Mode_DISABLED
 #define _meshtastic_Config_LoRaConfig_FEM_LNA_Mode_MAX meshtastic_Config_LoRaConfig_FEM_LNA_Mode_NOT_PRESENT
@@ -69,8 +69,8 @@ typedef PB_BYTES_ARRAY_T(32) meshtastic_NodeInfoLite_public_key_t;
 typedef struct _meshtastic_NodeInfoLite {
    /* The node number */
    uint32_t num;
-    /* Returns the Signal-to-noise ratio (SNR) of the last received message,
- as measured by the receiver. Return SNR of the last received message in dB */
+    /* In-memory SNR of the last received message in dB. Not serialised directly:
+ always zeroed before encode; persisted as snr_q4 = 19 below. */
    float snr;
    /* Set to indicate the last time we received a packet from this node */
    uint32_t last_heard;
@@ -94,6 +94,10 @@ typedef struct _meshtastic_NodeInfoLite {
    meshtastic_Config_DeviceConfig_Role role;
    /* The public key of the user's device, for PKI-based encrypted DMs. */
    meshtastic_NodeInfoLite_public_key_t public_key;
+    /* Q4-encoded SNR: dB × 4, sint32 zigzag. Matches RouteDiscovery convention.
+ Encode: snr_q4 = (int32_t)(snr * 4.0f). Decode: snr = snr_q4 / 4.0f.
+ float snr is always zeroed on disk; this field carries all persisted SNR. */
+    int32_t snr_q4;
 } meshtastic_NodeInfoLite;

 /* This message is never sent over the wire, but it is used for serializing DB
@@ -215,7 +219,7 @@ extern "C" {
 /* Initializer values for message structs */
 #define meshtastic_PositionLite_init_default     {0, 0, 0, 0, _meshtastic_Position_LocSource_MIN, 0}
 #define meshtastic_UserLite_init_default         {{0}, "", "", _meshtastic_HardwareModel_MIN, 0, _meshtastic_Config_DeviceConfig_Role_MIN, {0, {0}}, false, 0}
-#define meshtastic_NodeInfoLite_init_default     {0, 0, 0, 0, false, 0, 0, 0, "", "", _meshtastic_HardwareModel_MIN, _meshtastic_Config_DeviceConfig_Role_MIN, {0, {0}}}
+#define meshtastic_NodeInfoLite_init_default     {0, 0, 0, 0, false, 0, 0, 0, "", "", _meshtastic_HardwareModel_MIN, _meshtastic_Config_DeviceConfig_Role_MIN, {0, {0}}, 0}
 #define meshtastic_DeviceState_init_default      {false, meshtastic_MyNodeInfo_init_default, false, meshtastic_User_init_default, 0, {meshtastic_MeshPacket_init_default}, false, meshtastic_MeshPacket_init_default, 0, 0, 0, false, meshtastic_MeshPacket_init_default, 0, {meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default, meshtastic_NodeRemoteHardwarePin_init_default}}
 #define meshtastic_NodePositionEntry_init_default {0, false, meshtastic_PositionLite_init_default}
 #define meshtastic_NodeTelemetryEntry_init_default {0, false, meshtastic_DeviceMetrics_init_default}
@@ -226,7 +230,7 @@ extern "C" {
 #define meshtastic_BackupPreferences_init_default {0, 0, false, meshtastic_LocalConfig_init_default, false, meshtastic_LocalModuleConfig_init_default, false, meshtastic_ChannelFile_init_default, false, meshtastic_User_init_default}
 #define meshtastic_PositionLite_init_zero        {0, 0, 0, 0, _meshtastic_Position_LocSource_MIN, 0}
 #define meshtastic_UserLite_init_zero            {{0}, "", "", _meshtastic_HardwareModel_MIN, 0, _meshtastic_Config_DeviceConfig_Role_MIN, {0, {0}}, false, 0}
-#define meshtastic_NodeInfoLite_init_zero        {0, 0, 0, 0, false, 0, 0, 0, "", "", _meshtastic_HardwareModel_MIN, _meshtastic_Config_DeviceConfig_Role_MIN, {0, {0}}}
+#define meshtastic_NodeInfoLite_init_zero        {0, 0, 0, 0, false, 0, 0, 0, "", "", _meshtastic_HardwareModel_MIN, _meshtastic_Config_DeviceConfig_Role_MIN, {0, {0}}, 0}
 #define meshtastic_DeviceState_init_zero         {false, meshtastic_MyNodeInfo_init_zero, false, meshtastic_User_init_zero, 0, {meshtastic_MeshPacket_init_zero}, false, meshtastic_MeshPacket_init_zero, 0, 0, 0, false, meshtastic_MeshPacket_init_zero, 0, {meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero, meshtastic_NodeRemoteHardwarePin_init_zero}}
 #define meshtastic_NodePositionEntry_init_zero   {0, false, meshtastic_PositionLite_init_zero}
 #define meshtastic_NodeTelemetryEntry_init_zero  {0, false, meshtastic_DeviceMetrics_init_zero}
@@ -263,6 +267,7 @@ extern "C" {
 #define meshtastic_NodeInfoLite_hw_model_tag     16
 #define meshtastic_NodeInfoLite_role_tag         17
 #define meshtastic_NodeInfoLite_public_key_tag   18
+#define meshtastic_NodeInfoLite_snr_q4_tag       19
 #define meshtastic_DeviceState_my_node_tag       2
 #define meshtastic_DeviceState_owner_tag         3
 #define meshtastic_DeviceState_receive_queue_tag 5
@@ -330,7 +335,8 @@ X(a, STATIC,   SINGULAR, STRING,   long_name,        14) \
 X(a, STATIC,   SINGULAR, STRING,   short_name,       15) \
 X(a, STATIC,   SINGULAR, UENUM,    hw_model,         16) \
 X(a, STATIC,   SINGULAR, UENUM,    role,             17) \
-X(a, STATIC,   SINGULAR, BYTES,    public_key,       18)
+X(a, STATIC,   SINGULAR, BYTES,    public_key,       18) \
+X(a, STATIC,   SINGULAR, SINT32,   snr_q4,           19)
 #define meshtastic_NodeInfoLite_CALLBACK NULL
 #define meshtastic_NodeInfoLite_DEFAULT NULL

@@ -450,7 +456,7 @@ extern const pb_msgdesc_t meshtastic_BackupPreferences_msg;
 #define meshtastic_ChannelFile_size              718
 #define meshtastic_DeviceState_size              1944
 #define meshtastic_NodeEnvironmentEntry_size     170
-#define meshtastic_NodeInfoLite_size             105
+#define meshtastic_NodeInfoLite_size             112
 #define meshtastic_NodePositionEntry_size        42
 #define meshtastic_NodeStatusEntry_size          89
 #define meshtastic_NodeTelemetryEntry_size       35
@@ -325,6 +325,14 @@ typedef enum _meshtastic_HardwareModel {
    meshtastic_HardwareModel_T_IMPULSE_PLUS = 135,
    /* Lilygo T-Echo Card */
    meshtastic_HardwareModel_T_ECHO_CARD = 136,
+    /* Seeed Tracker L2 */
+    meshtastic_HardwareModel_SEEED_WIO_TRACKER_L2 = 137,
+    /* Elecrow CrowPanel Advance P4 models, ESP32-P4 and TFT with SX1262 radio plugin */
+    meshtastic_HardwareModel_CROWPANEL_P4 = 138,
+    /* Heltec Mesh Tower V2 */
+    meshtastic_HardwareModel_HELTEC_MESH_TOWER_V2 = 139,
+    /* Meshnology W10 */
+    meshtastic_HardwareModel_MESHNOLOGY_W10 = 140,
    /* ------------------------------------------------------------------------------------------------------------------------------------------
 Reserved ID For developing private Ports. These will show up in live traffic sparsely, so we can use a high number. Keep it within 8 bits.
 ------------------------------------------------------------------------------------------------------------------------------------------ */
@@ -621,7 +629,9 @@ typedef enum _meshtastic_MeshPacket_TransportMechanism {
    /* Arrived via Multicast UDP */
    meshtastic_MeshPacket_TransportMechanism_TRANSPORT_MULTICAST_UDP = 6,
    /* Arrived via API connection */
-    meshtastic_MeshPacket_TransportMechanism_TRANSPORT_API = 7
+    meshtastic_MeshPacket_TransportMechanism_TRANSPORT_API = 7,
+    /* Arrived via Unicast UDP */
+    meshtastic_MeshPacket_TransportMechanism_TRANSPORT_UNICAST_UDP = 8
 } meshtastic_MeshPacket_TransportMechanism;

 /* Log levels, chosen to match python logging conventions. */
@@ -658,7 +668,14 @@ typedef enum _meshtastic_LockdownStatus_State {
 token's TTL. */
    meshtastic_LockdownStatus_State_UNLOCKED = 3,
    /* Passphrase rejected. backoff_seconds is non-zero when rate-limited. */
-    meshtastic_LockdownStatus_State_UNLOCK_FAILED = 4
+    meshtastic_LockdownStatus_State_UNLOCK_FAILED = 4,
+    /* Lockdown is supported by this firmware but not currently active
+ (no passphrase has been provisioned, or it was disabled via
+ AdminMessage.lockdown_auth.disable). The device is operating in
+ normal, non-encrypted mode. Clients render the lockdown-mode
+ toggle as OFF on receiving this. Distinct from NEEDS_PROVISION,
+ which is only used during an in-progress enable flow. */
+    meshtastic_LockdownStatus_State_DISABLED = 5
 } meshtastic_LockdownStatus_State;

 /* Struct definitions */
@@ -765,7 +782,10 @@ typedef struct _meshtastic_User {
 Note: app developers are encouraged to also use the following standard
 node IDs "^all" (for broadcast), "^local" (for the locally connected node) */
    char id[16];
-    /* A full name for this user, i.e. "Kevin Hester" */
+    /* A full name for this user, i.e. "Kevin Hester"
+ Limited to 24 bytes of UTF-8: longer names are accepted from senders
+ built against the older 39-byte limit, but devices truncate them before
+ storing or rebroadcasting. Clients should enforce 24 bytes in their UI. */
    char long_name[40];
    /* A VERY short name, ideally two characters.
 Suitable for a tiny OLED screen */
@@ -1525,16 +1545,16 @@ extern "C" {
 #define _meshtastic_MeshPacket_Delayed_ARRAYSIZE ((meshtastic_MeshPacket_Delayed)(meshtastic_MeshPacket_Delayed_DELAYED_DIRECT+1))

 #define _meshtastic_MeshPacket_TransportMechanism_MIN meshtastic_MeshPacket_TransportMechanism_TRANSPORT_INTERNAL
-#define _meshtastic_MeshPacket_TransportMechanism_MAX meshtastic_MeshPacket_TransportMechanism_TRANSPORT_API
-#define _meshtastic_MeshPacket_TransportMechanism_ARRAYSIZE ((meshtastic_MeshPacket_TransportMechanism)(meshtastic_MeshPacket_TransportMechanism_TRANSPORT_API+1))
+#define _meshtastic_MeshPacket_TransportMechanism_MAX meshtastic_MeshPacket_TransportMechanism_TRANSPORT_UNICAST_UDP
+#define _meshtastic_MeshPacket_TransportMechanism_ARRAYSIZE ((meshtastic_MeshPacket_TransportMechanism)(meshtastic_MeshPacket_TransportMechanism_TRANSPORT_UNICAST_UDP+1))

 #define _meshtastic_LogRecord_Level_MIN meshtastic_LogRecord_Level_UNSET
 #define _meshtastic_LogRecord_Level_MAX meshtastic_LogRecord_Level_CRITICAL
 #define _meshtastic_LogRecord_Level_ARRAYSIZE ((meshtastic_LogRecord_Level)(meshtastic_LogRecord_Level_CRITICAL+1))

 #define _meshtastic_LockdownStatus_State_MIN meshtastic_LockdownStatus_State_STATE_UNSPECIFIED
-#define _meshtastic_LockdownStatus_State_MAX meshtastic_LockdownStatus_State_UNLOCK_FAILED
-#define _meshtastic_LockdownStatus_State_ARRAYSIZE ((meshtastic_LockdownStatus_State)(meshtastic_LockdownStatus_State_UNLOCK_FAILED+1))
+#define _meshtastic_LockdownStatus_State_MAX meshtastic_LockdownStatus_State_DISABLED
+#define _meshtastic_LockdownStatus_State_ARRAYSIZE ((meshtastic_LockdownStatus_State)(meshtastic_LockdownStatus_State_DISABLED+1))

