Move large repeater tables off classic ESP32 static DRAM

Classic ESP32 links into a dram0_0_seg of only 124,580 bytes: memory.ld
carves the BT controller's 0xdb5c (56,156) reservation off the 0x2c200
window before the application gets any. Three large objects dominated what
was left, and Tbeam_SX1262_repeater_observer_mqtt overran the build's 8 KiB
static reserve by 4,744 bytes.

Heap-allocate them instead, each with a defined behaviour when the
allocation fails:

- OtaContext: generalize the Companion's borrowed-storage path behind
  OTA_DYNAMIC_CONTEXT and add OTA_HEAP_CONTEXT, which allocates the context
  on first use and frees it once no transfer, apply or folder link needs it.
  A repeater is idle nearly all the time, so the workspace is usually absent.
  Exhaustion is reported to the caller and the operation declines.
- ClientACL: the client table becomes a pointer with a live capacity;
  capacity 0 refuses new clients rather than writing through a null table.
- MyMesh flood packet filters: likewise, with flood_packet_filter_slots as
  the live bound for every rule loop. At capacity 0 the node forwards
  unfiltered, and both save paths refuse to write so a stored ruleset is
  never replaced by an empty file.

Also override the Arduino SDK's weak btInUse() in simple_repeater so
initArduino() releases the BT controller memory to the heap. That grows the
runtime heap these tables now come from; it cannot recover the same
reservation from the linker's static window.

Static DRAM, classic ESP32:
  Heltec_v2_repeater                   108,332 -> 70,732
  Tbeam_SX1262_repeater_observer_mqtt  121,132 -> 83,532  (was failing)

examples/simple_repeater/MyMesh.cpp

@@ -4,6 +4,7 @@
 #include <helpers/radiolib/RadioPowerLimits.h>
 #include <helpers/radiolib/RxBoostedGainDefaults.h>
 #include <algorithm>
+#include <new>       // std::nothrow (heap-allocated flood rule table)
 #include <stdlib.h>  // for qsort()
 #include <helpers/CLICommandUtils.h>
 #include <helpers/ClockSyncUtils.h>
@@ -3329,6 +3330,15 @@ MyMesh::MyMesh(mesh::MainBoard &board, mesh::Radio &radio, mesh::MillisecondCloc
       , bridge(&_prefs, _mgr, &rtc)
 #endif
 {
+  // Global constructors run before setup(), while the heap is still
+  // unfragmented. A failed allocation leaves flood_packet_filter_slots at 0:
+  // every rule loop is bounded by it, so the node forwards unfiltered instead
+  // of dereferencing a null table. saveFloodPacketFilters() refuses to write
+  // in that state so a stored ruleset is never overwritten with an empty one.
+  flood_packet_filters =
+      new (std::nothrow) FloodPacketFilterEntry[FLOOD_PACKET_FILTER_SLOTS];
+  flood_packet_filter_slots = flood_packet_filters ? FLOOD_PACKET_FILTER_SLOTS : 0;
+
   static_cast<StaticPoolPacketManager*>(_mgr)->setFloodScopePreference(
       scoreFloodTransportScope, this);
   last_millis = 0;
@@ -3380,7 +3390,7 @@ MyMesh::MyMesh(mesh::MainBoard &board, mesh::Radio &radio, mesh::MillisecondCloc
   recv_pkt_channel_scope_bypass = false;
   recv_pkt_channel_scope_rejected = false;
   recv_pkt_filter_match_mask = 0;
-  memset(flood_packet_filters, 0, sizeof(flood_packet_filters));
+  memset(flood_packet_filters, 0, sizeof(FloodPacketFilterEntry) * flood_packet_filter_slots);
   flood_packet_filter_blacklist_count = 0;
   memset(flood_packet_filter_blacklist, 0, sizeof(flood_packet_filter_blacklist));
   memset(flood_channel_scopes, 0, sizeof(flood_channel_scopes));
@@ -5667,6 +5677,9 @@ static void formatFloodModerationPath(
     const uint8_t path[FLOOD_GROUP_MODERATION_PATH_BYTES_MAX]);
 
 void MyMesh::seedDefaultFloodPacketFilters() {
+  // Slots 0 and 1 carry the built-in defaults; without a table there is
+  // nothing to seed and the node forwards unfiltered.
+  if (flood_packet_filter_slots < 2) return;
   auto& entry = flood_packet_filters[0];
   memset(&entry, 0, sizeof(entry));
   entry.active = true;
@@ -5713,7 +5726,7 @@ bool MyMesh::loadFloodPacketFilters() {
 
