From f304b8ff771429a99961d722b99544fd37c99a9f Mon Sep 17 00:00:00 2001
From: mikecarper <mikecarper@gmail.com>
Date: Sun, 11 Oct 2026 02:08:02 -0700
Subject: [PATCH] Add Meshtext Companion channel chat and automatic radio2
 setup

---
 .github/workflows/run-unit-tests.yml          |  13 +-
 build_legacy.sh                               |   3 +
 docs/cli_commands.md                          |   4 +
 docs/companion_protocol.md                    |  31 +-
 docs/radio_profiles.md                        | 267 ++++++
 docs/terminal_chat_cli.md                     |  15 +
 .../companion_radio/MeshtextCompanion.cpp     | 604 +++++++++++++
 examples/companion_radio/MyMesh.cpp           | 441 ++++++++--
 examples/companion_radio/MyMesh.h             |  58 +-
 licenses/ESPP-Meshtext-MIT.txt                |  37 +
 scripts/check_firmware_capabilities.py        |  18 +
 scripts/firmware_build_recipe.py              |   3 +-
 scripts/firmware_memory_manifest.py           |   4 +
 scripts/package_cascade_release.py            |   9 +-
 scripts/package_esp32_partition_migration.py  |   4 +
 scripts/package_meshtext_license.py           | 151 ++++
 src/Dispatcher.cpp                            | 204 ++++-
 src/Dispatcher.h                              |  34 +-
 src/Mesh.cpp                                  |   6 +-
 src/Mesh.h                                    |   8 +
 src/RadioProfiles.h                           |  16 +-
 src/helpers/CLICommandUtils.h                 |  11 +
 src/helpers/CompanionChannelAlias.h           |  71 ++
 src/helpers/CompanionMeshtextChannel.h        |  97 ++
 src/helpers/MeshtextChat.cpp                  | 368 ++++++++
 src/helpers/MeshtextChat.h                    |  82 ++
 src/helpers/MeshtextConfig.h                  |  22 +
 src/helpers/RadioProfileCLI.cpp               | 250 +++++-
 src/helpers/RadioProfileCLI.h                 |  38 +-
 src/helpers/radiolib/CustomSX1262.h           |  31 +
 src/helpers/radiolib/CustomSX1262Wrapper.h    |  12 +
 src/helpers/radiolib/RadioLibWrappers.cpp     |  35 +
 src/helpers/radiolib/RadioLibWrappers.h       |   8 +
 test/fixtures/companion_lost_reply.cpp        |   5 +-
 test/fixtures/companion_meshtext.cpp          | 831 ++++++++++++++++++
 .../test_cli_command_utils.cpp                |   5 +
 test/test_companion_channel_alias.py          | 656 ++++++++++++++
 test/test_companion_lost_reply.py             |   3 +-
 test/test_companion_meshtext.py               | 215 +++++
 test/test_companion_terminal_profile.py       |  16 +-
 test/test_companion_tx_routing.py             |  39 +-
 .../test_contact_import.cpp                   | 202 ++++-
 test/test_meshtext_auto_radio2_hil.py         | 234 +++++
 test/test_meshtext_auto_radio2_hil_sdk.py     | 175 ++++
 test/test_meshtext_chat.py                    | 491 +++++++++++
 test/test_meshtext_license.py                 | 203 +++++
 test/test_meshtext_transport.py               | 354 ++++++++
 test/test_radio_profile_auto.py               | 375 ++++++++
 test/test_radio_profile_spiffs_missing.py     |   2 +-
 test/test_sx1262_protocol_batching.py         | 173 ++++
 tools/hil/mercer_mt_flash.sh                  | 241 +++++
 tools/hil/meshtext_auto_radio2.py             | 653 ++++++++++++++
 52 files changed, 7700 insertions(+), 128 deletions(-)
 create mode 100644 examples/companion_radio/MeshtextCompanion.cpp
 create mode 100644 licenses/ESPP-Meshtext-MIT.txt
 create mode 100644 scripts/package_meshtext_license.py
 create mode 100644 src/helpers/CompanionChannelAlias.h
 create mode 100644 src/helpers/CompanionMeshtextChannel.h
 create mode 100644 src/helpers/MeshtextChat.cpp
 create mode 100644 src/helpers/MeshtextChat.h
 create mode 100644 src/helpers/MeshtextConfig.h
 create mode 100644 test/fixtures/companion_meshtext.cpp
 create mode 100644 test/test_companion_channel_alias.py
 create mode 100644 test/test_companion_meshtext.py
 create mode 100644 test/test_meshtext_auto_radio2_hil.py
 create mode 100644 test/test_meshtext_auto_radio2_hil_sdk.py
 create mode 100644 test/test_meshtext_chat.py
 create mode 100644 test/test_meshtext_license.py
 create mode 100644 test/test_meshtext_transport.py
 create mode 100644 test/test_radio_profile_auto.py
 create mode 100644 test/test_sx1262_protocol_batching.py
 create mode 100644 tools/hil/mercer_mt_flash.sh
 create mode 100644 tools/hil/meshtext_auto_radio2.py

diff --git a/.github/workflows/run-unit-tests.yml b/.github/workflows/run-unit-tests.yml
index 060b0962a..cbb75f236 100644
--- a/.github/workflows/run-unit-tests.yml
+++ b/.github/workflows/run-unit-tests.yml
@@ -234,6 +234,7 @@ jobs:
 
       - name: Verify Companion contact and channel TX routing
         run: |
+          python3 -B test/test_companion_channel_alias.py -v
           python3 -B test/test_companion_tx_routing.py -v
           python3 -B test/test_companion_discovery.py -v
           python3 -B test/test_repeater_discovery.py -v
@@ -269,6 +270,16 @@ jobs:
           python3 -B test/test_identity_and_settings_recovery.py -v
           python3 -B test/test_contact_cache.py -v
 
+      - name: Verify Meshtext chat codec, transport and Companion integration
+        run: |
+          python3 -B test/test_meshtext_chat.py -v
+          python3 -B test/test_meshtext_transport.py -v
+          python3 -B test/test_meshtext_license.py -v
+          python3 -B test/test_radio_profile_auto.py -v
+          python3 -B test/test_companion_meshtext.py -v
+          python3 -B test/test_meshtext_auto_radio2_hil.py -v
+          python3 -B test/test_meshtext_auto_radio2_hil_sdk.py -v
+
       - name: Verify receive recovery and pinned radio status transport
         run: |
           python3 -B test/test_dispatcher_startup_watchdog.py -v
@@ -311,7 +322,7 @@ jobs:
         working-directory: test
         run: >-
           python3 -B -m unittest -v
-          test_sx1262_profile_switch test_sx1262_batched_modulation
+          test_sx1262_profile_switch test_sx1262_batched_modulation test_sx1262_protocol_batching
           test_radio_chirp_math
 
       - name: Verify radio lab collectors and compiled experiment contracts
diff --git a/build_legacy.sh b/build_legacy.sh
index af4317088..13704b39a 100755
--- a/build_legacy.sh
+++ b/build_legacy.sh
@@ -4743,6 +4743,9 @@ collect_build_artifacts() {
       ;;
   esac
 
+  python3 scripts/package_meshtext_license.py collect "$build_output_dir" \
+    --stem "${OUTPUT_DIR}/${firmware_filename}" || return $?
+
   python3 scripts/firmware_memory_manifest.py package "$build_output_dir" \
     --stem "${OUTPUT_DIR}/${firmware_filename}" || return $?
 }
diff --git a/docs/cli_commands.md b/docs/cli_commands.md
index ffaf2146e..b99edbaf8 100644
--- a/docs/cli_commands.md
+++ b/docs/cli_commands.md
@@ -7,6 +7,10 @@
 See [two LoRa profiles](radio_profiles.md) for `radio2`, `tempradio2`, scheduling,
 RX-only mode, cross-transmission policy, and optional radio preambles.
 
+For supported Full Companions, see [Meshtext channel chat](radio_profiles.md#meshtext-channel-chat)
+for `mt-` channels and the explicit `send mt.nodeinfo <channel slot>` command.
+Chat remains plain text; NodeInfo is sent only when that command is requested.
+
 See [carrier-wave RF checks](carrier_wave.md) for `cw on [seconds]`,
 `cw2 on [seconds]`, and stopping a carrier with `off`.
 
diff --git a/docs/companion_protocol.md b/docs/companion_protocol.md
index 85ecc08ca..6547a57a7 100644
--- a/docs/companion_protocol.md
+++ b/docs/companion_protocol.md
@@ -545,6 +545,11 @@ Byte 1: Channel index (0 through max_channels - 1)
 
 **Response**: `PACKET_CHANNEL_INFO` (0x12) with channel details
 
+On builds with `MESH_ENABLE_MESHTEXT_CHAT=1`, a capable client can append a
+third request byte of `32` (`1F <index> 20`) to retrieve the complete 32-byte
+secret for an `mt-` channel. Ordinary two-byte requests, and requests for
+MeshCore channels, retain the original 16-byte secret response.
+
 ---
 
 ### 4. Set Channel
@@ -583,7 +588,27 @@ Bytes 34-49: Secret (16 bytes)
     [16 bytes of secret]
 ```
 
-**Note**: The 32-byte secret variant is unsupported and returns `PACKET_ERROR`.
+**Meshtext-only extension**: With `MESH_ENABLE_MESHTEXT_CHAT=1`, a 66-byte
+`SET_CHANNEL` frame can supply 32 secret bytes at offsets 34–65 for an `mt-`
+channel. Non-MT channels and feature-disabled builds reject this variant with
+`PACKET_ERROR`; the standard 50-byte MeshCore command is unchanged. The MT
+backend uses AES-256 when the upper 16 bytes are nonzero, otherwise AES-128.
+
+A legacy 50-byte SET of an existing MT channel preserves its upper 16 key
+bytes when the supplied lower half is unchanged. This permits an old client's
+GET/edit/SET round trip without silently truncating a provisioned AES-256 key.
+To explicitly replace or downgrade that key, send the full 32-byte variant
+(zero the upper half for AES-128). A client using only the legacy GET cannot
+export a complete AES-256 key. Stock app editors do not gain 256-bit
+provisioning or sharing from this firmware extension.
+
+For local CLI provisioning without implementing the binary extension, use
+`set mt.channel` with a 32- or 64-digit hexadecimal PSK; see the
+[private-channel commands](radio_profiles.md#meshtext-channel-chat).
+
+MT channel changes can also fail with a bad-state error for conflicting
+presets, an unsuitable manual radio2 profile, ambiguous region or a busy
+automatic owner. See [Meshtext channel chat](radio_profiles.md#meshtext-channel-chat).
 
 **Response**: `PACKET_OK` (0x00) on success, `PACKET_ERROR` (0x01) on failure
 
@@ -1035,7 +1060,9 @@ Bytes 2-33: Channel Name (32 bytes, null-terminated)
 Bytes 34-49: Secret (16 bytes)
 ```
 
-**Note**: The device returns the 16-byte channel secret in this response.
+**Note**: The normal response contains the 16-byte channel secret. An opt-in
+32-byte MT GET described above extends the secret through byte 65; response
+code, index and name fields remain unchanged.
 
 **PACKET_DEVICE_INFO** (0x0D):
 ```
diff --git a/docs/radio_profiles.md b/docs/radio_profiles.md
index 5fafff99a..08791bd6e 100644
--- a/docs/radio_profiles.md
+++ b/docs/radio_profiles.md
@@ -241,6 +241,270 @@ its choice. They use reserved bytes in existing saved records, so record
 sizes and the phone protocol are unchanged. Older firmware ignores these
 bytes and may reset the choices when it saves the records.
 
+## Companion channel-name routing aliases
+
+Companions recognize the case-sensitive prefixes `r2-` and `mt-`, immediately
+after the optional leading `#`. Keep the prefix in the app's displayed name.
+For MeshCore aliases, the firmware strips exactly one prefix when deriving an
+automatic hashtag key:
+
+```text
+#emergency       -> hashtag key for #emergency
+#r2-emergency    -> the same key for #emergency
+#mt-emergency    -> the same key for #emergency only in MeshCore fallback mode
+```
+
+Only the app's automatic, name-derived hashtag key is normalized; a supplied
+private key is not replaced. Non-hashtag names such as `r2-Private` also retain
+their supplied key. Empty or nested prefixes (`r2-`, `#r2-mt-emergency`) are
+rejected. MeshCore hashtag names remain case-sensitive.
+
+When radio2 is configured (`rx` or `rxtx`), `r2-` binds the channel to radio2 for
+both send and receive, including emergency retransmissions. It overrides global
+crossing and cannot be changed with `set tx.channel`; rename the channel to
+remove the binding. RX-only radio2 cannot send. If radio2 is off/unconfigured,
+ignore the routing prefix and use ordinary MeshCore routing instead. The key
+stays the same as radio2 is enabled, disabled, or a temporary window expires.
+
+If both the ordinary and `r2-` slots have the same key, a packet received on
+radio2 selects the `r2-` slot; a packet received on radio1 selects the ordinary
+slot. Global packet deduplication still delivers each packet once, not once in
+each slot. Receiving a radio2-only channel on the wrong profile does not mark
+that authenticated packet seen, so it can still arrive later on radio2.
+
+The saved channel record retains the original displayed name and app-supplied
+key for editing and sharing. Runtime copies resolve the actual wire key.
+Repeater/room/sensor hashtag behavior is unchanged; those nodes can join the
+canonical MeshCore channel (`#emergency`). Older Companion firmware does not
+recognize these aliases.
+
+### Meshtext channel chat
+
+`MESH_ENABLE_MESHTEXT_CHAT` enables the text-only Meshtext backend in the
+Companion. It defaults on only for ESP32-S3 **Full Companion** builds using
+SX1262 LoRa, not an ESP-NOW primary. Other builds default off. This is not
+a replacement for stock peer firmware or a cross-protocol bridge.
+
+In an enabled build, an `mt-` name always requests Meshtext, even if radio2 is
+off or setup is blocked. It never falls back to sending MeshCore frames. In a
+feature-disabled build, `mt-` remains an ordinary MeshCore naming alias while
+radio2 is off; with radio2 configured, MT channel changes/sends are unsupported.
+The `r2-` MeshCore behavior above is unchanged in either build.
+
+With the region configured, join `#mt-longfast`, for example, through the app's
+normal hashtag-channel editor. A recognized preset name selects the stock
+peer channel name (`LongFast`) and, **only for an automatically
+name-derived hashtag key**, the expanded public `AQ==` key. This public key is
+not a secret. An explicitly
+supplied private AES-128 or AES-256 key stays private and unchanged. A custom
+name such as `mt-Private` uses the exact tail (`Private`) as its wire name and
+the supplied key; custom wire names are limited to 11 bytes and need a manual
+radio2 profile or another MT channel with a recognized preset. Preset names
+are ASCII case-insensitive; the `mt-` marker is still case-sensitive.
+
+Recognized aliases and modulation are:
+
+| Alias tail | Stock wire name | BW (kHz) | SF | CR |
+| --- | --- | ---: | ---: | ---: |
+| `shortturbo` | `ShortTurbo` | 500 | 7 | 5 |
+| `shortfast` | `ShortFast` | 250 | 7 | 5 |
+| `shortslow` | `ShortSlow` | 250 | 8 | 5 |
+| `mediumturbo` | `MediumTurbo` | 500 | 9 | 5 |
+| `mediumfast` | `MediumFast` | 250 | 9 | 5 |
+| `mediumslow` | `MediumSlow` | 250 | 10 | 5 |
+| `longturbo` | `LongTurbo` | 500 | 11 | 8 |
+| `longfast` | `LongFast` | 250 | 11 | 5 |
+| `longmod` or `longmoderate` | `LongMod` | 125 | 11 | 8 |
+| `longslow` | `LongSlow` | 125 | 12 | 8 |
+
+The selected region must have room for the bandwidth; for example, 500 kHz
+presets are unavailable in the supported EU868 plan. Use these CLI commands:
+
+```text
+get mt.status
+get mt.region
+get mt.slot
+get mt.hops
+get mt.node
+get mt.shortname
+set mt.node !12345678
+set mt.node default
+set mt.region auto
+set mt.region us
+set mt.slot 0
+set mt.hops 7
+set mt.shortname HALO
+set mt.shortname default
+send mt.nodeinfo 0
+get radio2
+set radio2 auto
+```
+
+`mt.region` accepts `auto`, `us`, `eu868`, `eu433`, or `anz`. `auto` infers US
+only from a primary frequency at least 902 MHz and below 915 MHz, EU868 from
+869.4–869.65 MHz, and EU433 from 433–434 MHz. The US/ANZ overlap at 915–928 MHz
+is ambiguous: explicitly select `us` or `anz`. `mt.slot` is a 1-based frequency
+slot, or `0` for the stock preset-name-derived slot; unavailable slots are
+blocked. Check `get mt.status` after configuration; a successful settings save
+does not mean the MT backend is active.
+
+Outgoing MT messages default to a hop limit of **7**. `set mt.hops <0..7>`
+changes this budget, and `get mt.hops` or `get mt.status` shows it. `0` sends
+only the initial over-air hop with no forwarding budget; larger values permit
+protocol-compatible peers to forward within that budget. The Companion itself still
+does not relay MT packets.
+
+`get mt.node` shows the effective Meshtext sender node ID. By default it is
+SHA-derived from the MeshCore public identity and remains stable for that
+identity. `set mt.node !12345678` sets a saved override; exactly eight hexadecimal
+digits are required, with or without the leading `!`. Input is hexadecimal,
+not decimal, and is never silently truncated. IDs `00000000` through `00000003`
+and `ffffffff` are reserved and rejected. `set mt.node default` clears the
+override and restores the identity-derived ID.
+
+The example ID is illustrative: choose an ID unique among your protocol-compatible
+peers. Collisions can merge different senders into one identity and interfere
+with packet deduplication. Changing the MT ID does not alter the MeshCore
+private key, reset the outgoing packet-ID sequence or send automatic traffic.
+Settings changes are refused while an MT transmission is
+pending. Neither node IDs nor text labels are authenticated.
+
+`set mt.shortname <label>` saves a Meshtext-only NodeInfo name of 1–4 Unicode
+scalar characters, with valid UTF-8 and at most 16 encoded bytes. Combining
+characters count separately. `get mt.shortname` shows the saved/effective
+name. Stock NodeInfo accepts only four UTF-8 **bytes**, so the effective wire
+name is the longest complete UTF-8 prefix that fits. The saved value is not
+changed. `set mt.shortname default` clears the override and uses the last four
+hexadecimal digits of the effective MT node ID. This does not change the
+MeshCore node name, add a label to chat text or transmit anything.
+
+`send mt.nodeinfo <channel slot>` explicitly queues **one** standard
+`NODEINFO_APP` broadcast on the selected configured MT channel. The slot is
+the Companion channel index, not `mt.slot` (the frequency slot). The packet
+contains the actual sender ID, the global MeshCore node name as its long name
+(UTF-8-safe truncated to 24 bytes), the effective short name, `CLIENT_MUTE`
+(no relaying), and the no-DM flag. It omits MAC, public keys and unsupported
+metadata. The usual radio2 TX-mode, pending-TX, airtime and profile guards
+apply. The reply says **queued**, not delivered or acknowledged.
+
+There are no automatic NodeInfo advertisements: not at boot, on a timer, when
+names change, when chat is sent, or in response to received packets. Received
+NodeInfo is still ignored; this backend does not maintain a node database.
+
+Region, frequency slot, hop limit, shortname and node-ID override are saved
+atomically together; changing one preserves the others. Current 40-byte `MT03`
+settings include both overrides. New firmware accepts valid legacy
+`MT01`/`MT02` settings and defaults the shortname to the sender-ID suffix and
+the node ID to the MeshCore identity; `MT01` also defaults the hop limit to 7.
+Older MT firmware cannot read `MT03`, so downgrading does not preserve access
+to these settings. Invalid or unsupported stored settings block MT operation
+rather than silently selecting another network.
+
+Private channels can be provisioned directly through the Companion CLI:
+
+```text
+set mt.preset <longfast|shortturbo|...>
+set mt.channel <slot> <mt-name> <32/64 hex digits|AQ==>
+get mt.channel <slot>
+delete mt.channel <slot>
+```
+
+`set mt.preset` accepts the recognized presets above and explicitly saves a
+manual `rxtx` radio2 RF tuple using the current region and frequency slot. It
+is not an automatic owner: deleting the channel does not remove that saved RF
+configuration. Set region/slot first; changing them later does not overwrite
+the manual frequency, so rerun `set mt.preset` if you intend to retune it.
+
+`set mt.channel` accepts a 32-digit hexadecimal AES-128 PSK, a 64-digit
+hexadecimal AES-256 PSK, or the literal `AQ==` for the public key. It does not
+accept arbitrary Base64 private keys. The stored format interprets an all-zero
+upper 16-byte half as AES-128, including in a 64-digit input; use a nonzero
+upper half for AES-256. Slot numbers are zero-based and build-specific, as in
+the app. `get mt.channel` reports name, wire name and AES size, never the PSK.
+The firmware console masks key input echo; keep your client-side logs and
+stored keys private as well. SET and DELETE save transactionally and restore
+the previous channel if storage fails. DELETE applies only to an MT channel,
+not a MeshCore slot.
+
+For a private channel named `Team` on a protocol-compatible peer:
+
+```text
+set mt.region us
+set mt.preset longfast
+set mt.channel 1 mt-Team <your-32-or-64-hex-digit-key>
+get mt.channel 1
+get mt.node
+set mt.shortname HALO
+get mt.status
+send mt.nodeinfo 1
+channel 1 Hello
+```
+
+Replace the key placeholder with your actual hexadecimal PSK and send after
+`get mt.status` reports active. The peer must use the same preset, frequency,
+PSK and exact case-sensitive wire name `Team`; `mt-` is only the local marker.
+Alternatively, `set mt.channel 1 mt-longfast <your-key>` preserves a private
+PSK but uses wire name `LongFast` and can acquire automatic RF without
+`set mt.preset`, provided radio2 automatic ownership is permitted. This route
+is available for both 128-bit and 256-bit private keys even when the stock app
+cannot provision or export the latter.
+
+When radio2 was never manually configured, a recognized preset can acquire an
+automatic `rxtx` profile. Its RF tuple is RAM-only and stays available for RX
+while the required channels exist. Removing the last MT channel, losing its
+last recognized-preset dependency, or detecting a conflict releases only the
+automatic profile. Explicit manual RF settings are retained: named aliases
+must match their BW/SF/CR and fit the selected region, but do not overwrite
+their frequency. The runtime MT overlay uses its required 16-symbol preamble;
+the saved manual preamble is retained.
+
+`set radio2 off` is an explicit manual veto, including after reboot. Older
+saved off profiles are conservatively treated as manual. Local
+`set radio2 auto` clears the saved manual RF/off choice and permits automatic
+ownership after two seconds; it rejects pending changes, leases and schedules
+rather than cancelling them. `get radio2` distinguishes `auto-owned`, `off (manual)`
+and `off (automatic allowed)`. Temporary profiles, scheduled changes and reply
+commit barriers take precedence and can suspend MT operation. Automatic
+cleanup does not undo later manual edits.
+
+All MT channels share this one secondary modem profile. Different recognized
+presets, or mixing any MT and `r2-` channels, are rejected instead of selecting
+whichever channel was edited last. Loaded conflicts also block MT traffic.
+Neither `radio2.cross on` nor MeshCore channel routes cross MT frames between
+protocols.
+
+The app uses its existing channel index/text commands and receive events.
+Outgoing MT chat is plain text exactly as entered, with the sender node ID in
+the standard radio header. It contains no custom name envelope or NodeInfo.
+Incoming text uses the exact sender-ID prefix `!12345678: ` before the received
+payload when passed to the MeshCore app. Changing the shortname only changes
+future manually requested NodeInfo, not chat or the packet's sender ID;
+`set mt.node` changes the actual Meshtext sender ID. Neither setting change
+emits advertisements. A successful
+send response means **queued**, not acknowledged by a remote node. This backend
+does not relay MT packets or provide ACKs, administrative commands, direct
+messages, automatic node-info adverts or a node database. MeshCore emergency forwarding
+does not apply to MT traffic. Interoperability is with stock peers' PSK channel
+text using AES-CTR, not AES-CCM. AES-CTR channel traffic is not authenticated;
+successful decoding is not proof of sender identity.
+
+The codec supports AES-128 and AES-256 and up to 228 UTF-8 bytes of wire text,
+without an added label/node-ID prefix. The standard app channel editor
+still provisions 16-byte keys. An MT-only 32-byte binary SET/opt-in GET
+extension is available for capable clients, with protection against legacy
+16-byte edits truncating an existing 256-bit key; see
+[Companion protocol](companion_protocol.md#4-set-channel). This does not give
+stock apps seamless 256-bit provisioning or sharing. Current V3 Companion
+receive events carry at most 165 text bytes **including the node-ID prefix**;
+longer incoming MT text is UTF-8-safe truncated for the app.
+
+Radio1 and radio2 still time-share **one physical radio**. The device cannot
+receive either network while tuned to the other or transmitting; long MT
+airtime, particularly LongFast, can leave substantial MeshCore receive gaps.
+The compatible protocol's fixed short preamble also does not provide the scan-aware long
+preamble described below. Do not treat this as continuous coverage of both
+networks or guaranteed message delivery.
+
 ## Choose whether traffic crosses between profiles
 
 ```text
@@ -257,6 +521,9 @@ set radio2.cross off
 | `radio` | `tempradio2` | Isolated | Cross | Isolated |
 | `tempradio` | `radio2` | Isolated | Cross | Isolated |
 
+This table describes MeshCore profiles. A Meshtext secondary profile is
+always isolated, including with `radio2.cross on`.
+
 These are the global rules used by Companion targets set to `auto`; an explicit
 contact/channel choice above overrides crossing for its own outbound packets.
 Ordinary crossing respects `rx`. The infrastructure-only `tx.reply ... force`
diff --git a/docs/terminal_chat_cli.md b/docs/terminal_chat_cli.md
index b01dfb4f3..b71995e69 100644
--- a/docs/terminal_chat_cli.md
+++ b/docs/terminal_chat_cli.md
@@ -51,6 +51,21 @@ connection. Use the WiFi MOTA seeder on port 5001 for a host folder over WiFi.
 