 #define meshtastic_Position_location_source_ENUMTYPE meshtastic_Position_LocSource
 #define meshtastic_Position_altitude_source_ENUMTYPE meshtastic_Position_AltSource
@@ -27,7 +27,7 @@ typedef struct _meshtastic_ServiceEnvelope {
 /* Information about a node intended to be reported unencrypted to a map using MQTT. */
 typedef struct _meshtastic_MapReport {
    /* A full name for this user, i.e. "Kevin Hester" */
-    char long_name[40];
+    char long_name[25];
    /* A VERY short name, ideally two characters.
 Suitable for a tiny OLED screen */
    char short_name[5];
@@ -126,7 +126,7 @@ extern const pb_msgdesc_t meshtastic_MapReport_msg;
 /* Maximum encoded size of messages (where known) */
 /* meshtastic_ServiceEnvelope_size depends on runtime parameters */
 #define MESHTASTIC_MESHTASTIC_MQTT_PB_H_MAX_SIZE meshtastic_MapReport_size
-#define meshtastic_MapReport_size                110
+#define meshtastic_MapReport_size                95

 #ifdef __cplusplus
 } /* extern "C" */
@@ -11,11 +11,12 @@
 #endif
 #include "SPILock.h"
 #include "power.h"
-#include "serialization/JSON.h"
 #include <FSCommon.h>
 #include <HTTPBodyParser.hpp>
 #include <HTTPMultipartBodyParser.hpp>
 #include <HTTPURLEncodedBodyParser.hpp>
+#include <cmath>
+#include <sstream>

 #ifdef ARCH_ESP32
 #include "esp_task_wdt.h"
@@ -259,40 +260,95 @@ void htmlDeleteDir(const char *dirname)
    root.close();
 }

-JSONArray htmlListDir(const char *dirname, uint8_t levels)
+// Escape a string into a JSON double-quoted literal. Matches the previous
+// SimpleJSON StringifyString behavior (0x00-0x1F and 0x7F -> \u00xx lowercase,
+// escapes " \ / \b \f \n \r \t, UTF-8 passes through unchanged).
+static std::string jsonEscape(const std::string &str)
+{
+    std::string out = "\"";
+    for (size_t i = 0; i < str.size(); ++i) {
+        char chr = str[i];
+        if (chr == '"' || chr == '\\' || chr == '/') {
+            out += '\\';
+            out += chr;
+        } else if (chr == '\b') {
+            out += "\\b";
+        } else if (chr == '\f') {
+            out += "\\f";
+        } else if (chr == '\n') {
+            out += "\\n";
+        } else if (chr == '\r') {
+            out += "\\r";
+        } else if (chr == '\t') {
+            out += "\\t";
+        } else if ((unsigned char)chr < 0x20 || chr == 0x7F) {
+            char buf[8];
+            snprintf(buf, sizeof(buf), "\\u%04x", (unsigned char)chr);
+            out += buf;
+        } else {
+            out += chr;
+        }
+    }
+    out += "\"";
+    return out;
+}
+
+// Format a numeric value the way the previous SimpleJSON serializer did
+// (std::stringstream with precision 15, NaN/Inf -> "null").
+static std::string jsonNum(double v)
+{
+    if (std::isinf(v) || std::isnan(v))
+        return "null";
+    std::ostringstream ss;
+    ss.precision(15);
+    ss << v;
+    return ss.str();
+}
+
+// Build a serialized JSON array string listing files in `dirname`.
+// Subdirectories recurse as nested arrays (up to `levels` deep).
+std::string htmlListDir(const char *dirname, uint8_t levels)
 {
    File root = FSCom.open(dirname, FILE_O_READ);
-    JSONArray fileList;
+    std::string out = "[";
+    bool first = true;
    if (!root) {
-        return fileList;
+        out += "]";
+        return out;
    }
    if (!root.isDirectory()) {
-        return fileList;
+        out += "]";
+        return out;
    }

    // iterate over the file list
    File file = root.openNextFile();
    while (file) {
+        std::string element;
+        bool haveElement = false;
        if (file.isDirectory() && !String(file.name()).endsWith(".")) {
            if (levels) {
 #ifdef ARCH_ESP32
-                fileList.push_back(new JSONValue(htmlListDir(file.path(), levels - 1)));
+                element = htmlListDir(file.path(), levels - 1);
 #else
-                fileList.push_back(new JSONValue(htmlListDir(file.name(), levels - 1)));
+                element = htmlListDir(file.name(), levels - 1);
 #endif
+                haveElement = true;
                file.close();
            }
        } else {
-            JSONObject thisFileMap;
-            thisFileMap["size"] = new JSONValue((int)file.size());
 #ifdef ARCH_ESP32
            String fileName = String(file.path()).substring(1);
-            thisFileMap["name"] = new JSONValue(fileName.c_str());
 #else
            String fileName = String(file.name()).substring(1);
-            thisFileMap["name"] = new JSONValue(fileName.c_str());
 #endif
            String tempName = String(file.name()).substring(1);
+            // Keys in the previous std::map<string,...> were emitted in
+            // alphabetical order: name, nameModified, size.
+            element = "{";
+            element += jsonEscape("name");
+            element += ":";
+            element += jsonEscape(fileName.c_str());
            if (tempName.endsWith(".gz")) {
 #ifdef ARCH_ESP32
                String modifiedFile = String(file.path()).substring(1);
@@ -300,15 +356,30 @@ JSONArray htmlListDir(const char *dirname, uint8_t levels)
                String modifiedFile = String(file.name()).substring(1);
 #endif
                modifiedFile.remove((modifiedFile.length() - 3), 3);
-                thisFileMap["nameModified"] = new JSONValue(modifiedFile.c_str());
+                element += ",";
+                element += jsonEscape("nameModified");
+                element += ":";
+                element += jsonEscape(modifiedFile.c_str());
            }
-            fileList.push_back(new JSONValue(thisFileMap));
+            element += ",";
+            element += jsonEscape("size");
+            element += ":";
+            element += jsonNum((int)file.size());
+            element += "}";
+            haveElement = true;
+        }
+        if (haveElement) {
+            if (!first)
+                out += ",";
+            out += element;
+            first = false;
        }
        file.close();
        file = root.openNextFile();
    }
    root.close();
-    return fileList;
+    out += "]";
+    return out;
 }

 void handleFsBrowseStatic(HTTPRequest *req, HTTPResponse *res)
@@ -318,28 +389,25 @@ void handleFsBrowseStatic(HTTPRequest *req, HTTPResponse *res)
    res->setHeader("Access-Control-Allow-Methods", "GET");

    concurrency::LockGuard g(spiLock);
-    auto fileList = htmlListDir("/static", 10);
+    std::string fileList = htmlListDir("/static", 10);

-    // create json output structure
-    JSONObject filesystemObj;
-    filesystemObj["total"] = new JSONValue((int)FSCom.totalBytes());
-    filesystemObj["used"] = new JSONValue((int)FSCom.usedBytes());
-    filesystemObj["free"] = new JSONValue(int(FSCom.totalBytes() - FSCom.usedBytes()));
+    uint64_t total = FSCom.totalBytes();
+    uint64_t used = FSCom.usedBytes();

-    JSONObject jsonObjInner;
-    jsonObjInner["files"] = new JSONValue(fileList);
-    jsonObjInner["filesystem"] = new JSONValue(filesystemObj);
+    // Key order matches the previous std::map-based emission (alphabetical).
+    std::string out;
+    out.reserve(fileList.size() + 128);
+    out += "{\"data\":{\"files\":";
+    out += fileList;
+    out += ",\"filesystem\":{\"free\":";
+    out += jsonNum((int)(total - used));
+    out += ",\"total\":";
+    out += jsonNum((int)total);
+    out += ",\"used\":";
+    out += jsonNum((int)used);
+    out += "}},\"status\":\"ok\"}";

-    JSONObject jsonObjOuter;
-    jsonObjOuter["data"] = new JSONValue(jsonObjInner);
-    jsonObjOuter["status"] = new JSONValue("ok");
-
-    JSONValue *value = new JSONValue(jsonObjOuter);
-
-    std::string jsonString = value->Stringify();
-    res->print(jsonString.c_str());
-
-    delete value;
+    res->print(out.c_str());
 }

 void handleFsDeleteStatic(HTTPRequest *req, HTTPResponse *res)
@@ -354,27 +422,13 @@ void handleFsDeleteStatic(HTTPRequest *req, HTTPResponse *res)
    if (params->getQueryParameter("delete", paramValDelete)) {
        std::string pathDelete = "/" + paramValDelete;
        concurrency::LockGuard g(spiLock);
-        if (FSCom.remove(pathDelete.c_str())) {
-
-            LOG_INFO("%s", pathDelete.c_str());
-            JSONObject jsonObjOuter;
-            jsonObjOuter["status"] = new JSONValue("ok");
-            JSONValue *value = new JSONValue(jsonObjOuter);
-            std::string jsonString = value->Stringify();
-            res->print(jsonString.c_str());
-            delete value;
-            return;
-        } else {
-
-            LOG_INFO("%s", pathDelete.c_str());
-            JSONObject jsonObjOuter;
-            jsonObjOuter["status"] = new JSONValue("Error");
-            JSONValue *value = new JSONValue(jsonObjOuter);
-            std::string jsonString = value->Stringify();
-            res->print(jsonString.c_str());
-            delete value;
-            return;
-        }
+        const char *status = FSCom.remove(pathDelete.c_str()) ? "ok" : "Error";
+        LOG_INFO("%s", pathDelete.c_str());
+        std::string out = "{\"status\":";
+        out += jsonEscape(status);
+        out += "}";
+        res->print(out.c_str());
+        return;
    }
 }

@@ -615,95 +669,113 @@ void handleReport(HTTPRequest *req, HTTPResponse *res)
        res->println("<pre>");
    }

-    // Helper lambda to create JSON array and clean up memory properly
-    auto createJSONArrayFromLog = [](const uint32_t *logArray, int count) -> JSONValue * {
-        JSONArray tempArray;
+    auto arrayFromLog = [](const uint32_t *logArray, int count) -> std::string {
+        std::string s = "[";
        for (int i = 0; i < count; i++) {
-            tempArray.push_back(new JSONValue((int)logArray[i]));
+            if (i)
+                s += ",";
+            s += jsonNum((int)logArray[i]);
        }
-        JSONValue *result = new JSONValue(tempArray);
-        // Note: Don't delete tempArray elements here - JSONValue now owns them
-        return result;
+        s += "]";
+        return s;
    };

-    // data->airtime->tx_log
    uint32_t *logArray;
    logArray = airTime->airtimeReport(TX_LOG);
-    JSONValue *txLogJsonValue = createJSONArrayFromLog(logArray, airTime->getPeriodsToLog());
-
-    // data->airtime->rx_log
+    std::string txLog = arrayFromLog(logArray, airTime->getPeriodsToLog());
    logArray = airTime->airtimeReport(RX_LOG);
-    JSONValue *rxLogJsonValue = createJSONArrayFromLog(logArray, airTime->getPeriodsToLog());
-
-    // data->airtime->rx_all_log
+    std::string rxLog = arrayFromLog(logArray, airTime->getPeriodsToLog());
    logArray = airTime->airtimeReport(RX_ALL_LOG);
-    JSONValue *rxAllLogJsonValue = createJSONArrayFromLog(logArray, airTime->getPeriodsToLog());
+    std::string rxAllLog = arrayFromLog(logArray, airTime->getPeriodsToLog());

-    // data->airtime
-    JSONObject jsonObjAirtime;
-    jsonObjAirtime["tx_log"] = txLogJsonValue;
-    jsonObjAirtime["rx_log"] = rxLogJsonValue;
-    jsonObjAirtime["rx_all_log"] = rxAllLogJsonValue;
-    jsonObjAirtime["channel_utilization"] = new JSONValue(airTime->channelUtilizationPercent());
-    jsonObjAirtime["utilization_tx"] = new JSONValue(airTime->utilizationTXPercent());
-    jsonObjAirtime["seconds_since_boot"] = new JSONValue(int(airTime->getSecondsSinceBoot()));
-    jsonObjAirtime["seconds_per_period"] = new JSONValue(int(airTime->getSecondsPerPeriod()));
-    jsonObjAirtime["periods_to_log"] = new JSONValue(airTime->getPeriodsToLog());
-
-    // data->wifi
-    JSONObject jsonObjWifi;
-    jsonObjWifi["rssi"] = new JSONValue(WiFi.RSSI());
    String wifiIPString = WiFi.localIP().toString();
    std::string wifiIP = wifiIPString.c_str();
-    jsonObjWifi["ip"] = new JSONValue(wifiIP.c_str());

-    // data->memory
-    JSONObject jsonObjMemory;
-    jsonObjMemory["heap_total"] = new JSONValue((int)memGet.getHeapSize());
-    jsonObjMemory["heap_free"] = new JSONValue((int)memGet.getFreeHeap());
-    jsonObjMemory["psram_total"] = new JSONValue((int)memGet.getPsramSize());
-    jsonObjMemory["psram_free"] = new JSONValue((int)memGet.getFreePsram());
    spiLock->lock();
-    jsonObjMemory["fs_total"] = new JSONValue((int)FSCom.totalBytes());
-    jsonObjMemory["fs_used"] = new JSONValue((int)FSCom.usedBytes());
-    jsonObjMemory["fs_free"] = new JSONValue(int(FSCom.totalBytes() - FSCom.usedBytes()));
+    uint64_t fsTotal = FSCom.totalBytes();
+    uint64_t fsUsed = FSCom.usedBytes();
    spiLock->unlock();