   enum class FileState : uint8_t { Missing, Valid, Invalid, Unreadable };
   auto loadFile = [this](const char* filename) -> FileState {
-    memset(flood_packet_filters, 0, sizeof(flood_packet_filters));
+    memset(flood_packet_filters, 0, sizeof(FloodPacketFilterEntry) * flood_packet_filter_slots);
     flood_channel_data_rule_slot = 0xFF;
     flood_channel_data_rule_max_hops = FLOOD_CHANNEL_HOPS_ALL;
     memset(flood_channel_scopes, 0, sizeof(flood_channel_scopes));
@@ -5737,7 +5750,7 @@ bool MyMesh::loadFloodPacketFilters() {
   success = (version_6 || version_7)
       && file.read(&count, sizeof(count)) == sizeof(count)
       && FloodFilterPolicy::forwardPersistenceCountSupported(
-          count, FLOOD_PACKET_FILTER_SLOTS);
+          count, flood_packet_filter_slots);
 
   for (int i = 0; success && i < count; i++) {
     uint8_t active = 0;
@@ -6072,7 +6085,7 @@ bool MyMesh::loadFloodPacketFilters() {
   }
     file.close();
     if (!success) {
-      memset(flood_packet_filters, 0, sizeof(flood_packet_filters));
+      memset(flood_packet_filters, 0, sizeof(FloodPacketFilterEntry) * flood_packet_filter_slots);
       memset(flood_channel_scopes, 0, sizeof(flood_channel_scopes));
       memset(flood_channel_direct_scopes, 0,
              sizeof(flood_channel_direct_scopes));
@@ -6177,7 +6190,7 @@ bool MyMesh::isFloodChannelDataRule(
 }
 
 int MyMesh::findFloodChannelDataRule() const {
-  if (flood_channel_data_rule_slot >= FLOOD_PACKET_FILTER_SLOTS) return -1;
+  if (flood_channel_data_rule_slot >= flood_packet_filter_slots) return -1;
   return isFloodChannelDataRule(
       flood_packet_filters[flood_channel_data_rule_slot])
       ? flood_channel_data_rule_slot : -1;
@@ -6230,7 +6243,7 @@ void MyMesh::setFloodChannelData(const char* value, char* reply) {
   int current = findFloodChannelDataRule();
   int slot = current;
   if (!enable && slot < 0) {
-    for (int i = 0; i < FLOOD_PACKET_FILTER_SLOTS; i++) {
+    for (int i = 0; i < flood_packet_filter_slots; i++) {
       if (!flood_packet_filters[i].active) {
         slot = i;
         break;
@@ -6311,7 +6324,7 @@ bool MyMesh::migrateLegacyFloodChannelData() {
   if (_prefs.flood_channel_data_enabled) return true;
 
   int slot = -1;
-  for (int i = 0; i < FLOOD_PACKET_FILTER_SLOTS; i++) {
+  for (int i = 0; i < flood_packet_filter_slots; i++) {
     if (!flood_packet_filters[i].active) {
       slot = i;
       break;
@@ -6437,7 +6450,7 @@ bool MyMesh::migrateLegacyFloodChannelBlocks() {
 
     bool duplicate = false;
     int free_slot = -1;
-    for (int i = 0; i < FLOOD_PACKET_FILTER_SLOTS; i++) {
+    for (int i = 0; i < flood_packet_filter_slots; i++) {
       const auto& entry = flood_packet_filters[i];
       if (!entry.active) {
         if (free_slot < 0) free_slot = i;
@@ -6498,6 +6511,9 @@ bool MyMesh::migrateLegacyFloodChannelBlocks() {
 bool MyMesh::saveFloodPacketFilters(bool empty_scope_phase,
                                     bool empty_forward_phase) {
   if (_fs == NULL) return false;
+  // Without a rule table there is nothing to persist. Writing the file anyway
+  // would replace the operator's stored ruleset with an empty one.
+  if (flood_packet_filter_slots == 0) return false;
   // Recovery owns transaction remnants; overwriting one could erase the only
   // complete image after a failed publish boundary.
   if (_fs->exists(FLOOD_PACKET_FILTER_TEMP_FILE)
@@ -6520,7 +6536,7 @@ bool MyMesh::saveFloodPacketFilters(bool empty_scope_phase,
 