 ## Local maintenance commands
 
+Supported ESP32-S3/SX1262 Full Companions also support
+[Meshtext channel chat](radio_profiles.md#meshtext-channel-chat):
+
+```text
+set mt.shortname MIKE
+send mt.nodeinfo 0
+channel 0 Hello
+```
+
+Use a configured `mt-` channel slot. The explicit `send mt.nodeinfo` command
+queues one standard name/ID advertisement; chat carries only the entered text.
+There are no automatic NodeInfo sends or responses. The long name comes from
+the existing node name; `get mt.shortname` shows the effective four-byte short
+name. These commands are not added to smaller or feature-disabled builds.
+
 Local means a connection directly to the node: USB, BLE or WiFi/Ethernet
 Companion protocol, a TCP terminal, or the browser CLI on the LAN. These
 connections can use the following commands when the role and build include
diff --git a/examples/companion_radio/MeshtextCompanion.cpp b/examples/companion_radio/MeshtextCompanion.cpp
new file mode 100644
index 000000000..03ba97b3e
--- /dev/null
+++ b/examples/companion_radio/MeshtextCompanion.cpp
@@ -0,0 +1,604 @@
+#include "MyMesh.h"
+
+#if MESH_ENABLE_MESHTEXT_CHAT
+#include <Preferences.h>
+#include <esp_system.h>
+#include <helpers/CLICommandUtils.h>
+#include <helpers/UTF8Helpers.h>
+
+namespace {
+constexpr size_t LegacySettingsSize = 16;
+constexpr size_t SettingsSize = 40;
+bool validShortName(const char* name) {
+  if (!name) return false;
+  const size_t length = strnlen(name, 17);
+  if (length > 16 || mesh::validUtf8PrefixLength(name, length) != length) return false;
+  unsigned characters = 0;
+  for (size_t i = 0; i < length;) {
+    const uint8_t first = static_cast<uint8_t>(name[i++]);
+    uint32_t scalar = first;
+    unsigned remaining = 0;
+    if (first >= 0xf0) { scalar &= 7; remaining = 3; }
+    else if (first >= 0xe0) { scalar &= 15; remaining = 2; }
+    else if (first >= 0xc0) { scalar &= 31; remaining = 1; }
+    while (remaining--) scalar = (scalar << 6) | (static_cast<uint8_t>(name[i++]) & 63);
+    // Reject control/bidi characters in a displayed NodeInfo short name.
+    if (scalar <= 32 || (scalar >= 0x7f && scalar <= 0x9f) || scalar == ':'
+        || (scalar >= 0x200b && scalar <= 0x200f) || (scalar >= 0x2028 && scalar <= 0x202f)
+        || (scalar >= 0x2060 && scalar <= 0x206f) || scalar == 0xfeff) return false;
+    if (++characters > 4) return false;
+  }
+  return true; // Empty is the stored default, selected explicitly by the CLI.
+}
+void makeWireShortName(const char* configured, uint32_t node, char out[5]) {
+  // Stock User.short_name has four UTF-8 bytes, not four Unicode scalars.
+  // Project older saved labels without changing their persistent settings.
+  const size_t length = mesh::validUtf8PrefixLength(configured, 4);
+  if (length) {
+    memcpy(out, configured, length);
+    out[length] = 0;
+  } else {
+    snprintf(out, 5, "%04lx", (unsigned long)(node & 0xffff));
+  }
+}
+bool validNodeOverride(uint32_t node) {
+  return node == 0 || (node >= 4 && node != UINT32_MAX);
+}
+void makeSettings(uint8_t image[SettingsSize], mesh::mt::Region region, uint32_t slot,
+                  uint8_t hops, const char* short_name, uint32_t node_override) {
+  memset(image, 0, SettingsSize);
+  memcpy(image, "MT03", 4);
+  image[4] = static_cast<uint8_t>(region);
+  image[5] = hops;
+  for (unsigned i = 0; i < 4; ++i) image[8 + i] = slot >> (8 * i);
+  memcpy(image + 12, short_name, strlen(short_name));
+  for (unsigned i = 0; i < 4; ++i) image[32 + i] = node_override >> (8 * i);
+  mesh::Utils::sha256(image + 36, 4, image, 36);
+}
+bool describe(const ChannelDetails& channel, mesh::mt::Channel& wire) {
+  return mesh::mt::describeChannel(channel.name, channel.channel.secret, wire,
+      [](uint8_t* out, size_t size, const uint8_t* in, size_t length) {
+        mesh::Utils::sha256(out, size, in, length);
+      });
+}
+bool nextToken(const char*& cursor, char* out, size_t capacity) {
+  while (*cursor == ' ' || *cursor == '\t') ++cursor;
+  size_t size = 0;
+  while (*cursor && *cursor != ' ' && *cursor != '\t') {
+    if (size + 1 >= capacity) return false;
+    out[size++] = *cursor++;
+  }
+  out[size] = 0;
+  return size != 0;
+}
+bool endTokens(const char* cursor) {
+  while (*cursor == ' ' || *cursor == '\t') ++cursor;
+  return !*cursor;
+}
+}
+
+mesh::mt::Region MyMesh::meshtextRegion() const {
+  return _mt_region == mesh::mt::Region::Unset
+      ? mesh::mt::inferRegion(_prefs.freq) : _mt_region;
+}
+
+void MyMesh::refreshMeshtextIdentity() {
+  uint8_t digest[4];
+  mesh::Utils::sha256(digest, sizeof(digest), self_id.pub_key, PUB_KEY_SIZE);
+  _mt_default_node = uint32_t(digest[0]) | (uint32_t(digest[1]) << 8)
+      | (uint32_t(digest[2]) << 16) | (uint32_t(digest[3]) << 24);
+  if (_mt_default_node < 4 || _mt_default_node == UINT32_MAX) _mt_default_node = 0x0badf00d;
+  _mt_node = _mt_node_override ? _mt_node_override : _mt_default_node;
+  _mt_seen.clear();
+  // Importing a new MeshCore identity may change the derived sender ID, but
+  // must never restart the packet sequence used by any earlier sender ID.
+}
+
+void MyMesh::beginMeshtext() {
+  refreshMeshtextIdentity();
+  // Independent random boot seed, then monotonic IDs. Never reuse a packet ID
+  // within this boot (including failed admission) with the same CTR sender.
+  _mt_packet_id = esp_random();
+  if (!_mt_packet_id) _mt_packet_id = 1;
+  Preferences prefs;
+  if (!prefs.begin("mesh-mt", false)) { _mt_settings_valid = false; return; }
+  const size_t size = prefs.getBytesLength("settings");
+  if (size) {
+    uint8_t image[SettingsSize] = {}, expected[SettingsSize] = {};
+    _mt_settings_valid = (size == SettingsSize || size == LegacySettingsSize)
+        && prefs.getBytes("settings", image, size) == size;
+    if (_mt_settings_valid) {
+      const auto region = static_cast<mesh::mt::Region>(image[4]);
+      const bool legacy = size == LegacySettingsSize;
+      const bool legacy_v1 = legacy && memcmp(image, "MT01", 4) == 0;
+      const uint8_t hops = legacy_v1 ? 7 : image[5];
+      const uint32_t slot = uint32_t(image[8]) | (uint32_t(image[9]) << 8)
+          | (uint32_t(image[10]) << 16) | (uint32_t(image[11]) << 24);
+      if (legacy) {
+        memcpy(expected, legacy_v1 ? "MT01" : "MT02", 4);
+        expected[4] = image[4]; expected[5] = legacy_v1 ? 0 : hops;
+        memcpy(expected + 8, image + 8, 4);
+        mesh::Utils::sha256(expected + 12, 4, expected, 12);
+      } else if (validShortName(reinterpret_cast<const char*>(image + 12))) {
+        const uint32_t node_override = uint32_t(image[32]) | (uint32_t(image[33]) << 8)
+            | (uint32_t(image[34]) << 16) | (uint32_t(image[35]) << 24);
+        if (validNodeOverride(node_override))
+          makeSettings(expected, region, slot, hops, reinterpret_cast<const char*>(image + 12), node_override);
+      }
+      _mt_settings_valid = region <= mesh::mt::Region::ANZ && slot <= 1024 && hops <= 7
+          && memcmp(image, expected, size) == 0;
+      if (_mt_settings_valid) {
+        _mt_region = region; _mt_slot = slot; _mt_hop_limit = hops;
+        if (!legacy) {
+          memcpy(_mt_short_name, image + 12, sizeof(_mt_short_name));
+          _mt_node_override = uint32_t(image[32]) | (uint32_t(image[33]) << 8)
+              | (uint32_t(image[34]) << 16) | (uint32_t(image[35]) << 24);
+          _mt_node = _mt_node_override ? _mt_node_override : _mt_default_node;
+        }
+      }
+    }
+  }
+  prefs.end();
+  refreshMeshtextProfile();
+}
+
+bool MyMesh::saveMeshtextSettings(mesh::mt::Region region, uint32_t slot, uint8_t hops,
+                                  const char* short_name, uint32_t node_override) {
+  if (hops == UINT8_MAX) hops = _mt_hop_limit;
+  if (!short_name) short_name = _mt_short_name;
+  if (node_override == UINT32_MAX) node_override = _mt_node_override;
+  if (region > mesh::mt::Region::ANZ || slot > 1024 || hops > 7 || !validShortName(short_name)
+      || !validNodeOverride(node_override) || hasForeignRadioFrame()) return false;
+  uint8_t image[SettingsSize], verify[SettingsSize];
+  makeSettings(image, region, slot, hops, short_name, node_override);
+  Preferences prefs;
+  if (!prefs.begin("mesh-mt", false)) return false;
+  // NVS commits this one blob atomically; never split region and slot into
+  // separate commits which could join an unintended network after power loss.
+  const bool ok = prefs.putBytes("settings", image, sizeof(image)) == sizeof(image)
+      && prefs.getBytes("settings", verify, sizeof(verify)) == sizeof(verify)
+      && memcmp(image, verify, sizeof(image)) == 0;
+  prefs.end();
+  if (!ok) {
+    // A failed read-back cannot prove whether NVS committed. Suspend the
+    // backend rather than silently use one network now and another at boot.
+    _mt_settings_valid = false;
+    _mt_profile_dirty = true;
+    refreshMeshtextProfile();
+    return false;
+  }
+  _mt_region = region; _mt_slot = slot; _mt_hop_limit = hops; _mt_settings_valid = true;
+  memcpy(_mt_short_name, image + 12, sizeof(_mt_short_name));
+  _mt_node_override = node_override;
+  _mt_node = node_override ? node_override : _mt_default_node;
+  // Keep the packet sequence monotonic even when changing away from and back
+  // to a sender ID. Never reset it on a name/settings change (CTR nonce reuse).
+  _mt_profile_dirty = true;
+  _mt_seen.clear();
+  refreshMeshtextProfile();
+  return true;
+}
+
+bool MyMesh::eraseMeshtextSettings() {
+  // The filesystem erase also removes channels/identity on the next boot.
+  // Do not keep sending with their still-resident RAM copies until then.
+  _mt_active = false;
+  _mt_settings_valid = false;
+  _mt_profile_dirty = true;
+  _mt_seen.clear();
+  _radio_profiles.clearAutoSecondary();
+  _radio_profiles.clearSecondaryProtocol();
+  Preferences prefs;
+  if (!prefs.begin("mesh-mt", false)) {
+    _mt_status = "Meshtext settings erase failed";
+    return false;
+  }
+  const bool ok = !prefs.getBytesLength("settings") || prefs.remove("settings");
+  prefs.end();
+  if (ok) {
+    _mt_region = mesh::mt::Region::Unset; _mt_slot = 0; _mt_hop_limit = 7;
+    _mt_short_name[0] = 0; _mt_node_override = 0; _mt_node = _mt_default_node;
+  }
+  _mt_status = ok ? "settings erased; reboot required" : "Meshtext settings erase failed";
+  return ok;
+}
+
+bool MyMesh::isMeshtextChannel(const ChannelDetails& channel) const {
+  const auto alias = parseCompanionChannelAlias(channel.name);
+  if (alias.kind != CompanionChannelKind::Meshtext) return false;
+  // With the backend present, Meshtext names are explicit protocol requests even
+  // while setup is blocked. Never silently emit a different wire protocol.
+  return true;
+}
+
+bool MyMesh::validateMeshtextChannelChange(int index, const ChannelDetails& candidate) {
+  const auto candidate_kind = parseCompanionChannelAlias(candidate.name).kind;
+  // Unrelated MeshCore edits and removals remain possible even when an old
+  // Meshtext configuration is suspended or incompatible with a new firmware build.
+  if (!candidate.name[0] || candidate_kind == CompanionChannelKind::MeshCore) return true;
+  bool have_preset = false, have_mt = false, have_r2 = false;
+  mesh::mt::Preset preset = mesh::mt::Preset::LongFast;
+  for (int i = 0; i < MAX_GROUP_CHANNELS; ++i) {
+    ChannelDetails channel;
+    if (i == index) channel = candidate;
+    else if (!BaseChatMesh::getChannel(i, channel)) continue;
+    if (!channel.name[0]) continue;
+    const auto alias = parseCompanionChannelAlias(channel.name);
+    if (alias.kind == CompanionChannelKind::Radio2) have_r2 = true;
+    if (alias.kind != CompanionChannelKind::Meshtext) continue;
+    mesh::mt::Preset found;
+    const bool named = mesh::mt::parsePreset(alias.tail, found);
+    mesh::mt::Channel wire;
+    if (!describe(channel, wire)) return false;
+    have_mt = true;
+    if (named) {
+      if (have_preset && preset != found) return false;
+      preset = found; have_preset = true;
+    }
+  }
+  // radio2 is one modem profile, not a second physical transceiver. There is
+  // no silent last-channel-wins behavior and no protocol bridging.
+  if (have_mt && have_r2) return false;
+  if (!have_mt) return true;
+  if (!_radio->supportsMeshtext() || !_mt_settings_valid) return false;
+  if (have_preset) {
+    mesh::RadioProfileParams requested;
+    if (!mesh::mt::modemConfig(meshtextRegion(), preset, requested, _mt_slot)
+        || !_radio->validateProfile(requested)) return false;
+    if (_radio_profiles.manualSecondaryConfigured()) {
+      const auto saved = _radio_profiles.savedSecondaryConfig();
+      if (!mesh::mt::sameModulation(saved.params, requested)
+          || !mesh::mt::frequencyInRegion(meshtextRegion(), saved.params)) return false;
+    } else if (!_radio_profiles.canAutoSecondary()) return false;
+  }
+  return true;
+}
+
+void MyMesh::refreshMeshtextProfile() {
+  const auto* current_profiles = _radio->profiles();
+  const uint32_t primary_generation = current_profiles ? current_profiles->generation[0] : 0;
+  const uint32_t secondary_generation = current_profiles ? current_profiles->generation[1] : 0;
+  const uint32_t intent_generation = _radio_profiles.secondaryIntentGeneration();
+  if (!_mt_profile_dirty && primary_generation == _mt_primary_generation
+      && secondary_generation == _mt_secondary_generation && intent_generation == _mt_intent_generation
+      && _mt_last_radio_ready == _radio_available && _mt_primary_frequency == _prefs.freq) return;
+  // Hashing names and scanning the channel table every radio loop would add
+  // blind time to the dual-profile scanner. Recompute only on configuration
+  // or lease/generation edges; RX/TX still derive a fresh bounded wire copy.
+  struct CacheUpdate {
+    MyMesh& owner;
+    ~CacheUpdate() {
+      const auto* p = owner._radio->profiles();
+      owner._mt_primary_generation = p ? p->generation[0] : 0;
+      owner._mt_secondary_generation = p ? p->generation[1] : 0;
+      owner._mt_intent_generation = owner._radio_profiles.secondaryIntentGeneration();
+      owner._mt_last_radio_ready = owner._radio_available;
+      owner._mt_primary_frequency = owner._prefs.freq;
+      owner._mt_profile_dirty = false;
+    }
+  } cache_update{*this};
+  _mt_active = false;
+  bool have_mt = false, have_r2 = false, have_preset = false, conflict = false;
+  mesh::mt::Preset preset = mesh::mt::Preset::LongFast;
+  for (int i = 0; i < MAX_GROUP_CHANNELS; ++i) {
+    ChannelDetails channel;
+    if (!BaseChatMesh::getChannel(i, channel) || !channel.name[0]) continue;
+    const auto alias = parseCompanionChannelAlias(channel.name);
+    if (alias.kind == CompanionChannelKind::Radio2) have_r2 = true;
+    if (alias.kind != CompanionChannelKind::Meshtext) continue;
+    mesh::mt::Preset found;
+    const bool named = mesh::mt::parsePreset(alias.tail, found);
+    have_mt = true;
+    mesh::mt::Channel wire;
+    if (!describe(channel, wire)) conflict = true;
+    if (named) {
+      if (have_preset && preset != found) conflict = true;
+      preset = found; have_preset = true;
+    }
+  }
+  const char* blocked = nullptr;
+  if (!have_mt) blocked = "no Meshtext channels";
+  else if (conflict || have_r2) blocked = "conflicting radio2 channels/presets";
+  else if (!_radio_available || !_radio->supportsMeshtext()) blocked = "modem unavailable";
+  else if (!_mt_settings_valid) blocked = "invalid Meshtext settings; set mt.region to repair";
+  else if (meshtextRegion() == mesh::mt::Region::Unset) blocked = "region ambiguous; set mt.region";
+  if (blocked) {
+    _mt_status = blocked;
+    _radio_profiles.clearAutoSecondary();
+    _radio_profiles.clearSecondaryProtocol();
+    return;
+  }
+  mesh::RadioProfileParams requested;
+  if (have_preset && (!mesh::mt::modemConfig(meshtextRegion(), preset, requested, _mt_slot)
+      || !_radio->validateProfile(requested))) {
+    _mt_status = "preset/slot unavailable in this region or modem";
+    _radio_profiles.clearAutoSecondary();
+    _radio_profiles.clearSecondaryProtocol();
+    return;
+  }
+  if (_radio_profiles.manualSecondaryConfigured()) {
+    const auto saved = _radio_profiles.savedSecondaryConfig();
+    if (!mesh::mt::frequencyInRegion(meshtextRegion(), saved.params)
+        || (have_preset && !mesh::mt::sameModulation(saved.params, requested))) {
+      _mt_status = "manual radio2 does not match Meshtext preset/region";
+      _radio_profiles.clearSecondaryProtocol();
+      return;
+    }
+    _mt_active = _radio_profiles.useSecondaryProtocol(mesh::RadioProfileProtocol::Meshtext);
+  } else if (have_preset) {
+    mesh::RadioProfileConfig config;
+    config.params = requested; config.mode = mesh::RadioProfileMode::RxTx;
+    const auto* profiles = _radio->profiles();
+    if (_radio_profiles.autoSecondaryActive() && profiles
+        && profiles->secondary.params != requested) {
+      _radio_profiles.clearAutoSecondary(); // only release the profile we own
+    }
+    _mt_active = _radio_profiles.requestAutoSecondary(config);
+  } else {
+    // A custom channel cannot reconstruct an RF preset after reboot. Losing
+    // its last named-preset dependency must release the auto owner, not leave
+    // a ghost-enabled secondary or silently turn into MeshCore channel chat.
+    _radio_profiles.clearAutoSecondary();
+    _radio_profiles.clearSecondaryProtocol();
+    _mt_status = "custom Meshtext channel needs a named preset or manual radio2";
+    return;
+  }
+  _mt_status = _mt_active ? "active" : "radio2 manually off, leased, scheduled or busy";
+}
+
+bool MyMesh::sendMeshtextText(const ChannelDetails& channel, const char* text, size_t length) {
+  refreshMeshtextProfile();
+  if (!_mt_active || !text || !length || hasForeignRadioFrame()) return false;
+  const auto* profiles = _radio->profiles();
+  if (!profiles || !profiles->canTransmit(1)
+      || profiles->secondary.params.protocol != mesh::RadioProfileProtocol::Meshtext) return false;
+  mesh::mt::Channel wire;
+  if (!describe(channel, wire)) return false;
+  // Stock TEXT_MESSAGE_APP contains the user's text only. Sender identity is
+  // in the radio header; name metadata requires a separately requested User.
+  if (length > mesh::mt::MaxTextSize) return false;
+  if (!_mt_packet_id) return false; // exhaustion: do not wrap/reuse CTR nonces.
+  const uint32_t id = _mt_packet_id++;
+  uint8_t raw[mesh::mt::MaxFrameSize];
+  // Outbound Meshtext channel chat defaults to seven hops; the CLI can reduce it.
+  // This does not enable forwarding or ACK responses in this Companion.
+  const size_t size = mesh::mt::encodeText(_mt_node, id, _mt_hop_limit, wire.name, wire.key,
+                                         wire.key_length, text, length, raw);
+  return size && queueForeignRadioFrame(raw, size, 1, profiles->generation[1]);
+}
+
+bool MyMesh::sendMeshtextNodeInfo(const ChannelDetails& channel) {
+  refreshMeshtextProfile();
+  if (!_mt_active || hasForeignRadioFrame()) return false;
+  const auto* profiles = _radio->profiles();
+  if (!profiles || !profiles->canTransmit(1)
+      || profiles->secondary.params.protocol != mesh::RadioProfileProtocol::Meshtext) return false;
+  mesh::mt::Channel wire;
+  if (!describe(channel, wire)) return false;
+  const size_t full_length = strnlen(_prefs.node_name, sizeof(_prefs.node_name));
+  if (full_length == sizeof(_prefs.node_name)
+      || mesh::validUtf8PrefixLength(_prefs.node_name, full_length) != full_length) return false;
+  const size_t long_length = mesh::validUtf8PrefixLength(_prefs.node_name, 24);
+  char short_name[5];
+  makeWireShortName(_mt_short_name, _mt_node, short_name);
+  if (!_mt_packet_id) return false;
+  // Share the text packet sequence: separate counters would reuse CTR nonces.
+  const uint32_t id = _mt_packet_id++;
+  uint8_t raw[mesh::mt::MaxFrameSize];
+  const size_t size = mesh::mt::encodeNodeInfo(_mt_node, id, _mt_hop_limit, wire.name, wire.key,
+      wire.key_length, _prefs.node_name, long_length, short_name, strlen(short_name), raw);
+  // Only the explicit CLI reaches here. No timer, RX reply or chat piggyback.
+  return size && queueForeignRadioFrame(raw, size, 1, profiles->generation[1]);
+}
+
+bool MyMesh::onForeignRadioFrame(const uint8_t* bytes, size_t length, uint8_t profile,
+                               uint32_t generation, float snr, float rssi) {
+  (void)rssi;
+  const auto* profiles = _radio->profiles();
+  if (!_mt_active || !profiles || profile != 1 || generation != profiles->generation[1]) return false;
+  for (int i = 0; i < MAX_GROUP_CHANNELS; ++i) {
+    ChannelDetails channel;
+    mesh::mt::Channel wire;
+    if (!BaseChatMesh::getChannel(i, channel) || !describe(channel, wire)) continue;
+    mesh::mt::DecodedText decoded;
+    if (!mesh::mt::decodeText(bytes, length, wire.name, wire.key, wire.key_length, _mt_node, decoded)) continue;
+    if (_mt_seen.seen(decoded.from, decoded.id)) return true;
+    char text[MAX_FRAME_SIZE];
+    const int prefix = snprintf(text, sizeof(text), "!%08lx: ", (unsigned long)decoded.from);
+    size_t copy = decoded.text_len;
+    if (copy > sizeof(text) - prefix - 1) copy = sizeof(text) - prefix - 1;
+    // Preserve UTF-8 when fitting a stock peer text into the Companion envelope.
+    while (copy < decoded.text_len && copy && (uint8_t(decoded.text[copy]) & 0xc0) == 0x80) --copy;
+    memcpy(text + prefix, decoded.text, copy); text[prefix + copy] = 0;
+    const uint32_t timestamp = getRTCClock()->getCurrentTime();
+    ChannelDetails policy_channel;
+    if (!getChannel(i, policy_channel)) return false;
+    if (queueChannelText(i, policy_channel.channel.secret, snr, decoded.hops, timestamp, text, false)) {
+      _mt_seen.remember(decoded.from, decoded.id);
+      ++_mt_received;
+    }
+    return true;
+  }
+  return false;
+}
+
+void MyMesh::onForeignRadioSendComplete(bool success) {
+  if (success) ++_mt_sent;
+  else ++_mt_failed;
+}
+
+bool MyMesh::handleMeshtextCommand(const char* command, char* reply, size_t capacity) {
+  const char* nodeinfo_args = !strncmp(command, "send mt.nodeinfo ", 17) ? command + 17 : nullptr;
+  if (!strcmp(command, "send mt.nodeinfo")) nodeinfo_args = "";
+  if (nodeinfo_args) {
+    char index_text[12]; uint32_t index = 0;
+    ChannelDetails channel;
+    if (!nextToken(nodeinfo_args, index_text, sizeof(index_text)) || !endTokens(nodeinfo_args)
+        || !mesh::cli::parseUnsignedIntegerStrict(index_text, index) || index >= MAX_GROUP_CHANNELS) {
+      snprintf(reply, capacity, "Error: use send mt.nodeinfo <channel slot>");
+    } else if (!getChannelForSave(index, channel) || !isMeshtextChannel(channel)) {
+      snprintf(reply, capacity, "Error: configured Meshtext channel required");
+    } else if (!sendMeshtextNodeInfo(channel)) {
+      snprintf(reply, capacity, "Error: NodeInfo not queued; check get mt.status, TX mode or pending TX");
+    } else {
+      snprintf(reply, capacity, "OK - NodeInfo queued on Meshtext channel %lu; no automatic adverts",
+          (unsigned long)index);
+    }
+    return true;
+  }
+  const char* channel_args = !strncmp(command, "set mt.channel ", 15) ? command + 15 : nullptr;
+  const char* channel_get = !strncmp(command, "get mt.channel ", 15) ? command + 15 : nullptr;
+  const char* channel_delete = !strncmp(command, "delete mt.channel ", 18) ? command + 18 : nullptr;
+  if (channel_args || channel_get || channel_delete) {
+    const char* cursor = channel_args ? channel_args : channel_get ? channel_get : channel_delete;
+    char index_text[12]; uint32_t index = 0;
+    if (!nextToken(cursor, index_text, sizeof(index_text))
+        || !mesh::cli::parseUnsignedIntegerStrict(index_text, index) || index >= MAX_GROUP_CHANNELS) {
+      snprintf(reply, capacity, "Error: invalid channel slot"); return true;
+    }
+    ChannelDetails previous{}, channel{};
+    if (!getChannelForSave(index, previous)) {
+      snprintf(reply, capacity, "Error: channel slot unavailable"); return true;
+    }
+    if (channel_get || channel_delete) {
+      if (!endTokens(cursor) || !previous.name[0] || !isMeshtextChannel(previous)) {
+        snprintf(reply, capacity, "Error: Meshtext channel not found or extra arguments"); return true;
+      }
+      if (channel_get) {
+        mesh::mt::Channel wire;
+        if (!describe(previous, wire)) snprintf(reply, capacity, "Error: invalid Meshtext channel");
+        else snprintf(reply, capacity, "> %lu %s; wire=%s; AES-%u; key not displayed",
+            (unsigned long)index, previous.name, wire.name, unsigned(wire.key_length * 8));
+        return true;
+      }
+    } else {
+      char key_text[65];
+      if (!nextToken(cursor, channel.name, sizeof(channel.name))
+          || !nextToken(cursor, key_text, sizeof(key_text)) || !endTokens(cursor)
+          || !isMeshtextChannel(channel)) {
+        snprintf(reply, capacity, "Error: use set mt.channel <slot> <mt-name> <32/64 hex digits|AQ==>"); return true;
+      }
+      if (!strcmp(key_text, "AQ==")) memcpy(channel.channel.secret, mesh::mt::DefaultPsk, 16);
+      else {
+        const size_t digits = strlen(key_text);
+        if ((digits != 32 && digits != 64)
+            || !mesh::Utils::fromHex(channel.channel.secret, digits / 2, key_text)) {
+          snprintf(reply, capacity, "Error: key must be 32/64 hex digits or AQ=="); return true;
+        }
+      }
+      if (!validateMeshtextChannelChange(index, channel)) {
+        snprintf(reply, capacity, "Error: conflicting Meshtext preset, region, manual radio2 or busy owner"); return true;
+      }
+    }
+    if (!setChannel(index, channel)) snprintf(reply, capacity, "Error: invalid Meshtext channel");
+    else if (!saveChannels()) {
+      setChannel(index, previous);
+      snprintf(reply, capacity, "Error: channel not saved; previous channel restored");
+    } else {
+      _mt_seen.clear(); _mt_profile_dirty = true;
+      refreshMeshtextProfile();
+      snprintf(reply, capacity, "OK - Meshtext channel %lu %s; %s", (unsigned long)index,
+          channel_delete ? "deleted" : "saved", _mt_status);
+    }
+    return true;
+  }
+  const char* preset_value = !strncmp(command, "set mt.preset ", 14) ? command + 14 : nullptr;
+  if (preset_value) {
+    mesh::mt::Preset preset; mesh::RadioProfileParams requested;
+    if (!mesh::mt::parsePreset(preset_value, preset)
+        || !mesh::mt::modemConfig(meshtextRegion(), preset, requested, _mt_slot)
+        || !_radio->supportsMeshtext() || !_radio->validateProfile(requested)) {
+      snprintf(reply, capacity, "Error: invalid Meshtext preset/region/slot; use set mt.region first"); return true;
+    }
+    // Explicit provisioning for custom private names. This is a manual saved
+    // radio2 choice, not an automatic alias owner, so deletion cannot undo it.
+    char radio_command[96];
+    snprintf(radio_command, sizeof(radio_command), "set radio2 %.6f,%g,%u,%u,rxtx",
+        requested.freq, requested.bw, requested.sf, requested.cr);
+    _radio_profiles.handle(radio_command, reply, capacity);
+    _mt_profile_dirty = true;
+    refreshMeshtextProfile();
+    return true;
+  }
+  const bool status = !strcmp(command, "get mt") || !strcmp(command, "get mt.status");
+  const bool get_region = !strcmp(command, "get mt.region");
+  const bool get_slot = !strcmp(command, "get mt.slot");
+  const bool get_hops = !strcmp(command, "get mt.hops");
+  const bool get_node = !strcmp(command, "get mt.node");
+  const bool get_short_name = !strcmp(command, "get mt.shortname");
+  const char* region_value = !strncmp(command, "set mt.region ", 14) ? command + 14 : nullptr;
+  const char* slot_value = !strncmp(command, "set mt.slot ", 12) ? command + 12 : nullptr;
+  const char* hops_value = !strncmp(command, "set mt.hops ", 12) ? command + 12 : nullptr;
+  const char* node_value = !strncmp(command, "set mt.node ", 12) ? command + 12 : nullptr;
+  const char* short_name_value = !strncmp(command, "set mt.shortname ", 17) ? command + 17 : nullptr;
+  if (!strcmp(command, "set mt.node")) node_value = "";
+  if (!strcmp(command, "set mt.shortname")) short_name_value = "";
+  if (!status && !get_region && !get_slot && !get_hops && !get_node && !get_short_name
+      && !region_value && !slot_value && !hops_value && !node_value && !short_name_value) return false;
+  if (region_value || slot_value || hops_value || node_value || short_name_value) {
+    auto region = _mt_region; uint32_t slot = _mt_slot;
+    uint32_t hops = _mt_hop_limit;
+    uint32_t node_override = _mt_node_override;
+    const char* short_name = _mt_short_name;
+    if (region_value && !mesh::mt::parseRegion(region_value, region)) {
+      snprintf(reply, capacity, "Error: use set mt.region auto|us|eu868|eu433|anz"); return true;
+    }
+    if (slot_value && (!mesh::cli::parseUnsignedIntegerStrict(slot_value, slot) || slot > 1024)) {
+      snprintf(reply, capacity, "Error: mt.slot must be 0 (preset default) or 1..1024"); return true;
+    }
+    if (hops_value && (!mesh::cli::parseUnsignedIntegerStrict(hops_value, hops) || hops > 7)) {
+      snprintf(reply, capacity, "Error: mt.hops must be 0..7"); return true;
+    }
+    if (node_value) {
+      if (!strcmp(node_value, "default")) node_override = 0;
+      else {
+        if (*node_value == '!') ++node_value;
+        uint8_t bytes[4];
+        if (strlen(node_value) != 8 || !mesh::Utils::fromHex(bytes, sizeof(bytes), node_value)) {
+          snprintf(reply, capacity, "Error: use set mt.node !<8 hex digits>|default"); return true;
+        }
+        node_override = (uint32_t(bytes[0]) << 24) | (uint32_t(bytes[1]) << 16)
+            | (uint32_t(bytes[2]) << 8) | uint32_t(bytes[3]);
+        if (!node_override || !validNodeOverride(node_override)) {
+          snprintf(reply, capacity, "Error: mt.node IDs 0..3 and ffffffff are reserved; use default to reset"); return true;
+        }
+      }
+    }
+    if (short_name_value) {
+      short_name = !strcmp(short_name_value, "default") ? "" : short_name_value;
+      if ((!*short_name && strcmp(short_name_value, "default")) || !validShortName(short_name)) {
+        snprintf(reply, capacity, "Error: mt.shortname must be 1..4 UTF-8 characters (no spaces/control/colon), or default"); return true;
+      }
+    }
+    if (!saveMeshtextSettings(region, slot, hops, short_name, node_override))
+      snprintf(reply, capacity, "Error: Meshtext settings not saved (pending TX or storage error)");
+    else if (node_value)
+      snprintf(reply, capacity, "OK - mt.node=!%08lx (%s); choose a unique ID", (unsigned long)_mt_node,
+          _mt_node_override ? "saved override" : "identity default");
+    else if (short_name_value)
+      snprintf(reply, capacity, "OK - mt.shortname=%s; node=!%08lx", _mt_short_name[0] ? _mt_short_name : "default",
+          (unsigned long)_mt_node);
+    else snprintf(reply, capacity, "OK - mt.region=%s mt.slot=%lu mt.hops=%lu; %s", mesh::mt::regionName(region), (unsigned long)slot, (unsigned long)hops, _mt_status);
+    return true;
+  }
+  refreshMeshtextProfile();
+  if (get_region) snprintf(reply, capacity, "> %s; effective=%s", mesh::mt::regionName(_mt_region), mesh::mt::regionName(meshtextRegion()));
+  else if (get_slot) snprintf(reply, capacity, "> %lu%s", (unsigned long)_mt_slot, _mt_slot ? "" : " (preset default)");
+  else if (get_hops) snprintf(reply, capacity, "> %u", _mt_hop_limit);
+  else if (get_node) snprintf(reply, capacity, "> !%08lx (%s)", (unsigned long)_mt_node,
+      _mt_node_override ? "saved override" : "identity default");
+  else if (get_short_name) {
+    char short_name[5]; makeWireShortName(_mt_short_name, _mt_node, short_name);
+    snprintf(reply, capacity, "> %s; effective=%s (manual NodeInfo only)",
+        _mt_short_name[0] ? _mt_short_name : "default", short_name);
+  }
+  else {
+    const auto* profiles = _radio->profiles();
+    const auto p = profiles ? profiles->secondary.params : mesh::RadioProfileParams{};
+    snprintf(reply, capacity, "> Meshtext !%08lx; %s; %s; %.3f/%g/SF%u/CR%u; hops=%u; RX=%lu TX=%lu fail=%lu; RX time-shared",
+        (unsigned long)_mt_node, _mt_status, _radio_profiles.autoSecondaryActive() ? "auto radio2" : "manual radio2",
+        p.freq, p.bw, p.sf, p.cr, _mt_hop_limit, (unsigned long)_mt_received, (unsigned long)_mt_sent, (unsigned long)_mt_failed);
+  }
+  return true;
+}
+#endif
diff --git a/examples/companion_radio/MyMesh.cpp b/examples/companion_radio/MyMesh.cpp
index c4b56d6c6..a24f467cb 100644
--- a/examples/companion_radio/MyMesh.cpp
+++ b/examples/companion_radio/MyMesh.cpp
@@ -4,6 +4,7 @@
 #include "NotificationSettingsFile.h"
 #include "MyMesh.h"
 #include <helpers/CompanionTxRoutingCLI.h>
+#include <helpers/CompanionChannelAlias.h>
 #include <helpers/FleetCommand.h>
 #include "CompanionBluetooth.h"
 #include "CompanionWireless.h"
@@ -1639,7 +1640,8 @@ static bool __attribute__((noinline)) hasEmergencyClientRepeat(uint16_t key) {
 }
 