-    // data->power
-    JSONObject jsonObjPower;
-    jsonObjPower["battery_percent"] = new JSONValue(powerStatus->getBatteryChargePercent());
-    jsonObjPower["battery_voltage_mv"] = new JSONValue(powerStatus->getBatteryVoltageMv());
-    jsonObjPower["has_battery"] = new JSONValue(BoolToString(powerStatus->getHasBattery()));
-    jsonObjPower["has_usb"] = new JSONValue(BoolToString(powerStatus->getHasUSB()));
-    jsonObjPower["is_charging"] = new JSONValue(BoolToString(powerStatus->getIsCharging()));
+    // Emit keys in the same alphabetical order as the previous
+    // std::map-based JSON output to keep responses byte-compatible.
+    std::string out;
+    out.reserve(1024);
+    out += "{\"data\":{";

-    // data->device
-    JSONObject jsonObjDevice;
-    jsonObjDevice["reboot_counter"] = new JSONValue((int)myNodeInfo.reboot_count);
+    // airtime
+    out += "\"airtime\":{";
+    out += "\"channel_utilization\":";
+    out += jsonNum(airTime->channelUtilizationPercent());
+    out += ",\"periods_to_log\":";
+    out += jsonNum(airTime->getPeriodsToLog());
+    out += ",\"rx_all_log\":";
+    out += rxAllLog;
+    out += ",\"rx_log\":";
+    out += rxLog;
+    out += ",\"seconds_per_period\":";
+    out += jsonNum((int)airTime->getSecondsPerPeriod());
+    out += ",\"seconds_since_boot\":";
+    out += jsonNum((int)airTime->getSecondsSinceBoot());
+    out += ",\"tx_log\":";
+    out += txLog;
+    out += ",\"utilization_tx\":";
+    out += jsonNum(airTime->utilizationTXPercent());
+    out += "}";

-    // data->radio
-    JSONObject jsonObjRadio;
-    jsonObjRadio["frequency"] = new JSONValue(RadioLibInterface::instance->getFreq());
-    jsonObjRadio["lora_channel"] = new JSONValue((int)RadioLibInterface::instance->getChannelNum() + 1);
+    // device
+    out += ",\"device\":{\"reboot_counter\":";
+    out += jsonNum((int)myNodeInfo.reboot_count);
+    out += "}";

-    // collect data to inner data object
-    JSONObject jsonObjInner;
-    jsonObjInner["airtime"] = new JSONValue(jsonObjAirtime);
-    jsonObjInner["wifi"] = new JSONValue(jsonObjWifi);
-    jsonObjInner["memory"] = new JSONValue(jsonObjMemory);
-    jsonObjInner["power"] = new JSONValue(jsonObjPower);
-    jsonObjInner["device"] = new JSONValue(jsonObjDevice);
-    jsonObjInner["radio"] = new JSONValue(jsonObjRadio);
+    // memory
+    out += ",\"memory\":{";
+    out += "\"fs_free\":";
+    out += jsonNum((int)(fsTotal - fsUsed));
+    out += ",\"fs_total\":";
+    out += jsonNum((int)fsTotal);
+    out += ",\"fs_used\":";
+    out += jsonNum((int)fsUsed);
+    out += ",\"heap_free\":";
+    out += jsonNum((int)memGet.getFreeHeap());
+    out += ",\"heap_total\":";
+    out += jsonNum((int)memGet.getHeapSize());
+    out += ",\"psram_free\":";
+    out += jsonNum((int)memGet.getFreePsram());
+    out += ",\"psram_total\":";
+    out += jsonNum((int)memGet.getPsramSize());
+    out += "}";

-    // create json output structure
-    JSONObject jsonObjOuter;
-    jsonObjOuter["data"] = new JSONValue(jsonObjInner);
-    jsonObjOuter["status"] = new JSONValue("ok");
-    // serialize and write it to the stream
-    JSONValue *value = new JSONValue(jsonObjOuter);
-    std::string jsonString = value->Stringify();
-    res->print(jsonString.c_str());
-    delete value;
+    // power (has_* / is_charging were serialized as the strings "true"/"false")
+    out += ",\"power\":{";
+    out += "\"battery_percent\":";
+    out += jsonNum(powerStatus->getBatteryChargePercent());
+    out += ",\"battery_voltage_mv\":";
+    out += jsonNum(powerStatus->getBatteryVoltageMv());
+    out += ",\"has_battery\":";
+    out += jsonEscape(BoolToString(powerStatus->getHasBattery()));
+    out += ",\"has_usb\":";
+    out += jsonEscape(BoolToString(powerStatus->getHasUSB()));
+    out += ",\"is_charging\":";
+    out += jsonEscape(BoolToString(powerStatus->getIsCharging()));
+    out += "}";
+
+    // radio
+    out += ",\"radio\":{\"frequency\":";
+    out += jsonNum(RadioLibInterface::instance->getFreq());
+    out += ",\"lora_channel\":";
+    out += jsonNum((int)RadioLibInterface::instance->getChannelNum() + 1);
+    out += "}";
+
+    // wifi
+    out += ",\"wifi\":{\"ip\":";
+    out += jsonEscape(wifiIP);
+    out += ",\"rssi\":";
+    out += jsonNum(WiFi.RSSI());
+    out += "}";
+
+    out += "},\"status\":\"ok\"}";
+
+    res->print(out.c_str());
 }

 void handleNodes(HTTPRequest *req, HTTPResponse *res)
@@ -724,58 +796,66 @@ void handleNodes(HTTPRequest *req, HTTPResponse *res)
        res->println("<pre>");
    }

-    JSONArray nodesArray;
+    std::string out;
+    out.reserve(2048);
+    out += "{\"data\":{\"nodes\":[";

+    bool firstNode = true;
    uint32_t readIndex = 0;
    const meshtastic_NodeInfoLite *tempNodeInfo = nodeDB->readNextMeshNode(readIndex);
    while (tempNodeInfo != NULL) {
        if (nodeInfoLiteHasUser(tempNodeInfo)) {
-            JSONObject node;
-
            char id[16];
            snprintf(id, sizeof(id), "!%08x", tempNodeInfo->num);

-            node["id"] = new JSONValue(id);
-            node["snr"] = new JSONValue(tempNodeInfo->snr);
-            node["via_mqtt"] = new JSONValue(BoolToString(nodeInfoLiteViaMqtt(tempNodeInfo)));
-            node["last_heard"] = new JSONValue((int)tempNodeInfo->last_heard);
-            node["position"] = new JSONValue();
-
+            std::string position;
            if (nodeDB->hasValidPosition(tempNodeInfo)) {
                meshtastic_PositionLite posLite;
                if (nodeDB->copyNodePosition(tempNodeInfo->num, posLite)) {
-                    JSONObject position;
-                    position["latitude"] = new JSONValue((float)posLite.latitude_i * 1e-7);
-                    position["longitude"] = new JSONValue((float)posLite.longitude_i * 1e-7);
-                    position["altitude"] = new JSONValue((int)posLite.altitude);
-                    node["position"] = new JSONValue(position);
+                    position = "{\"altitude\":";
+                    position += jsonNum((int)posLite.altitude);
+                    position += ",\"latitude\":";
+                    position += jsonNum((float)posLite.latitude_i * 1e-7);
+                    position += ",\"longitude\":";
+                    position += jsonNum((float)posLite.longitude_i * 1e-7);
+                    position += "}";
+                } else {
+                    position = "null";
                }
+            } else {
+                position = "null";
            }

-            node["long_name"] = new JSONValue(tempNodeInfo->long_name);
-            node["short_name"] = new JSONValue(tempNodeInfo->short_name);
-            // mac_address dropped from NodeInfoLite as part of the slim refactor; emit zeros.
-            node["mac_address"] = new JSONValue("00:00:00:00:00:00");
-            node["hw_model"] = new JSONValue(tempNodeInfo->hw_model);
+            if (!firstNode)
+                out += ",";
+            firstNode = false;

-            nodesArray.push_back(new JSONValue(node));
+            // Alphabetical key order matches previous std::map-based output.
+            out += "{\"hw_model\":";
+            out += jsonNum(tempNodeInfo->hw_model);
+            out += ",\"id\":";
+            out += jsonEscape(id);
+            out += ",\"last_heard\":";
+            out += jsonNum((int)tempNodeInfo->last_heard);
+            out += ",\"long_name\":";
+            out += jsonEscape(tempNodeInfo->long_name);
+            out += ",\"mac_address\":";
+            out += jsonEscape("00:00:00:00:00:00");
+            out += ",\"position\":";
+            out += position;
+            out += ",\"short_name\":";
+            out += jsonEscape(tempNodeInfo->short_name);
+            out += ",\"snr\":";
+            out += jsonNum(tempNodeInfo->snr);
+            out += ",\"via_mqtt\":";
+            out += jsonEscape(BoolToString(nodeInfoLiteViaMqtt(tempNodeInfo)));
+            out += "}";
        }
        tempNodeInfo = nodeDB->readNextMeshNode(readIndex);
    }

-    // collect data to inner data object
-    JSONObject jsonObjInner;
-    jsonObjInner["nodes"] = new JSONValue(nodesArray);
-
-    // create json output structure
-    JSONObject jsonObjOuter;
-    jsonObjOuter["data"] = new JSONValue(jsonObjInner);
-    jsonObjOuter["status"] = new JSONValue("ok");
-    // serialize and write it to the stream
-    JSONValue *value = new JSONValue(jsonObjOuter);
-    std::string jsonString = value->Stringify();
-    res->print(jsonString.c_str());
-    delete value;
+    out += "]},\"status\":\"ok\"}";
+    res->print(out.c_str());
 }

 /*
@@ -897,20 +977,28 @@ void handleScanNetworks(HTTPRequest *req, HTTPResponse *res)

    int n = WiFi.scanNetworks();

-    // build list of network objects
-    JSONArray networkObjs;
+    std::string out = "{\"data\":[";
+    bool firstNet = true;
    if (n > 0) {
        for (int i = 0; i < n; ++i) {
            char ssidArray[50];
+            // The previous implementation pre-escaped quotes before handing
+            // the value to the JSON serializer; preserve that (byte-compatible
+            // even if it double-encodes a quote) so existing clients are not
+            // affected by this refactor.
            String ssidString = String(WiFi.SSID(i));
            ssidString.replace("\"", "\\\"");
            ssidString.toCharArray(ssidArray, 50);

            if (WiFi.encryptionType(i) != WIFI_AUTH_OPEN) {
-                JSONObject thisNetwork;
-                thisNetwork["ssid"] = new JSONValue(ssidArray);
-                thisNetwork["rssi"] = new JSONValue(int(WiFi.RSSI(i)));
-                networkObjs.push_back(new JSONValue(thisNetwork));
+                if (!firstNet)
+                    out += ",";
+                firstNet = false;
+                out += "{\"rssi\":";
+                out += jsonNum((int)WiFi.RSSI(i));
+                out += ",\"ssid\":";
+                out += jsonEscape(ssidArray);
+                out += "}";
            }
            // Yield some cpu cycles to IP stack.
            //   This is important in case the list is large and it takes us time to return
@@ -918,16 +1006,7 @@ void handleScanNetworks(HTTPRequest *req, HTTPResponse *res)
            yield();
        }
    }
-
-    // build output structure
-    JSONObject jsonObjOuter;
-    jsonObjOuter["data"] = new JSONValue(networkObjs);
-    jsonObjOuter["status"] = new JSONValue("ok");
-
-    // serialize and write it to the stream
-    JSONValue *value = new JSONValue(jsonObjOuter);
-    std::string jsonString = value->Stringify();
-    res->print(jsonString.c_str());
-    delete value;
+    out += "],\"status\":\"ok\"}";
+    res->print(out.c_str());
 }
 #endif
@@ -109,6 +109,15 @@ static inline int get_max_num_nodes()
 #define HAS_TRAFFIC_MANAGEMENT 0
 #endif