   const uint8_t magic[4] = {'F', 'P', 'F', '7'};
   const uint8_t count = FloodFilterPolicy::forwardPersistenceCount(
-      flood_packet_filters, FLOOD_PACKET_FILTER_SLOTS,
+      flood_packet_filters, flood_packet_filter_slots,
       empty_forward_phase);
   bool success = writeExact(magic, sizeof(magic))
       && writeExact(&count, sizeof(count));
@@ -6643,7 +6659,7 @@ bool MyMesh::saveFloodPacketFilters(bool empty_scope_phase,
 }
 #else
 bool MyMesh::loadFloodPacketFilters() {
-  memset(flood_packet_filters, 0, sizeof(flood_packet_filters));
+  memset(flood_packet_filters, 0, sizeof(FloodPacketFilterEntry) * flood_packet_filter_slots);
   if (_fs == NULL) {
     seedDefaultFloodPacketFilters();
     return true;
@@ -6663,7 +6679,7 @@ bool MyMesh::loadFloodPacketFilters() {
   bool version_6 = success && memcmp(magic, "FPF6", sizeof(magic)) == 0;
   success = version_6
       && file.read(&count, sizeof(count)) == sizeof(count)
-      && count <= FLOOD_PACKET_FILTER_SLOTS;
+      && count <= flood_packet_filter_slots;
 
   for (int i = 0; success && i < count; i++) {
     uint8_t active = 0;
@@ -6728,7 +6744,7 @@ bool MyMesh::loadFloodPacketFilters() {
   file.close();
 
   // A truncated or invalid file fails open; filtering must never be enabled by corrupt bytes.
-  if (!success) memset(flood_packet_filters, 0, sizeof(flood_packet_filters));
+  if (!success) memset(flood_packet_filters, 0, sizeof(FloodPacketFilterEntry) * flood_packet_filter_slots);
   return success;
 }
 
@@ -6736,16 +6752,18 @@ bool MyMesh::saveFloodPacketFilters(bool empty_scope_phase,
                                     bool empty_forward_phase) {
   (void)empty_scope_phase;
   if (_fs == NULL) return false;
+  // As above: never replace a stored ruleset with an empty file.
+  if (flood_packet_filter_slots == 0) return false;
   File file = openFloodSettingsWrite(_fs, FLOOD_PACKET_FILTER_FILE);
   if (!file) return false;
 
   const uint8_t magic[4] = {'F', 'P', 'F', '6'};
-  uint8_t count = FLOOD_PACKET_FILTER_SLOTS;
+  uint8_t count = flood_packet_filter_slots;
   bool success = file.write(magic, sizeof(magic)) == sizeof(magic)
       && file.write(&count, sizeof(count)) == sizeof(count);
   FloodPacketFilterEntry empty_entry;
   memset(&empty_entry, 0, sizeof(empty_entry));
-  for (int i = 0; success && i < FLOOD_PACKET_FILTER_SLOTS; i++) {
+  for (int i = 0; success && i < flood_packet_filter_slots; i++) {
     const auto& entry = empty_forward_phase
         ? empty_entry : flood_packet_filters[i];
     uint8_t active = entry.active ? 1 : 0;
@@ -6862,7 +6880,7 @@ bool MyMesh::authenticateFloodPacketFilterChannel(
 }
 
 bool MyMesh::hasFloodPacketFilterRetryRules() const {
-  for (int i = 0; i < FLOOD_PACKET_FILTER_SLOTS; i++) {
+  for (int i = 0; i < flood_packet_filter_slots; i++) {
     if (flood_packet_filters[i].active
         && flood_packet_filters[i].retry_on_match) return true;
   }
@@ -6870,7 +6888,7 @@ bool MyMesh::hasFloodPacketFilterRetryRules() const {
 }
 