 bool MyMesh::filterRecvFloodPacket(mesh::Packet* packet) {
-  if (emergency_client_repeat_packet != NULL && packet->getPathHashCount() > 0) {
+  if (emergency_client_repeat_packet != NULL && packet->getPathHashCount() > 0
+      && packet->radio_origin == emergency_client_repeat_packet->radio_origin) {
     if (emergencyClientRepeatKey(packet) == emergency_client_repeat_key) {
       releasePacket(emergency_client_repeat_packet);
       emergency_client_repeat_packet = NULL;
@@ -1658,6 +1660,127 @@ bool MyMesh::allowPacketForward(const mesh::Packet* packet) {
   return true;
 }
 
+bool MyMesh::isAliasRadio2Defined() const {
+  const auto profiles = _radio->profiles();
+  return profiles != nullptr && profiles->enabled();
+}
+
+bool MyMesh::resolveChannelAlias(ChannelDetails& channel) const {
+  uint8_t original_key[16];
+  memcpy(original_key, channel.channel.secret, sizeof(original_key));
+  if (!resolveCompanionChannelKey(channel.name, channel.channel.secret,
+      [](uint8_t* out, size_t size, const uint8_t* text, int length) {
+        mesh::Utils::sha256(out, size, text, length);
+      })) return false;
+  const auto kind = parseCompanionChannelAlias(channel.name).kind;
+#if MESH_ENABLE_MESHTEXT_CHAT
+  if (isMeshtextChannel(channel)) channel.channel.tx_radio = mesh::RADIO_TX_OFF;
+#endif
+  if (isAliasRadio2Defined()
+      && (kind == CompanionChannelKind::Radio2 || kind == CompanionChannelKind::Meshtext)) {
+    channel.channel.tx_radio = kind == CompanionChannelKind::Radio2
+        ? mesh::RADIO_TX_SECONDARY : mesh::RADIO_TX_OFF;
+  }
+  if (memcmp(original_key, channel.channel.secret, sizeof(original_key)) != 0) {
+    // BaseChatMesh already cached the hash for ordinary/private keys. Only a
+    // rewritten automatic alias needs another SHA-256 during receive scans.
+    mesh::Utils::sha256(channel.channel.hash, sizeof(channel.channel.hash), channel.channel.secret, 16);
+  }
+  return true;
+}
+
+bool MyMesh::getChannel(int channel_idx, ChannelDetails& channel) {
+  return BaseChatMesh::getChannel(channel_idx, channel) && resolveChannelAlias(channel);
+}
+
+bool MyMesh::setChannel(int channel_idx, const ChannelDetails& channel) {
+  if (parseCompanionChannelAlias(channel.name).kind == CompanionChannelKind::Invalid) return false;
+  return BaseChatMesh::setChannel(channel_idx, channel);
+}
+
+int MyMesh::searchChannelsForPacket(const mesh::Packet* packet, const uint8_t* hash,
+                                  mesh::GroupChannel matches[], int max_matches) {
+  int count = 0;
+  const bool radio2_defined = isAliasRadio2Defined();
+  for (int priority = 0; priority < 2; ++priority) {
+    for (int i = 0; i < MAX_GROUP_CHANNELS && count < max_matches; ++i) {
+      ChannelDetails channel;
+      if (!getChannel(i, channel) || channel.name[0] == 0
+#if MESH_ENABLE_MESHTEXT_CHAT
+          || isMeshtextChannel(channel)
+#endif
+          || companionChannelReceivePriority(channel.name, packet->radio_origin, radio2_defined) != priority
+          || channel.channel.hash[0] != hash[0]) continue;
+      bool duplicate = false;
+      for (int j = 0; j < count; ++j) {
+        if (memcmp(matches[j].secret, channel.channel.secret, sizeof(channel.channel.secret)) == 0) {
+          duplicate = true;
+          break;
+        }
+      }
+      if (!duplicate) matches[count++] = channel.channel;
+    }
+  }
+  return count;
+}
+
+int MyMesh::findChannelIdxForPacket(const mesh::GroupChannel& key, const mesh::Packet* packet) {
+  const bool radio2_defined = isAliasRadio2Defined();
+  for (int priority = 0; priority < 2; ++priority) {
+    for (int i = 0; i < MAX_GROUP_CHANNELS; ++i) {
+      ChannelDetails channel;
+      if (getChannel(i, channel) && channel.name[0] != 0
+#if MESH_ENABLE_MESHTEXT_CHAT
+          && !isMeshtextChannel(channel)
+#endif
+          && companionChannelReceivePriority(channel.name, packet->radio_origin, radio2_defined) == priority
+          && memcmp(channel.channel.secret, key.secret, sizeof(key.secret)) == 0) return i;
+    }
+  }
+  return -1;
+}
+
+bool MyMesh::allowGroupPacketOnRadio(mesh::Packet* packet) {
+  if (!isAliasRadio2Defined() || packet->payload_len < 1) return true;
+  if (packet->payload_len > MAX_PACKET_PAYLOAD) return false;
+  // Reject only an authenticated key match. The one-byte channel hash alone
+  // must not suppress unrelated channels or opaque relaying.
+  for (int i = 0; i < MAX_GROUP_CHANNELS; ++i) {
+    ChannelDetails channel;
+    if (!getChannel(i, channel) || channel.name[0] == 0
+        || channel.channel.hash[0] != packet->payload[0]) continue;
+    const auto alias = parseCompanionChannelAlias(channel.name);
+    if (alias.kind != CompanionChannelKind::Radio2
+        && alias.kind != CompanionChannelKind::Meshtext) continue;
+    uint8_t data[MAX_PACKET_PAYLOAD];
+    if (mesh::Utils::MACThenDecrypt(channel.channel.secret, data, packet->payload + 1,
+                                  packet->payload_len - 1) <= 0) continue;
+    const int selected = findChannelIdxForPacket(channel.channel, packet);
+    if (selected < 0) return false;
+    ChannelDetails selected_channel;
+    if (getChannel(selected, selected_channel)
+        && parseCompanionChannelAlias(selected_channel.name).kind == CompanionChannelKind::Radio2) {
+      // Also bind direct-path relaying, which runs before local delivery.
+      packet->tx_radio = mesh::RADIO_TX_SECONDARY;
+    }
+    return true;
+  }
+  return true;
+}
+
+void MyMesh::onGroupDataRecv(mesh::Packet* packet, uint8_t type,
+                           const mesh::GroupChannel& key, uint8_t* data, size_t len) {
+  const int index = findChannelIdxForPacket(key, packet);
+  if (index < 0) return;
+  ChannelDetails channel;
+  if (getChannel(index, channel) && isAliasRadio2Defined()
+      && parseCompanionChannelAlias(channel.name).kind == CompanionChannelKind::Radio2) {
+    // Forwarding and the emergency hold copy stay on the originating profile.
+    packet->tx_radio = mesh::RADIO_TX_SECONDARY;
+  }
+  BaseChatMesh::onGroupDataRecv(packet, type, key, data, len);
+}
+
 #ifdef COMPANION_MESH_CLOCK_SYNC
 void MyMesh::onAdvertRecv(mesh::Packet* packet, const mesh::Identity& id,
                           uint32_t timestamp, const uint8_t* app_data,
@@ -1923,74 +2046,11 @@ void MyMesh::onChannelMessageRecv(const mesh::GroupChannel &channel, mesh::Packe
   const bool is_emergency_channel =
       memcmp(channel.secret, EMERGENCY_CHANNEL_SECRET,
              sizeof(EMERGENCY_CHANNEL_SECRET)) == 0;
-  int i = 0;
-  if (app_target_ver >= 3) {
-    out_frame[i++] = RESP_CODE_CHANNEL_MSG_RECV_V3;
-    out_frame[i++] = (int8_t)(pkt->getSNR() * 4);
-    out_frame[i++] = 0; // reserved1
-    out_frame[i++] = 0; // reserved2
-  } else {
-    out_frame[i++] = RESP_CODE_CHANNEL_MSG_RECV;
-  }
-
-  uint8_t channel_idx = findChannelIdx(channel);
-  out_frame[i++] = channel_idx;
-  uint8_t path_len = out_frame[i++] = pkt->isRouteFlood() ? pkt->path_len : 0xFF;
-
-  out_frame[i++] = TXT_TYPE_PLAIN;
-  memcpy(&out_frame[i], &timestamp, 4);
-  i += 4;
-  int tlen = strlen(text); // TODO: UTF-8 ??
-  if (i + tlen > MAX_FRAME_SIZE) {
-    tlen = MAX_FRAME_SIZE - i;
-  }
-  memcpy(&out_frame[i], text, tlen);
-  i += tlen;
-  const bool queued = addToOfflineQueue(out_frame, i);
-
-#if COMPANION_FEATURE_NOTIFICATIONS
-  const bool notification_managed = _notifications.message(nullptr, channel.secret, _serial->isConnected(), millis());
-  if (_ui) _ui->setMessageNotificationOverride(notification_managed, _notifications.overridesScreen());
-#else
-  const bool notification_managed = false;
-#endif
-  if (_serial->isConnected()) {
-    uint8_t frame[1];
-    frame[0] = PUSH_CODE_MSG_WAITING;
-    _serial->writeFrame(frame, 1);
-  } else {
-#ifdef DISPLAY_CLASS
-    if (_ui && !notification_managed) _ui->notify(UIEventType::channelMessage);
-#endif
-  }
-
-#if COMPANION_FEATURE_TEXT_TERMINAL
-  if (hasTerminalOutput()
-      && _terminal_display.shouldShowChannel(is_emergency_channel)) {
-    ChannelDetails details;
-    const char* channel_name = getChannel(channel_idx, details) ? details.name : "Unknown";
-    terminalOutput().printf(
-        "\r\nCHANNEL MSG -> %s (%s)\r\n  %s\r\n> ", channel_name,
-        pkt->isRouteDirect() ? "DIRECT" : "FLOOD", text);
-  }
-#endif
-#ifdef DISPLAY_CLASS
-  // Get the channel name from the channel index
-  const char *channel_name = "Unknown";
-  ChannelDetails channel_details;
-  if (getChannel(channel_idx, channel_details)) {
-    channel_name = channel_details.name;
-  }
-  char channel_label[64];
-  snprintf(channel_label, sizeof(channel_label), "Ch %u %s",
-           (unsigned int)channel_idx, channel_name);
-  if (_ui) {
-    _ui->newMsg(path_len, channel_label, text, offline_queue_len,
-                channel_idx, channel_name, queued ? offline_queue_len - 1 : -1);
-  }
-#endif
-
-  if (_ui) _ui->setMessageNotificationOverride(false);
+  const int selected_channel = findChannelIdxForPacket(channel, pkt);
+  if (selected_channel < 0) return;
+  queueChannelText(selected_channel, channel.secret, pkt->getSNR(),
+                   pkt->isRouteFlood() ? pkt->path_len : 0xFF,
+                   timestamp, text, is_emergency_channel);
 
   if (pkt->isRouteFlood() && is_emergency_channel) {
     bool zero_path = pkt->getPathHashCount() == 0;
@@ -2016,6 +2076,84 @@ void MyMesh::onChannelMessageRecv(const mesh::GroupChannel &channel, mesh::Packe
   }
 }
 
+bool MyMesh::queueChannelText(uint8_t channel_idx, const uint8_t secret[32], float snr,
+                            uint8_t path_len, uint32_t timestamp, const char* text,
+                            bool is_emergency_channel) {
+  if (!text || channel_idx >= MAX_GROUP_CHANNELS) return false;
+  int i = 0;
+  if (app_target_ver >= 3) {
+    out_frame[i++] = RESP_CODE_CHANNEL_MSG_RECV_V3;
+    const float bounded_snr = !isfinite(snr) ? 0 : snr < -32 ? -32 : snr > 31.75f ? 31.75f : snr;
+    out_frame[i++] = (int8_t)(bounded_snr * 4);
+    out_frame[i++] = 0; // reserved1
+    out_frame[i++] = 0; // reserved2
+  } else {
+    out_frame[i++] = RESP_CODE_CHANNEL_MSG_RECV;
+  }
+
+  out_frame[i++] = channel_idx;
+  out_frame[i++] = path_len;
+
+  out_frame[i++] = TXT_TYPE_PLAIN;
+  memcpy(&out_frame[i], &timestamp, 4);
+  i += 4;
+  int tlen = strlen(text); // TODO: UTF-8 ??
+  if (i + tlen > MAX_FRAME_SIZE) {
+    tlen = MAX_FRAME_SIZE - i;
+    while (tlen > 0 && (uint8_t(text[tlen]) & 0xc0) == 0x80) --tlen;
+  }
+  memcpy(&out_frame[i], text, tlen);
+  i += tlen;
+  const bool queued = addToOfflineQueue(out_frame, i);
+  if (!queued) return false;
+
+#if COMPANION_FEATURE_NOTIFICATIONS
+  const bool notification_managed = _notifications.message(nullptr, secret, _serial && _serial->isConnected(), millis());
+  if (_ui) _ui->setMessageNotificationOverride(notification_managed, _notifications.overridesScreen());
+#else
+  const bool notification_managed = false;
+#endif
+  if (_serial && _serial->isConnected()) {
+    uint8_t frame[1];
+    frame[0] = PUSH_CODE_MSG_WAITING;
+    _serial->writeFrame(frame, 1);
+  } else {
+#ifdef DISPLAY_CLASS
+    if (_ui && !notification_managed) _ui->notify(UIEventType::channelMessage);
+#endif
+  }
+
+#if COMPANION_FEATURE_TEXT_TERMINAL
+  if (hasTerminalOutput()
+      && _terminal_display.shouldShowChannel(is_emergency_channel)) {
+    ChannelDetails details;
+    const char* channel_name = getChannel(channel_idx, details) ? details.name : "Unknown";
+    terminalOutput().printf(
+        "\r\nCHANNEL MSG -> %s (%s)\r\n  %s\r\n> ", channel_name,
+        path_len == 0xFF ? "DIRECT" : "FLOOD", text);
+  }
+#endif
+#ifdef DISPLAY_CLASS
+  // Get the channel name from the channel index
+  const char *channel_name = "Unknown";
+  ChannelDetails channel_details;
+  if (getChannel(channel_idx, channel_details)) {
+    channel_name = channel_details.name;
+  }
+  char channel_label[64];
+  snprintf(channel_label, sizeof(channel_label), "Ch %u %s",
+           (unsigned int)channel_idx, channel_name);
+  if (_ui) {
+    _ui->newMsg(path_len, channel_label, text, offline_queue_len,
+                channel_idx, channel_name, queued ? offline_queue_len - 1 : -1);
+  }
+#endif
+
+  if (_ui) _ui->setMessageNotificationOverride(false);
+
+  return true;
+}
+
 void MyMesh::onChannelDataRecv(const mesh::GroupChannel &channel, mesh::Packet *pkt, uint16_t data_type,
                                const uint8_t *data, size_t data_len) {
   if (data_len > MAX_CHANNEL_DATA_LENGTH) {
@@ -2030,7 +2168,9 @@ void MyMesh::onChannelDataRecv(const mesh::GroupChannel &channel, mesh::Packet *
   out_frame[i++] = 0; // reserved1
   out_frame[i++] = 0; // reserved2
 
-  uint8_t channel_idx = findChannelIdx(channel);
+  const int selected_channel = findChannelIdxForPacket(channel, pkt);
+  if (selected_channel < 0) return;
+  uint8_t channel_idx = selected_channel;
   out_frame[i++] = channel_idx;
   out_frame[i++] = pkt->isRouteFlood() ? pkt->path_len : 0xFF;
   out_frame[i++] = (uint8_t)(data_type & 0xFF);
@@ -2954,6 +3094,9 @@ void MyMesh::begin(bool has_display, bool radio_available,
 #endif
 
   configureRadioFromPrefs();
+#if MESH_ENABLE_MESHTEXT_CHAT
+  beginMeshtext();
+#endif
 
 #if defined(WITH_MQTT_BRIDGE) && defined(ESP32_PLATFORM) && defined(WIFI_SSID)
   _mqtt_enabled = CompanionMqttSetupPortal::loadEnabled();
@@ -3412,6 +3555,14 @@ bool MyMesh::handleTxRoutingCommand(const char* command, char* reply, size_t rep
   if (parsed.set && policy != parsed.policy) {
     bool saved;
     if (parsed.channel) {
+      const auto alias = parseCompanionChannelAlias(channel.name);
+      if (isAliasRadio2Defined()
+          && (alias.kind == CompanionChannelKind::Radio2 || alias.kind == CompanionChannelKind::Meshtext)) {
+        snprintf(reply, reply_size, "Error: channel prefix controls routing; rename it to change routing");
+        return true;
+      }
+      // Persist the app PSK, not the resolved wire-key copy used for reporting.
+      getChannelForSave(channel_index, channel);
       const ChannelDetails previous = channel;
       channel.channel.tx_radio = parsed.policy;
       saved = setChannel(channel_index, channel) && saveChannels();
@@ -3460,6 +3611,9 @@ bool MyMesh::handleLocalControlCommand(const char* command, char* reply,
   }
 