+// HopScalingModule - variable hop module: dynamically adjusts broadcast hop_limit based on mesh density
+// Enable per-variant by defining HAS_VARIABLE_HOPS=1 in variant.h
+#ifdef ARCH_STM32WL
+#define HAS_VARIABLE_HOPS 0
+#endif
+#ifndef HAS_VARIABLE_HOPS
+#define HAS_VARIABLE_HOPS 1
+#endif
+
 // Cache size for traffic management (number of nodes to track)
 // Can be overridden per-variant based on available memory
 #ifndef TRAFFIC_MANAGEMENT_CACHE_SIZE
@@ -573,11 +573,14 @@ static void WiFiEvent(WiFiEvent_t event)
 #endif
        break;
    case ARDUINO_EVENT_ETH_GOT_IP6:
-#if defined(USE_WS5500) || defined(USE_CH390D)
+#if defined(USE_CH390D)
+        // The CH390 driver's ETH class doesn't expose the IPv6 address getters
+        LOG_INFO("Obtained IP6 address");
+#elif defined(USE_WS5500)
 #if ESP_ARDUINO_VERSION >= ESP_ARDUINO_VERSION_VAL(3, 0, 0)
        LOG_INFO("Obtained Local IP6 address: %s", ETH.linkLocalIPv6().toString().c_str());
        LOG_INFO("Obtained GlobalIP6 address: %s", ETH.globalIPv6().toString().c_str());
-#elif defined(USE_WS5500)
+#else
        LOG_INFO("Obtained IP6 address: %s", ETH.localIPv6().toString().c_str());
 #endif
 #endif
@@ -206,4 +206,10 @@ bool sanitizeUtf8(char *buf, size_t bufSize)
    }

    return replaced;
-}
+}
+
+void clampLongName(char *longName)
+{
+    longName[MAX_LONG_NAME_BYTES] = '\0';
+    sanitizeUtf8(longName, MAX_LONG_NAME_BYTES + 1);
+}
@@ -60,10 +60,27 @@ size_t pb_string_length(const char *str, size_t max_len);
 // Ensures the result is null-terminated within bufSize. Returns true if any bytes were replaced.
 bool sanitizeUtf8(char *buf, size_t bufSize);

+// Longest User.long_name content (bytes, excluding NUL) we store or transmit.
+// The wire decode buffer stays at 40 so names from senders built against the
+// older 39-byte limit still parse; everything we keep or send is clamped to
+// this, matching the slim NodeInfoLite storage width in deviceonly.proto.
+#define MAX_LONG_NAME_BYTES 24
+
+// Clamp a long_name buffer (at least MAX_LONG_NAME_BYTES + 1 bytes) in-place
+// to MAX_LONG_NAME_BYTES bytes of content, fixing any partial UTF-8 sequence
+// left at the cut.
+void clampLongName(char *longName);
+
 /// Calculate 2^n without calling pow() - used for spreading factor and other calculations
 inline uint32_t pow_of_2(uint32_t n)
 {
    return 1 << n;
 }

+/// Returns true if n is a power of two (n >= 1).
+template <typename T> constexpr bool is_pow_of_2(T n)
+{
+    return n >= T(1) && (n & (n - T(1))) == T(0);
+}
+
 #define IS_ONE_OF(item, ...) isOneOf(item, sizeof((int[]){__VA_ARGS__}) / sizeof(int), __VA_ARGS__)
@@ -2,6 +2,7 @@
 #include "Channels.h"
 #include "MeshService.h"
 #include "NodeDB.h"
+#include "PositionPrecision.h"
 #include "PowerFSM.h"
 #include "RTC.h"
 #include "SPILock.h"
@@ -19,6 +20,7 @@
 #include "main.h"
 #endif
 #ifdef ARCH_PORTDUINO
+#include "PortduinoGlue.h"
 #include "unistd.h"
 #endif

@@ -27,6 +29,12 @@
 #include "RadioInterface.h"
 #include "TypeConversions.h"
 #include "mesh/RadioLibInterface.h"
+#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
+#include "mesh/PhoneAPI.h"
+#endif
+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+#include "security/EncryptedStorage.h"
+#endif

 #if !MESHTASTIC_EXCLUDE_MQTT
 #include "mqtt/MQTT.h"
@@ -76,20 +84,69 @@ bool AdminModule::handleReceivedProtobuf(const meshtastic_MeshPacket &mp, meshta
    // if handled == false, then let others look at this message also if they want
    bool handled = false;
    assert(r);
+
+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+    // While storage is locked, drop every admin payload — both local and
+    // remote (PKC, mesh-relayed). Lockdown unlock is the prerequisite for
+    // any admin operation: operators must authenticate via lockdown_auth
+    // first. The lockdown_auth path itself is handled synchronously in
+    // PhoneAPI::handleToRadioPacket before reaching here, so the real
+    // unlock flow is not affected by this gate. Without this, a remote
+    // PKC-authorized peer (or a USERPREFS-baked admin_key) could drive
+    // factory_reset / set_config against a locked device before the
+    // operator has even unlocked it.
+    // Only gate when lockdown is ACTIVE. A lockdown-capable build that hasn't
+    // been provisioned (or was disabled) is not unlocked either, but must
+    // still serve admin normally — so check isLockdownActive() first.
+    if (EncryptedStorage::isLockdownActive() && !EncryptedStorage::isUnlocked()) {
+        LOG_WARN("AdminModule: dropping admin payload — storage locked");
+        return handled;
+    }
+#endif
+
    bool fromOthers = !isFromUs(&mp);
    if (mp.which_payload_variant != meshtastic_MeshPacket_decoded_tag) {
        return handled;
    }
+#ifdef ARCH_PORTDUINO
+    // Simulator only: honor exit_simulator unconditionally for the local client (from==0).
+    // The from==0 branch below now covers pki_encrypted local packets too, but is_managed
+    // can still block it. Rather than threading simulator awareness through the auth gates,
+    // intercept here before any auth logic runs. Local-origin + force_simradio only.
+    // TODO: should a local client bypass admin auth at all? Fenced to the simulator for now.
+    if (portduino_config.force_simradio && mp.from == 0 &&
+        r->which_payload_variant == meshtastic_AdminMessage_exit_simulator_tag) {
+        LOG_INFO("Exiting simulator");
+        exit(0);
+    }
+#endif
    meshtastic_Channel *ch = &channels.getByIndex(mp.channel);
    // Could tighten this up further by tracking the last public_key we went an AdminMessage request to
    // and only allowing responses from that remote.
    if (messageIsResponse(r)) {
        LOG_DEBUG("Allow admin response message");
    } else if (mp.from == 0) {
+        // Local admin from a BLE/USB/TCP client. from == 0 cannot arrive from the
+        // mesh: RF drops packets without a sender (RadioLibInterface) and MQTT treats
+        // from == 0 as our own downlink and ignores it. Clients may set pki_encrypted
+        // on self-addressed admin (the python CLI does), so don't use it to reroute
+        // local packets into the remote-PKC key check.
+        //
+        // Under MESHTASTIC_PHONEAPI_ACCESS_CONTROL, the per-connection auth
+        // gate lives in PhoneAPI::handleToRadioPacket — any local admin
+        // payload other than lockdown_auth is dropped there if the
+        // originating connection is unauthorized. By the time we reach
+        // this branch the connection has already proven the passphrase,
+        // so is_managed needs no additional gate here.
+        //
+        // Without that build flag the legacy is_managed semantics still
+        // apply: refuse all plain local admin and require PKC instead.
+#ifndef MESHTASTIC_PHONEAPI_ACCESS_CONTROL
        if (config.security.is_managed) {
            LOG_INFO("Ignore local admin payload because is_managed");
            return handled;
        }
+#endif
    } else if (strcasecmp(ch->settings.name, Channels::adminChannel) == 0) {
        if (!config.security.admin_channel_enabled) {
            LOG_INFO("Ignore admin channel, legacy admin is disabled");
@@ -105,6 +162,17 @@ bool AdminModule::handleReceivedProtobuf(const meshtastic_MeshPacket &mp, meshta
             memcmp(mp.public_key.bytes, config.security.admin_key[2].bytes, 32) == 0)) {
            LOG_INFO("PKC admin payload with authorized sender key");

+            // Note: PKC admin does NOT automatically authorize the
+            // originating local PhoneAPI connection for content
+            // redaction purposes. PKC and the per-connection lockdown
+            // auth slot are independent gates — operators using PKC
+            // admin from a local app should still send lockdown_auth
+            // separately to unlock the redacted FromRadio stream.
+            // (The previous auto-authorize path read a shared
+            // g_currentContext set during synchronous PhoneAPI
+            // dispatch; by the time this Router-thread handler runs
+            // that pointer is unrelated, so the path was unsafe.)
+
            // Automatically favorite the node that is using the admin key
            auto remoteNode = nodeDB->getMeshNode(mp.from);
            if (remoteNode && !nodeInfoLiteIsFavorite(remoteNode)) {
@@ -141,6 +209,17 @@ bool AdminModule::handleReceivedProtobuf(const meshtastic_MeshPacket &mp, meshta
    }
    switch (r->which_payload_variant) {

+#ifdef MESHTASTIC_ENCRYPTED_STORAGE
+    // lockdown_auth is handled synchronously in
+    // PhoneAPI::handleToRadioPacket — see handleLockdownAuthInline. A
+    // packet should not normally reach AdminModule under that flag set,
+    // but if it ever does (e.g. injected via a non-PhoneAPI path), drop
+    // it silently rather than leaking a partial response.
+    case meshtastic_AdminMessage_lockdown_auth_tag:
+        LOG_WARN("AdminModule: lockdown_auth reached Router/AdminModule path; ignoring (should be handled in PhoneAPI)");
+        return handled;
+#endif // MESHTASTIC_ENCRYPTED_STORAGE
+
    /**
     * Getters
     */
@@ -481,7 +560,7 @@ bool AdminModule::handleReceivedProtobuf(const meshtastic_MeshPacket &mp, meshta
 #if HAS_SCREEN
        IF_SCREEN(screen->showSimpleBanner("Device is rebooting\ninto DFU mode.", 0));
 #endif
-#if defined(ARCH_NRF52) || defined(ARCH_RP2040) || defined(ARCH_STM32WL)
+#if defined(ARCH_NRF52) || defined(ARCH_RP2040) || defined(ARCH_STM32)
        enterDfuMode();
 #endif
        break;
@@ -625,10 +704,15 @@ void AdminModule::handleSetOwner(const meshtastic_User &o)
    int changed = 0;

    if (*o.long_name) {
-        changed |= strcmp(owner.long_name, o.long_name);
-        strncpy(owner.long_name, o.long_name, sizeof(owner.long_name));
+        // Apps built against the older 39-byte limit may send longer names; clamp
+        // before the changed-compare so re-sending the same long name is a no-op.
+        char longName[sizeof(o.long_name)];
+        strncpy(longName, o.long_name, sizeof(longName));
+        longName[sizeof(longName) - 1] = '\0';
+        clampLongName(longName);
+        changed |= strcmp(owner.long_name, longName);
+        strncpy(owner.long_name, longName, sizeof(owner.long_name));
        owner.long_name[sizeof(owner.long_name) - 1] = '\0';
-        sanitizeUtf8(owner.long_name, sizeof(owner.long_name));
    }
    if (*o.short_name) {
        changed |= strcmp(owner.short_name, o.short_name);
@@ -829,7 +913,7 @@ void AdminModule::handleSetConfig(const meshtastic_Config &c, bool fromOthers)
                }
                if (strncmp(moduleConfig.mqtt.root, default_mqtt_root, strlen(default_mqtt_root)) == 0) {
                    //  Default root is in use, so subscribe to the appropriate MQTT topic for this region
-                    sprintf(moduleConfig.mqtt.root, "%s/%s", default_mqtt_root, myRegion->name);
+                    snprintf(moduleConfig.mqtt.root, sizeof(moduleConfig.mqtt.root), "%s/%s", default_mqtt_root, myRegion->name);
                }
                changes = SEGMENT_CONFIG | SEGMENT_MODULECONFIG;
            } else {
@@ -840,13 +924,39 @@ void AdminModule::handleSetConfig(const meshtastic_Config &c, bool fromOthers)

        if (!RadioInterface::validateConfigLora(validatedLora)) {
            if (fromOthers) {
-                LOG_WARN("Invalid LoRa config received from another node, rejecting changes");
-                //  modem_preset set to use the old setting if the check fails
-                validatedLora.modem_preset = oldLoraConfig.modem_preset;
+                // A preset locked to a sibling EU region still swaps the region for remote admin;
+                // any other invalid config is rejected outright.
+                const RegionInfo *swapRegion =
+                    validatedLora.use_preset
+                        ? RadioInterface::regionSwapForPreset(validatedLora.region, validatedLora.modem_preset)
+                        : NULL;
+                if (swapRegion) {
+                    validatedLora.region = swapRegion->code;
+                }
+                if (!swapRegion || !RadioInterface::validateConfigLora(validatedLora)) {
+                    LOG_WARN("Invalid LoRa config received from another node, rejecting changes");
+                    // Rejecting means rejecting everything: a partial restore of region/preset
+                    // could still apply other fields the validation already deemed invalid.
+                    validatedLora = oldLoraConfig;
+                }
            } else {
                LOG_WARN("Invalid LoRa config received from client, using corrected values");
                RadioInterface::clampConfigLora(validatedLora);
            }
+            // A preset locked to a sibling EU region swaps the region during the clamp;
+            // apply the same housekeeping as an explicit region change.
+            if (validatedLora.region != oldLoraConfig.region) {
+                config.lora.region = validatedLora.region;
+                initRegion();
+                if (getEffectiveDutyCycle() < 100) {
+                    validatedLora.ignore_mqtt = true; // Ignore MQTT by default if region has a duty cycle limit
+                }
+                if (strncmp(moduleConfig.mqtt.root, default_mqtt_root, strlen(default_mqtt_root)) == 0) {
+                    //  Default root is in use, so subscribe to the appropriate MQTT topic for this region
+                    snprintf(moduleConfig.mqtt.root, sizeof(moduleConfig.mqtt.root), "%s/%s", default_mqtt_root, myRegion->name);
+                }
+                changes = SEGMENT_CONFIG | SEGMENT_MODULECONFIG;
+            }
            //  use_preset and bandwidth are coerced into valid values by the check.
        }