 bool MyMesh::floodPacketFilterAllowsRetry(uint64_t match_mask) const {
-  for (int i = 0; i < FLOOD_PACKET_FILTER_SLOTS; i++) {
+  for (int i = 0; i < flood_packet_filter_slots; i++) {
     if ((match_mask & ((uint64_t)1U << i)) != 0
         && flood_packet_filters[i].retry_on_match) return true;
   }
@@ -6881,14 +6899,14 @@ int MyMesh::nextFloodPacketFilterMatch(uint64_t match_mask,
                                        uint64_t visited_mask) const {
   uint8_t priorities[FLOOD_PACKET_FILTER_SLOTS];
   uint8_t specificities[FLOOD_PACKET_FILTER_SLOTS];
-  for (int i = 0; i < FLOOD_PACKET_FILTER_SLOTS; i++) {
+  for (int i = 0; i < flood_packet_filter_slots; i++) {
     priorities[i] = flood_packet_filters[i].priority;
     specificities[i] = FloodFilterPolicy::channelMatcherSpecificity(
         flood_packet_filters[i].channel_key_len);
   }
   return FloodFilterPolicy::nextOrderedRule(
       match_mask, visited_mask, priorities, specificities,
-      FLOOD_PACKET_FILTER_SLOTS);
+      flood_packet_filter_slots);
 }
 
 bool MyMesh::resolveFloodPacketFilterTargetRegion(
@@ -6910,7 +6928,7 @@ uint64_t MyMesh::applyFloodPacketFilterStop(uint64_t match_mask) {
   uint8_t priorities[FLOOD_PACKET_FILTER_SLOTS];
   uint8_t specificities[FLOOD_PACKET_FILTER_SLOTS];
   uint8_t stop_flags[FLOOD_PACKET_FILTER_SLOTS];
-  for (int i = 0; i < FLOOD_PACKET_FILTER_SLOTS; i++) {
+  for (int i = 0; i < flood_packet_filter_slots; i++) {
     priorities[i] = flood_packet_filters[i].priority;
     const auto& entry = flood_packet_filters[i];
     specificities[i] = FloodFilterPolicy::channelMatcherSpecificity(
@@ -6928,7 +6946,7 @@ uint64_t MyMesh::applyFloodPacketFilterStop(uint64_t match_mask) {
   }
   return FloodFilterPolicy::truncateRulesAtStop(
       match_mask, priorities, specificities, stop_flags,
-      FLOOD_PACKET_FILTER_SLOTS);
+      flood_packet_filter_slots);
 }
 
 uint64_t MyMesh::evaluateFloodPacketFilterMatches(
@@ -6944,7 +6962,7 @@ uint64_t MyMesh::evaluateFloodPacketFilterMatches(
   bool channel_auth_checked[FLOOD_PACKET_FILTER_SLOTS] = { false };
   bool channel_auth_valid[FLOOD_PACKET_FILTER_SLOTS] = { false };
   uint64_t matches = 0;
-  for (int i = 0; i < FLOOD_PACKET_FILTER_SLOTS; i++) {
+  for (int i = 0; i < flood_packet_filter_slots; i++) {
     const auto& entry = flood_packet_filters[i];
     if (!floodPacketFilterFieldsMatch(
             entry, packet, incoming_is_scoped, incoming_transport_code,
@@ -7056,7 +7074,7 @@ bool MyMesh::shouldBlockFloodPacketForward(const mesh::Packet* packet) const {
 void MyMesh::commitFloodPacketFilterRates(const mesh::Packet* packet) {
   if (packet == NULL || !packet->isRouteFlood()) return;
   uint32_t now = _ms->getMillis();
-  for (int i = 0; i < FLOOD_PACKET_FILTER_SLOTS; i++) {
+  for (int i = 0; i < flood_packet_filter_slots; i++) {
     auto& entry = flood_packet_filters[i];
     if ((recv_pkt_filter_match_mask & ((uint64_t)1U << i)) == 0
         || !entry.rate_limit_enabled) {
@@ -7098,7 +7116,7 @@ uint64_t MyMesh::evaluateFloodPacketFilterMatches(
     const RegionEntry* incoming_region) {
   (void)incoming_region;
   uint64_t matches = 0;
-  for (int i = 0; i < FLOOD_PACKET_FILTER_SLOTS; i++) {
+  for (int i = 0; i < flood_packet_filter_slots; i++) {
     const auto& entry = flood_packet_filters[i];
     if (floodPacketFilterFieldsMatch(entry, packet, false, 0,
                                      incoming_region_allowed, NULL)
@@ -7118,7 +7136,7 @@ bool MyMesh::applyFloodPacketFilterScope(mesh::Packet* packet,
   scope_set = false;
   fast_track = false;
   if (packet == NULL || !packet->isRouteFlood()) return false;
-  for (int i = 0; i < FLOOD_PACKET_FILTER_SLOTS; i++) {
+  for (int i = 0; i < flood_packet_filter_slots; i++) {
     const auto& entry = flood_packet_filters[i];
     if ((match_mask & ((uint64_t)1U << i)) == 0
         || entry.scope_name[0] == 0) continue;
@@ -7145,7 +7163,7 @@ bool MyMesh::shouldBlockFloodPacketForward(const mesh::Packet* packet) const {
   if (packet == NULL || !packet->isRouteFlood()) return false;
   uint8_t type = packet->getPayloadType();
   uint8_t hops = packet->getPathHashCount();
-  for (int i = 0; i < FLOOD_PACKET_FILTER_SLOTS; i++) {
+  for (int i = 0; i < flood_packet_filter_slots; i++) {
     const auto& entry = flood_packet_filters[i];
     if ((recv_pkt_filter_match_mask & ((uint64_t)1U << i)) != 0
         && entry.scope_name[0] == 0) {
@@ -7175,7 +7193,7 @@ static bool floodRuleRegionNamePresent(const RegionMap& map,
 }
 