   if (handleTxRoutingCommand(command, reply, reply_size)) return true;
+#if MESH_ENABLE_MESHTEXT_CHAT
+  if (handleMeshtextCommand(command, reply, reply_size)) return true;
+#endif
   if (mesh::handleUsbLoggingWatchdogCommand(command, reply, reply_size)) return true;
 #if COMPANION_FEATURE_OTA_CLI
   const auto* ota_context = mesh::ota::ota_context_if_active();
@@ -5733,7 +5887,16 @@ void MyMesh::handleCmdFrame(size_t len) {
     } else {
       ChannelDetails channel;
       bool success = getChannel(channel_idx, channel);
-      if (success && sendGroupMessage(msg_timestamp, channel.channel, _prefs.node_name, text, len - i)) {
+#if MESH_ENABLE_MESHTEXT_CHAT
+      if (success && isMeshtextChannel(channel)) {
+        if (sendMeshtextText(channel, text, len - i)) writeOKFrame();
+        else writeErrFrame(ERR_CODE_BAD_STATE);
+      } else
+#endif
+      if (success && isAliasRadio2Defined()
+          && parseCompanionChannelAlias(channel.name).kind == CompanionChannelKind::Meshtext) {
+        writeErrFrame(ERR_CODE_UNSUPPORTED_CMD);
+      } else if (success && sendGroupMessage(msg_timestamp, channel.channel, _prefs.node_name, text, len - i)) {
         writeOKFrame();
       } else {
         writeErrFrame(ERR_CODE_NOT_FOUND); // bad channel_idx
@@ -5777,6 +5940,13 @@ void MyMesh::handleCmdFrame(size_t len) {
     ChannelDetails channel;
     if (!getChannel(channel_idx, channel)) {
       writeErrFrame(ERR_CODE_NOT_FOUND); // bad channel_idx
+#if MESH_ENABLE_MESHTEXT_CHAT
+    } else if (isMeshtextChannel(channel)) {
+      writeErrFrame(ERR_CODE_UNSUPPORTED_CMD); // channel text only, never raw/admin data
+#endif
+    } else if (isAliasRadio2Defined()
+        && parseCompanionChannelAlias(channel.name).kind == CompanionChannelKind::Meshtext) {
+      writeErrFrame(ERR_CODE_UNSUPPORTED_CMD);
     } else if (data_type == DATA_TYPE_RESERVED) {
       writeErrFrame(ERR_CODE_ILLEGAL_ARG);
     } else if (payload_len > MAX_GROUP_DATA_LENGTH) {
@@ -6250,6 +6420,11 @@ void MyMesh::handleCmdFrame(size_t len) {
 #if ENABLE_PRIVATE_KEY_IMPORT
     if (!mesh::LocalIdentity::validatePrivateKey(&cmd_frame[1])) {
         writeErrFrame(ERR_CODE_ILLEGAL_ARG); // invalid key
+#if MESH_ENABLE_MESHTEXT_CHAT
+    } else if (hasForeignRadioFrame()) {
+        // Finish queued/sending MT text before changing its sender identity.
+        writeErrFrame(ERR_CODE_BAD_STATE);
+#endif
     } else if (!flushContactsBeforeReboot()) {
         // loadContacts() resets the dirty-page map, so never replace the
         // identity and reload while newer contact state exists only in RAM.
@@ -6259,6 +6434,9 @@ void MyMesh::handleCmdFrame(size_t len) {
         identity.readFrom(&cmd_frame[1], 64);
         if (_store->saveMainIdentity(identity)) {
           self_id = identity;
+#if MESH_ENABLE_MESHTEXT_CHAT
+          refreshMeshtextIdentity();
+#endif
 #if defined(ENABLE_OTA)
           mesh::ota::ota_refresh_seeder_identity(self_id.pub_key);
 #endif
@@ -6447,36 +6625,99 @@ void MyMesh::handleCmdFrame(size_t len) {
   } else if (cmd_frame[0] == CMD_GET_CHANNEL && len >= 2) {
     uint8_t channel_idx = cmd_frame[1];
     ChannelDetails channel;
-    if (getChannel(channel_idx, channel)) {
+    if (getChannelForSave(channel_idx, channel)) {
       int i = 0;
       out_frame[i++] = RESP_CODE_CHANNEL_INFO;
       out_frame[i++] = channel_idx;
       strcpy((char *)&out_frame[i], channel.name);
       i += 32;
-      memcpy(&out_frame[i], channel.channel.secret, 16);
-      i += 16; // NOTE: only 128-bit supported
+      size_t key_size = 16; // Original app response remains byte-for-byte compatible.
+#if MESH_ENABLE_MESHTEXT_CHAT
+      if (len >= 3 && cmd_frame[2] == 32 && isMeshtextChannel(channel)) key_size = 32;
+#endif
+      memcpy(&out_frame[i], channel.channel.secret, key_size);
+      i += key_size;
       _serial->writeFrame(out_frame, i);
     } else {
       writeErrFrame(ERR_CODE_NOT_FOUND);
     }
   } else if (cmd_frame[0] == CMD_SET_CHANNEL && len >= 2 + 32 + 32) {
-    writeErrFrame(ERR_CODE_UNSUPPORTED_CMD); // not supported (yet)
+#if MESH_ENABLE_MESHTEXT_CHAT
+    const uint8_t channel_idx = cmd_frame[1];
+    ChannelDetails previous{}, channel{};
+    StrHelper::strncpy(channel.name, (char *)&cmd_frame[2], 32);
+    memcpy(channel.channel.secret, &cmd_frame[2 + 32], sizeof(channel.channel.secret));
+    if (parseCompanionChannelAlias(channel.name).kind != CompanionChannelKind::Meshtext) {
+      writeErrFrame(ERR_CODE_UNSUPPORTED_CMD); // MeshCore wire protocol is still AES-128.
+      return;
+    }
+    if (!validateMeshtextChannelChange(channel_idx, channel)) {
+      writeErrFrame(ERR_CODE_BAD_STATE);
+      return;
+    }
+    if (!getChannelForSave(channel_idx, previous) || !setChannel(channel_idx, channel)) {
+      writeErrFrame(ERR_CODE_NOT_FOUND);
+    } else if (!saveChannels()) {
+      setChannel(channel_idx, previous);
+      writeErrFrame(ERR_CODE_FILE_IO_ERROR);
+    } else {
+      _mt_seen.clear();
+      _mt_profile_dirty = true;
+      refreshMeshtextProfile();
+      writeOKFrame();
+    }
+#else
+    writeErrFrame(ERR_CODE_UNSUPPORTED_CMD);
+#endif
   } else if (cmd_frame[0] == CMD_SET_CHANNEL && len >= 2 + 32 + 16) {
     uint8_t channel_idx = cmd_frame[1];
-    ChannelDetails previous;
+    ChannelDetails previous{};
     ChannelDetails channel;
     StrHelper::strncpy(channel.name, (char *)&cmd_frame[2], 32);
     memset(channel.channel.secret, 0, sizeof(channel.channel.secret));
     memcpy(channel.channel.secret, &cmd_frame[2 + 32], 16); // NOTE: only 128-bit supported
-    const bool have_previous = getChannel(channel_idx, previous);
+    const auto alias = parseCompanionChannelAlias(channel.name);
+    if (alias.kind == CompanionChannelKind::Invalid) {
+      writeErrFrame(ERR_CODE_ILLEGAL_ARG);
+      return;
+    }
+#if MESH_ENABLE_MESHTEXT_CHAT
+    // Legacy apps fetch only 16 bytes. A label-only edit must not silently
+    // truncate a provisioned MT AES-256 key to AES-128. An explicit 32-byte SET
+    // (zero upper half for AES-128) is the unambiguous way to replace that key.
+    if (alias.kind == CompanionChannelKind::Meshtext
+        && getChannelForSave(channel_idx, previous) && isMeshtextChannel(previous)
+        && !memcmp(channel.channel.secret, previous.channel.secret, 16)) {
+      memcpy(channel.channel.secret + 16, previous.channel.secret + 16, 16);
+    }
+    if (!validateMeshtextChannelChange(channel_idx, channel)) {
+      writeErrFrame(ERR_CODE_BAD_STATE); // Conflicting preset, manual RF, region or busy owner.
+      return;
+    }
+#else
+    if (alias.kind == CompanionChannelKind::Meshtext && isAliasRadio2Defined()) {
+      writeErrFrame(ERR_CODE_UNSUPPORTED_CMD); // Meshtext transport not implemented yet.
+      return;
+    }
+#endif
+    const bool have_previous = getChannelForSave(channel_idx, previous);
+    ChannelDetails wire_channel = channel;
+    ChannelDetails previous_wire_channel = previous;
+    resolveChannelAlias(wire_channel);
+    if (have_previous) resolveChannelAlias(previous_wire_channel);
     if (have_previous && channel.name[0] != 0 && previous.name[0] != 0
-        && !memcmp(channel.channel.secret, previous.channel.secret, sizeof(channel.channel.secret))) {
+        && !memcmp(wire_channel.channel.secret, previous_wire_channel.channel.secret, sizeof(channel.channel.secret))) {
       channel.channel.tx_radio = previous.channel.tx_radio;
     }
     if (!have_previous
         || !setChannel(channel_idx, channel)) {
       writeErrFrame(ERR_CODE_NOT_FOUND); // bad channel_idx
     } else if (saveChannels()) {
+#if MESH_ENABLE_MESHTEXT_CHAT
+      _mt_seen.clear();
+      _mt_profile_dirty = true;
+      refreshMeshtextProfile();
+#endif
       writeOKFrame();
     } else {
       // AtomicFileWriter preserves the last complete channels file. Keep the
@@ -8695,6 +8936,21 @@ void MyMesh::handleTerminalDisplayCommand(const char* arguments) {
 
 void MyMesh::sendTerminalChannelMessage(ChannelDetails& channel,
                                         const char* text) {
+#if MESH_ENABLE_MESHTEXT_CHAT
+  if (isMeshtextChannel(channel)) {
+    if (text && sendMeshtextText(channel, text, strlen(text))) {
+      terminalOutput().printf("  Queued to %s (Meshtext).\r\n", channel.name);
+    } else {
+      terminalOutput().printf("  ERROR: %s; use get mt.status\r\n", _mt_status);
+    }
+    return;
+  }
+#endif
+  if (isAliasRadio2Defined()
+      && parseCompanionChannelAlias(channel.name).kind == CompanionChannelKind::Meshtext) {
+    terminalOutput().print("  ERROR: Meshtext channel transport is not available\r\n");
+    return;
+  }
   const size_t prefix_len = strlen(_prefs.node_name) + 2;  // "name: "
   const size_t max_text_len = prefix_len < MAX_TEXT_LEN
       ? MAX_TEXT_LEN - prefix_len : 0;
@@ -9570,6 +9826,20 @@ void MyMesh::handleTerminalCommand(char* command) {
         "  board\r\n"
         "  version\r\n");
     terminalOutput().print("  get storage.layout\r\n");
+#if MESH_ENABLE_MESHTEXT_CHAT
+    terminalOutput().print("  get mt.status / get mt.region / get mt.slot / get mt.hops\r\n"
+        "  get mt.node / get mt.shortname\r\n"
+        "  set mt.region <auto|us|eu868|eu433|anz>\r\n"
+        "  set mt.slot <0|1-based frequency slot>\r\n"
+        "  set mt.hops <0..7> (saved; default 7)\r\n"
+        "  set mt.node <!8hex|default> (saved; use a unique ID)\r\n"
+        "  set mt.shortname <1..4 UTF-8 characters|default> (saved; NodeInfo uses 4 bytes)\r\n"
+        "  send mt.nodeinfo <channel slot> (one manual advert; no automatic adverts)\r\n"
+        "  set mt.preset <longfast|shortturbo|...> (saved manual radio2)\r\n"
+        "  set mt.channel <slot> <mt-name> <32/64 hex digits|AQ==>\r\n"
+        "  get mt.channel <slot> / delete mt.channel <slot>\r\n"
+        "  Join #mt-longfast or #mt-shortturbo in the app for automatic radio2\r\n");
+#endif
 #if defined(NRF52_PLATFORM) && defined(EXTRAFS) && !defined(QSPIFLASH)
     terminalOutput().print("  get flash.health\r\n");
 #endif
@@ -9830,6 +10100,12 @@ bool MyMesh::handleDirectCommand(const char* command, char* reply, size_t reply_
       stopContactsIterator();
       resetContacts();
       mesh::resetLazyPersistenceAfterSuccess(dirty_contacts_expiry, dirty_contacts_failures);
+#if MESH_ENABLE_MESHTEXT_CHAT
+      if (!eraseMeshtextSettings()) {
+        snprintf(reply, reply_size, "File system erased; Error: MT settings erase failed");
+        return true;
+      }
+#endif
       snprintf(reply, reply_size, "File system erase: OK");
     } else {
       snprintf(reply, reply_size, "File system erase: Err");
@@ -10369,6 +10645,12 @@ complete_line:
       }
     } else if (strcmp(cli_command, "erase") == 0) {
       bool success = _store->formatFileSystem();
+#if MESH_ENABLE_MESHTEXT_CHAT
+      if (success && !eraseMeshtextSettings()) {
+        output.println("  Error: file system erased, but MT settings erase failed");
+        return;
+      }
+#endif
       if (success) {
         output.println("  > erase done");
       } else {
@@ -10611,6 +10893,9 @@ void MyMesh::loop() {
 #endif
 
   _radio_profiles.loop();
+#if MESH_ENABLE_MESHTEXT_CHAT
+  refreshMeshtextProfile();
+#endif
 #if defined(WITH_MQTT_BRIDGE) && defined(ESP32_PLATFORM) && defined(WIFI_SSID)
   if (_mqtt_bridge) _mqtt_bridge->servicePendingClockCorrection();
 #endif
diff --git a/examples/companion_radio/MyMesh.h b/examples/companion_radio/MyMesh.h
index 3734d12c6..b388887c5 100644
--- a/examples/companion_radio/MyMesh.h
+++ b/examples/companion_radio/MyMesh.h
@@ -26,6 +26,10 @@
 
 #include "DataStore.h"
 #include <helpers/RadioProfileCLI.h>
+#include <helpers/MeshtextConfig.h>
+#if MESH_ENABLE_MESHTEXT_CHAT
+#include <helpers/CompanionMeshtextChannel.h>
+#endif
 #include <helpers/CompanionNotificationPolicy.h>
 #include "NodePrefs.h"
 
@@ -351,6 +355,37 @@ protected:
   uint8_t getExtraAckTransmitCount() const override;
   bool filterRecvFloodPacket(mesh::Packet* packet) override;
   bool allowPacketForward(const mesh::Packet* packet) override;
+  bool allowGroupPacketOnRadio(mesh::Packet* packet) override;
+  int searchChannelsForPacket(const mesh::Packet* packet, const uint8_t* hash,
+                             mesh::GroupChannel channels[], int max_matches) override;
+  void onGroupDataRecv(mesh::Packet* packet, uint8_t type,
+                       const mesh::GroupChannel& channel, uint8_t* data, size_t len) override;
+  bool isAliasRadio2Defined() const;
+  bool resolveChannelAlias(ChannelDetails& channel) const;
+#if MESH_ENABLE_MESHTEXT_CHAT
+  void beginMeshtext();
+  void refreshMeshtextIdentity();
+  void refreshMeshtextProfile();
+  bool isMeshtextChannel(const ChannelDetails& channel) const;
+  bool validateMeshtextChannelChange(int index, const ChannelDetails& channel);
+  bool handleMeshtextCommand(const char* command, char* reply, size_t capacity);
+  bool saveMeshtextSettings(mesh::mt::Region region, uint32_t slot, uint8_t hops = UINT8_MAX,
+                             const char* short_name = nullptr, uint32_t node_override = UINT32_MAX);
+  bool eraseMeshtextSettings();
+  bool sendMeshtextText(const ChannelDetails& channel, const char* text, size_t length);
+  bool sendMeshtextNodeInfo(const ChannelDetails& channel);
+  bool onForeignRadioFrame(const uint8_t* bytes, size_t length, uint8_t profile,
+                          uint32_t generation, float snr, float rssi) override;
+  void onForeignRadioSendComplete(bool success) override;
+  bool allowForeignRadioTransmit() const override {
+    return _radio_available && _scheduled_reboot_at == 0 && _mt_active;
+  }
+  mesh::mt::Region meshtextRegion() const;
+#endif
+  bool queueChannelText(uint8_t index, const uint8_t secret[32], float snr,
+                        uint8_t path_len, uint32_t timestamp, const char* text,
+                        bool is_emergency_channel);
+  int findChannelIdxForPacket(const mesh::GroupChannel& channel, const mesh::Packet* packet);
   bool allowFloodRetry(const mesh::Packet* packet) const override;
   uint8_t getFloodRetryMaxPathLength(const mesh::Packet* packet) const override;
   uint8_t getFloodRetryMaxAttempts(const mesh::Packet* packet) const override;
@@ -436,13 +471,18 @@ protected:
   bool getContactForSave(uint32_t idx, ContactInfo& contact) override { return getContactByIdx(idx, contact); }
   ContactInfo* getContactForStore(uint32_t idx) override { return getContactPtrByIdx(idx); }
   void onContactCacheFlushed() override;
-  bool onChannelLoaded(uint8_t channel_idx, const ChannelDetails& ch) override { return setChannel(channel_idx, ch); }
-  bool getChannelForSave(uint8_t channel_idx, ChannelDetails& ch) override { return getChannel(channel_idx, ch); }
+  // A legacy malformed alias must not quarantine every other saved channel.
+  // The raw slot remains visible to the app so it can be renamed or deleted.
+  bool onChannelLoaded(uint8_t channel_idx, const ChannelDetails& ch) override { return BaseChatMesh::setChannel(channel_idx, ch); }
+  bool getChannelForSave(uint8_t channel_idx, ChannelDetails& ch) override { return BaseChatMesh::getChannel(channel_idx, ch); }
 
   void clearPendingReqs();
   bool hasPendingReqs() const;
 
 public:
+  // Runtime copies use the wire PSK; storage/app keep the original alias PSK.
+  bool getChannel(int channel_idx, ChannelDetails& channel);
+  bool setChannel(int channel_idx, const ChannelDetails& channel);
   bool savePrefs() {
     const uint8_t previous_usb_debug = _prefs.usb_debug_enabled;
     _prefs.usb_debug_enabled = _prefs.usb_debug_enabled == 1 ? 1 : 0;
@@ -647,6 +687,20 @@ private:
 
   DataStore* _store;
   mesh::RadioProfileCLI _radio_profiles;
+#if MESH_ENABLE_MESHTEXT_CHAT
+  mesh::mt::Region _mt_region = mesh::mt::Region::Unset;
+  uint32_t _mt_slot = 0, _mt_node = 0, _mt_packet_id = 0;
+  uint32_t _mt_default_node = 0, _mt_node_override = 0;
+  char _mt_short_name[17] = {};
+  uint8_t _mt_hop_limit = 7;
+  uint32_t _mt_sent = 0, _mt_failed = 0, _mt_received = 0;
+  mesh::mt::SeenPackets _mt_seen;
+  bool _mt_settings_valid = true, _mt_active = false;
+  bool _mt_profile_dirty = true, _mt_last_radio_ready = false;
+  uint32_t _mt_primary_generation = 0, _mt_secondary_generation = 0, _mt_intent_generation = 0;
+  float _mt_primary_frequency = 0;
+  const char* _mt_status = "no Meshtext channels";
+#endif
   uint16_t _temp_radio_preamble = 0;
   CompanionNodePrefs _prefs;
   #if COMPANION_FEATURE_NOTIFICATIONS
diff --git a/licenses/ESPP-Meshtext-MIT.txt b/licenses/ESPP-Meshtext-MIT.txt
new file mode 100644
index 000000000..5deca291a
--- /dev/null
+++ b/licenses/ESPP-Meshtext-MIT.txt
@@ -0,0 +1,37 @@
+MeshtextChat attribution
+
+The framing, channel hash, frequency-slot, AES-CTR nonce and minimal protobuf
+wire helpers in src/helpers/MeshtextChat.cpp are bounded adaptations of the
+MIT-licensed esp-cpp/espp radio messaging component identified below. They do
+not incorporate code from GPL firmware or generated protobuf definitions.
+
+Pinned upstream source:
+https://github.com/esp-cpp/espp/tree/4b32f78e007f3750b2ea82a96c3c5896c2770a97/components/meshtastic
+Files: include/meshtastic_types.hpp, src/meshtastic_protocol.cpp,
+src/meshtastic_crypto.cpp, src/meshtastic_protobuf.cpp.
+License:
+https://github.com/esp-cpp/espp/blob/4b32f78e007f3750b2ea82a96c3c5896c2770a97/LICENSE
+
+This implementation uses the repository's existing rweather/Crypto AES backend,
+which retains its separate Southern Storm Software MIT notices. No ESP-IDF or
+mbedTLS code from the upstream component is imported.
+
+MIT License
+
+Copyright (c) 2022 esp-cpp
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/scripts/check_firmware_capabilities.py b/scripts/check_firmware_capabilities.py
index e6a2470d2..27bff6211 100644
--- a/scripts/check_firmware_capabilities.py
+++ b/scripts/check_firmware_capabilities.py
@@ -11,6 +11,9 @@ import sys
 import struct
 import zipfile
 import zlib
+from package_meshtext_license import (CAPABILITY as MESHTEXT_CAPABILITY,
+    meshtext_evidence, notice_bytes as meshtext_notice_bytes,
+    notice_record as meshtext_notice_record)
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "tools" / "mota"))
 from motalib import parse_nrf52_layout
@@ -186,6 +189,19 @@ def main() -> int:
 
     checks = []
     malformed = False
+    third_party_notices = []
+    try:
+        codec_symbols, chat_symbols = meshtext_evidence(args.image)
+        if codec_symbols:
+            stem = args.output.name.removesuffix(".capabilities.json")
+            third_party_notices.append(meshtext_notice_record(stem, meshtext_notice_bytes()))
+        if chat_symbols:
+            checks.append({"capability": MESHTEXT_CAPABILITY,
+                           "evidence": "; ".join(chat_symbols), "present": True,
+                           "source": "linked ELF symbols"})
+    except (OSError, ValueError) as error:
+        print(f"capability check: cannot qualify linked Meshtext code: {error}", file=sys.stderr)
+        malformed = True
     application = b""
     if args.expect_application:
         try:
@@ -245,6 +261,8 @@ def main() -> int:
         "ota_update_evidence": ota_evidence,
         "verified": not malformed and not missing and (not args.require_ota or ota_verified),
     }
+    if third_party_notices:
+        manifest["third_party_notices"] = third_party_notices
     if ota_verified and args.platform == "NRF52_PLATFORM" and "lora" in ota_methods:
         with zipfile.ZipFile(args.dfu_package) as package:
             app = json.loads(package.read("manifest.json"))["manifest"]["application"]
diff --git a/scripts/firmware_build_recipe.py b/scripts/firmware_build_recipe.py
index bdd067216..9817dc248 100644
--- a/scripts/firmware_build_recipe.py
+++ b/scripts/firmware_build_recipe.py
@@ -23,7 +23,8 @@ RECIPE_ENVIRONMENT = (
     "MESHCORE_NRF52_LEGACY_FLASH_OTA", "MESHCORE_REDUCED_TLS",
 )
 PACKAGE_SUFFIXES = (".bin", "-merged.bin", ".uf2", ".zip", ".hex",
-                    ".capabilities.json", ".memory.json", ".font-license.txt")
+                    ".capabilities.json", ".memory.json", ".font-license.txt",
+                    ".meshtext-license.txt")
 
 
 def canonical_digest(value):
diff --git a/scripts/firmware_memory_manifest.py b/scripts/firmware_memory_manifest.py
index 7a537cda3..ab52d58a2 100644
--- a/scripts/firmware_memory_manifest.py
+++ b/scripts/firmware_memory_manifest.py
@@ -10,6 +10,7 @@ import sys
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 from package_nrf52_font_license import validate_artifact_notice
+from package_meshtext_license import validate_artifact_notice as validate_meshtext_notice
 
 
 def digest(path):
@@ -43,6 +44,7 @@ def artifact_files(stem):
     candidates = [stem.parent / (stem.name + suffix)
                   for suffix in (".bin", "-merged.bin", ".uf2", ".zip", ".hex", ".capabilities.json",
                                  ".font-license.txt")]
+    candidates.append(stem.parent / (stem.name + ".meshtext-license.txt"))
     return [p for p in candidates if p.is_file()]
 
 
@@ -50,6 +52,7 @@ def package_report(directory, stem):
     stem = Path(stem)
     report = validate_build(directory)
     validate_artifact_notice(stem)
+    validate_meshtext_notice(stem)
     files = artifact_files(stem)
     if len(files) < 2 or not any(p.suffix in (".bin", ".uf2", ".zip", ".hex") for p in files):
         raise ValueError("cannot qualify an empty firmware package")
@@ -64,6 +67,7 @@ def package_report(directory, stem):
 def validate_package(stem):
     stem = Path(stem)
     validate_artifact_notice(stem)
+    validate_meshtext_notice(stem)
     report = passing_report(stem.parent / (stem.name + ".memory.json"))
     actual = {p.name: digest(p) for p in artifact_files(stem)}
     if len(actual) < 2 or actual != report.get("files"):
diff --git a/scripts/package_cascade_release.py b/scripts/package_cascade_release.py
index 2c1e74f1c..446430c58 100644
--- a/scripts/package_cascade_release.py
+++ b/scripts/package_cascade_release.py
@@ -18,6 +18,7 @@ sys.path.insert(0, str(Path(__file__).resolve().parent))
 from firmware_memory_manifest import validate_package
 from check_nrf52_uf2 import check_uf2
 from package_nrf52_font_license import validate_artifact_notice
+from package_meshtext_license import validate_artifact_notice as validate_meshtext_notice
 
 
 ROOT = Path(__file__).resolve().parents[1]
@@ -161,6 +162,9 @@ def collect_artifacts(directory, version):
         font_notice = validate_artifact_notice(directory / stem)
         if font_notice is not None:
             files.append(font_notice)
+        meshtext_notice = validate_meshtext_notice(directory / stem)
+        if meshtext_notice is not None:
+            files.append(meshtext_notice)
         manifest["runtime_ram"] = {key: memory[key] for key in (
             "passed", "available_internal_bytes", "required_heap_bytes", "elf_sha256")}
         accounted.update(files)
@@ -192,8 +196,11 @@ def category(record):
 
 
 def sha256(path):
+    digest = hashlib.sha256()
     with path.open("rb") as stream:
-        return hashlib.file_digest(stream, "sha256").hexdigest()
+        for block in iter(lambda: stream.read(1024 * 1024), b""):
+            digest.update(block)
+    return digest.hexdigest()
 
 
 def completed_matrix_failures(status, allow_partial=False):
diff --git a/scripts/package_esp32_partition_migration.py b/scripts/package_esp32_partition_migration.py
index 444a20324..02ce77911 100644
--- a/scripts/package_esp32_partition_migration.py
+++ b/scripts/package_esp32_partition_migration.py
@@ -23,6 +23,7 @@ from motalib import (  # noqa: E402
 )
 from check_esp32_app_size import app_partition_size  # noqa: E402
 from firmware_memory_manifest import validate_package  # noqa: E402
+from package_meshtext_license import validate_artifact_notice as validate_meshtext_notice
 
 
 BOARDS = {
@@ -587,6 +588,9 @@ def package_board(name: str, spec: dict, build_dir: Path, output_dir: Path,
         "target-partitions.bin": table,
         "capabilities.json": capability_path.read_bytes(),
     }
+    meshtext_notice = validate_meshtext_notice(build_dir / stem)
+    if meshtext_notice is not None:
+        files[meshtext_notice.name] = meshtext_notice.read_bytes()
     if spec.get("expander_bridge"):
         expander_body = (utility_build_dir / spec["expander_bridge"] /
                          "firmware.bin").read_bytes()
diff --git a/scripts/package_meshtext_license.py b/scripts/package_meshtext_license.py
new file mode 100644
index 000000000..d7f048624
--- /dev/null
+++ b/scripts/package_meshtext_license.py
@@ -0,0 +1,151 @@
+#!/usr/bin/env python3
+"""Ship the adapted Meshtext MIT notice only for actually linked code."""
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import sys
+
+from firmware_elf import FirmwareElf
+
+ROOT = Path(__file__).resolve().parents[1]
+NOTICE_PATH = ROOT / "licenses/ESPP-Meshtext-MIT.txt"
+SIDECAR_SUFFIX = ".meshtext-license.txt"
+CAPABILITY = "companion.meshtext.channel_text"
+COMPONENT = "espp-meshtext"
+
+
+def notice_bytes():
+    data = NOTICE_PATH.read_bytes()
+    if not valid_notice(data):
+        raise ValueError("Meshtext MIT source notice is incomplete")
+    return data
+
+
+def valid_notice(data):
+    return (0 < len(data) <= 262144 and all(text in data for text in (
+        b"Copyright (c) 2022 esp-cpp", b"Permission is hereby granted, free of charge",
+        b"included in all", b"copies or substantial portions of the Software",
+        b'THE SOFTWARE IS PROVIDED "AS IS"', b"OTHER DEALINGS IN THE", b"SOFTWARE.")))
+
+
+def linked_symbols(path):
+    """Only allocated executable definitions qualify; debug strings do not."""
+    if Path(path).read_bytes()[:4] != b"\x7fELF":
+        return []  # Existing marker-only test fixtures are not linked ELFs.
+    elf = FirmwareElf(path)
+    result = []
+    for name, (_address, size, index) in elf.symbols.items():
+        if size <= 0 or index >= len(elf.sections):
+            continue
+        section = elf.sections[index]
+        if section[1] != 8 and section[2] & 6 == 6:
+            result.append(name)
+    return sorted(result)
+
+
+def meshtext_evidence(path):
+    symbols = linked_symbols(path)
+    # Match the Itanium namespace prefix, not arbitrary names containing MT.
+    codec = [name for name in symbols if name.startswith("_ZN4mesh2mt")]
+    required = ("_ZN4mesh2mt10encodeTextE", "_ZN4mesh2mt10decodeTextE",
+                "_ZN6MyMesh16sendMeshtextTextE", "_ZN6MyMesh19onForeignRadioFrameE",
+                "_ZN4mesh10Dispatcher22queueForeignRadioFrameE")
+    selected = []
+    for operation in required:
+        matches = [name for name in symbols if name.startswith(operation)]
+        if not matches:
+            return codec, []
+        selected.append(matches[0])
+    return codec, selected if codec else []
+
+
+def notice_record(stem, data):
+    return {"component": COMPONENT, "license": "MIT",
+            "file": Path(stem).name + SIDECAR_SUFFIX,
+            "sha256": hashlib.sha256(data).hexdigest()}
+
+
+def sidecar(stem):
+    stem = Path(stem)
+    return stem.parent / (stem.name + SIDECAR_SUFFIX)
+
+
+def manifest_record(stem):
+    stem = Path(stem)
+    manifest = json.loads((stem.parent / (stem.name + ".capabilities.json")).read_text())
+    records = [record for record in manifest.get("third_party_notices", [])
+               if record.get("component") == COMPONENT]
+    if len(records) > 1:
+        raise ValueError(f"{stem}: duplicate Meshtext license declarations")
+    if not records:
+        if CAPABILITY in manifest.get("capabilities", []):
+            raise ValueError(f"{stem}: Meshtext capability lacks its MIT notice")
+        return None
+    record = records[0]
+    if (record.get("file") != sidecar(stem).name or record.get("license") != "MIT"
+            or not re.fullmatch(r"[0-9a-f]{64}", str(record.get("sha256", "")))):
+        raise ValueError(f"{stem}: invalid Meshtext license declaration")
+    return record
+
+
+def validate_artifact_notice(stem):
+    record = manifest_record(stem)
+    output = sidecar(stem)
+    if record is None:
+        if output.exists():
+            raise ValueError(f"{output}: stale notice for an unaffected firmware")
+        return None
+    if not output.is_file():
+        raise ValueError(f"{output}: missing Meshtext MIT notice")
+    data = output.read_bytes()
+    if not valid_notice(data) or hashlib.sha256(data).hexdigest() != record["sha256"]:
+        raise ValueError(f"{output}: incomplete or mismatched Meshtext MIT notice")
+    return output
+
+
+def collect_build_notice(directory, stem):
+    codec, _chat = meshtext_evidence(Path(directory) / "firmware.elf")
+    record = manifest_record(stem)
+    if bool(codec) != bool(record):
+        raise ValueError("Meshtext license declaration does not match the linked ELF")
+    if not codec:
+        return validate_artifact_notice(stem)
+    data = notice_bytes()
+    if record != notice_record(stem, data):
+        raise ValueError("Meshtext license declaration does not match this build's source notice")
+    output = sidecar(stem)
+    if output.exists():
+        return validate_artifact_notice(stem)
+    temporary = output.with_name(f".{output.name}.{os.getpid()}.tmp")
+    try:
+        temporary.write_bytes(data)
+        temporary.replace(output)
+    finally:
+        temporary.unlink(missing_ok=True)
+    return validate_artifact_notice(stem)
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("action", choices=("collect", "validate"))
+    parser.add_argument("path", type=Path)
+    parser.add_argument("--stem", type=Path)
+    args = parser.parse_args()
+    try:
+        if args.action == "collect":
+            if args.stem is None:
+                parser.error("collect requires --stem")
+            collect_build_notice(args.path, args.stem)
+        else:
+            validate_artifact_notice(args.path)
+    except (OSError, ValueError, KeyError, TypeError) as error:
+        parser.exit(1, f"Meshtext license qualification failed: {error}\n")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/src/Dispatcher.cpp b/src/Dispatcher.cpp
index 91420a238..f4d55f1f5 100644
--- a/src/Dispatcher.cpp
+++ b/src/Dispatcher.cpp
@@ -48,6 +48,12 @@ void Dispatcher::setRadioAvailable(bool available) {
   if (radio_available == available) return;
 
   radio_available = available;
+#if MESH_ENABLE_MESHTEXT_CHAT
+  if (!available && hasForeignRadioFrame()) {
+    if (foreign_radio_sending) _radio->onSendFinished();
+    finishForeignRadioFrame(false, foreign_radio_sending);
+  }
+#endif
   radio_nonrx_timer_armed = false;
   if (!dispatcher_started || !radio_available) return;
 