@@ -895,22 +1005,14 @@ void AdminModule::handleSetConfig(const meshtastic_Config &c, bool fromOthers)
        LOG_INFO("Set config: Security");
        config.security = c.payload_variant.security;
 #if !(MESHTASTIC_EXCLUDE_PKI_KEYGEN) && !(MESHTASTIC_EXCLUDE_PKI)
-        // If the client set the key to blank, go ahead and regenerate so long as we're not in ham mode
-        if (!owner.is_licensed && config.lora.region != meshtastic_Config_LoRaConfig_RegionCode_UNSET) {
-            if (config.security.private_key.size != 32) {
-                crypto->generateKeyPair(config.security.public_key.bytes, config.security.private_key.bytes);
-
-            } else {
-                if (crypto->regeneratePublicKey(config.security.public_key.bytes, config.security.private_key.bytes)) {
-                    config.security.public_key.size = 32;
-                }
-            }
+        // Only regenerate keys if the private key is not 32 bytes
+        if (config.security.private_key.size != 32) {
+            nodeDB->generateCryptoKeyPair();
+        }
+        // If user provided a private key of correct size but no public key, generate the public key from private key
+        else if (config.security.private_key.size == 32 && config.security.public_key.size == 0) {
+            nodeDB->generateCryptoKeyPair(config.security.private_key.bytes);
        }
-#endif
-        owner.public_key.size = config.security.public_key.size;
-        memcpy(owner.public_key.bytes, config.security.public_key.bytes, config.security.public_key.size);
-#if !MESHTASTIC_EXCLUDE_PKI
-        crypto->setDHPrivateKey(config.security.private_key.bytes);
 #endif
        if (config.security.is_managed && !(config.security.admin_key[0].size == 32 || config.security.admin_key[1].size == 32 ||
                                            config.security.admin_key[2].size == 32)) {
@@ -920,9 +1022,9 @@ void AdminModule::handleSetConfig(const meshtastic_Config &c, bool fromOthers)
            sendWarning(warning);
        }

-        if (config.security.debug_log_api_enabled == c.payload_variant.security.debug_log_api_enabled &&
-            config.security.serial_enabled == c.payload_variant.security.serial_enabled)
-            requiresReboot = false;
+        changes = SEGMENT_CONFIG | SEGMENT_DEVICESTATE | SEGMENT_NODEDATABASE;
+
+        requiresReboot = true;

        break;
    case meshtastic_Config_device_ui_tag:
@@ -1056,7 +1158,26 @@ void AdminModule::handleSetChannel(const meshtastic_Channel &cc)
    if (channels.ensureLicensedOperation()) {
        sendWarning(licensedModeMessage);
    }
+    // Refresh derived state (primaryIndex in particular) BEFORE the precision clamp below. usesPublicKey()
+    // resolves a secondary channel's key against the primary, so it must see the post-update primaryIndex;
+    // running the clamp first could evaluate secondaries against the previous primary and skip the clamp/warning.
    channels.onConfigChanged(); // tell the radios about this change
+
+    // Persist the public-key precision clamp for all channels that may be affected (e.g. secondaries
+    // that inherit a now-public primary key) and warn the client once if anything was coarsened.
+    bool clamped = false;
+    for (uint8_t i = 0; i < channels.getNumChannels(); i++) {
+        meshtastic_Channel &ch = channels.getByIndex(i);
+        if (ch.role == meshtastic_Channel_Role_DISABLED || !ch.settings.has_module_settings)
+            continue;
+        uint32_t allowed = getPositionPrecisionForChannel(i);
+        if (allowed != ch.settings.module_settings.position_precision) {
+            ch.settings.module_settings.position_precision = allowed;
+            clamped = true;
+        }
+    }
+    if (clamped)
+        sendWarning(publicChannelPrecisionMessage);
    saveChanges(SEGMENT_CHANNELS, false);
 }

@@ -1463,6 +1584,10 @@ void AdminModule::handleSetHamMode(const meshtastic_HamParameters &p)
    }
    channels.onConfigChanged();

+    if (strcmp(p.call_sign, "N0CALL") == 0) {
+        config.lora.tx_enabled = false;
+    }
+
    service->reloadOwner(false);
    saveChanges(SEGMENT_CONFIG | SEGMENT_NODEDATABASE | SEGMENT_DEVICESTATE | SEGMENT_CHANNELS);
 }
@@ -67,7 +67,11 @@ class AdminModule : public ProtobufModule<meshtastic_AdminMessage>, public Obser
  private:
    bool handleSetModuleConfig(const meshtastic_ModuleConfig &c);
    void handleSetChannel();
+
+  public:
    void handleSetHamMode(const meshtastic_HamParameters &req);
+
+  private:
    void handleStoreDeviceUIConfig(const meshtastic_DeviceUIConfig &uicfg);
    void handleSendInputEvent(const meshtastic_AdminMessage_InputEvent &inputEvent);
    void reboot(int32_t seconds);
@@ -84,6 +88,9 @@ class AdminModule : public ProtobufModule<meshtastic_AdminMessage>, public Obser
 static constexpr const char *licensedModeMessage =
    "Licensed mode activated, removing admin channel and encryption from all channels";

+static constexpr const char *publicChannelPrecisionMessage =
+    "Precise position is not allowed on a public (open / known-key) channel; reduced to coarse precision";
+
 extern AdminModule *adminModule;