 void MyMesh::formatFloodPacketFilterDetail(int index, char* reply, size_t reply_len) const {
-  if (index < 0 || index >= FLOOD_PACKET_FILTER_SLOTS || !flood_packet_filters[index].active) {
+  if (index < 0 || index >= flood_packet_filter_slots || !flood_packet_filters[index].active) {
     snprintf(reply, reply_len, "Err - empty filter slot");
     return;
   }
@@ -7336,8 +7354,8 @@ void MyMesh::formatFloodPacketFilters(const char* args, char* reply) const {
   if (*selector == '.') selector = skipFloodFilterSpaces(selector + 1);
   if (*selector != 0) {
     uint8_t slot;
-    if (!parseFloodFilterUnsigned(selector, FLOOD_PACKET_FILTER_SLOTS, slot) || slot == 0) {
-      snprintf(reply, 160, "Err - filter slot must be 1-%d", FLOOD_PACKET_FILTER_SLOTS);
+    if (!parseFloodFilterUnsigned(selector, flood_packet_filter_slots, slot) || slot == 0) {
+      snprintf(reply, 160, "Err - filter slot must be 1-%d", flood_packet_filter_slots);
       return;
     }
     formatFloodPacketFilterDetail(slot - 1, reply, 160);
@@ -7347,7 +7365,7 @@ void MyMesh::formatFloodPacketFilters(const char* args, char* reply) const {
   size_t used = (size_t)snprintf(reply, 160, ">");
   int active_count = 0;
   bool truncated = false;
-  for (int i = 0; i < FLOOD_PACKET_FILTER_SLOTS; i++) {
+  for (int i = 0; i < flood_packet_filter_slots; i++) {
     const auto& entry = flood_packet_filters[i];
     if (!entry.active) continue;
     active_count++;
@@ -7407,14 +7425,14 @@ void MyMesh::setFloodPacketFilter(const char* args, char* reply,
     size_t slot_len = (size_t)(cursor - slot_start);
     char slot_text[8];
     if (slot_len == 0 || slot_len >= sizeof(slot_text)) {
-      snprintf(reply, 160, "Err - filter slot must be 1-%d", FLOOD_PACKET_FILTER_SLOTS);
+      snprintf(reply, 160, "Err - filter slot must be 1-%d", flood_packet_filter_slots);
       return;
     }
     memcpy(slot_text, slot_start, slot_len);
     slot_text[slot_len] = 0;
     uint8_t slot;
-    if (!parseFloodFilterUnsigned(slot_text, FLOOD_PACKET_FILTER_SLOTS, slot) || slot == 0) {
-      snprintf(reply, 160, "Err - filter slot must be 1-%d", FLOOD_PACKET_FILTER_SLOTS);
+    if (!parseFloodFilterUnsigned(slot_text, flood_packet_filter_slots, slot) || slot == 0) {
+      snprintf(reply, 160, "Err - filter slot must be 1-%d", flood_packet_filter_slots);
       return;
     }
     requested_slot = slot - 1;
@@ -7829,7 +7847,7 @@ void MyMesh::setFloodPacketFilter(const char* args, char* reply,
 