@@ -68,6 +74,12 @@ void Dispatcher::setRadioAvailable(bool available) {
 }
 
 void Dispatcher::begin() {
+#if MESH_ENABLE_MESHTEXT_CHAT
+  if (hasForeignRadioFrame()) {
+    if (foreign_radio_sending && radio_available) _radio->onSendFinished();
+    finishForeignRadioFrame(false, foreign_radio_sending);
+  }
+#endif
   n_sent_flood = n_sent_direct = 0;
   n_recv_flood = n_recv_direct = 0;
   last_meshcore_recv_millis = 0;
@@ -259,6 +271,154 @@ void Dispatcher::failOutboundTransmit() {
   outbound_cancellation = OutboundCancellation::None;
 }
 
+#if MESH_ENABLE_MESHTEXT_CHAT
+bool Dispatcher::isForeignRadioCurrent() const {
+  const auto* profiles = _radio->profiles();
+  return radio_available && _radio->supportsMeshtext() && profiles
+      && allowForeignRadioTransmit()
+      && foreign_radio_profile == 1 && profiles->enabled()
+      && profiles->canTransmit(foreign_radio_profile)
+      && profiles->params(foreign_radio_profile).protocol == RadioProfileProtocol::Meshtext
+      && foreign_radio_generation == profiles->generation[foreign_radio_profile];
+}
+
+bool Dispatcher::queueForeignRadioFrame(const uint8_t* bytes, size_t length,
+                                        uint8_t profile, uint32_t generation) {
+  const auto* profiles = _radio->profiles();
+  if (!bytes || !length || length > sizeof(foreign_radio_bytes) || hasForeignRadioFrame()
+      || !radio_available || !_radio->supportsMeshtext() || _radio->isCarrierWaveActive()
+      || !allowForeignRadioTransmit()
+      || !profiles || profile != 1 || !profiles->enabled() || !profiles->canTransmit(profile)
+      || profiles->params(profile).protocol != RadioProfileProtocol::Meshtext
+      || generation != profiles->generation[profile]) return false;
+  memcpy(foreign_radio_bytes, bytes, length);
+  foreign_radio_length = (uint16_t)length;
+  foreign_radio_profile = profile;
+  foreign_radio_generation = generation;
+  foreign_radio_retry_at = foreign_radio_prepare_deadline = 0;
+  foreign_radio_sending = false;
+  return true;
+}
+
+void Dispatcher::finishForeignRadioFrame(bool success, bool account_airtime) {
+  if (!hasForeignRadioFrame()) return;
+  if (account_airtime) {
+    const uint32_t elapsed = (uint32_t)_ms->getMillis() - foreign_radio_start;
+    total_air_time += elapsed;
+    updateTxBudget();
+    tx_budget_ms = elapsed >= tx_budget_ms ? 0 : tx_budget_ms - elapsed;
+    if (tx_budget_ms < MIN_TX_BUDGET_RESERVE_MS) {
+      const float duty_cycle = 1.0f / (1.0f + getAirtimeBudgetFactor());
+      next_tx_time = futureMillis((unsigned long)((MIN_TX_BUDGET_RESERVE_MS - tx_budget_ms) / duty_cycle));
+    } else next_tx_time = _ms->getMillis();
+  }
+  if (success && _radio->profiles()) ++_radio->profiles()->tx_packets[foreign_radio_profile];
+  // Release ownership before calling the application; it may submit another
+  // explicit user message. No retry is scheduled after any failure/timeout.
+  foreign_radio_length = 0;
+  foreign_radio_sending = false;
+  foreign_radio_yield_meshcore = true;
+  profile_cad_busy[foreign_radio_profile] = 0;
+  foreign_radio_retry_at = foreign_radio_prepare_deadline = 0;
+  radio_nonrx_start = _ms->getMillis();
+  onForeignRadioSendComplete(success);
+}
+
+bool Dispatcher::serviceForeignRadioFrame() {
+  if (!hasForeignRadioFrame()) return false;
+  if (!foreign_radio_sending) {
+    if (!isForeignRadioCurrent()) finishForeignRadioFrame(false, false);
+    return false;
+  }
+  if (_radio->isSendComplete()) {
+    const bool current = isForeignRadioCurrent();
+    _radio->onSendFinished();
+    finishForeignRadioFrame(current, true);
+    return false;
+  }
+  if (millisHasNowPassed(foreign_radio_expiry)) {
+    _radio->onSendFinished();
+    finishForeignRadioFrame(false, true);
+    _err_flags |= ERR_EVENT_RADIO_WATCHDOG;
+    _radio->recoverRadio(true);
+    return false;
+  }
+  return true;
+}
+
+bool Dispatcher::checkForeignRadioSend() {
+  if (!hasForeignRadioFrame() || outbound || foreign_radio_sending) return false;
+  if (!isForeignRadioCurrent()) {
+    finishForeignRadioFrame(false, false);
+    return false;
+  }
+  if (!restoreOutboundTxOverrides() || _radio->isCarrierWaveActive()) return false;
+  const uint32_t now = _ms->getMillis();
+  // Continuous explicit foreign chat must leave due MeshCore traffic a turn
+  // between messages; a blocked/absent MeshCore queue does not stall MT.
+  if (foreign_radio_yield_meshcore && _mgr->getOutboundCount(now) > 0) {
+    foreign_radio_yield_meshcore = false;
+    return false;
+  }
+  if (foreign_radio_retry_at && (int32_t)(now - foreign_radio_retry_at) < 0) return false;
+  updateTxBudget();
+  const uint32_t airtime = validPrepareBusyAirtime(
+      _radio->getProfileAirtime(foreign_radio_profile, foreign_radio_length));
+  if (!airtime) { finishForeignRadioFrame(false, false); return false; }
+  if (tx_budget_ms < airtime / MIN_TX_BUDGET_AIRTIME_DIV) {
+    const float duty_cycle = 1.0f / (1.0f + getAirtimeBudgetFactor());
+    next_tx_time = futureMillis((unsigned long)((airtime / MIN_TX_BUDGET_AIRTIME_DIV - tx_budget_ms) / duty_cycle));
+    return false;
+  }
+  if (!millisHasNowPassed(next_tx_time)) return false;
+  const auto prepared = _radio->prepareTransmitProfile(foreign_radio_profile);
+  if (prepared == RadioParamApplyResult::BUSY) {
+    if (!foreign_radio_prepare_deadline) {
+      uint32_t maximum = validPrepareBusyAirtime(_radio->getProfileAirtime(0, MAX_TRANS_UNIT));
+      const uint32_t other = validPrepareBusyAirtime(_radio->getProfileAirtime(1, MAX_TRANS_UNIT));
+      if (other > maximum) maximum = other;
+      foreign_radio_prepare_deadline = now + maximum * 3 / 2 + RADIO_PREPARE_BUSY_GRACE_MS;
+      if (!foreign_radio_prepare_deadline) foreign_radio_prepare_deadline = 1;
+    } else if (millisHasNowPassed(foreign_radio_prepare_deadline)) {
+      finishForeignRadioFrame(false, false);
+      _err_flags |= ERR_EVENT_RADIO_WATCHDOG;
+      _radio->recoverRadio(true);
+      return false;
+    }
+    foreign_radio_retry_at = now + 10;
+    return false;
+  }
+  foreign_radio_prepare_deadline = 0;
+  if (prepared != RadioParamApplyResult::APPLIED || !isForeignRadioCurrent()) {
+    finishForeignRadioFrame(false, false);
+    return false;
+  }
+  // CAD is the normal bounded pre-transmit check. Waiting does not retain the
+  // transceiver: MeshCore RX/TX and profile scanning continue in the meantime.
+  uint32_t& busy_since = profile_cad_busy[foreign_radio_profile];
+  if (_radio->isReceiving()) {
+    if (!busy_since) busy_since = now ? now : 1;
+    if ((uint32_t)(now - busy_since) <= getCADFailMaxDuration()) {
+      foreign_radio_retry_at = now + getCADFailRetryDelay();
+      return false;
+    }
+    _err_flags |= ERR_EVENT_CAD_TIMEOUT;
+  }
+  busy_since = 0;
+  foreign_radio_retry_at = 0;
+  foreign_radio_start = _ms->getMillis();
+  if (!_radio->startSendRaw(foreign_radio_bytes, foreign_radio_length)) {
+    // RadioLib owns failure cleanup (including the board's FEM). Unlike
+    // MeshCore reliable routing, foreign chat never retries autonomously.
+    finishForeignRadioFrame(false, false);
+    return false;
+  }
+  foreign_radio_sending = true;
+  foreign_radio_expiry = foreign_radio_start + airtime * 3 / 2 + 1000;
+  return true;
+}
+#endif
+
 int Dispatcher::calcRxDelay(float score, uint32_t air_time) const {
   return (int) ((powf(10.0f, 0.85f - score) - 1.0f) * air_time);
 }
@@ -301,6 +461,9 @@ void Dispatcher::logPacketLine(const char* direction, const Packet* packet,
 
 bool Dispatcher::getNextQueueWakeDelay(uint32_t& delay_millis) const {
   if (isDualRadioActive()) { delay_millis = 0; return true; }
+#if MESH_ENABLE_MESHTEXT_CHAT
+  if (hasForeignRadioFrame()) { delay_millis = 0; return true; }
+#endif
   const uint32_t now = _ms->getMillis();
   bool found = false;
   uint32_t shortest_delay = 0;
@@ -371,6 +534,11 @@ void Dispatcher::loop() {
   // A maintenance carrier has no TxDone packet. Keep its deadline serviced,
   // but leave queued packets and RX/AGC watchdogs alone until normal RX returns.
   if (_radio->isCarrierWaveActive()) return;
+#if MESH_ENABLE_MESHTEXT_CHAT
+  // Use the same physical-radio owner and cleanup path as MeshCore TX. A
+  // foreign packet never enters the MeshCore retry/forwarding machinery.
+  if (serviceForeignRadioFrame()) return;
+#endif
 
   const unsigned long now = _ms->getMillis();
   if (!radio_nonrx_timer_armed) {
@@ -632,7 +800,11 @@ void Dispatcher::loop() {
     }
 #endif
   }
+#if MESH_ENABLE_MESHTEXT_CHAT
+  if (!checkForeignRadioSend()) checkSend();
+#else
   checkSend();
+#endif
   releaseDroppedOutbound();
 }
 
@@ -728,6 +900,24 @@ void Dispatcher::checkRecv() {
       snr = _radio->getLastSNR();
       rssi = _radio->getLastRSSI();
 
+      const uint8_t profile = _radio->receiveProfile();
+      const auto* profiles = _radio->profiles();
+      // Protocol is selected by the receiving modem, never guessed from a
+      // payload byte. No foreign bytes may leak into MeshCore raw sinks,
+      // parsing, duplicate suppression, direct forwarding, or app counters.
+      if (profiles && profile < 2
+          && profiles->params(profile).protocol == RadioProfileProtocol::Meshtext) {
+#if MESH_ENABLE_MESHTEXT_CHAT
+        if (profiles->enabled() && _radio->receiveProfileGeneration() == profiles->generation[profile]) {
+          rx_air_time += _radio->getProfileAirtime(profile, len);
+          ++_radio->profiles()->rx_packets[profile];
+          onForeignRadioFrame(raw, (size_t)len, profile, profiles->generation[profile], snr, rssi);
+        }
+#endif
+        _radio->onReceiveProcessed();
+        return;
+      }
+
       // TRACE and CONTROL are direct-only.  Reject a flood framing before
       // raw hooks can expose it to USB logs, MQTT, ESP-NOW, or another bridge.
       // The header check is deliberate: it also holds when the packet pool is
@@ -793,6 +983,7 @@ void Dispatcher::processRecvPacket(Packet* pkt) {
   const auto* profiles = _radio->profiles();
   if (profiles && (pkt->radio_profile > 1
       || (pkt->radio_profile == 1 && !profiles->enabled())
+      || profiles->params(pkt->radio_profile).protocol != RadioProfileProtocol::MeshCore
       || pkt->radio_generation != profiles->generation[pkt->radio_profile])) {
     releasePacket(pkt);
     return;
@@ -1083,8 +1274,15 @@ uint8_t Dispatcher::getTransmitProfileMask(const Packet* packet) const {
   uint8_t origin = packet->radio_profile;
   if (policy == RADIO_TX_AUTO && packet->radio_local && packet->getPayloadType() == PAYLOAD_TYPE_OTA
       && profiles->secondary_temporary && !profiles->primary_temporary) origin = 1;
-  return policy == RADIO_TX_AUTO ? profiles->transmitMask(origin)
+  uint8_t mask = policy == RADIO_TX_AUTO ? profiles->transmitMask(origin)
       : explicitRadioTxMask(policy, profiles->canTransmit(1, force));
+  // Explicit BOTH/secondary/reply-force policies cannot turn a MeshCore
+  // packet into foreign-network traffic. The raw API is its only TX path.
+  for (uint8_t profile = 0; profile < 2; ++profile) {
+    if (profiles->params(profile).protocol != RadioProfileProtocol::MeshCore)
+      mask &= (uint8_t)~(1U << profile);
+  }
+  return mask;
 }
 
 uint32_t Dispatcher::getTransmitAirtime(const Packet* packet) const {
@@ -1099,8 +1297,10 @@ uint32_t Dispatcher::getTransmitAirtime(const Packet* packet) const {
 
 bool Dispatcher::isPacketRadioCurrent(const Packet* packet) const {
   const auto* p = _radio->profiles();
-  if (!p || !packet->radio_bound) return true;
+  if (!p) return true;
   const uint8_t target = packet->radio_profile;
+  if (target > 1 || p->params(target).protocol != RadioProfileProtocol::MeshCore) return false;
+  if (!packet->radio_bound) return true;
   const uint8_t origin = packet->radio_origin;
   const bool force = packet->radio_reply && packet->radio_reply_force;
   return target < 2 && origin < 2 && p->canTransmit(target, force)
diff --git a/src/Dispatcher.h b/src/Dispatcher.h
index 597469d74..41399721d 100644
--- a/src/Dispatcher.h
+++ b/src/Dispatcher.h
@@ -5,6 +5,7 @@
 #include <Packet.h>
 #include <Utils.h>
 #include <RadioProfiles.h>
+#include <helpers/MeshtextConfig.h>
 #ifndef RADIO_LIVENESS_SOFT_ONLY
   #include <helpers/RadioLivenessTracker.h>
 #endif
@@ -45,6 +46,7 @@ public:
   virtual RadioProfiles* profiles() { return nullptr; }
   virtual const RadioProfiles* profiles() const { return nullptr; }
   virtual bool validateProfile(const RadioProfileParams&) const { return false; }
+  virtual bool supportsMeshtext() const { return false; }
   virtual uint8_t receiveProfile() const { return 0; }
   virtual uint32_t receiveProfileGeneration() const {
     return profiles() ? profiles()->generation[receiveProfile()] : 0;
@@ -341,6 +343,21 @@ class Dispatcher {
   uint32_t receive_context_generation = 0;
   bool receive_context_active = false;
   uint32_t profile_cad_busy[2] = {};
+#if MESH_ENABLE_MESHTEXT_CHAT
+  // One bounded user-send slot; never placed in the MeshCore packet pool.
+  uint8_t foreign_radio_bytes[MAX_TRANS_UNIT] = {};
+  uint16_t foreign_radio_length = 0;
+  uint8_t foreign_radio_profile = 0;
+  uint32_t foreign_radio_generation = 0;
+  uint32_t foreign_radio_retry_at = 0, foreign_radio_prepare_deadline = 0;
+  uint32_t foreign_radio_start = 0, foreign_radio_expiry = 0;
+  bool foreign_radio_sending = false;
+  bool foreign_radio_yield_meshcore = false;
+  bool isForeignRadioCurrent() const;
+  bool serviceForeignRadioFrame();
+  bool checkForeignRadioSend();
+  void finishForeignRadioFrame(bool success, bool account_airtime);
+#endif
 
   void processRecvPacket(Packet* pkt);
   void releaseDroppedOutbound();
@@ -423,6 +440,15 @@ protected:
   virtual void onTracePacketQueuedForSend(Packet* packet) { }
   virtual void onSendComplete(Packet* packet) { }
   virtual void onSendFail(Packet* packet) { }
+#if MESH_ENABLE_MESHTEXT_CHAT
+  // Foreign RX is consumed here before MeshCore parsing or any raw bridge.
+  // Returning false drops the frame; it never falls through to MeshCore.
+  virtual bool onForeignRadioFrame(const uint8_t*, size_t, uint8_t, uint32_t, float, float) { return false; }
+  virtual void onForeignRadioSendComplete(bool) { }
+  virtual bool allowForeignRadioTransmit() const { return true; }
+  bool queueForeignRadioFrame(const uint8_t* bytes, size_t length, uint8_t profile, uint32_t generation);
+  bool hasForeignRadioFrame() const { return foreign_radio_length != 0; }
+#endif
   virtual void onRadioProfileCopyQueued(Packet* packet, const Packet* original, uint8_t priority) { }
   // Policy gate for the other profile only; same-profile TX remains eligible.
   // Called before admitting copies (including bound retry packets) to a queue.
@@ -504,7 +530,13 @@ public:
   // Raw radio reads, local sends, and statistics resets do not update this clock.
   uint32_t getLastMeshCoreRecvMillis() const { return last_meshcore_recv_millis; }
   uint16_t getErrFlags() const { return _err_flags; }  // Get error flags
-  bool hasOutbound() const { return outbound != NULL; }
+  bool hasOutbound() const {
+    return outbound != NULL
+#if MESH_ENABLE_MESHTEXT_CHAT
+        || hasForeignRadioFrame()
+#endif
+        ;
+  }
   bool isCurrentOutbound(const Packet* packet) const { return outbound == packet; }
   void resetStats() {
     n_sent_flood = n_sent_direct = n_recv_flood = n_recv_direct = 0;
diff --git a/src/Mesh.cpp b/src/Mesh.cpp
index f538e2791..f9dfcb9d9 100644
--- a/src/Mesh.cpp
+++ b/src/Mesh.cpp
@@ -1061,6 +1061,10 @@ DispatcherAction Mesh::onRecvPacket(Packet* pkt) {
     return ACTION_RELEASE;
   }
 
+  if ((pkt->getPayloadType() == PAYLOAD_TYPE_GRP_TXT
+       || pkt->getPayloadType() == PAYLOAD_TYPE_GRP_DATA)
+      && !allowGroupPacketOnRadio(pkt)) return ACTION_RELEASE;
+
   if (pkt->isRouteDirect() && pkt->getPathHashCount() > 0) {
     // check for 'early received' ACK
     if (pkt->getPayloadType() == PAYLOAD_TYPE_ACK) {
@@ -1262,7 +1266,7 @@ DispatcherAction Mesh::onRecvPacket(Packet* pkt) {
         onGroupPacketRecv(pkt);
         // scan channels DB, for all matching hashes of 'channel_hash' (max 4 matches supported ATM)
         GroupChannel channels[4];
-        int num = searchChannelsByHash(&channel_hash, channels, 4);
+        int num = searchChannelsForPacket(pkt, &channel_hash, channels, 4);
         // for each matching channel, try to decrypt data
         for (int j = 0; j < num; j++) {
           // decrypt, checking MAC is valid
diff --git a/src/Mesh.h b/src/Mesh.h
index c60909352..3445f9cb8 100644
--- a/src/Mesh.h
+++ b/src/Mesh.h
@@ -578,6 +578,14 @@ protected:
    */
   virtual int searchChannelsByHash(const uint8_t* hash, GroupChannel channels[], int max_matches);
 
+  // Use captured RX origin: queued packets can outlive a transceiver retune.
+  virtual int searchChannelsForPacket(const Packet* packet, const uint8_t* hash,
+                                     GroupChannel channels[], int max_matches) {
+    return searchChannelsByHash(hash, channels, max_matches);
+  }
+  // Known wrong-profile traffic must not poison global receive deduplication.
+  virtual bool allowGroupPacketOnRadio(Packet* packet) { return true; }
+
   /**
    * \brief  A structurally valid encrypted group packet has been observed.
    *         Called once for each unseen packet before local channel matching and
diff --git a/src/RadioProfiles.h b/src/RadioProfiles.h
index 7c97bf0d0..6e083209b 100644
--- a/src/RadioProfiles.h
+++ b/src/RadioProfiles.h
@@ -9,6 +9,7 @@ namespace mesh {
 
 enum class RadioProfileMode : uint8_t { Off = 0, Rx = 1, RxTx = 2 };
 enum class RadioCrossMode : uint8_t { Auto = 0, On = 1, Off = 2 };
+enum class RadioProfileProtocol : uint8_t { MeshCore = 0, Meshtext = 1 };
 
 // These are modulation profiles of ONE transceiver, never additional radios.
 struct RadioProfileParams {
@@ -17,10 +18,11 @@ struct RadioProfileParams {
   uint16_t preamble = 0;  // 0 = automatic, otherwise symbols
   uint8_t sf = 0;
   uint8_t cr = 0;
+  RadioProfileProtocol protocol = RadioProfileProtocol::MeshCore;
 
   bool operator==(const RadioProfileParams& other) const {
     return freq == other.freq && bw == other.bw && sf == other.sf
-        && cr == other.cr && preamble == other.preamble;
+        && cr == other.cr && preamble == other.preamble && protocol == other.protocol;
   }
   bool operator!=(const RadioProfileParams& other) const { return !(*this == other); }
 };
@@ -102,8 +104,9 @@ class RadioProfiles {
         || (reply_rx_override && secondary.mode == RadioProfileMode::Rx)));
   }
   bool canCross() const {
-    return cross == RadioCrossMode::On || (cross == RadioCrossMode::Auto
-        && primary_temporary == secondary_temporary);
+    return primary.protocol == secondary.params.protocol
+        && (cross == RadioCrossMode::On || (cross == RadioCrossMode::Auto
+        && primary_temporary == secondary_temporary));
   }
   uint8_t transmitMask(uint8_t origin) const {
     if (origin > 1) origin = 0;
@@ -117,6 +120,7 @@ class RadioProfiles {
   static bool valid(const RadioProfileParams& p) {
     if (!isfinite(p.freq) || !isfinite(p.bw) || p.freq < 150 || p.freq > 2500
         || p.sf < 5 || p.sf > 12 || p.cr < 5 || p.cr > 8
+        || (p.protocol != RadioProfileProtocol::MeshCore && p.protocol != RadioProfileProtocol::Meshtext)
         || (p.preamble != 0 && (p.preamble < 8 || p.preamble > MaxPreamble))) return false;
     static constexpr float bandwidths[] = {7.8f, 10.4f, 15.6f, 20.8f, 31.25f, 41.7f,
                                62.5f, 125, 250, 500, 1000, 812.5f, 1625};
@@ -219,6 +223,9 @@ class RadioProfiles {
   }
   uint16_t preamble(uint8_t profile, uint16_t single_profile_default) const {
     const auto& p = params(profile);
+    // The foreign network's wire format has a fixed 16-symbol preamble;
+    // MeshCore's scan recommendations must never silently lengthen it.
+    if (p.protocol == RadioProfileProtocol::Meshtext) return 16;
     if (p.preamble) return p.preamble;
     if (!enabled()) return single_profile_default;
     // Do not expose an unmeasured short preamble while the startup test runs.
@@ -235,6 +242,9 @@ class RadioProfiles {
     }
     // Recommendations over 128 are reported as unsafe, but the profile can
     // still run at the cap when its physical preamble is legal.
+    // A foreign network fixes its own preamble and cannot advertise our scan
+    // cycle. Accept safe wire settings, but do not claim loss-free scanning.
+    if (enabled() && primary.protocol != secondary.params.protocol) return true;
     if (enabled()) {
       const uint8_t slow = slowerProfile();
       const double available = double(preamble(slow, 32)) / 2.0 * symbolUs(params(slow))
diff --git a/src/helpers/CLICommandUtils.h b/src/helpers/CLICommandUtils.h
index 82912879f..83a1bf6ee 100644
--- a/src/helpers/CLICommandUtils.h
+++ b/src/helpers/CLICommandUtils.h
@@ -136,6 +136,17 @@ inline const char* terminalPasswordInput(const char* line) {
       == TerminalArgumentCommandMatch::Valid) {
     return password;
   }
+  // `set mt.channel <slot> <name> <PSK>`: never echo private channel keys.
+  const char* channel = nullptr;
+  if (parseTerminalArgumentCommand(setting, "mt.channel", channel)
+      == TerminalArgumentCommandMatch::Valid) {
+    for (unsigned token = 0; token < 2; ++token) {
+      while (*channel && *channel != ' ' && *channel != '\t') ++channel;
+      channel = skipRecentRepeaterSpaces(channel);
+      if (!*channel) return nullptr;
+    }
+    return channel;
+  }
   return nullptr;
 }
 