 void disableBluetooth();
@@ -0,0 +1,493 @@
+#include "HopScalingModule.h"
+#include "SafeFile.h"
+#include "meshUtils.h"
+
+#if HAS_VARIABLE_HOPS
+
+#include "FSCommon.h"
+#include "NodeDB.h"
+#include "SPILock.h"
+#include "concurrency/LockGuard.h"
+#include "mesh-pb-constants.h"
+#include <algorithm>
+#include <cmath>
+#include <cstring>
+
+namespace
+{
+// Module scheduling
+constexpr uint32_t INITIAL_DELAY_MS = 30 * 1000UL;    // Startup grace period before first run
+constexpr uint32_t RUN_INTERVAL_MS = 5 * 60 * 1000UL; // Emit micro-summary every 5 minutes
+// RUNS_PER_HOUR is a public class constant in HopScalingModule.h
+
+// Persistence
+// Note: this only needs incrementing if the published arrangement changes. For testing purposes, or prior to widespread release,
+// it can stay the same even if the internal layout changes.
+constexpr uint32_t HISTOGRAM_STATE_MAGIC = 0x48535432; // 'HST2' — layout v2
+constexpr uint8_t HISTOGRAM_STATE_VERSION = 1;
+constexpr const char *HISTOGRAM_STATE_FILE = "/prefs/hopScalingState.bin";
+
+#pragma pack(push, 1)
+struct PersistedHistogram {
+    uint32_t magic;
+    uint8_t version;
+    uint8_t samplingDenominator;
+    uint8_t filteringDenominator;
+    uint8_t filterDenomHoldRollsRemaining; // rollHour() calls remaining in the hold; 0 when expired/not active
+    uint16_t hashSeed;
+    Record entries[HopScalingModule::CAPACITY]; // full 512-byte array; count derived on load
+};
+#pragma pack(pop)
+
+} // namespace
+
+HopScalingModule *hopScalingModule;
+
+// ---------------------------------------------------------------------------
+// Lifecycle
+// ---------------------------------------------------------------------------
+
+HopScalingModule::HopScalingModule() : concurrency::OSThread("HopScaling")
+{
+    clear();
+    loadFromDisk();
+    setIntervalFromNow(INITIAL_DELAY_MS);
+}
+
+void HopScalingModule::clear()
+{
+    memset(entries, 0, sizeof(entries));
+    count = 0;
+    samplingDenominator = DENOM_MIN;
+    filteringDenominator = DENOM_MIN;
+    filteringDenomHoldRollsRemaining = 0;
+    lastPerHopCounts = {};
+    lastSuggestedHop = MAX_HOP;
+    lastPoliteNumer = POLITENESS_DEFAULT;
+    lastTrendStats = {};
+    memset(denominatorHistory, DENOM_MIN, sizeof(denominatorHistory));
+#ifndef PIO_UNIT_TESTING
+    hashSeed = static_cast<uint16_t>(random());
+#else
+    hashSeed = 0; // deterministic in unit tests
+#endif
+}
+
+// ---------------------------------------------------------------------------
+// Persistence
+// ---------------------------------------------------------------------------
+
+void HopScalingModule::saveToDisk() const
+{
+#ifdef FSCom
+    FSCom.mkdir("/prefs");
+    PersistedHistogram state{};
+    state.magic = HISTOGRAM_STATE_MAGIC;
+    state.version = HISTOGRAM_STATE_VERSION;
+    state.samplingDenominator = samplingDenominator;
+    state.filteringDenominator = filteringDenominator;
+    state.filterDenomHoldRollsRemaining = filteringDenomHoldRollsRemaining;
+    state.hashSeed = hashSeed;
+    // Save all CAPACITY slots; count is reconstructed on load by scanning seenHoursAgo.
+    memcpy(state.entries, entries, sizeof(state.entries));
+    auto file = SafeFile(HISTOGRAM_STATE_FILE, true);
+    const size_t written = file.write(reinterpret_cast<const uint8_t *>(&state), sizeof(state));
+    if (file.close() && written == sizeof(state)) {
+        LOG_DEBUG("[HOPSCALE] Saved: count=%u samp=1/%u filt=1/%u holdRollsRemaining=%u", count, samplingDenominator,
+                  filteringDenominator, state.filterDenomHoldRollsRemaining);
+    } else {
+        LOG_WARN("[HOPSCALE] Failed to write %s (%u of %u bytes)", HISTOGRAM_STATE_FILE, static_cast<unsigned>(written),
+                 static_cast<unsigned>(sizeof(state)));
+    }
+#endif
+}
+
+void HopScalingModule::loadFromDisk()
+{
+#ifdef FSCom
+    concurrency::LockGuard g(spiLock);
+    auto file = FSCom.open(HISTOGRAM_STATE_FILE, FILE_O_READ);
+    if (!file)
+        return;
+    PersistedHistogram state{};
+    const bool readOk = (file.read(reinterpret_cast<uint8_t *>(&state), sizeof(state)) == sizeof(state));
+    file.close();
+    // Validate magic, version, denom range, denom power-of-two invariant, and hold counter.
+    if (!readOk || state.magic != HISTOGRAM_STATE_MAGIC || state.version != HISTOGRAM_STATE_VERSION ||
+        state.samplingDenominator < DENOM_MIN || state.samplingDenominator > DENOM_MAX ||
+        state.filteringDenominator < state.samplingDenominator || state.filteringDenominator > DENOM_MAX ||
+        !is_pow_of_2(state.samplingDenominator) || !is_pow_of_2(state.filteringDenominator) ||
+        state.filterDenomHoldRollsRemaining > FILTER_DENOM_HOLD_ROLLS) {
+        LOG_DEBUG("[HOPSCALE] No valid persisted state (magic=%08x ver=%u samp=%u filt=%u hold=%u), starting fresh", state.magic,
+                  state.version, state.samplingDenominator, state.filteringDenominator, state.filterDenomHoldRollsRemaining);
+        return;
+    }
+    // Derive count by scanning: active entries have seenHoursAgo != 0; pack them to the front.
+
+    uint8_t restored = 0;
+    for (uint8_t i = 0; i < CAPACITY && restored < CAPACITY; i++) {
+        if (state.entries[i].seenHoursAgo != 0u) {
+            entries[restored++] = state.entries[i];
+        }
+    }
+    count = restored;
+    samplingDenominator = state.samplingDenominator;
+    filteringDenominator = state.filteringDenominator;
+    filteringDenomHoldRollsRemaining = state.filterDenomHoldRollsRemaining;
+    // denominatorHistory can't be recovered; initialise all slots to filteringDenominator so
+    // the first few post-reboot scaledPerHour values use a safe (slightly conservative) multiplier.
+    memset(denominatorHistory, filteringDenominator, sizeof(denominatorHistory));
+    hashSeed = state.hashSeed;
+    LOG_INFO("[HOPSCALE] Restored: count=%u samp=1/%u filt=1/%u holdRollsRemaining=%u", count, samplingDenominator,
+             filteringDenominator, state.filterDenomHoldRollsRemaining);
+#endif
+}
+
+// ---------------------------------------------------------------------------
+// Core API
+// ---------------------------------------------------------------------------
+
+void HopScalingModule::samplePacketForHistogram(uint32_t nodeId, uint8_t hopCount)
+{
+    const uint16_t hash = hashNodeId(nodeId);
+
+    if (!passesFilter(hash, samplingDenominator))
+        return;
+
+    hopCount = std::min(hopCount, MAX_HOP);
+
+    // Update an existing entry
+    Record *entry = nullptr;
+    for (uint8_t i = 0; i < count; i++) {
+        if (entries[i].nodeHash == hash) {
+            entry = &entries[i];
+            break;
+        }
+    }
+    if (entry) {
+        entry->hops_away = hopCount;
+        markCurrentHour(*entry);
+        return;
+    }
+
+    // New node: trim if necessary before allocating a slot
+    if (getFillPercentage() >= FILL_HIGH_PCT) {
+        trimIfNeeded();
+    }
+
+    if (count < CAPACITY) {
+        entries[count].nodeHash = hash;
+        entries[count].hops_away = hopCount;
+        entries[count].seenHoursAgo = 1u; // mark current hour
+        count++;
+    } else {
+        LOG_WARN("[HOPSCALE] Histogram full at samp=1/%u (DENOM_MAX=%u); dropping node hash=0x%04x; hop recommendation may be "
+                 "skewed!!!",
+                 samplingDenominator, DENOM_MAX, hash);
+    }
+}
+
+void HopScalingModule::rollHour()
+{
+    // Advance denominatorHistory before the tally so each slot h holds the filteringDenominator
+    // that was active when seenHoursAgo bit h was set.  hourlyRaw[h] is then gated per-slot by
+    // denominatorHistory[h], giving a correct population estimate for each historical hour even
+    // when filteringDenominator changes between rolls.  Scale-up backfills the entire array so
+    // the invariant holds retroactively (see trimIfNeeded()).
+    for (uint8_t h = 12; h > 0; h--)
+        denominatorHistory[h] = denominatorHistory[h - 1];
+    denominatorHistory[0] = filteringDenominator;
+
+    // 1. Tally per-hop counts and per-slot hourly activity in one pass.
+    //    hourlyRaw[h]: gated per-slot by denominatorHistory[h] so the raw count and its
+    //      multiplier are always consistent, even across filteringDenominator transitions.
+    //    counts.*: gated uniformly by the current filteringDenominator for a consistent
+    //      population estimate used by the hop-walk recommendation (step 2).
+    PerHopCounts counts{};
+    uint16_t hourlyRaw[13] = {};
+    uint16_t trendNewThisHour = 0;
+    uint16_t trendReturning = 0;
+    uint16_t trendLapsed = 0;
+    uint16_t trendOlderThan4h = 0;
+    uint16_t trendAgingOut = 0;
+    for (uint8_t i = 0; i < count; i++) {
+        const uint16_t hash = entries[i].nodeHash;
+        const uint32_t seen = entries[i].seenHoursAgo;
+
+        // Per-slot hourly activity: gate each slot by its own denominator.
+        for (uint8_t h = 0; h < 13; h++) {
+            if ((seen & (1u << h)) && passesFilter(hash, denominatorHistory[h]))
+                hourlyRaw[h]++;
+        }
+
+        // Hop counts and trend stats: uniform current-denominator gate.
+        if (!passesFilter(hash, filteringDenominator))
+            continue;
+
+        if (seenInLast13h(entries[i])) {
+            counts.perHop[entries[i].hops_away]++;
+            counts.total++;
+        }
+        const bool heardThisHour = (seen & 1u) != 0u;
+        const bool heardLastHour = (seen & 2u) != 0u;
+        const bool hasOlderHistory = (seen >> 1u) != 0u;
+        const bool recentlySilent = (seen & 0xFu) == 0u;
+        if (heardThisHour && !hasOlderHistory)
+            trendNewThisHour++;
+        else if (heardThisHour && hasOlderHistory)
+            trendReturning++;
+        if (!heardThisHour && heardLastHour)
+            trendLapsed++;
+        if (recentlySilent && (seen & 0x1FF0u) != 0u)
+            trendOlderThan4h++;
+        if (seen == (1u << 12u))
+            trendAgingOut++;
+    }
+    lastPerHopCounts = counts;
+
+    // 1b. Compute politeness factor from the 0-2 h vs 1-3 h activity ratio.
+    {
+        const uint32_t recent = static_cast<uint32_t>(hourlyRaw[0]) + hourlyRaw[1];
+        const uint32_t older = static_cast<uint32_t>(hourlyRaw[1]) + hourlyRaw[2];
+        if (older > 1 && recent > 1) {
+            const uint32_t r = static_cast<uint32_t>(recent) * ACTIVITY_WEIGHT_SCALE;
+            const uint32_t o = static_cast<uint32_t>(older);
+            if (r < o * ACTIVITY_WEIGHT_GENEROUS_MAX_NUMER)
+                lastPoliteNumer = POLITENESS_GENEROUS;
+            else if (r > o * ACTIVITY_WEIGHT_STRICT_MIN_NUMER)
+                lastPoliteNumer = POLITENESS_STRICT;
+            else
+                lastPoliteNumer = POLITENESS_DEFAULT;
+        } else {
+            lastPoliteNumer = POLITENESS_DEFAULT;
+        }
+    }
+
+    // 1c. Scale and cache trend stats (denominatorHistory already advanced above).
+    {
+        MeshTrendStats t{};
+        for (uint8_t h = 0; h < 13; h++) {
+            const uint32_t s = static_cast<uint32_t>(hourlyRaw[h]) * denominatorHistory[h];
+            t.scaledPerHour[h] = static_cast<uint16_t>(std::min<uint32_t>(s, UINT16_MAX));
+        }
+        auto scale = [&](uint16_t raw) -> uint16_t {
+            return static_cast<uint16_t>(std::min<uint32_t>(static_cast<uint32_t>(raw) * filteringDenominator, UINT16_MAX));
+        };
+        t.newThisHour = scale(trendNewThisHour);
+        t.returningThisHour = scale(trendReturning);
+        t.lapsedSinceLastHour = scale(trendLapsed);
+        t.olderThan4h = scale(trendOlderThan4h);
+        t.agingOut = scale(trendAgingOut);
+        lastTrendStats = t;
+    }
+
+    // 2. Walk scaled hop buckets to produce a hop-limit recommendation.
+    //     effectiveMin: walk threshold — first hop whose cumulative count reaches this.
+    //     effectiveMax: ceiling on the one-hop extension check with GENEROUS politeness.
+    const uint16_t effectiveMin = TARGET_AFFECTED_NODES;
+    const uint16_t effectiveMax = MAX_TARGET_NODES;
+    uint8_t suggested = MAX_HOP;
+    if (counts.total > 0) {
+        uint32_t cumulative = 0;
+        for (uint8_t hop = 0; hop <= MAX_HOP; hop++) {
+            cumulative += static_cast<uint32_t>(counts.perHop[hop]) * filteringDenominator;
+            if (cumulative >= effectiveMin) {
+                suggested = hop;
+                break;
+            }
+        }
+        if (suggested < MAX_HOP) {
+            const uint32_t atNext = static_cast<uint32_t>(counts.perHop[suggested + 1]) * filteringDenominator;
+            // politeLimit = effectiveMin + gap * politeNumer / POLITENESS_DENOM
+            // Multiply both sides by POLITENESS_DENOM to stay in integers.
+            const uint32_t gap = static_cast<uint32_t>(effectiveMax) - static_cast<uint32_t>(effectiveMin);
+            if ((cumulative + atNext) * POLITENESS_DENOM <=
+                static_cast<uint32_t>(effectiveMin) * POLITENESS_DENOM + gap * lastPoliteNumer) {
+                suggested++;
+            }
+        }
+    }
+    lastSuggestedHop = suggested;
+
+    // 3. Log scaled per-hop counts and recommendation.
+    {
+        uint16_t scaled[MAX_HOP + 1];
+        for (uint8_t h = 0; h <= MAX_HOP; h++) {
+            const uint32_t s = static_cast<uint32_t>(counts.perHop[h]) * filteringDenominator;
+            scaled[h] = static_cast<uint16_t>(std::min<uint32_t>(s, UINT16_MAX));
+        }
+        const uint32_t scaledTotal = static_cast<uint32_t>(counts.total) * filteringDenominator;
+        memcpy(lastScaledPerHop, scaled, sizeof(lastScaledPerHop));
+        LOG_INFO("[HOPSCALE] rollHour: entries=%u/128 samp=1/%u filt=1/%u counted=%u est=%u suggestedHop=%u polite=%u/4", count,
+                 samplingDenominator, filteringDenominator, counts.total, static_cast<unsigned>(scaledTotal), suggested,
+                 lastPoliteNumer);
+
+        const auto &ts = lastTrendStats;
+        LOG_INFO("[HOPSCALE] scaledSeenPerHour (h0=now): [%u %u %u %u %u %u %u %u %u %u %u %u %u]", ts.scaledPerHour[0],
+                 ts.scaledPerHour[1], ts.scaledPerHour[2], ts.scaledPerHour[3], ts.scaledPerHour[4], ts.scaledPerHour[5],
+                 ts.scaledPerHour[6], ts.scaledPerHour[7], ts.scaledPerHour[8], ts.scaledPerHour[9], ts.scaledPerHour[10],
+                 ts.scaledPerHour[11], ts.scaledPerHour[12]);
+        LOG_INFO("[HOPSCALE] trend: new=%u returning=%u lapsed=%u olderThan4h=%u agingOut=%u", ts.newThisHour,
+                 ts.returningThisHour, ts.lapsedSinceLastHour, ts.olderThan4h, ts.agingOut);
+    }
+
+    // 4. Scale-down check: if fewer than FILL_LOW_PCT% of capacity pass the filteringDenominator
+    //    gate and are active, halve samplingDenominator to admit more nodes.
+    //    Note: during a filteringDenominator hold period, lowering samplingDenominator does not
+    //    immediately improve counts.total (new admissions don't pass the elevated
+    //    filteringDenominator).  On a genuinely quieting mesh this check can therefore fire on
+    //    consecutive hours, cascading samplingDenominator toward DENOM_MIN.  This is intentional:
+    //    rapid re-admission allows quick recovery if the mesh returns.  The hop recommendation
+    //    stays conservative (MAX_HOP) throughout because filteringDenominator remains elevated;
+    //    step 5 below re-synchronises the denominators once the hold expires.
+    if (counts.total * 100u < static_cast<uint32_t>(CAPACITY) * FILL_LOW_PCT) {
+        if (samplingDenominator > DENOM_MIN) {
+            samplingDenominator = static_cast<uint8_t>(samplingDenominator / 2u);
+            LOG_INFO("[HOPSCALE] Scale-down: sampling denom halved to %u (filter denom=%u)", samplingDenominator,
+                     filteringDenominator);
+        }
+    }
+
+    // 5. Tick down the hold counter; once it reaches zero, halve filteringDenominator toward
+    //    samplingDenominator once per rollHour() (= once per hour) rather than a single jump:
+    //    avoids a sudden large change in the hop-walk count when samplingDenominator cascaded
+    //    down significantly during the hold period.  No new hold is placed on each step — the
+    //    13-roll hold already guaranteed that re-admitted nodes have full seenHoursAgo history;
+    //    further pacing is provided naturally by the 1-step-per-hour rate.  denominatorHistory
+    //    is updated automatically by the shift at the top of rollHour(), so no backfill here.
+    if (filteringDenominator > samplingDenominator) {
+        if (filteringDenomHoldRollsRemaining > 0)
+            filteringDenomHoldRollsRemaining--;
+        if (filteringDenomHoldRollsRemaining == 0) {
+            const uint8_t stepped = static_cast<uint8_t>(filteringDenominator / 2u);
+            filteringDenominator = (stepped > samplingDenominator) ? stepped : samplingDenominator;
+            LOG_INFO("[HOPSCALE] Filter denom stepped to %u (samp=1/%u)", filteringDenominator, samplingDenominator);
+        }
+    }
+
+    // 6. Shift all seen bitmaps left by one slot (opens a fresh slot for the new hour).
+    for (uint8_t i = 0; i < count; i++) {
+        rollSeenBits(entries[i]);
+    }
+
+    if (histogramRollCount < 255)
+        histogramRollCount++;
+
+    saveToDisk();
+}
+
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+
+void HopScalingModule::trimIfNeeded()
+{
+    // Step 1: evict stale entries (not seen in any of the past 13 hours).
+    uint8_t newCount = 0;
+    for (uint8_t i = 0; i < count; i++) {
+        if (seenInLast13h(entries[i])) {
+            if (i != newCount) {
+                entries[newCount] = entries[i];
+            }
+            newCount++;
+        }
+    }
+    count = newCount;
+
+    // Step 2: if still too full, double the sampling denominator and remove non-matching entries.
+    if (getFillPercentage() >= FILL_HIGH_PCT && samplingDenominator < DENOM_MAX) {
+        samplingDenominator = static_cast<uint8_t>(
+            std::min<uint16_t>(static_cast<uint16_t>(samplingDenominator) * 2u, static_cast<uint16_t>(DENOM_MAX)));
+        filteringDenominator = std::max(filteringDenominator, samplingDenominator);
+        filteringDenomHoldRollsRemaining = FILTER_DENOM_HOLD_ROLLS;
+        // Raise any denominatorHistory slot that is below the new filteringDenominator.
+        // Slots already above it (recorded during a prior scale-up that hasn't fully stepped
+        // down yet) are left untouched: eviction at samplingDenominator retains exactly those
+        // entries, so the old higher gate remains accurate for those historical hours.
+        // Slots below the new value must be raised because the eviction removed entries that
+        // had been admitted at the looser old gate — the remaining entries represent a 1/N
+        // subsample where N is the new filteringDenominator, not the old smaller value.
+        for (uint8_t h = 0; h < 13; h++)
+            denominatorHistory[h] = std::max(denominatorHistory[h], filteringDenominator);
+        LOG_INFO("[HOPSCALE] Scale-up: samp denom doubled to %u (filt=%u)", samplingDenominator, filteringDenominator);
+
+        newCount = 0;
+        for (uint8_t i = 0; i < count; i++) {
+            if (passesFilter(entries[i].nodeHash, samplingDenominator)) {
+                if (i != newCount) {
+                    entries[newCount] = entries[i];
+                }
+                newCount++;
+            }
+        }
+        count = newCount;
+    }
+}
+
+void HopScalingModule::logStatusReport(bool didHourlyUpdate) const
+{
+    const bool histActive = (histogramRollCount > 0 && count > 0);
+    const auto &histCounts = lastPerHopCounts;
+    const uint8_t runsRemaining = didHourlyUpdate ? RUNS_PER_HOUR : (RUNS_PER_HOUR - runsSinceLastHourlyUpdate);
+    const uint8_t minsUntilRollover = runsRemaining * (RUN_INTERVAL_MS / (60 * 1000UL));
+
+    LOG_INFO("[HOPSCALE] hop=%u histActive=%u fill=%u%% samp=1/%u filt=1/%u entries=%u lastCounted=%u polite=%u/4 "
+             "nextRoll=%umin",
+             lastRequiredHop, histActive ? 1u : 0u, getFillPercentage(), samplingDenominator, filteringDenominator, count,
+             histCounts.total, lastPoliteNumer, minsUntilRollover);
+
+    LOG_INFO("[HOPSCALE] nodes perHop: [%u %u %u %u %u %u %u %u]", histCounts.perHop[0], histCounts.perHop[1],
+             histCounts.perHop[2], histCounts.perHop[3], histCounts.perHop[4], histCounts.perHop[5], histCounts.perHop[6],
+             histCounts.perHop[7]);
+    LOG_INFO("[HOPSCALE] last scaled perHop: [%u %u %u %u %u %u %u %u]", lastScaledPerHop[0], lastScaledPerHop[1],
+             lastScaledPerHop[2], lastScaledPerHop[3], lastScaledPerHop[4], lastScaledPerHop[5], lastScaledPerHop[6],