   int slot = requested_slot;
   if (slot < 0) {
-    for (int i = 0; i < FLOOD_PACKET_FILTER_SLOTS; i++) {
+    for (int i = 0; i < flood_packet_filter_slots; i++) {
       // Keep the compatibility-owned row distinct from an ordinary rule with
       // identical match/action fields. Otherwise a generic, unnumbered set
       // would silently detach flood.channel.data from its own row.
@@ -7845,7 +7863,7 @@ void MyMesh::setFloodPacketFilter(const char* args, char* reply,
     }
   }
   if (slot < 0) {
-    for (int i = 0; i < FLOOD_PACKET_FILTER_SLOTS; i++) {
+    for (int i = 0; i < flood_packet_filter_slots; i++) {
       if (!flood_packet_filters[i].active) {
         slot = i;
         break;
@@ -7876,7 +7894,7 @@ void MyMesh::setFloodPacketFilter(const char* args, char* reply,
 }
 #else
 void MyMesh::formatFloodPacketFilterDetail(int index, char* reply, size_t reply_len) const {
-  if (index < 0 || index >= FLOOD_PACKET_FILTER_SLOTS || !flood_packet_filters[index].active) {
+  if (index < 0 || index >= flood_packet_filter_slots || !flood_packet_filters[index].active) {
     snprintf(reply, reply_len, "Err - empty filter slot");
     return;
   }
@@ -7909,8 +7927,8 @@ void MyMesh::formatFloodPacketFilters(const char* args, char* reply) const {
   if (*selector == '.') selector = skipFloodFilterSpaces(selector + 1);
   if (*selector != 0) {
     uint8_t slot;
-    if (!parseFloodFilterUnsigned(selector, FLOOD_PACKET_FILTER_SLOTS, slot) || slot == 0) {
-      snprintf(reply, 160, "Err - filter slot must be 1-%d", FLOOD_PACKET_FILTER_SLOTS);
+    if (!parseFloodFilterUnsigned(selector, flood_packet_filter_slots, slot) || slot == 0) {
+      snprintf(reply, 160, "Err - filter slot must be 1-%d", flood_packet_filter_slots);
       return;
     }
     formatFloodPacketFilterDetail(slot - 1, reply, 160);
@@ -7920,7 +7938,7 @@ void MyMesh::formatFloodPacketFilters(const char* args, char* reply) const {
   size_t used = (size_t)snprintf(reply, 160, ">");
   int active_count = 0;
   bool truncated = false;
-  for (int i = 0; i < FLOOD_PACKET_FILTER_SLOTS; i++) {
+  for (int i = 0; i < flood_packet_filter_slots; i++) {
     const auto& entry = flood_packet_filters[i];
     if (!entry.active) continue;
     active_count++;
@@ -7962,14 +7980,14 @@ void MyMesh::setFloodPacketFilter(const char* args, char* reply,
     size_t slot_len = (size_t)(cursor - slot_start);
     char slot_text[8];
     if (slot_len == 0 || slot_len >= sizeof(slot_text)) {
-      snprintf(reply, 160, "Err - filter slot must be 1-%d", FLOOD_PACKET_FILTER_SLOTS);
+      snprintf(reply, 160, "Err - filter slot must be 1-%d", flood_packet_filter_slots);
       return;
     }
     memcpy(slot_text, slot_start, slot_len);
     slot_text[slot_len] = 0;
     uint8_t slot;
-    if (!parseFloodFilterUnsigned(slot_text, FLOOD_PACKET_FILTER_SLOTS, slot) || slot == 0) {
-      snprintf(reply, 160, "Err - filter slot must be 1-%d", FLOOD_PACKET_FILTER_SLOTS);
+    if (!parseFloodFilterUnsigned(slot_text, flood_packet_filter_slots, slot) || slot == 0) {
+      snprintf(reply, 160, "Err - filter slot must be 1-%d", flood_packet_filter_slots);
       return;
     }
     requested_slot = slot - 1;
@@ -8081,7 +8099,7 @@ void MyMesh::setFloodPacketFilter(const char* args, char* reply,
 