diff --git a/src/helpers/CompanionChannelAlias.h b/src/helpers/CompanionChannelAlias.h
new file mode 100644
index 000000000..af0f9846c
--- /dev/null
+++ b/src/helpers/CompanionChannelAlias.h
@@ -0,0 +1,71 @@
+#pragma once
+
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+
+// Local labels, not part of a hashtag PSK. Keep the original app label/key.
+enum class CompanionChannelKind : uint8_t { MeshCore, Radio2, Meshtext, Invalid };
+struct CompanionChannelAlias {
+  CompanionChannelKind kind;
+  bool hashtag;
+  const char* tail;
+};
+
+inline CompanionChannelAlias parseCompanionChannelAlias(const char* name) {
+  if (name == nullptr) return {CompanionChannelKind::Invalid, false, ""};
+  const bool hashtag = name[0] == '#';
+  const char* tail = name + (hashtag ? 1 : 0);
+  CompanionChannelKind kind = CompanionChannelKind::MeshCore;
+  if (strncmp(tail, "r2-", 3) == 0) {
+    kind = CompanionChannelKind::Radio2;
+    tail += 3;
+  } else if (strncmp(tail, "mt-", 3) == 0) {
+    kind = CompanionChannelKind::Meshtext;
+    tail += 3;
+  }
+  if (kind != CompanionChannelKind::MeshCore
+      && (tail[0] == 0 || tail[0] == '#' || strncmp(tail, "r2-", 3) == 0
+          || strncmp(tail, "mt-", 3) == 0)) kind = CompanionChannelKind::Invalid;
+  return {kind, hashtag, tail};
+}
+
+inline bool companionChannelCanonicalName(const char* name, char* out, size_t size) {
+  if (out == nullptr) return false;
+  const auto alias = parseCompanionChannelAlias(name);
+  if (alias.kind == CompanionChannelKind::Invalid) return false;
+  const size_t offset = alias.hashtag ? 1 : 0;
+  const size_t length = strlen(alias.tail);
+  if (size <= offset + length) return false;
+  if (offset) out[0] = '#';
+  memcpy(out + offset, alias.tail, length + 1);
+  return true;
+}
+
+template <typename Hash>
+bool resolveCompanionChannelKey(const char* name, uint8_t secret[32], Hash hash) {
+  const auto alias = parseCompanionChannelAlias(name);
+  if (alias.kind == CompanionChannelKind::Invalid) return false;
+  if (alias.kind == CompanionChannelKind::MeshCore || !alias.hashtag) return true;
+  for (size_t i = 16; i < 32; ++i) {
+    if (secret[i] != 0) return true; // Never rewrite an explicit 256-bit PSK.
+  }
+  uint8_t app_key[16];
+  hash(app_key, sizeof(app_key), reinterpret_cast<const uint8_t*>(name), strlen(name));
+  if (memcmp(secret, app_key, sizeof(app_key)) != 0) return true; // Custom PSK.
+  char canonical[32];
+  if (!companionChannelCanonicalName(name, canonical, sizeof(canonical))) return false;
+  hash(secret, 16, reinterpret_cast<const uint8_t*>(canonical), strlen(canonical));
+  return true;
+}
+
+inline int companionChannelReceivePriority(const char* name, uint8_t origin,
+                                          bool radio2_defined = true) {
+  const auto alias = parseCompanionChannelAlias(name);
+  if (alias.kind == CompanionChannelKind::Invalid) return -1;
+  if (radio2_defined) {
+    if (alias.kind == CompanionChannelKind::Meshtext) return -1;
+    if (alias.kind == CompanionChannelKind::Radio2) return origin == 1 ? 0 : -1;
+  }
+  return origin == 1 ? 1 : 0;
+}
diff --git a/src/helpers/CompanionMeshtextChannel.h b/src/helpers/CompanionMeshtextChannel.h
new file mode 100644
index 000000000..5ba2116bd
--- /dev/null
+++ b/src/helpers/CompanionMeshtextChannel.h
@@ -0,0 +1,97 @@
+#pragma once
+
+#include "CompanionChannelAlias.h"
+#include "MeshtextChat.h"
+#include <initializer_list>
+
+namespace mesh { namespace mt {
+
+struct Channel {
+  char name[12] = {};
+  uint8_t key[32] = {};
+  size_t key_length = 16;
+  Preset preset = Preset::LongFast;
+  bool named_preset = false;
+};
+
+// The app retains its original label and PSK. Only this volatile wire copy
+// expands a recognized public preset alias into the Meshtext AQ== key.
+// Explicit private keys, including 256-bit keys, must never become public.
+template <typename Hash>
+bool describeChannel(const char* name, const uint8_t secret[32], Channel& out, Hash hash) {
+  const auto alias = parseCompanionChannelAlias(name);
+  if (alias.kind != CompanionChannelKind::Meshtext || !secret) return false;
+  Channel result;
+  result.named_preset = parsePreset(alias.tail, result.preset);
+  const char* wire_name = result.named_preset ? presetName(result.preset) : alias.tail;
+  if (!wire_name || !*wire_name || strlen(wire_name) >= sizeof(result.name)) return false;
+  memcpy(result.name, wire_name, strlen(wire_name) + 1);
+  memcpy(result.key, secret, sizeof(result.key));
+  for (size_t i = 16; i < sizeof(result.key); ++i) {
+    if (result.key[i]) result.key_length = 32;
+  }
+  if (alias.hashtag && result.key_length == 16) {
+    uint8_t derived[16];
+    hash(derived, sizeof(derived), reinterpret_cast<const uint8_t*>(name), strlen(name));
+    char canonical[32];
+    if (!companionChannelCanonicalName(name, canonical, sizeof(canonical))) return false;
+    const bool app_derived = memcmp(derived, secret, sizeof(derived)) == 0;
+    hash(derived, sizeof(derived), reinterpret_cast<const uint8_t*>(canonical), strlen(canonical));
+    const bool canonical_derived = memcmp(derived, secret, sizeof(derived)) == 0;
+    if (app_derived || canonical_derived) {
+      if (result.named_preset) memcpy(result.key, DefaultPsk, sizeof(DefaultPsk));
+      else memcpy(result.key, derived, sizeof(derived));
+    }
+  }
+  bool nonzero = false;
+  for (size_t i = 0; i < result.key_length; ++i) nonzero |= result.key[i] != 0;
+  if (!nonzero) return false; // Never silently fall back to an open channel.
+  out = result;
+  return true;
+}
+
+// The 902-915 MHz portion is unambiguously US among supported plans; 915-928
+// overlaps US and ANZ, so it requires an explicit region instead of guessing.
+inline Region inferRegion(float primary_frequency) {
+  if (primary_frequency >= 902 && primary_frequency < 915) return Region::US;
+  if (primary_frequency >= 869.4f && primary_frequency <= 869.65f) return Region::EU868;
+  if (primary_frequency >= 433 && primary_frequency <= 434) return Region::EU433;
+  return Region::Unset;
+}
+
+inline const char* regionName(Region region) {
+  switch (region) {
+    case Region::US: return "us";
+    case Region::EU868: return "eu868";
+    case Region::EU433: return "eu433";
+    case Region::ANZ: return "anz";
+    default: return "auto";
+  }
+}
+
+inline bool parseRegion(const char* value, Region& region) {
+  if (!value) return false;
+  for (Region item : {Region::Unset, Region::US, Region::EU868, Region::EU433, Region::ANZ}) {
+    if (!strcmp(value, regionName(item))) { region = item; return true; }
+  }
+  return false;
+}
+
+inline bool sameModulation(const RadioProfileParams& a, const RadioProfileParams& b) {
+  return a.bw == b.bw && a.sf == b.sf && a.cr == b.cr;
+}
+
+inline bool frequencyInRegion(Region region, const RadioProfileParams& p) {
+  const float half_width = p.bw / 2000.0f;
+  float lower = 0, upper = 0;
+  switch (region) {
+    case Region::US: lower = 902; upper = 928; break;
+    case Region::ANZ: lower = 915; upper = 928; break;
+    case Region::EU868: lower = 869.4f; upper = 869.65f; break;
+    case Region::EU433: lower = 433; upper = 434; break;
+    default: return false;
+  }
+  return p.freq - half_width >= lower - 0.0001f && p.freq + half_width <= upper + 0.0001f;
+}
+
+} } // namespace mesh::mt
diff --git a/src/helpers/MeshtextChat.cpp b/src/helpers/MeshtextChat.cpp
new file mode 100644
index 000000000..594336638
--- /dev/null
+++ b/src/helpers/MeshtextChat.cpp
@@ -0,0 +1,368 @@
+#include "MeshtextChat.h"
+
+#if defined(MESH_ENABLE_MESHTEXT_CHAT) && MESH_ENABLE_MESHTEXT_CHAT
+
+#include <AES.h>
+#include <string.h>
+
+// Adapted from esp-cpp/espp, Copyright (c) 2022 esp-cpp, MIT license.
+// Pinned source and complete notice: licenses/ESPP-Meshtext-MIT.txt.
+// No upstream GPL implementation or generated schema code is included.
+namespace mesh {
+namespace mt {
+
+const uint8_t DefaultPsk[16] = {
+  0xd4, 0xf1, 0xbb, 0x3a, 0x20, 0x29, 0x07, 0x59,
+  0xf0, 0xbc, 0xff, 0xab, 0xcf, 0x4e, 0x69, 0x01
+};
+
+namespace {
+
+static constexpr uint32_t Broadcast = 0xffffffffU;
+struct PresetInfo {
+  Preset preset;
+  const char* name;
+  uint32_t bandwidth;
+  uint8_t sf, cr;
+};
+const PresetInfo Presets[] = {
+  {Preset::ShortTurbo, "ShortTurbo", 500000, 7, 5},
+  {Preset::ShortFast, "ShortFast", 250000, 7, 5},
+  {Preset::ShortSlow, "ShortSlow", 250000, 8, 5},
+  {Preset::MediumTurbo, "MediumTurbo", 500000, 9, 5},
+  {Preset::MediumFast, "MediumFast", 250000, 9, 5},
+  {Preset::MediumSlow, "MediumSlow", 250000, 10, 5},
+  {Preset::LongTurbo, "LongTurbo", 500000, 11, 8},
+  {Preset::LongFast, "LongFast", 250000, 11, 5},
+  {Preset::LongModerate, "LongMod", 125000, 11, 8},
+  {Preset::LongSlow, "LongSlow", 125000, 12, 8},
+};
+
+const PresetInfo* presetInfo(Preset preset) {
+  for (const auto& entry : Presets) if (entry.preset == preset) return &entry;
+  return nullptr;
+}
+
+uint32_t nameHash(const char* name) {
+  uint32_t hash = 5381;
+  while (*name) hash = hash * 33U + static_cast<uint8_t>(*name++);
+  return hash;
+}
+
+bool validName(const char* name) {
+  if (name == nullptr || name[0] == 0) return false;
+  for (size_t i = 1; i < 12; ++i) if (name[i] == 0) return true;
+  return false;
+}
+
+bool equalPresetName(const char* a, const char* b) {
+  while (*a && *b) {
+    uint8_t first = static_cast<uint8_t>(*a++), second = static_cast<uint8_t>(*b++);
+    if (first >= 'A' && first <= 'Z') first += 'a' - 'A';
+    if (second >= 'A' && second <= 'Z') second += 'a' - 'A';
+    if (first != second) return false;
+  }
+  return *a == *b;
+}
+
+uint8_t channelHash(const char* name, const uint8_t* key, size_t key_len) {
+  uint8_t hash = 0;
+  while (*name) hash ^= static_cast<uint8_t>(*name++);
+  for (size_t i = 0; i < key_len; ++i) hash ^= key[i];
+  return hash;
+}
+
+void put32(uint8_t* out, uint32_t value) {
+  for (unsigned i = 0; i < 4; ++i) out[i] = static_cast<uint8_t>(value >> (8 * i));
+}
+
+uint32_t get32(const uint8_t* in) {
+  return uint32_t(in[0]) | uint32_t(in[1]) << 8 | uint32_t(in[2]) << 16 | uint32_t(in[3]) << 24;
+}
+
+void erase(uint8_t* bytes, size_t size) {
+  volatile uint8_t* dest = bytes;
+  while (size--) *dest++ = 0;
+}
+
+bool validUtf8(const uint8_t* text, size_t length, size_t maximum, size_t* scalar_count = nullptr) {
+  if (text == nullptr || length > maximum) return false;
+  size_t scalars = 0;
+  // Full UTF-8 validation: no NUL, overlong encoding, surrogate or >U+10FFFF.
+  for (size_t i = 0; i < length;) {
+    const uint8_t first = text[i++];
+    ++scalars;
+    if (first == 0) return false;
+    if (first < 0x80) continue;
+    unsigned continuation;
+    uint8_t second_min = 0x80, second_max = 0xbf;
+    if (first >= 0xc2 && first <= 0xdf) continuation = 1;
+    else if (first >= 0xe0 && first <= 0xef) {
+      continuation = 2;
+      if (first == 0xe0) second_min = 0xa0;
+      if (first == 0xed) second_max = 0x9f;
+    } else if (first >= 0xf0 && first <= 0xf4) {
+      continuation = 3;
+      if (first == 0xf0) second_min = 0x90;
+      if (first == 0xf4) second_max = 0x8f;
+    } else return false;
+    if (continuation > length - i || text[i] < second_min || text[i] > second_max) return false;
+    ++i;
+    while (--continuation) {
+      if (text[i] < 0x80 || text[i] > 0xbf) return false;
+      ++i;
+    }
+  }
+  if (scalar_count != nullptr) *scalar_count = scalars;
+  return true;
+}
+
+bool validText(const uint8_t* text, size_t length) {
+  return length != 0 && validUtf8(text, length, MaxTextSize);
+}
+
+template <class Cipher>
+bool crypt(const uint8_t* key, size_t key_len, uint32_t id, uint32_t from,
+           uint8_t* data, size_t length) {
+  Cipher cipher;
+  if (!cipher.setKey(key, key_len)) return false;
+  // Initial counter is packet ID as LE64 followed by sender as LE64. The
+  // standard CTR counter increment is big-endian across the entire block.
+  uint8_t counter[16] = {}, stream[16];
+  put32(counter, id);
+  put32(counter + 8, from);
+  for (size_t offset = 0; offset < length;) {
+    cipher.encryptBlock(stream, counter);
+    for (int i = 15; i >= 0; --i) if (++counter[i] != 0) break;
+    size_t block = length - offset;
+    if (block > sizeof(stream)) block = sizeof(stream);
+    for (size_t i = 0; i < block; ++i) data[offset + i] ^= stream[i];
+    offset += block;
+  }
+  cipher.clear();
+  erase(counter, sizeof(counter));
+  erase(stream, sizeof(stream));
+  return true;
+}
+
+bool cryptPayload(const uint8_t* key, size_t key_len, uint32_t id, uint32_t from,
+                  uint8_t* data, size_t length) {
+  if (key_len == 16) return crypt<AES128>(key, key_len, id, from, data, length);
+  if (key_len == 32) return crypt<AES256>(key, key_len, id, from, data, length);
+  return false;
+}
+
+size_t finishFrame(uint32_t from, uint32_t id, uint8_t hop_limit, const char* channel_name,
+                   const uint8_t* key, size_t key_len, uint8_t* out, size_t data_size) {
+  if (!cryptPayload(key, key_len, id, from, out + HeaderSize, data_size)) return 0;
+  put32(out, Broadcast); put32(out + 4, from); put32(out + 8, id);
+  out[12] = hop_limit | (hop_limit << 5);
+  out[13] = channelHash(channel_name, key, key_len);
+  out[14] = out[15] = 0;
+  return HeaderSize + data_size;
+}
+
+struct Reader {
+  const uint8_t* data;
+  size_t size, pos = 0;
+
+  Reader(const uint8_t* input, size_t length) : data(input), size(length) {}
+  bool varint(uint64_t& value) {
+    value = 0;
+    for (unsigned i = 0; i < 10 && pos < size; ++i) {
+      const uint8_t byte = data[pos++];
+      if (i == 9 && (byte & 0xfe) != 0) return false;
+      value |= uint64_t(byte & 0x7f) << (7 * i);
+      if ((byte & 0x80) == 0) return i == 0 || byte != 0;
+    }
+    return false;
+  }
+  bool bytes(const uint8_t*& out, size_t& length) {
+    uint64_t count;
+    if (!varint(count) || count > size - pos) return false;
+    length = static_cast<size_t>(count); out = data + pos; pos += length;
+    return true;
+  }
+  bool fixed32(uint32_t& value) {
+    if (size - pos < 4) return false;
+    value = get32(data + pos); pos += 4; return true;
+  }
+  bool skip(uint8_t wire) {
+    uint64_t ignored;
+    const uint8_t* bytes_;
+    size_t count;
+    if (wire == 0) return varint(ignored);
+    if (wire == 2) return bytes(bytes_, count);
+    count = wire == 1 ? 8 : wire == 5 ? 4 : 0;
+    if (count == 0 || count > size - pos) return false;
+    pos += count; return true;
+  }
+};
+
+bool textData(const uint8_t* data, size_t size, const uint8_t*& text, size_t& text_len) {
+  Reader reader(data, size);
+  bool have_port = false, have_text = false;
+  while (reader.pos < reader.size) {
+    uint64_t tag, value;
+    if (!reader.varint(tag) || tag < 8 || tag > 0xffffffffULL) return false;
+    const uint32_t field = static_cast<uint32_t>(tag >> 3);
+    const uint8_t wire = tag & 7;
+    if (field == 1) {
+      if (have_port || wire != 0 || !reader.varint(value) || value != 1) return false;
+      have_port = true; // TEXT_MESSAGE_APP
+    } else if (field == 2) {
+      if (have_text || wire != 2 || !reader.bytes(text, text_len)) return false;
+      have_text = true;
+    } else if (field == 3) {
+      // A received request does not cause any response in this text-only engine.
+      if (wire != 0 || !reader.varint(value) || value > 1) return false;
+    } else if (field >= 4 && field <= 8) {
+      uint32_t fixed;
+      if (wire != 5 || !reader.fixed32(fixed)) return false;
+      if (field == 4 && fixed != 0 && fixed != Broadcast) return false;
+    } else if (!reader.skip(wire)) return false;
+  }
+  return have_port && have_text && validText(text, text_len);
+}
+
+} // namespace
+
+bool parsePreset(const char* name, Preset& preset) {
+  if (name == nullptr) return false;
+  for (const auto& entry : Presets) {
+    if (equalPresetName(entry.name, name)) { preset = entry.preset; return true; }
+  }
+  if (equalPresetName(name, "LongModerate")) { preset = Preset::LongModerate; return true; }
+  return false;
+}
+
+const char* presetName(Preset preset) {
+  const auto info = presetInfo(preset);
+  return info == nullptr ? nullptr : info->name;
+}
+
+bool modemConfig(Region region, Preset preset, RadioProfileParams& params, uint32_t slot) {
+  const auto info = presetInfo(preset);
+  if (info == nullptr) return false;
+  uint32_t start, end;
+  switch (region) {
+    case Region::US: start = 902000000; end = 928000000; break;
+    case Region::EU868: start = 869400000; end = 869650000; break;
+    case Region::EU433: start = 433000000; end = 434000000; break;
+    case Region::ANZ: start = 915000000; end = 928000000; break;
+    default: return false;
+  }
+  if (info->bandwidth > end - start) return false;
+  const uint32_t slots = (end - start) / info->bandwidth;
+  if (slot > slots) return false;
+  const uint32_t index = slot == 0 ? nameHash(info->name) % slots : slot - 1;
+  RadioProfileParams result;
+  result.freq = (start + info->bandwidth / 2 + index * info->bandwidth) / 1000000.0f;
+  result.bw = info->bandwidth / 1000.0f;
+  result.sf = info->sf; result.cr = info->cr; result.preamble = 16;
+  result.protocol = RadioProfileProtocol::Meshtext;
+  params = result;
+  return true;
+}
+
+size_t encodeText(uint32_t from, uint32_t id, uint8_t hop_limit, const char* channel_name,
+                  const uint8_t* key, size_t key_len, const char* text, size_t text_len,
+                  uint8_t out[MaxFrameSize]) {
+  if (out == nullptr || key == nullptr || (key_len != 16 && key_len != 32)
+      || !validName(channel_name) || from == 0 || from == Broadcast || id == 0 || hop_limit > 7
+      || !validText(reinterpret_cast<const uint8_t*>(text), text_len)) return 0;
+  uint8_t* data = out + HeaderSize;
+  size_t count = 0;
+  data[count++] = 0x08; data[count++] = 1; // Data.portnum = TEXT_MESSAGE_APP
+  data[count++] = 0x12; // Data.payload
+  if (text_len >= 128) data[count++] = static_cast<uint8_t>(text_len) | 0x80;
+  data[count++] = static_cast<uint8_t>(text_len >> (text_len >= 128 ? 7 : 0));
+  memcpy(data + count, text, text_len); count += text_len;
+  return finishFrame(from, id, hop_limit, channel_name, key, key_len, out, count);
+}
+
+size_t encodeNodeInfo(uint32_t from, uint32_t id, uint8_t hop_limit, const char* channel_name,
+                      const uint8_t* key, size_t key_len, const char* long_name, size_t long_name_len,
+                      const char* short_name, size_t short_name_len, uint8_t out[MaxFrameSize]) {
+  size_t short_characters = 0;
+  if (out == nullptr || key == nullptr || (key_len != 16 && key_len != 32)
+      || !validName(channel_name) || from <= 3 || from == Broadcast || id == 0 || hop_limit > 7
+      || !validUtf8(reinterpret_cast<const uint8_t*>(long_name), long_name_len, MaxLongNameSize)
+      || short_name_len == 0
+      || !validUtf8(reinterpret_cast<const uint8_t*>(short_name), short_name_len,
+                    MaxShortNameSize, &short_characters)
+      || short_characters > MaxShortNameCharacters) return 0;
+
+  // Handwritten standard protobuf wire fields, not generated schema code.
+  // User: id=1, long_name=2, short_name=3, role=7, is_unmessagable=9.
+  // All individual strings and the complete User payload fit one-byte lengths.
+  static_assert(11 + 2 + MaxLongNameSize + 2 + MaxShortNameSize + 4 < 128,
+                "NodeInfo requires bounded one-byte protobuf lengths");
+  static const char Hex[] = "0123456789abcdef";
+  uint8_t* data = out + HeaderSize;
+  size_t count = 0;
+  data[count++] = 0x08; data[count++] = 4; // Data.portnum = NODEINFO_APP.
+  data[count++] = 0x12; data[count++] = 0; // Data.payload length set below.
+  data[count++] = 0x0a; data[count++] = 9; data[count++] = '!';
+  for (unsigned i = 0; i < 8; ++i) data[count++] = Hex[(from >> (28 - 4 * i)) & 15];
+  if (long_name_len != 0) {
+    data[count++] = 0x12; data[count++] = static_cast<uint8_t>(long_name_len);
+    memcpy(data + count, long_name, long_name_len); count += long_name_len;
+  }
+  data[count++] = 0x1a; data[count++] = static_cast<uint8_t>(short_name_len);
+  memcpy(data + count, short_name, short_name_len); count += short_name_len;
+  data[count++] = 0x38; data[count++] = 1; // Config.DeviceConfig.Role.CLIENT_MUTE.
+  data[count++] = 0x48; data[count++] = 1; // User.is_unmessagable explicitly true.
+  data[3] = static_cast<uint8_t>(count - 4);
+  return finishFrame(from, id, hop_limit, channel_name, key, key_len, out, count);
+}
+
+bool decodeText(const uint8_t* raw, size_t length, const char* channel_name,
+                const uint8_t* key, size_t key_len, uint32_t local_node, DecodedText& decoded) {
+  if (raw == nullptr || key == nullptr || (key_len != 16 && key_len != 32)
+      || !validName(channel_name) || length <= HeaderSize || length > HeaderSize + MaxDataSize
+      || get32(raw) != Broadcast || raw[13] != channelHash(channel_name, key, key_len)) return false;
+  const uint32_t from = get32(raw + 4), id = get32(raw + 8);
+  if (from == 0 || from == Broadcast || from == local_node || id == 0) return false;
+  uint8_t data[MaxDataSize];
+  const size_t data_size = length - HeaderSize;
+  memcpy(data, raw + HeaderSize, data_size);
+  if (!cryptPayload(key, key_len, id, from, data, data_size)) {
+    erase(data, data_size); return false;
+  }
+  const uint8_t* text = nullptr;
+  size_t text_len = 0;
+  const bool valid = textData(data, data_size, text, text_len);
+  if (valid) {
+    decoded.from = from; decoded.id = id;
+    decoded.hop_limit = raw[12] & 7; decoded.hop_start = raw[12] >> 5;
+    decoded.hops = decoded.hop_start >= decoded.hop_limit ? decoded.hop_start - decoded.hop_limit : 0;
+    decoded.text_len = static_cast<uint16_t>(text_len);
+    memcpy(decoded.text, text, text_len); decoded.text[text_len] = 0;
+  }
+  erase(data, data_size);
+  return valid;
+}
+
+bool SeenPackets::seen(uint32_t from, uint32_t id) const {
+  if (from == 0 || from == Broadcast || id == 0) return false;
+  for (const auto& entry : entries_) if (entry.from == from && entry.id == id) return true;
+  return false;
+}
+
+bool SeenPackets::remember(uint32_t from, uint32_t id) {
+  if (from == 0 || from == Broadcast || id == 0 || seen(from, id)) return false;
+  entries_[next_].from = from; entries_[next_].id = id;
+  next_ = (next_ + 1) % Capacity;
+  return true;
+}
+
+void SeenPackets::clear() {
+  for (auto& entry : entries_) { entry.from = 0; entry.id = 0; }
+  next_ = 0;
+}
+
+} // namespace mt
+} // namespace mesh
+
+#endif // MESH_ENABLE_MESHTEXT_CHAT
diff --git a/src/helpers/MeshtextChat.h b/src/helpers/MeshtextChat.h
new file mode 100644
index 000000000..128a5d2ac
--- /dev/null
+++ b/src/helpers/MeshtextChat.h
@@ -0,0 +1,82 @@
+#pragma once
+
+#include <stddef.h>
+#include <stdint.h>
+#include <RadioProfiles.h>
+#include "MeshtextConfig.h"
+
+// Bounded adaptation of MIT-licensed esp-cpp/espp wire helpers.
+// See licenses/ESPP-Meshtext-MIT.txt for the pinned source and license.
+// Meshtext is a bounded text interoperability component, not a peer firmware fork.
+// NodeInfo may only be explicitly encoded; received NodeInfo stays ignored.
+namespace mesh {
+namespace mt {
+
+enum class Region : uint8_t { Unset, US, EU868, EU433, ANZ };
+enum class Preset : uint8_t {
+  ShortTurbo, ShortFast, ShortSlow, MediumTurbo, MediumFast, MediumSlow,
+  LongTurbo, LongFast, LongModerate, LongSlow
+};
+
+// ASCII case-insensitive alias parsing; wire/default names retain stock case.
+bool parsePreset(const char* name, Preset& preset);
+// The stock default channel name; LongModerate uses "LongMod".
+const char* presetName(Preset preset);
+// freq is MHz, bw is kHz; slot is 1-based, or 0 for the preset-name hash.
+// Invalid regions/presets/slots are rejected, leaving params unchanged.
+bool modemConfig(Region region, Preset preset, RadioProfileParams& params, uint32_t slot = 0);
+
+static constexpr size_t HeaderSize = 16;
+static constexpr size_t MaxFrameSize = 255;
+static constexpr size_t MaxDataSize = 233;
+static constexpr size_t MaxTextSize = 228; // Data port + payload tag/length overhead.
+static constexpr size_t MaxLongNameSize = 24; // Current stock User.long_name bound.
+static constexpr size_t MaxShortNameSize = 4; // Stock max_size:5 includes NUL.
+static constexpr size_t MaxShortNameCharacters = 4; // Unicode scalar values.
+extern const uint8_t DefaultPsk[16]; // Expanded AQ== public key; never a hashtag hash.
+
+struct DecodedText {
+  uint32_t from = 0, id = 0;
+  uint8_t hops = 0, hop_limit = 0, hop_start = 0;
+  uint16_t text_len = 0;
+  char text[MaxTextSize + 1] = {};
+};
+
+// Expanded AES-128/256 PSK only. No unencrypted-key fallback. Names are exact,
+// canonical peer channel names (<12 bytes), without local display markers.
+// Returns 0 for invalid arguments, malformed UTF-8, embedded NUL or overflow.
+size_t encodeText(uint32_t from, uint32_t id, uint8_t hop_limit, const char* channel_name,
+                  const uint8_t* key, size_t key_len, const char* text, size_t text_len,
+                  uint8_t out[MaxFrameSize]);
+// Explicit broadcast NODEINFO_APP containing only User id, long/short names,
+// CLIENT_MUTE (no forwarding), and is_unmessagable=true (no direct messages).
+// Names use explicit UTF-8 byte lengths, without their terminating NUL. Long
+// names may be empty; short names require 1..4 UTF-8 bytes (stock wire bound).
+// This can hold four ASCII characters but fewer multi-byte characters. Longer
+// names are rejected, not byte-truncated. No MAC, PSK, public key or MC identity
+// is copied. No ACK/response is requested and no automatic send is performed.
+size_t encodeNodeInfo(uint32_t from, uint32_t id, uint8_t hop_limit, const char* channel_name,
+                      const uint8_t* key, size_t key_len, const char* long_name, size_t long_name_len,
+                      const char* short_name, size_t short_name_len, uint8_t out[MaxFrameSize]);
+// Only broadcast TEXT_MESSAGE_APP is delivered. No DMs, ACKs, administrative
+// handling, relaying or automatic transmissions. AES-CTR is not authenticated;
+// a successful parse is not a proof of sender identity or PSK authenticity.
+// On failure, decoded is left unchanged. Caller records dedup only on success.
+bool decodeText(const uint8_t* raw, size_t length, const char* channel_name,
+                const uint8_t* key, size_t key_len, uint32_t local_node, DecodedText& decoded);
+
+// Shared across channel slots. Packet IDs must never be reused with one sender
+// and PSK (CTR nonce reuse). Call remember only after valid RX or successful TX.
+class SeenPackets {
+ public:
+  static constexpr size_t Capacity = 32;
+  bool seen(uint32_t from, uint32_t id) const;
+  bool remember(uint32_t from, uint32_t id); // false for duplicate/invalid pair
+  void clear();
+ private:
+  struct Entry { uint32_t from = 0, id = 0; } entries_[Capacity];
+  uint8_t next_ = 0;
+};
+
+} // namespace mt
+} // namespace mesh
diff --git a/src/helpers/MeshtextConfig.h b/src/helpers/MeshtextConfig.h
new file mode 100644
index 000000000..3ef465f82
--- /dev/null
+++ b/src/helpers/MeshtextConfig.h
@@ -0,0 +1,22 @@
+#pragma once
+
+// Resolve the chip in every translation unit, including Dispatcher.cpp which
+// includes this before Arduino.h. Otherwise different class layouts could be
+// selected for the same build depending on include order.
+#if !defined(MESH_ENABLE_MESHTEXT_CHAT) && defined(ESP32_PLATFORM) && defined(ARDUINO)
+  #include <sdkconfig.h>
+#endif
+
+// Channel chat is an optional Companion transport, never a bridge. Start with
+// the roomy ESP32-S3 Full/SX1262 family; other builds retain every existing
+// feature and do not acquire the codec or its bounded raw-frame queue. A new
+// family must qualify its modem implementation, flash and runtime RAM first.
+#ifndef MESH_ENABLE_MESHTEXT_CHAT
+  #if defined(ESP32_PLATFORM) && defined(CONFIG_IDF_TARGET_ESP32S3) \
+      && defined(COMPANION_RADIO_FULL) && defined(USE_SX1262) \
+      && !(defined(MESH_PRIMARY_ESPNOW) && MESH_PRIMARY_ESPNOW)
+    #define MESH_ENABLE_MESHTEXT_CHAT 1
+  #else
+    #define MESH_ENABLE_MESHTEXT_CHAT 0
+  #endif
+#endif
diff --git a/src/helpers/RadioProfileCLI.cpp b/src/helpers/RadioProfileCLI.cpp
index 6d166752c..5b88ddd0e 100644
--- a/src/helpers/RadioProfileCLI.cpp
+++ b/src/helpers/RadioProfileCLI.cpp
@@ -95,7 +95,7 @@ RadioProfileCLI::ImageReadResult RadioProfileCLI::readImage(
   if (!read_complete) return ImageReadResult::Unreadable;
   uint32_t stored;
   memcpy(&stored, bytes + size - 4, 4);
-  return bytes[0] == 'R' && bytes[1] == '2' && bytes[2] == 1
+  return bytes[0] == 'R' && bytes[1] == '2' && (bytes[2] == 1 || bytes[2] == 2)
       && stored == checksum(bytes, size - 4)
       ? ImageReadResult::Valid : ImageReadResult::Invalid;
 }
@@ -119,9 +119,10 @@ bool RadioProfileCLI::writeImage(const char* path, const uint8_t* bytes, size_t
       && memcmp(bytes, verify, size) == 0;
 }
 