+             lastScaledPerHop[7]);
+}
+
+int32_t HopScalingModule::runOnce()
+{
+    const bool isFirstRun = !hasCompletedInitialRun;
+    bool didHourlyUpdate = false;
+
+    if (isFirstRun) {
+        hasCompletedInitialRun = true;
+        runsSinceLastHourlyUpdate = 0;
+        didHourlyUpdate = true;
+    } else {
+        runsSinceLastHourlyUpdate++;
+        if (runsSinceLastHourlyUpdate >= RUNS_PER_HOUR) {
+            runsSinceLastHourlyUpdate = 0;
+            didHourlyUpdate = true;
+        }
+    }
+
+    if (didHourlyUpdate && !isFirstRun) {
+        rollHour();
+    }
+
+    if (didHourlyUpdate) {
+        uint8_t suggested = (histogramRollCount > 0 && count > 0) ? lastSuggestedHop : HOP_MAX;
+        // Role-based hop floor: TRACKER/TAK_TRACKER always reach at least 2 hops,
+        // SENSOR reaches at least 1, so these reporting roles remain reachable even
+        // on a dense mesh where the histogram recommends a lower hop count.
+        uint8_t roleFloor = 0;
+        switch (config.device.role) {
+        case meshtastic_Config_DeviceConfig_Role_TRACKER:
+        case meshtastic_Config_DeviceConfig_Role_TAK_TRACKER:
+            roleFloor = 2;
+            break;
+        case meshtastic_Config_DeviceConfig_Role_SENSOR:
+            roleFloor = 1;
+            break;
+        default:
+            break;
+        }
+        lastRequiredHop = std::max(suggested, roleFloor);
+    }
+
+    logStatusReport(didHourlyUpdate);
+
+    return RUN_INTERVAL_MS;
+}
+
+#endif
@@ -0,0 +1,351 @@
+#pragma once
+
+#include "MeshTypes.h"
+#include "concurrency/OSThread.h"
+#include "configuration.h"
+#include "mesh/Default.h"
+#include "mesh/mesh-pb-constants.h"
+#include <algorithm>
+#include <cstdint>
+#include <cstring>
+
+#if HAS_VARIABLE_HOPS
+
+/**
+ * HopScalingModule: Sampled hop-distance histogram for mesh-aware hop limit recommendations.
+ *
+ * Memory layout: 512 bytes total (128 entries × 4 bytes/entry, no padding)
+ *   - 16-bit XOR-fold hash of node ID
+ *   - 3-bit hops away (0–7)
+ *   - 13-bit hourly seen bitmap
+ *   All three fields are packed into a single 32-bit Record; sizeof(Record) == 4.
+ *
+ * Sampling:
+ *   - A node is added only when passesFilter(hashNodeId(nodeId), samplingDenominator),
+ *     i.e. (hash16(nodeId) & (samplingDenominator – 1)) == 0  (hash-space subsample, not raw ID)
+ *   - samplingDenominator starts at 1 (sample all), doubles when the list exceeds FILL_HIGH_PCT
+ *   - filteringDenominator tracks samplingDenominator upward immediately but does not drop back
+ *     down until FILTER_DENOM_HOLD_MS (13 h) have elapsed since the last scale-up
+ *
+ * Hourly rollover (rollHour()):
+ *   - Summarises per-hop node counts for entries matching filteringDenominator and seen in the
+ *     last 13 hours
+ *   - Scales each hop bucket by filteringDenominator and walks the buckets to recommend a hop
+ *     limit, matching the same algorithm used in HopScalingModule
+ *   - Shifts the 13-bit seen bitmap left by one slot to open a fresh slot for the new hour;
+ *     nodes not seen in 13 consecutive hours have all seen bits cleared (stale)
+ *   - Checks for scale-down: if fewer than FILL_LOW_PCT of capacity pass filteringDenominator,
+ *     samplingDenominator is halved (filteringDenominator is held until the 13-h lock expires)
+ *
+ * Thread-safety: all access is single-threaded via the main loop cooperative scheduler.
+ */
+
+struct Record {
+    uint32_t nodeHash : 16;
+    uint32_t hops_away : 3;
+    uint32_t seenHoursAgo : 13;
+};
+static_assert(sizeof(Record) == 4);
+
+class HopScalingModule : private concurrency::OSThread
+{
+  public:
+    // -----------------------------------------------------------------------
+    // Capacity and memory layout
+    // -----------------------------------------------------------------------
+    static constexpr size_t CAPACITY = 128;
+    static constexpr size_t ENTRY_BYTES = sizeof(Record);
+    static constexpr size_t TOTAL_BYTES = CAPACITY * ENTRY_BYTES;
+
+    // Denominator limits (must be powers of 2)
+    static constexpr uint8_t DENOM_MIN = 1;
+    static constexpr uint8_t DENOM_MAX = 128;
+
+    static constexpr uint8_t MAX_HOP = 7;
+
+    // Fill-level thresholds (percent of CAPACITY)
+    static constexpr uint8_t FILL_HIGH_PCT = 80;
+    static constexpr uint8_t FILL_LOW_PCT = 20;
+
+    // How long filteringDenominator is held at an elevated level before it may drop.
+    //
+    // This value is deliberately equal to the seenHoursAgo window (13 hours / 13 bits).
+    // Invariant: every entry that existed when a scale-up fired had seenHoursAgo != 0 at
+    // that moment (trimIfNeeded() evicts stale entries before doubling the denominator),
+    // so it remains seenInLast13h for at most 13 more rollHour() calls — exactly the
+    // hold duration.  That means entries from the scale-up event keep counts.total above
+    // the scale-down threshold for the entire hold period under normal (active) mesh
+    // conditions.  On a genuinely quieting mesh the scale-down CAN fire before the hold
+    // expires — each firing halves samplingDenominator but filteringDenominator stays
+    // elevated, so the hop recommendation correctly stays conservative (MAX_HOP) while
+    // the cascade runs.  The cascade is bounded at DENOM_MIN (7 halvings from DENOM_MAX);
+    //    when the hold finally expires, step 5 of rollHour() halves filteringDenominator
+    //    once per hour (rather than jumping directly to samplingDenominator) until the two
+    //    converge, giving the hop-walk a gradual, 1-step-per-hour descent.
+    static constexpr uint32_t FILTER_DENOM_HOLD_MS = 13UL * 60UL * 60UL * 1000UL; // 13 h (documentation only)
+    // Number of rollHour() calls the hold spans — equals the seenHoursAgo window width.
+    // filteringDenomHoldRollsRemaining is initialised to this value on scale-up and
+    // decremented once per rollHour(); step-down begins when it reaches zero.
+    static constexpr uint8_t FILTER_DENOM_HOLD_ROLLS = 13u;
+
+    // Hop-walk: target cumulative affected-node count when choosing a hop limit
+    static constexpr uint16_t TARGET_AFFECTED_NODES = default_hop_scaling_min_target_nodes;
+
+    // Clamp bounds enforced on min_target_nodes / max_target_nodes
+    static constexpr uint16_t MIN_TARGET_NODES_FLOOR = default_hop_scaling_min_target_nodes_floor;
+    static constexpr uint16_t MAX_TARGET_NODES_CEILING = default_hop_scaling_max_target_nodes_ceiling;
+    static constexpr uint16_t MAX_TARGET_NODES = default_hop_scaling_max_target_nodes;
+
+    // Politeness factors for the one-hop extension check in the hop walk.
+    // Stored as integer numerators over POLITENESS_DENOM (4):
+    //   politeLimit = min + gap * politeNumer / POLITENESS_DENOM
+    // STRICT  → min + 25% of gap;  DEFAULT → midpoint;  GENEROUS → max
+    static constexpr uint8_t POLITENESS_DENOM = 4u;
+    static constexpr uint8_t POLITENESS_GENEROUS = 4u; // 4/4 = 1.00
+    static constexpr uint8_t POLITENESS_DEFAULT = 2u;  // 2/4 = 0.50
+    static constexpr uint8_t POLITENESS_STRICT = 1u;   // 1/4 = 0.25
+
+    // Activity weight thresholds (ratio of 0-2 h window vs 1-3 h window).
+    // Cross-multiply form: recent * ACTIVITY_WEIGHT_SCALE vs older * threshold_numer.
+    // GENEROUS if recent*10 < older*9 (ratio < 0.9); STRICT if recent*10 > older*12 (ratio > 1.2)
+    static constexpr uint8_t ACTIVITY_WEIGHT_SCALE = 10u;
+    static constexpr uint8_t ACTIVITY_WEIGHT_GENEROUS_MAX_NUMER = 9u;
+    static constexpr uint8_t ACTIVITY_WEIGHT_STRICT_MIN_NUMER = 12u;
+
+    // Scheduling: number of 5-minute runOnce() ticks that make up one hourly rollover
+    static constexpr uint8_t RUNS_PER_HOUR = 12;
+
+    // -----------------------------------------------------------------------
+    // Types
+    // -----------------------------------------------------------------------
+
+    /// Per-hop node counts produced at each hourly rollover.
+    struct PerHopCounts {
+        uint16_t perHop[MAX_HOP + 1] = {};
+        uint16_t total = 0;
+    };
+
+    /// Mesh activity trend stats produced at each hourly rollover.
+    /// All counts are scaled by filteringDenominator (i.e. estimated full-mesh population).
+    ///
+    /// Bitmap interpretation (before the hourly shift): bit 0 = just-completed hour, bit 12 = 12 h ago.
+    struct MeshTrendStats {
+        /// Estimated node count per hour slot (h=0 is the just-completed hour, h=12 is 12 h ago).
+        uint16_t scaledPerHour[13] = {};
+        /// Nodes heard only this hour with no prior bitmap history — indicates new arrivals.
+        uint16_t newThisHour = 0;
+        /// Nodes heard this hour that also appeared in at least one older hour — stable regulars.
+        uint16_t returningThisHour = 0;
+        /// Nodes heard last hour but silent this hour — potential departures.
+        uint16_t lapsedSinceLastHour = 0;
+        /// Nodes absent from the last 4 hours but still present in some older hour (5–13 h) — quieting down.
+        uint16_t olderThan4h = 0;
+        /// Nodes whose only remaining history is the 13th hour (bit 12 only) — about to age out entirely.
+        uint16_t agingOut = 0;
+    };
+
+    // -----------------------------------------------------------------------
+    // Lifecycle
+    // -----------------------------------------------------------------------
+
+    HopScalingModule();
+    ~HopScalingModule() = default;
+
+    /// Reset all entries and state.
+    void clear();
+
+    // -----------------------------------------------------------------------
+    // Core API
+    // -----------------------------------------------------------------------
+
+    /// Record a received packet.
+    /// Adds or updates an entry when passesFilter(hashNodeId(nodeId), samplingDenominator),
+    /// i.e. when the 16-bit XOR-fold hash of the node ID falls in the 1/samplingDenominator
+    /// subsample of the hash space.  This is NOT a raw nodeId modulo check.
+    /// Marks the current hour as seen and updates the stored hop count to the last observed value.
+    /// Triggers a trim pass if the list exceeds FILL_HIGH_PCT after the insertion.
+    void samplePacketForHistogram(uint32_t nodeId, uint8_t hopCount);
+
+    // -----------------------------------------------------------------------
+    // Accessors
+    // -----------------------------------------------------------------------
+
+    uint8_t getLastRequiredHop() const { return lastRequiredHop; }
+    uint8_t getEntryCount() const { return count; }
+    uint8_t getFillPercentage() const { return static_cast<uint8_t>((static_cast<uint16_t>(count) * 100u) / CAPACITY); }
+    uint8_t getSamplingDenominator() const { return samplingDenominator; }
+    uint8_t getFilteringDenominator() const { return filteringDenominator; }
+    float getPoliteness() const { return lastPoliteNumer / static_cast<float>(POLITENESS_DENOM); }
+    const PerHopCounts &getLastPerHopCounts() const { return lastPerHopCounts; }
+    uint8_t getLastSuggestedHop() const { return lastSuggestedHop; }
+    const MeshTrendStats &getLastTrendStats() const { return lastTrendStats; }
+
+    // Compatibility accessors used by tests
+    uint8_t getCompactHistogramEntryCount() const { return getEntryCount(); }
+    uint8_t getCompactHistogramDenominator() const { return getSamplingDenominator(); }
+    uint8_t getCompactHistogramFilterDenominator() const { return getFilteringDenominator(); }
+    uint8_t getCompactHistogramSuggestedHop() const { return getLastSuggestedHop(); }
+    size_t getCompactHistogramAllSampleCount() const { return getEntryCount(); }
+
+    /// Force both sampling and filtering denominators to a specific value.
+    /// Intended for unit tests that need a deterministic starting denominator.
+    void setSamplingDenominator(uint8_t d)
+    {
+        samplingDenominator = (d < DENOM_MIN) ? DENOM_MIN : (d > DENOM_MAX ? DENOM_MAX : d);
+        filteringDenominator = samplingDenominator;
+        filteringDenomHoldRollsRemaining = 0;
+    }
+
+#ifdef PIO_UNIT_TESTING
+    // Writable from tests as HopScalingModule::s_testNowMs; drives nowMs() in PIO_UNIT_TESTING builds.
+    inline static uint32_t s_testNowMs = 0;
+    /// Override the per-session hash seed. Use in tests that need a specific sampling distribution.
+    void setHashSeed(uint16_t seed) { hashSeed = seed; }
+    uint16_t getHashSeed() const { return hashSeed; }
+    /// Expose hashNodeId for tests that need to compute which node IDs pass a given denominator.
+    uint16_t hashNodeIdPublic(uint32_t nodeId) const { return hashNodeId(nodeId); }
+#endif
+
+  protected:
+    int32_t runOnce() override;
+
+  private:
+#ifdef PIO_UNIT_TESTING
+    friend class HopScalingTestShim;
+#endif
+
+    /// Perform hourly rollover.
+    /// 1. Tallies per-hop counts for entries matching filteringDenominator and seen in 13 h.
+    /// 2. Walks the scaled hop buckets and returns the recommended hop limit.
+    /// 3. Logs scaled per-hop counts and recommendation.
+    /// 4. Checks for scale-down (< FILL_LOW_PCT of capacity pass filteringDenominator).
+    /// 5. Decrements filteringDenomHoldRollsRemaining (if > 0); once it reaches zero, halves
+    ///    filteringDenominator once toward samplingDenominator per rollHour() call.
+    /// 6. Shifts all seen bitmaps left by one hour slot.
+    void rollHour();
+    // -----------------------------------------------------------------------
+    // Persistence
+    // -----------------------------------------------------------------------
+
+    /// Persist the histogram state (entries, denominators, hold-timer) to flash.
+    /// No-op on platforms without a filesystem.  Performs a full delete-and-rewrite of
+    /// the state file on each call; avoid calling more frequently than once per rollHour().
+    void saveToDisk() const;
+
+    /// Restore histogram state from flash.  Safe to call even when no file exists.
+    /// Call once after construction, before the first rollHour(), to warm-start the
+    /// histogram across reboots without waiting 13 hours for data to re-accumulate.
+    /// The restored entries are available immediately for sampling, but the first
+    /// rollHour() (triggered by the second runOnce() tick) is needed before a warm-start
+    /// recommendation replaces the HOP_MAX boot default.
+    void loadFromDisk();
+
+    /// Remove stale entries (seen-bits all zero) and, if the list is still crowded,
+    /// double samplingDenominator and filteringDenominator and remove non-matching entries.
+    void trimIfNeeded();
+
+    void logStatusReport(bool didHourlyUpdate) const;
+
+    // -----------------------------------------------------------------------
+    // Histogram storage
+    // -----------------------------------------------------------------------
+    Record entries[CAPACITY] = {};
+    uint8_t count = 0;
+
+    // -----------------------------------------------------------------------
+    // Denominator state
+    //
+    // Two separate denominators control two distinct gates:
+    //
+    //   samplingDenominator  — admission gate.  A node is added/updated only when
+    //     passesFilter(hash, samplingDenominator).  Lower value = more permissive =
+    //     more nodes enter = represents recent mesh state.
+    //
+    //   filteringDenominator — counting gate.  The hop-walk tally in rollHour() only
+    //     counts entries that pass passesFilter(hash, filteringDenominator).  It moves
+    //     up with samplingDenominator immediately (scale-up) but is held at the
+    //     elevated value for FILTER_DENOM_HOLD_MS (13 h) after any scale-up before it
+    //     may drop back down (scale-down).
+    //
+    // Why the estimate is invariant: passesFilter uses a hash-based uniform subsample.
+    // For any two powers-of-two denominators D ≤ F, the fraction of D-sampled entries
+    // that also pass F is exactly D/F.  Therefore:
+    //   raw_count × F  =  (total × D/F) × F  =  total × D
+    // The population estimate is the same whether we count with D or with F.
+    // The hold period is not about accuracy — it is about stability: it prevents the
+    // hop recommendation from reacting to recently-admitted nodes that have not yet
+    // accumulated enough seenHoursAgo history to be statistically reliable.
+    //
+    //   denominatorHistory[h]  — the filteringDenominator used to both gate and scale
+    //     hourlyRaw[h].  Invariant: denominatorHistory[h] always equals the
+    //     filteringDenominator that was active when seenHoursAgo bit h was set.
+    //     rollHour() advances the array at the very start (before the tally loop), then
+    //     gates hourlyRaw[h] per-slot by denominatorHistory[h] — each slot's raw count
+    //     and multiplier are therefore always consistent, even when filteringDenominator
+    //     changes between rolls (e.g. hold expiry).  On scale-up (trimIfNeeded()), the
+    //     entire array is backfilled uniformly with the new filteringDenominator to
+    //     preserve the invariant retroactively for all 13 slots.  Initialised to
+    //     DENOM_MIN (1); scaledPerHour slots that draw from a 1 entry are unscaled —
+    //     correct for a fresh instance with no prior history.
+    // -----------------------------------------------------------------------
+    uint8_t samplingDenominator = DENOM_MIN;
+    uint8_t filteringDenominator = DENOM_MIN;
+    uint8_t filteringDenomHoldRollsRemaining = 0; // counts down from FILTER_DENOM_HOLD_ROLLS to 0; step-down fires at 0
+    uint8_t denominatorHistory[13] = {};
+    uint16_t hashSeed = 0;
+
+    // -----------------------------------------------------------------------
+    // Cached hourly results
+    // -----------------------------------------------------------------------
+    PerHopCounts lastPerHopCounts = {};
+    uint16_t lastScaledPerHop[MAX_HOP + 1] = {};
+    uint8_t lastSuggestedHop = MAX_HOP;
+    uint8_t lastPoliteNumer = POLITENESS_DEFAULT;
+    MeshTrendStats lastTrendStats = {};
+
+    // -----------------------------------------------------------------------
+    // Hop recommendation state
+    // -----------------------------------------------------------------------
+    uint8_t lastRequiredHop = HOP_MAX;
+    uint8_t histogramRollCount = 0;
+
+    // -----------------------------------------------------------------------
+    // Scheduler state
+    // -----------------------------------------------------------------------
+    bool hasCompletedInitialRun = false;
+    uint8_t runsSinceLastHourlyUpdate = 0;
+
+    // -----------------------------------------------------------------------
+    // Inline record helpers
+    // -----------------------------------------------------------------------
+
+    // Record field semantics:
+    //   nodeHash     → XOR-fold of full 32-bit node ID to 16 bits
+    //   hops_away    → hop distance (0–7)
+    //   seenHoursAgo → 13-bit per-hour seen bitmap
+    //                  bit 0  = seen in the current / most-recent hour
+    //                  bit 12 = seen 12 hours ago
+    //                  Shifts left on each rollHour(); 0 means not seen in 13 h.
+
+    /// XOR-fold + golden-ratio hash of a 32-bit node ID to 16 bits, mixed with the session seed.
+    /// Multiplying by floor(2^32 / φ) gives uniform avalanche; XORing the seed ensures different
+    /// devices (or the same device after a clear()) sample a different subset of node IDs.
+    /// For seed=0 the function is deterministic, which is used in PIO_UNIT_TESTING builds.
+    uint16_t hashNodeId(uint32_t nodeId) const { return static_cast<uint16_t>((nodeId * 2654435761u) >> 16) ^ hashSeed; }
+    static bool seenInLast13h(const Record &r) { return r.seenHoursAgo != 0u; }
+    static void markCurrentHour(Record &r) { r.seenHoursAgo |= 1u; }
+    static void rollSeenBits(Record &r) { r.seenHoursAgo = (r.seenHoursAgo << 1u) & 0x1FFFu; }
+    static bool passesFilter(uint16_t nodeHash, uint8_t denom) { return (nodeHash & static_cast<uint16_t>(denom - 1u)) == 0u; }
+
+  public:
+    // Clock — public so tests can share the same timebase via HopScalingModule::s_testNowMs
+#ifdef PIO_UNIT_TESTING
+    static uint32_t nowMs() { return s_testNowMs; }
+#else
+    static uint32_t nowMs() { return millis(); }
+#endif
+};
+
+extern HopScalingModule *hopScalingModule;
+
+#endif
@@ -41,6 +41,9 @@
 #if HAS_TRAFFIC_MANAGEMENT && !MESHTASTIC_EXCLUDE_TRAFFIC_MANAGEMENT
 #include "modules/TrafficManagementModule.h"
 #endif
+#if HAS_VARIABLE_HOPS
+#include "modules/HopScalingModule.h"
+#endif
 #include "modules/TextMessageModule.h"
 #if !MESHTASTIC_EXCLUDE_TRACEROUTE
 #include "modules/TraceRouteModule.h"
@@ -131,6 +134,10 @@ void setupModules()
    }
 #endif