   int slot = requested_slot;
   if (slot < 0) {
-    for (int i = 0; i < FLOOD_PACKET_FILTER_SLOTS; i++) {
+    for (int i = 0; i < flood_packet_filter_slots; i++) {
       const auto& entry = flood_packet_filters[i];
       if (entry.active && entry.payload_type == payload_type
           && entry.min_hops == min_hops && entry.max_hops == max_hops
@@ -8095,7 +8113,7 @@ void MyMesh::setFloodPacketFilter(const char* args, char* reply,
     }
   }
   if (slot < 0) {
-    for (int i = 0; i < FLOOD_PACKET_FILTER_SLOTS; i++) {
+    for (int i = 0; i < flood_packet_filter_slots; i++) {
       if (!flood_packet_filters[i].active) {
         slot = i;
         break;
@@ -8137,7 +8155,7 @@ void MyMesh::deleteFloodPacketFilter(const char* args, char* reply) {
     if (!saveFloodPacketFilters(false, true)) {
       strcpy(reply, "Err - unable to save flood filter");
     } else {
-      memset(flood_packet_filters, 0, sizeof(flood_packet_filters));
+      memset(flood_packet_filters, 0, sizeof(FloodPacketFilterEntry) * flood_packet_filter_slots);
 #if MESH_ENABLE_FLOOD_RULE_ENGINE
       flood_channel_data_rule_slot = 0xFF;
 #endif
@@ -8147,8 +8165,8 @@ void MyMesh::deleteFloodPacketFilter(const char* args, char* reply) {
   }
 
   uint8_t slot;
-  if (!parseFloodFilterUnsigned(selector, FLOOD_PACKET_FILTER_SLOTS, slot) || slot == 0) {
-    snprintf(reply, 160, "Err - use: del flood.filter.<1-%d>|all", FLOOD_PACKET_FILTER_SLOTS);
+  if (!parseFloodFilterUnsigned(selector, flood_packet_filter_slots, slot) || slot == 0) {
+    snprintf(reply, 160, "Err - use: del flood.filter.<1-%d>|all", flood_packet_filter_slots);
     return;
   }
   int index = slot - 1;
@@ -12017,6 +12035,12 @@ void MyMesh::loop() {
   _cli.loop();
   processDeferredCliCommand();
   servicePostMeshLoop();
+#if defined(ENABLE_OTA) && OTA_DYNAMIC_CONTEXT
+  // Hand the OTA workspace back once no transfer, apply or folder link needs
+  // it. A repeater is idle almost all of its life, so this is where the bulk
+  // of the saving actually lands.
+  mesh::ota::ota_release_context_if_idle(isTempRadioActive());
+#endif
 }
 
 #if MESH_ENABLE_TELEMETRY_HISTORY

examples/simple_repeater/MyMesh.h

@@ -462,7 +462,14 @@ class MyMesh : public mesh::Mesh, public CommonCLICallbacks
   };
   mutable FloodRetryBridgeState flood_retry_bridge_states[MAX_FLOOD_RETRY_SLOTS];
   FloodRetryBridgeReachability flood_retry_bridge_reachability[FLOOD_RETRY_BRIDGE_BUCKETS + 1];
-  FloodPacketFilterEntry flood_packet_filters[FLOOD_PACKET_FILTER_SLOTS];
+  // The rule table is the single largest member of this object. It is heap
+  // allocated in the constructor (before setup(), while the heap is still
+  // unfragmented) so classic ESP32's small link-time static DRAM window does
+  // not have to hold it. flood_packet_filter_slots is the live capacity, and
+  // is 0 when the allocation failed: every loop below is bounded by it, so a
+  // zero-capacity node simply forwards without rule filtering.
+  FloodPacketFilterEntry* flood_packet_filters;
+  uint8_t flood_packet_filter_slots;
   uint8_t flood_packet_filter_blacklist_count;
   uint8_t flood_packet_filter_blacklist[FLOOD_PACKET_FILTER_BLACKLIST_MAX]
                                        [FLOOD_PACKET_FILTER_PATH_ID_SIZE];

examples/simple_repeater/main.cpp

@@ -24,6 +24,19 @@
   #include <helpers/nrf52/EthernetCLI.h>
 #endif
 
+#if defined(ESP32) && defined(CONFIG_BT_ENABLED) && !defined(BLE_PIN_CODE)
+// A repeater has no Bluetooth transport, but the Arduino SDK is built with the
+// BT controller enabled, so its memory stays reserved unless the application
+// says otherwise. initArduino() calls esp_bt_controller_mem_release() when
+// this weak hook returns false, handing that region to the heap. Note this
+// only grows the *runtime heap*: the same reservation is also carved out of
+// the linker's dram0_0_seg (0xdb5c on classic ESP32), and no runtime call can
+// give those static bytes back. It is what makes the heap-allocated tables
+// above comfortable, not a substitute for them.
+extern "C" bool btInUse();
+extern "C" bool btInUse() { return false; }
+#endif
+
 StdRNG fast_rng;
 #if MAX_RECENT_REPEATERS > 0
   #if defined(ESP32)