-bool RadioProfileCLI::save(const RadioProfileConfig& config, uint16_t preamble, RadioCrossMode cross) {
+bool RadioProfileCLI::save(const RadioProfileConfig& config, uint16_t preamble, RadioCrossMode cross,
+                           int8_t manual_secondary) {
   if (!discardCorruptSavedImagesForWrite()) return false;
-  return prepareSavedImage(TempPath, config, preamble, cross) && commitSavedImage(TempPath);
+  return prepareSavedImage(TempPath, config, preamble, cross, manual_secondary) && commitSavedImage(TempPath);
 }
 
 bool RadioProfileCLI::discardCorruptSavedImagesForWrite() {
@@ -143,9 +144,18 @@ bool RadioProfileCLI::discardCorruptSavedImagesForWrite() {
 }
 
 bool RadioProfileCLI::prepareSavedImage(const char* path, const RadioProfileConfig& config,
-                                      uint16_t preamble, RadioCrossMode cross) {
+                                      uint16_t preamble, RadioCrossMode cross, int8_t manual_secondary) {
   if (!fs_ || hold_) return false;
   uint8_t image[ImageSize] = {'R', '2', 1, (uint8_t)config.mode};
+#if MESH_ENABLE_MESHTEXT_CHAT
+  // Version 2 keeps the 24-byte layout and CRC; bit 7 records explicit radio2
+  // intent. Other settings can save an unused Off slot without claiming it.
+  image[2] = 2;
+  const bool manual = manual_secondary < 0 ? manual_secondary_ : manual_secondary != 0;
+  if (manual || config.mode != RadioProfileMode::Off) image[3] |= 0x80;
+#else
+  (void)manual_secondary;
+#endif
   memcpy(image + 4, &config.params.freq, 4);
   memcpy(image + 8, &config.params.bw, 4);
   image[12] = config.params.sf; image[13] = config.params.cr;
@@ -176,6 +186,12 @@ void RadioProfileCLI::begin(FILESYSTEM* fs, Radio* radio, RTCClock* rtc, bool in
   fs_ = fs; radio_ = radio; rtc_ = rtc; last_ms_ = millis();
   hold_ = false;
   recoverable_corrupt_store_ = false;
+  manual_secondary_ = false;
+  secondary_intent_generation_ = 0;
+#if MESH_ENABLE_MESHTEXT_CHAT
+  auto_secondary_requested_ = secondary_protocol_overlay_ = false;
+  owns_secondary_runtime_ = external_secondary_override_ = false;
+#endif
   infrastructure_replies_ = infrastructure_replies;
   if (radio_ && radio_->profiles()) {
     radio_->profiles()->reply_tx = infrastructure_replies ? RADIO_TX_BOTH : RADIO_TX_AUTO;
@@ -206,7 +222,10 @@ void RadioProfileCLI::begin(FILESYSTEM* fs, Radio* radio, RTCClock* rtc, bool in
             || backup_image == ImageReadResult::Invalid);
     return;
   }
-  saved_.mode = (RadioProfileMode)bytes[3];
+  // Legacy Off is ambiguous: preserve it as deliberate manual intent rather
+  // than allowing a newly installed automatic feature to turn the radio on.
+  manual_secondary_ = bytes[2] == 1 || (bytes[3] & 0x80) != 0;
+  saved_.mode = (RadioProfileMode)(bytes[2] == 2 ? bytes[3] & 0x7F : bytes[3]);
   memcpy(&saved_.params.freq, bytes + 4, 4);
   memcpy(&saved_.params.bw, bytes + 8, 4);
   saved_.params.sf = bytes[12]; saved_.params.cr = bytes[13];
@@ -215,6 +234,7 @@ void RadioProfileCLI::begin(FILESYSTEM* fs, Radio* radio, RTCClock* rtc, bool in
   cross_ = (RadioCrossMode)bytes[18];
   reply_setting_ = validReplySetting(bytes[19]) ? bytes[19] : 0;
   if ((uint8_t)saved_.mode > 2 || (uint8_t)cross_ > 2
+      || (bytes[2] == 2 && saved_.mode != RadioProfileMode::Off && !manual_secondary_)
       || (saved_.mode != RadioProfileMode::Off && !radio_->validateProfile(saved_.params))
       || (primary_preamble_ && (primary_preamble_ < 8 || primary_preamble_ > RadioProfiles::MaxPreamble))) {
     // A CRC-valid image can still be semantically stale (for example, after
@@ -257,9 +277,160 @@ void RadioProfileCLI::publish() {
       ? (validReplySetting(reply_setting_) ? reply_setting_ & 7 : RADIO_TX_BOTH) : RADIO_TX_AUTO;
   radio_->profiles()->reply_force = infrastructure_replies_
       && validReplySetting(reply_setting_) && (reply_setting_ & 8);
+#if MESH_ENABLE_MESHTEXT_CHAT
+  protectExternalSecondary();
+  if (external_secondary_override_) return;
+#endif
   if (publish_pending_ && (int32_t)(millis() - publish_after_ms_) < 0) return;
+#if MESH_ENABLE_MESHTEXT_CHAT
+  // An accepted remote command owns the old RX generation until its reply has
+  // completed (or its atomic storage commit has succeeded).
+  if (hasReplyMutation()) return;
+#endif
   publish_pending_ = false;
-  radio_->profiles()->setSecondary(temp_active_ ? temporary_ : saved_, temp_active_);
+  RadioProfileConfig config = temp_active_ ? temporary_ : saved_;
+#if MESH_ENABLE_MESHTEXT_CHAT
+  if (auto_secondary_requested_ && canAutoSecondary()) config = auto_secondary_;
+  else if (secondary_protocol_overlay_ && manualSecondaryConfigured() && !secondaryRuntimeBusy()) {
+    config.params.protocol = secondary_protocol_;
+    if (secondary_protocol_ == RadioProfileProtocol::Meshtext) config.params.preamble = 16;
+  }
+#endif
+  radio_->profiles()->setSecondary(config, temp_active_);
+#if MESH_ENABLE_MESHTEXT_CHAT
+  owns_secondary_runtime_ = auto_secondary_requested_ || secondary_protocol_overlay_;
+  if (owns_secondary_runtime_) {
+    owned_secondary_snapshot_ = config;
+    owned_secondary_generation_ = radio_->profiles()->generation[1];
+  }
+#endif
+}
+
+#if MESH_ENABLE_MESHTEXT_CHAT
+bool RadioProfileCLI::runtimeSecondaryUnchanged() const {
+  if (!owns_secondary_runtime_ || !radio_ || !radio_->profiles()) return true;
+  const auto* profiles = radio_->profiles();
+  return profiles->generation[1] == owned_secondary_generation_
+      && profiles->secondary.mode == owned_secondary_snapshot_.mode
+      && profiles->secondary.params == owned_secondary_snapshot_.params;
+}
+
+void RadioProfileCLI::protectExternalSecondary() {
+  if (runtimeSecondaryUnchanged()) return;
+  // Another owner changed the running tuple without a CLI mutation. Relinquish
+  // our RAM layer without restoring Off over that owner's settings, now or on
+  // later loop publications. An explicit CLI change can claim ownership back.
+  external_secondary_override_ = true;
+  owns_secondary_runtime_ = auto_secondary_requested_ = secondary_protocol_overlay_ = false;
+}
+#endif
+
+bool RadioProfileCLI::hasSecondarySchedule() const {
+  for (const auto& schedule : schedules_) if (schedule.active) return true;
+  return false;
+}
+
+bool RadioProfileCLI::secondaryRuntimeBusy() const {
+#if MESH_ENABLE_MESHTEXT_CHAT
+  if (external_secondary_override_ || !runtimeSecondaryUnchanged()) return true;
+#endif
+  return !fs_ || !radio_ || !radio_->profiles() || hold_ || temp_pending_ || temp_active_
+      || publish_pending_ || hasReplyMutation() || hasSecondarySchedule()
+      || radio_->profiles()->primary_temporary || radio_->profiles()->secondary_temporary;
+}
+
+void RadioProfileCLI::noteSecondaryManualChange() {
+  ++secondary_intent_generation_;
+#if MESH_ENABLE_MESHTEXT_CHAT
+  auto_secondary_requested_ = secondary_protocol_overlay_ = false;
+  owns_secondary_runtime_ = external_secondary_override_ = false;
+#endif
+}
+
+bool RadioProfileCLI::canAutoSecondary() const {
+#if MESH_ENABLE_MESHTEXT_CHAT
+  if (manual_secondary_ || saved_.mode != RadioProfileMode::Off || secondaryRuntimeBusy()) return false;
+  const auto& current = radio_->profiles()->secondary;
+  return current.mode == RadioProfileMode::Off || (auto_secondary_requested_
+      && current.mode == auto_secondary_.mode && current.params == auto_secondary_.params);
+#else
+  return false;
+#endif
+}
+
+bool RadioProfileCLI::requestAutoSecondary(const RadioProfileConfig& config) {
+#if MESH_ENABLE_MESHTEXT_CHAT
+  if (!canAutoSecondary() || config.mode == RadioProfileMode::Off
+      || (uint8_t)config.mode > (uint8_t)RadioProfileMode::RxTx
+      || !radio_->validateProfile(config.params)) return false;
+  if (auto_secondary_requested_ && (config.mode != auto_secondary_.mode
+      || config.params != auto_secondary_.params)) return false;
+  auto preview = *radio_->profiles();
+  preview.setSecondary(config, false);
+  if (!preview.automaticPreambleFits()) return false;
+  auto_secondary_ = config;
+  auto_secondary_requested_ = true;
+  publish();
+  return autoSecondaryActive();
+#else
+  (void)config;
+  return false;
+#endif
+}
+
+void RadioProfileCLI::clearAutoSecondary() {
+#if MESH_ENABLE_MESHTEXT_CHAT
+  if (!auto_secondary_requested_) return;
+  protectExternalSecondary();
+  auto_secondary_requested_ = false;
+  owns_secondary_runtime_ = secondary_protocol_overlay_;
+  publish();
+#endif
+}
+
+bool RadioProfileCLI::autoSecondaryActive() const {
+#if MESH_ENABLE_MESHTEXT_CHAT
+  if (!auto_secondary_requested_ || !canAutoSecondary()) return false;
+  const auto& current = radio_->profiles()->secondary;
+  return !radio_->profiles()->secondary_temporary && current.mode == auto_secondary_.mode
+      && current.params == auto_secondary_.params;
+#else
+  return false;
+#endif
+}
+
+bool RadioProfileCLI::useSecondaryProtocol(RadioProfileProtocol protocol) {
+#if MESH_ENABLE_MESHTEXT_CHAT
+  if (protocol == RadioProfileProtocol::MeshCore) {
+    clearSecondaryProtocol();
+    return true;
+  }
+  if (protocol != RadioProfileProtocol::Meshtext || !manualSecondaryConfigured()
+      || secondaryRuntimeBusy()) return false;
+  auto preview = *radio_->profiles();
+  auto config = saved_;
+  config.params.protocol = protocol;
+  config.params.preamble = 16;
+  preview.setSecondary(config, false);
+  if (!radio_->validateProfile(config.params) || !preview.automaticPreambleFits()) return false;
+  secondary_protocol_ = protocol;
+  secondary_protocol_overlay_ = true;
+  publish();
+  return true;
+#else
+  (void)protocol;
+  return false;
+#endif
+}
+
+void RadioProfileCLI::clearSecondaryProtocol() {
+#if MESH_ENABLE_MESHTEXT_CHAT
+  if (!secondary_protocol_overlay_) return;
+  protectExternalSecondary();
+  secondary_protocol_overlay_ = false;
+  owns_secondary_runtime_ = auto_secondary_requested_;
+  publish();
+#endif
 }
 
 bool RadioProfileCLI::stageRemoteMutation(RemoteMutation kind, const RadioProfileConfig& config,
@@ -308,6 +479,7 @@ bool RadioProfileCLI::applyReplyMutation() {
   remote_mutation_ = RemoteMutation::None;
   remote_delivered_ = false;
   if (kind == RemoteMutation::None) return true;
+  noteSecondaryManualChange();
   if (kind == RemoteMutation::Temporary) {
     pending_temporary_ = remote_config_;
     pending_duration_ms_ = remote_duration_ms_;
@@ -315,6 +487,7 @@ bool RadioProfileCLI::applyReplyMutation() {
     temp_pending_ = true;
   } else if (kind == RemoteMutation::Saved) {
     saved_ = remote_config_;
+    manual_secondary_ = true;
     publish_pending_ = true; publish_after_ms_ = millis();
 #if MESH_ENABLE_FLEET_CONTROL
   } else if (kind == RemoteMutation::AddSavedSchedule
@@ -348,7 +521,7 @@ bool RadioProfileCLI::applyReplyMutation() {
     schedule_retry_ms_ = 0;
 #endif
   } else {
-    if (kind == RemoteMutation::Off) { saved_ = {}; schedule_retry_ms_ = 0; }
+    if (kind == RemoteMutation::Off) { saved_ = {}; manual_secondary_ = true; schedule_retry_ms_ = 0; }
     temp_pending_ = temp_active_ = false; temp_remaining_ms_ = 0;
     for (auto& s : schedules_) if (kind == RemoteMutation::Off || s.temporary) s = {};
   }
@@ -393,13 +566,13 @@ void RadioProfileCLI::loop() {
       if (s.active && !s.temporary && epoch >= s.start && (!next || s.start < next->start)) next = &s;
     }
     if (!next) break;
-    if (!save(next->config, primary_preamble_, cross_)) {
+    if (!save(next->config, primary_preamble_, cross_, true)) {
       // Keep the requested time and order intact. A failed earlier entry must
       // not be retried after a later one and overwrite the newer settings.
       schedule_retry_ms_ = 60000;
       break;
     }
-    saved_ = next->config; *next = {};
+    saved_ = next->config; manual_secondary_ = true; noteSecondaryManualChange(); *next = {};
   }
   for (auto& s : schedules_) {
     if (!s.active || !s.temporary || s.started || epoch < s.start || temp_active_ || temp_pending_ || hasReplyMutation()) continue;
@@ -487,14 +660,14 @@ void RadioProfileCLI::appendChirpWarning(char* reply, size_t capacity, const Rad
 }
 
 void RadioProfileCLI::formatConfig(char* reply, size_t capacity, const RadioProfileConfig& config,
-                                   bool temporary, uint32_t remaining) const {
+                                   bool temporary, uint32_t remaining, bool automatic) const {
   if (config.mode == RadioProfileMode::Off) { snprintf(reply, capacity, "> off"); return; }
   RadioProfiles preview = *radio_->profiles();
   preview.setSecondary(config, temporary);
   uint16_t preamble = preview.preamble(1, 32);
-  snprintf(reply, capacity, "> %.3f,%.3f,%u,%u,%s,%u%s", config.params.freq, config.params.bw,
+  snprintf(reply, capacity, "> %.3f,%.3f,%u,%u,%s,%u%s%s", config.params.freq, config.params.bw,
            config.params.sf, config.params.cr, modeName(config.mode), preamble,
-           config.params.preamble ? "" : " (auto)");
+           config.params.preamble ? "" : " (auto)", automatic ? "; auto-owned" : "");
   if (temporary) {
     uint32_t minutes = (remaining + 59999UL) / 60000UL;
     const size_t used = strlen(reply);
@@ -643,14 +816,45 @@ bool RadioProfileCLI::handle(const char* command, char* reply, size_t capacity,
     return true;
   }
   if ((base || temporary) && verb == Get && !*args) {
+#if MESH_ENABLE_MESHTEXT_CHAT
+    if (base && autoSecondaryActive()) {
+      formatConfig(reply, capacity, auto_secondary_, false, 0, true);
+      return true;
+    }
+    if (base && saved_.mode == RadioProfileMode::Off) {
+      snprintf(reply, capacity, "> off (%s)", manual_secondary_ ? "manual" : "automatic allowed");
+      return true;
+    }
+#endif
     if (temporary && !temp_active_ && !temp_pending_) snprintf(reply, capacity, "> off");
     else formatConfig(reply, capacity, temporary ? (temp_pending_ ? pending_temporary_ : temporary_) : saved_,
                       temporary, temp_pending_ ? pending_duration_ms_ : temp_remaining_ms_);
     return true;
   }
+#if MESH_ENABLE_MESHTEXT_CHAT
+  if (base && verb == Set && !strcmp(args, "auto")) {
+    // This clears only saved permission, never an active/pending lease or a
+    // schedule. Remote acknowledgement staging must not weaken that contract.
+    if (remote_command_ || temp_pending_ || temp_active_ || hasSecondarySchedule()
+        || hasReplyMutation() || publish_pending_ || radio_->profiles()->primary_temporary
+        || radio_->profiles()->secondary_temporary) {
+      snprintf(reply, capacity, "Error: automatic radio2 requires no pending change, lease or schedule");
+      return true;
+    }
+    if (!save({}, primary_preamble_, cross_, 0)) {
+      snprintf(reply, capacity, "Error: settings could not be saved"); return true;
+    }
+    noteSecondaryManualChange();
+    saved_ = {}; manual_secondary_ = false;
+    publish_pending_ = true; publish_after_ms_ = millis() + 2000;
+    publish();
+    snprintf(reply, capacity, "OK - automatic radio2 permitted in 2s");
+    return true;
+  }
+#endif
   if ((base || temporary) && verb == Set && !strcmp(args, "off")) {
-    if (base && !(remote_command_ ? prepareSavedImage(ReplyPath, {}, primary_preamble_, cross_)
-                                 : save({}, primary_preamble_, cross_))) {
+    if (base && !(remote_command_ ? prepareSavedImage(ReplyPath, {}, primary_preamble_, cross_, true)
+                                 : save({}, primary_preamble_, cross_, true))) {
       snprintf(reply, capacity, "Error: settings could not be saved"); return true;
     }
     if (remote_command_) {
@@ -659,7 +863,8 @@ bool RadioProfileCLI::handle(const char* command, char* reply, size_t capacity,
           ? "saved radio2 restored" : "single radio");
       return true;
     }
-    if (base) { saved_ = {}; schedule_retry_ms_ = 0; }
+    noteSecondaryManualChange();
+    if (base) { saved_ = {}; manual_secondary_ = true; schedule_retry_ms_ = 0; }
     temp_pending_ = temp_active_ = false; temp_remaining_ms_ = 0;
     for (auto& s : schedules_) if (base || s.temporary) s = {};
     publish_pending_ = true; publish_after_ms_ = millis() + 2000;
@@ -691,6 +896,7 @@ bool RadioProfileCLI::handle(const char* command, char* reply, size_t capacity,
         }
         schedules_[first+i] = {};
       }
+      noteSecondaryManualChange();
       publish(); snprintf(reply, capacity, "OK"); return true;
     }
     if (!index) {
@@ -767,7 +973,9 @@ bool RadioProfileCLI::handle(const char* command, char* reply, size_t capacity,
         if (!stageRemoteSchedule(i, s)) {
           snprintf(reply, capacity, "Error: radio acknowledgement pending"); return true;
         }
-      } else schedules_[first+i] = s;
+      } else { schedules_[first+i] = s; noteSecondaryManualChange(); publish(); }
+#else
+      noteSecondaryManualChange(); publish();
 #endif
       snprintf(reply, capacity, "OK - %s %u queued, preamble=%u", key, i+1, preview.preamble(1, 32));
       appendChirpWarning(reply, capacity, preview); return true;
@@ -780,18 +988,24 @@ bool RadioProfileCLI::handle(const char* command, char* reply, size_t capacity,
     }
     if (remote_command_) stageRemoteMutation(RemoteMutation::Temporary, config, minutes * 60000UL);
     else {
+      noteSecondaryManualChange();
       pending_temporary_ = config; pending_duration_ms_ = minutes * 60000UL;
       temp_start_ms_ = millis() + 2000; temp_pending_ = true;
+#if MESH_ENABLE_MESHTEXT_CHAT
+      publish_pending_ = true; publish_after_ms_ = temp_start_ms_;
+#endif
     }
     // An existing session remains active until the new request can take over.
     snprintf(reply, capacity, "OK - tempradio2 %lud%luh%lum (%lu min); preamble=%u",
         (unsigned long)(minutes/1440), (unsigned long)(minutes/60%24),
         (unsigned long)(minutes%60), (unsigned long)minutes, preview.preamble(1, 32));
-  } else if (remote_command_ ? prepareSavedImage(ReplyPath, config, primary_preamble_, cross_)
-                            : save(config, primary_preamble_, cross_)) {
+  } else if (remote_command_ ? prepareSavedImage(ReplyPath, config, primary_preamble_, cross_, true)
+                            : save(config, primary_preamble_, cross_, true)) {
     if (remote_command_) stageRemoteMutation(RemoteMutation::Saved, config);
     else {
+      noteSecondaryManualChange();
       saved_ = config;
+      manual_secondary_ = true;
       publish_pending_ = true; publish_after_ms_ = millis() + 2000;
       publish();
     }
diff --git a/src/helpers/RadioProfileCLI.h b/src/helpers/RadioProfileCLI.h
index 765df15ef..0af499443 100644
--- a/src/helpers/RadioProfileCLI.h
+++ b/src/helpers/RadioProfileCLI.h
@@ -4,6 +4,7 @@
 #include <helpers/IdentityStore.h>
 #include <helpers/CLICommandUtils.h>
 #include <helpers/FleetControlConfig.h>
+#include <helpers/MeshtextConfig.h>
 
 namespace mesh {
 
@@ -28,6 +29,20 @@ class RadioProfileCLI {
   RadioCrossMode cross_ = RadioCrossMode::Auto;
   uint8_t reply_setting_ = 0;  // reserved image byte: 0 = role default
   bool infrastructure_replies_ = false;
+  // Saved Off can be an explicit veto, rather than an unused secondary slot.
+  bool manual_secondary_ = false;
+  uint32_t secondary_intent_generation_ = 0;
+#if MESH_ENABLE_MESHTEXT_CHAT
+  RadioProfileConfig auto_secondary_;
+  bool auto_secondary_requested_ = false;
+  bool secondary_protocol_overlay_ = false;
+  RadioProfileProtocol secondary_protocol_ = RadioProfileProtocol::MeshCore;
+  RadioProfileConfig owned_secondary_snapshot_;
+  uint32_t owned_secondary_generation_ = 0;
+  bool owns_secondary_runtime_ = false, external_secondary_override_ = false;
+  bool runtimeSecondaryUnchanged() const;
+  void protectExternalSecondary();
+#endif
   Schedule schedules_[8];
   uint32_t temp_remaining_ms_ = 0;
   uint32_t temp_start_ms_ = 0;
@@ -63,17 +78,21 @@ class RadioProfileCLI {
 #if MESH_ENABLE_FLEET_CONTROL
   bool stageRemoteSchedule(unsigned slot, const Schedule& schedule);
 #endif
-  bool save(const RadioProfileConfig& config, uint16_t preamble, RadioCrossMode cross);
+  bool save(const RadioProfileConfig& config, uint16_t preamble, RadioCrossMode cross,
+            int8_t manual_secondary = -1);
   bool prepareSavedImage(const char* path, const RadioProfileConfig& config,
-                         uint16_t preamble, RadioCrossMode cross);
+                         uint16_t preamble, RadioCrossMode cross, int8_t manual_secondary = -1);
   bool commitSavedImage(const char* path);
   bool discardCorruptSavedImagesForWrite();
   bool applyReplyMutation();
   ImageReadResult readImage(const char* path, uint8_t* bytes, size_t size);
   bool writeImage(const char* path, const uint8_t* bytes, size_t size);
   void publish();
+  bool hasSecondarySchedule() const;
+  bool secondaryRuntimeBusy() const;
+  void noteSecondaryManualChange();
   void formatConfig(char* reply, size_t capacity, const RadioProfileConfig& config,
-                    bool temporary, uint32_t remaining_ms) const;
+                    bool temporary, uint32_t remaining_ms, bool automatic = false) const;
  public:
   void begin(FILESYSTEM* fs, Radio* radio, RTCClock* rtc, bool infrastructure_replies = false);
   void loop();
@@ -85,6 +104,19 @@ class RadioProfileCLI {
   bool hasReplyMutation() const { return remote_mutation_ != RemoteMutation::None; }
   uint32_t replyMutationGeneration() const { return remote_generation_; }
   bool finishReplyMutation(bool delivered);
+  // Channel-derived RF settings are RAM-only and never replace explicit saved
+  // settings (including Off). Repeated identical requests do not retune.
+  bool requestAutoSecondary(const RadioProfileConfig& config);
+  void clearAutoSecondary();
+  bool autoSecondaryActive() const;
+  bool canAutoSecondary() const;
+  // Borrow a manually configured RF tuple without persisting its wire protocol
+  // or the foreign network's fixed preamble. Temporary sessions take priority.
+  bool useSecondaryProtocol(RadioProfileProtocol protocol);
+  void clearSecondaryProtocol();
+  bool manualSecondaryConfigured() const { return manual_secondary_ && saved_.mode != RadioProfileMode::Off; }
+  const RadioProfileConfig& savedSecondaryConfig() const { return saved_; }
+  uint32_t secondaryIntentGeneration() const { return secondary_intent_generation_; }
   uint16_t primaryPreamble() const { return primary_preamble_; }
   // Infrastructure owns a newer, atomic primary tuple in /com_prefs. Adopting
   // its committed value changes saved intent only, never the running radio.
diff --git a/src/helpers/radiolib/CustomSX1262.h b/src/helpers/radiolib/CustomSX1262.h
index dacea2448..2e85d3f4f 100644
--- a/src/helpers/radiolib/CustomSX1262.h
+++ b/src/helpers/radiolib/CustomSX1262.h
@@ -155,6 +155,37 @@ class CustomSX1262 : public SX1262 {
       return SX1262::invertIQ(enable);
     }
 