+#if HAS_VARIABLE_HOPS
+    hopScalingModule = new HopScalingModule();
+#endif
+
 #if !MESHTASTIC_EXCLUDE_ADMIN
    adminModule = new AdminModule();
 #endif
@@ -49,6 +49,12 @@ bool NodeInfoModule::handleReceivedProtobuf(const meshtastic_MeshPacket &mp, mes
        LOG_WARN("Invalid nodeInfo detected, is_licensed mismatch!");
        return true;
    }
+    NodeNum sourceNum = getFrom(&mp);
+    const meshtastic_NodeInfoLite *node = nodeDB->getMeshNode(sourceNum);
+    if (node && nodeInfoLiteHasXeddsaSigned(node) && !mp.xeddsa_signed) {
+        LOG_WARN("Dropping unsigned NodeInfo from node 0x%08x that previously signed", sourceNum);
+        return true;
+    }

    // Coerce user.id to be derived from the node number
    snprintf(p.id, sizeof(p.id), "!%08x", getFrom(&mp));
@@ -158,8 +164,8 @@ meshtastic_MeshPacket *NodeInfoModule::allocReply()
        ignoreRequest = true;
        return NULL;
    } else {
-        ignoreRequest = false; // Don't ignore requests anymore
-        meshtastic_User &u = owner;
+        ignoreRequest = false;     // Don't ignore requests anymore
+        meshtastic_User u = owner; // deliberate copy: the licensed strip below must not clobber the global owner state

        // Strip the public key if the user is licensed
        if (u.is_licensed && u.public_key.size > 0) {
--- a/Show More
+++ b/Show More