+    // MeshCore and Meshtext share CRC-on, explicit-header, normal-IQ LoRa
+    // packet settings. Only an acknowledged owned RX-to-RX hop may stage
+    // these fields: startReceive() then commits one complete packet tuple,
+    // including RadioLib's fixInvertedIQ register workaround, before SetRx.
+    // Ordinary setup/TX/CAD/sleep/recovery retains the normal setter path.
+    int16_t setProfileProtocol(uint8_t syncWord) {
+      const bool stage = _profileSwitch.canResumeFast();
+      const int16_t rc = SX1262::setSyncWord(syncWord);
+      if (rc != RADIOLIB_ERR_NONE) {
+        _profileSwitch.packetResult(rc, preambleLengthLoRa, crcTypeLoRa,
+                                   implicitLen, headerType, invertIQEnabled);
+        return rc;
+      }
+      if (!stage) {
+        int16_t state = setCRC(1);
+        if (state == RADIOLIB_ERR_NONE) state = explicitHeader();
+        if (state == RADIOLIB_ERR_NONE) state = invertIQ(false);
+        return state;
+      }
+
+      crcTypeLoRa = RADIOLIB_SX126X_LORA_CRC_ON;
+      implicitLen = 0xff; // RadioLib explicitHeader() default receive length.
+      headerType = RADIOLIB_SX126X_LORA_HEADER_EXPLICIT;
+      invertIQEnabled = RADIOLIB_SX126X_LORA_IQ_STANDARD;
+      // Even an unchanged software tuple must be acknowledged once after the
+      // protocol write. Failed packet/IQ-workaround/SetRx commands revoke the
+      // owned context; the wrapper restores the old protocol with full setup.
+      _profileSwitch.invalidatePacket();
+      return RADIOLIB_ERR_NONE;
+    }
+
     // Ordinary setters can change hardware or leave RadioLib's fields updated
     // after a failed write. They cannot preserve our acknowledged hop tuple.
     int16_t setBandwidth(float bw) override {
diff --git a/src/helpers/radiolib/CustomSX1262Wrapper.h b/src/helpers/radiolib/CustomSX1262Wrapper.h
index 5e7bf95e6..3f3de161a 100644
--- a/src/helpers/radiolib/CustomSX1262Wrapper.h
+++ b/src/helpers/radiolib/CustomSX1262Wrapper.h
@@ -38,8 +38,20 @@ public:
   ~CustomSX1262Wrapper() { unregisterInterruptAction(); }
   CustomSX1262Wrapper(CustomSX1262& radio, mesh::MainBoard& board) : RadioLibWrapper(radio, board) { }
   bool supportsCarrierWave() const override { return true; }
+#if MESH_ENABLE_MESHTEXT_CHAT
+  bool supportsMeshtext() const override { return true; }
+#endif
 
 protected:
+#if MESH_ENABLE_MESHTEXT_CHAT
+  bool applyProtocol(mesh::RadioProfileProtocol protocol) override {
+    auto* radio = static_cast<CustomSX1262*>(_radio);
+    const uint8_t sync = protocol == mesh::RadioProfileProtocol::Meshtext ? 0x2b : 0x12;
+    // Stage shared packet invariants only in a proven owned RX hop; normal
+    // initialization/rollback still repairs the complete RadioLib state.
+    return radio->setProfileProtocol(sync) == RADIOLIB_ERR_NONE;
+  }
+#endif
   int16_t applyCachedTxPower(int8_t dbm) override {
 #ifdef SX126X_PA_RAMP_TIME
     // External-PA boards such as the T-Beam 1W require a slower PA ramp. Use
diff --git a/src/helpers/radiolib/RadioLibWrappers.cpp b/src/helpers/radiolib/RadioLibWrappers.cpp
index b84c1bd12..d825df80e 100644
--- a/src/helpers/radiolib/RadioLibWrappers.cpp
+++ b/src/helpers/radiolib/RadioLibWrappers.cpp
@@ -298,6 +298,9 @@ bool RadioLibWrapper::restoreAfterDeepInit() {
     restored = _radio->setPreambleLength(currentPreambleLength())
         == RADIOLIB_ERR_NONE;
   }
+#if MESH_ENABLE_MESHTEXT_CHAT
+  restored = restored && applyProtocol(_physical_protocol);
+#endif
   if (_dbm_valid) {
     restored = applyCachedTxPower(_cur_dbm) == RADIOLIB_ERR_NONE && restored;
   }
@@ -323,6 +326,9 @@ mesh::RadioParamApplyResult RadioLibWrapper::trySetParams(float freq, float bw,
   const uint8_t previous_sf = _cur_sf;
   const uint8_t previous_cr = _cur_cr;
   const uint16_t previous_preamble = _physical_preamble;
+#if MESH_ENABLE_MESHTEXT_CHAT
+  const auto previous_protocol = _physical_protocol;
+#endif
   const uint8_t previous_profile = _active_profile;
   const uint32_t previous_generation = _profile_generation;
   const bool previous_refresh = _profile_refresh_required;
@@ -337,6 +343,10 @@ mesh::RadioParamApplyResult RadioLibWrapper::trySetParams(float freq, float bw,
   _physical_preamble = profilePreamble(0);
 
   bool success = applyParams(freq, bw, sf, cr);
+#if MESH_ENABLE_MESHTEXT_CHAT
+  success = success && applyProtocol(requested.protocol);
+  if (success) _physical_protocol = requested.protocol;
+#endif
   if (success) {
     cacheParams(freq, bw, sf, cr);
     _active_profile = 0;
@@ -367,6 +377,9 @@ mesh::RadioParamApplyResult RadioLibWrapper::trySetParams(float freq, float bw,
     _profile_generation = previous_generation;
     _profile_refresh_required = previous_refresh;
     _physical_preamble = previous_preamble;
+#if MESH_ENABLE_MESHTEXT_CHAT
+    _physical_protocol = previous_protocol;
+#endif
     _rx_ps_enabled = previous_rxps;
     _profile_saved_rxps = previous_saved_rxps;
     _rx_ps_continuous_fallback = previous_fallback;
@@ -375,6 +388,9 @@ mesh::RadioParamApplyResult RadioLibWrapper::trySetParams(float freq, float bw,
     bool restored = had_previous_params
       && _radio->standby() == RADIOLIB_ERR_NONE
       && applyParams(previous_freq, previous_bw, previous_sf, previous_cr);
+#if MESH_ENABLE_MESHTEXT_CHAT
+    restored = restored && applyProtocol(previous_protocol);
+#endif
 
     if (!restored) restored = restoreAfterDeepInit();
     if (restored) endReconfigure(resume_rx);
@@ -391,6 +407,7 @@ mesh::RadioParamApplyResult RadioLibWrapper::trySetParams(float freq, float bw,
 
 bool RadioLibWrapper::validateProfile(const mesh::RadioProfileParams& p) const {
   if (!mesh::RadioProfiles::valid(p)) return false;
+  if (p.protocol == mesh::RadioProfileProtocol::Meshtext && !supportsMeshtext()) return false;
 #if defined(USE_SX1276)
   return p.freq >= 137 && p.freq <= 1020 && p.sf >= 7 && p.bw <= 500;
 #elif defined(USE_SX1272)
@@ -432,8 +449,19 @@ mesh::RadioParamApplyResult RadioLibWrapper::tuneProfile(uint8_t profile) {
   const bool old_refresh = _profile_refresh_required;
   const bool old_params_valid = _params_valid;
   const uint16_t old_preamble = _physical_preamble;
+#if MESH_ENABLE_MESHTEXT_CHAT
+  const auto old_protocol = _physical_protocol;
+#endif
   _physical_preamble = preamble;
   bool applied = applyParams(p.freq, p.bw, p.sf, p.cr);
+#if MESH_ENABLE_MESHTEXT_CHAT
+  // Changing only the protocol still changes the sync word. Conversely a
+  // failed write must not publish the new generation or cached wire format.
+  if (applied && (_physical_protocol != p.protocol || _profile_refresh_required)) {
+    applied = applyProtocol(p.protocol);
+  }
+  if (applied) _physical_protocol = p.protocol;
+#endif
   if (applied) {
     cacheParams(p.freq, p.bw, p.sf, p.cr);
     _active_profile = profile;
@@ -456,8 +484,14 @@ mesh::RadioParamApplyResult RadioLibWrapper::tuneProfile(uint8_t profile) {
     _profile_generation = old_generation;
     _profile_refresh_required = old_refresh;
     _physical_preamble = old_preamble;
+#if MESH_ENABLE_MESHTEXT_CHAT
+    _physical_protocol = old_protocol;
+#endif
     bool restored = old_params_valid && _radio->standby() == RADIOLIB_ERR_NONE
         && applyParams(old_freq, old_bw, old_sf, old_cr);
+#if MESH_ENABLE_MESHTEXT_CHAT
+    restored = restored && applyProtocol(old_protocol);
+#endif
     if (!restored) restored = restoreAfterDeepInit();
     if (restored) endReconfigure(resume);
     if (!restored || (resume && !isInRecvMode())) _profile_refresh_required = true;
@@ -631,6 +665,7 @@ mesh::RadioParamApplyResult RadioLibWrapper::trySetPrimaryParams(const mesh::Rad
   const bool was_temp = _profiles.primary_temporary;
   const uint32_t generation = _profiles.generation[0];
   _profiles.primary.preamble = p.preamble;
+  _profiles.primary.protocol = p.protocol;
   _profiles.primary_temporary = temporary;
   const auto result = trySetParams(p.freq, p.bw, p.sf, p.cr, timings);
   if (result != mesh::RadioParamApplyResult::APPLIED) {
diff --git a/src/helpers/radiolib/RadioLibWrappers.h b/src/helpers/radiolib/RadioLibWrappers.h
index 97cb7846b..8b540dae1 100644
--- a/src/helpers/radiolib/RadioLibWrappers.h
+++ b/src/helpers/radiolib/RadioLibWrappers.h
@@ -89,6 +89,14 @@ protected:
   mesh::RadioProfiles _profiles;
   uint8_t _active_profile = 0;
   uint16_t _physical_preamble = 0;
+#if MESH_ENABLE_MESHTEXT_CHAT
+  mesh::RadioProfileProtocol _physical_protocol = mesh::RadioProfileProtocol::MeshCore;
+  // Wire settings are a transaction with the modulation tuple. Unsupported
+  // wrappers decline rather than claiming a profile was applied.
+  virtual bool applyProtocol(mesh::RadioProfileProtocol protocol) {
+    return protocol == mesh::RadioProfileProtocol::MeshCore;
+  }
+#endif
   uint32_t _profile_generation = 0;
   uint32_t _profile_scan_generation[2] = {};
   uint32_t _profile_visit_stamp = 0;
diff --git a/test/fixtures/companion_lost_reply.cpp b/test/fixtures/companion_lost_reply.cpp
index 54957363c..87ccf96e5 100644
--- a/test/fixtures/companion_lost_reply.cpp
+++ b/test/fixtures/companion_lost_reply.cpp
@@ -4,6 +4,7 @@
 #include <cassert>
 #include <cstdio>
 #include <cstring>
+#include <math.h>
 #include <stdint.h>
 #include <string>
 #include <vector>
@@ -12,6 +13,7 @@
 #define MAX_HASH_SIZE 8
 #define MAX_TEXT_LEN 150
 #define MAX_FRAME_SIZE 172
+#define MAX_GROUP_CHANNELS 40
 #define EXPECTED_ACK_TABLE_SIZE 8
 #define TXT_TYPE_PLAIN 0
 #define TXT_TYPE_CLI_COMMAND 1
@@ -169,7 +171,7 @@ public:
   bool hasTerminalOutput() const { return false; }
   Terminal& terminalOutput() { return terminal; }
   void rememberOneKeyAck(ContactInfo&) {}
-  uint8_t findChannelIdx(const mesh::GroupChannel&) { return 0; }
+  int findChannelIdxForPacket(const mesh::GroupChannel&, const mesh::Packet*) { return 0; }
   bool getChannel(int, ChannelDetails&) { return false; }
   uint16_t emergencyClientRepeatKey(mesh::Packet*) { return 0; }
   bool hasEmergencyClientRepeat(uint16_t) { return false; }
@@ -223,6 +225,7 @@ public:
   void onCLICommandRecv(const ContactInfo&, mesh::Packet*, uint32_t, const char*, char*);
   bool onSignedMessageRecv(const ContactInfo&, mesh::Packet*, uint32_t, const uint8_t*, const char*);
   void onChannelMessageRecv(const mesh::GroupChannel&, mesh::Packet*, uint32_t, const char*);
+  bool queueChannelText(uint8_t, const uint8_t[32], float, uint8_t, uint32_t, const char*, bool);
   bool handleDirectCommand(const char*, char*, size_t);
   bool handleCommand(const char*, uint32_t, char*);
   mesh::Packet* composeMsgPacket(const ContactInfo&, uint32_t, uint8_t, const char*, uint32_t&);
diff --git a/test/fixtures/companion_meshtext.cpp b/test/fixtures/companion_meshtext.cpp
new file mode 100644
index 000000000..c37852744
--- /dev/null
+++ b/test/fixtures/companion_meshtext.cpp
@@ -0,0 +1,831 @@
+// Template compiled by test_companion_meshtext.py. Markers insert actual
+// production method bodies; all boundary substitutes are visible below.
+@FIXTURE@
+#include <SHA256.h>
+#include <helpers/CompanionMeshtextChannel.h>
+#include <helpers/CompanionFrameLimits.h>
+#include <helpers/UTF8Helpers.h>
+#include <cmath>
+#include <limits>
+using std::isfinite;
+@CONSTANTS@
+#define MAX_GROUP_CHANNELS 8
+#define COMPANION_FEATURE_NOTIFICATIONS 1
+#define COMPANION_FEATURE_TEXT_TERMINAL 0
+#define TXT_TYPE_PLAIN 0
+
+void mesh::Utils::sha256(uint8_t* out, size_t size, const uint8_t* data, int length) {
+  assert(length >= 0 && size <= 32);
+  SHA256 hash; hash.update(data, length); hash.finalize(out, size);
+}
+
+struct Preferences {
+  static inline std::vector<uint8_t> blob;
+  static inline bool fail_begin=false, fail_write=false, fail_read=false;
+  static inline unsigned writes=0;
+  bool begin(const char* name, bool read_only) { assert(!strcmp(name,"mesh-mt") && !read_only); return !fail_begin; }
+  size_t getBytesLength(const char* key) { assert(!strcmp(key,"settings")); return blob.size(); }
+  size_t getBytes(const char*, void* out, size_t size) {
+    if(fail_read) return 0;
+    size=std::min(size,blob.size()); memcpy(out,blob.data(),size); return size;
+  }
+  size_t putBytes(const char*, const void* in, size_t size) {
+    ++writes; if(fail_write) return 0; const auto* data=static_cast<const uint8_t*>(in);
+    blob.assign(data,data+size); return size;
+  }
+  void end() {}
+  bool remove(const char* key) { assert(!strcmp(key,"settings")); if(fail_write) return false; blob.clear(); return true; }
+  static void reset() { blob.clear(); fail_begin=fail_write=fail_read=false; writes=0; }
+};
+static uint32_t test_random_seed=0x12345678;
+static uint32_t esp_random() { return test_random_seed; }
+
+namespace mesh { struct GroupChannel {
+  uint8_t hash[1]={},secret[32]={},tx_radio=RADIO_TX_AUTO;
+}; }
+struct ChannelDetails { mesh::GroupChannel channel; char name[32]={}; };
+struct BaseChatMesh {
+  ChannelDetails stored[MAX_GROUP_CHANNELS];
+  bool getChannel(int index, ChannelDetails& out) {
+    if(index<0 || index>=MAX_GROUP_CHANNELS) return false;
+    out=stored[index]; return true;
+  }
+  bool setChannel(int index, const ChannelDetails& in) {
+    if(index<0 || index>=MAX_GROUP_CHANNELS) return false;
+    stored[index]=in;
+    mesh::Utils::sha256(stored[index].channel.hash,1,in.channel.secret,
+        mesh::Utils::isZeroes(in.channel.secret+16,16)?16:32); return true;
+  }
+};
+struct MtRadio : Radio {
+  bool supported=true;
+  bool supportsMeshtext() const override { return supported; }
+};
+struct Serial {
+  bool connected=false;
+  std::vector<std::vector<uint8_t>> frames;
+  bool isConnected() { return connected; }
+  void writeFrame(const uint8_t* bytes,int size) { assert(size>=0); frames.emplace_back(bytes,bytes+size); }
+};
+struct UI { void setMessageNotificationOverride(bool,bool=false) {} };
+struct Notifications {
+  uint8_t key[32]={}; unsigned calls=0;
+  bool message(const void*,const uint8_t* secret,bool,uint32_t) { ++calls; memcpy(key,secret,32); return false; }
+  bool overridesScreen() const { return false; }
+};
+struct StrHelper {
+  static void strncpy(char* out,const char* in,size_t size) { ::strncpy(out,in,size-1); out[size-1]=0; }
+};
+class MyMesh : public BaseChatMesh {
+public:
+  MemoryFS fs; Clock clock; MtRadio radio; mesh::Radio* _radio=&radio;
+  mesh::RadioProfileCLI _radio_profiles;
+  struct {float freq=909.5; char node_name[32]="Test";} _prefs;
+  mesh::LocalIdentity self_id;
+  mesh::mt::Region _mt_region=mesh::mt::Region::Unset;
+  uint32_t _mt_slot=0,_mt_node=0,_mt_packet_id=0,_mt_sent=0,_mt_failed=0,_mt_received=0;
+  uint32_t _mt_default_node=0,_mt_node_override=0;
+  uint8_t _mt_hop_limit=7;
+  char _mt_short_name[17]={};
+  mesh::mt::SeenPackets _mt_seen;
+  bool _mt_settings_valid=true,_mt_active=false,_mt_profile_dirty=true,_mt_last_radio_ready=false;
+  uint32_t _mt_primary_generation=0,_mt_secondary_generation=0,_mt_intent_generation=0;
+  float _mt_primary_frequency=0; const char* _mt_status="no Meshtext channels";
+  bool _radio_available=true,foreign_pending=false,admit_foreign=true,save_result=true,ok=false;
+  uint32_t foreign_generation=0; uint8_t foreign_profile=255;
+  unsigned foreign_admissions=0,meshcore_sends=0;
+  std::vector<std::vector<uint8_t>> foreign,offline;
+  size_t offline_capacity=4;
+  Serial serial; Serial* _serial=&serial; UI ui; UI* _ui=&ui; Notifications _notifications;
+  uint8_t out_frame[MAX_FRAME_SIZE]={}; uint8_t app_target_ver=3;
+  int error=-1;
+  MyMesh() { g_mock_millis=0; self_id.pub_key[0]=42; _radio_profiles.begin(&fs,&radio,&clock); }
+  bool isAliasRadio2Defined() const;
+  bool resolveChannelAlias(ChannelDetails&) const;
+  bool getChannel(int,ChannelDetails&);
+  bool setChannel(int,const ChannelDetails&);
+  bool getChannelForSave(uint8_t index,ChannelDetails& value) { return BaseChatMesh::getChannel(index,value); }
+  mesh::mt::Region meshtextRegion() const;
+  void refreshMeshtextIdentity();
+  void beginMeshtext();
+  bool saveMeshtextSettings(mesh::mt::Region,uint32_t,uint8_t hops=UINT8_MAX,
+                             const char* short_name=nullptr,uint32_t node_override=UINT32_MAX);
+  bool eraseMeshtextSettings();
+  bool isMeshtextChannel(const ChannelDetails&) const;
+  bool validateMeshtextChannelChange(int,const ChannelDetails&);
+  void refreshMeshtextProfile();
+  bool sendMeshtextText(const ChannelDetails&,const char*,size_t);
+  bool sendMeshtextNodeInfo(const ChannelDetails&);
+  bool onForeignRadioFrame(const uint8_t*,size_t,uint8_t,uint32_t,float,float);
+  void onForeignRadioSendComplete(bool);
+  bool handleMeshtextCommand(const char*,char*,size_t);
+  bool queueChannelText(uint8_t,const uint8_t[32],float,uint8_t,uint32_t,const char*,bool);
+  bool hasForeignRadioFrame() const { return foreign_pending; }
+  bool queueForeignRadioFrame(const uint8_t* bytes,size_t size,uint8_t profile,uint32_t generation) {
+    if(!admit_foreign || foreign_pending) return false;
+    ++foreign_admissions; foreign.emplace_back(bytes,bytes+size); foreign_profile=profile;
+    foreign_generation=generation; foreign_pending=true; return true;
+  }
+  mesh::RTCClock* getRTCClock() { return &clock; }
+  bool addToOfflineQueue(const uint8_t* bytes,int size) {
+    assert(size>=0 && size<=MAX_FRAME_SIZE); if(offline.size()>=offline_capacity) return false;
+    offline.emplace_back(bytes,bytes+size); return true;
+  }
+  bool saveChannels() { return save_result; }
+  void writeErrFrame(uint8_t value) { error=value; }
+  void writeOKFrame() { ok=true; }
+  bool sendGroupMessage(uint32_t,mesh::GroupChannel&,const char*,const char*,int) { ++meshcore_sends; return true; }
+  void command(uint8_t* cmd_frame,int len);
+  void commit(int index,const ChannelDetails& value) {
+    assert(setChannel(index,value)); _mt_profile_dirty=true; refreshMeshtextProfile();
+  }
+  const char* cli(const char* command,bool expected=true) {
+    static char reply[256]; assert(_radio_profiles.handle(command,reply,sizeof(reply)));
+    if(strncmp(command,"get ",4) && strncmp(command,"del ",4)) {
+      if((!strncmp(reply,"OK",2))!=expected) { fprintf(stderr,"%s -> %s\n",command,reply); assert(false); }
+    }
+    return reply;
+  }
+  void advance(uint32_t ms) { g_mock_millis+=ms; clock.epoch+=ms/1000; _radio_profiles.loop(); refreshMeshtextProfile(); }
+};
+@METHODS@
+void MyMesh::command(uint8_t* cmd_frame,int len) {
+  error=-1; ok=false; serial.frames.clear();
+  @COMMANDS@
+}
+static ChannelDetails channel(const char* name,int private_bytes=0) {
+  ChannelDetails value; assert(strlen(name)<sizeof(value.name)); strcpy(value.name,name);
+  if(private_bytes) { for(int i=0;i<private_bytes;++i)value.channel.secret[i]=i+1; }
+  else mesh::Utils::sha256(value.channel.secret,16,reinterpret_cast<const uint8_t*>(name),strlen(name));
+  return value;
+}
+static void active(MyMesh& node) {
+  node.beginMeshtext(); node.commit(0,channel("#mt-longfast"));
+  assert(node._mt_active && node.radio.p.secondary.params.protocol==mesh::RadioProfileProtocol::Meshtext);
+}
+static void assertUntouched(const MyMesh& node) { assert(node.foreign.empty() && !node.meshcore_sends); }
+static void keys() {
+  Preferences::reset(); MyMesh node; active(node);
+  auto raw=channel("#mt-longfast"); ChannelDetails stored;
+  assert(node.getChannelForSave(0,stored) && !memcmp(raw.channel.secret,stored.channel.secret,32));
+  mesh::mt::Channel wire; assert(describe(stored,wire));
+  assert(!strcmp(wire.name,"LongFast") && wire.named_preset && wire.key_length==16);
+  assert(!memcmp(wire.key,mesh::mt::DefaultPsk,16));
+  ChannelDetails policy; assert(node.getChannel(0,policy));
+  assert(policy.channel.tx_radio==mesh::RADIO_TX_OFF);
+  assert(memcmp(policy.channel.secret,raw.channel.secret,16));
+  for(const char* name:{"#mt-LoNgFaSt","#mt-shortturbo","#mt-longmoderate"}) {
+    auto c=channel(name); const auto before=c;
+    assert(describe(c,wire) && !memcmp(wire.key,mesh::mt::DefaultPsk,16));
+    assert(!memcmp(c.channel.secret,before.channel.secret,32));
+  }
+  for(int size:{16,32}) {
+    auto c=channel("#mt-longfast",size); const auto before=c;
+    assert(describe(c,wire) && wire.key_length==size && !memcmp(wire.key,c.channel.secret,32));
+    assert(!memcmp(c.channel.secret,before.channel.secret,32));
+    node.foreign_pending=false; assert(node.sendMeshtextText(c,"private",7));
+    mesh::mt::DecodedText decoded;
+    assert(mesh::mt::decodeText(node.foreign.back().data(),node.foreign.back().size(),wire.name,wire.key,size,1,decoded));
+    assert(!strcmp(decoded.text,"private"));
+  }
+  auto custom=channel("#mt-emergency"); assert(describe(custom,wire));
+  auto ordinary=channel("#emergency"); assert(!memcmp(wire.key,ordinary.channel.secret,16));
+  assert(!wire.named_preset && !strcmp(wire.name,"emergency"));
+  auto invalid=channel("#mt-abcdefghijkl"); assert(!describe(invalid,wire));
+  puts("PASS keys");
+}
+static void automatic() {
+  Preferences::reset(); MyMesh node; assert(!node.radio.p.enabled()); active(node);
+  assert(node.radio.p.secondary.mode==mesh::RadioProfileMode::RxTx);
+  assert(node.radio.p.secondary.params.bw==250 && node.radio.p.secondary.params.sf==11);
+  assert(node._radio_profiles.autoSecondaryActive() && node.fs.files.empty() && Preferences::writes==0);
+  const auto generation=node.radio.p.generation[1]; node.refreshMeshtextProfile();
+  assert(node.radio.p.generation[1]==generation); assertUntouched(node);
+  MyMesh reboot; reboot.stored[0]=node.stored[0]; reboot.fs=node.fs;
+  reboot._radio_profiles.begin(&reboot.fs,&reboot.radio,&reboot.clock); reboot.beginMeshtext();
+  assert(reboot._mt_active && reboot._radio_profiles.autoSecondaryActive()); assertUntouched(reboot);
+  node.commit(0,{}); assert(!node._mt_active && !node.radio.p.enabled()); assertUntouched(node);
+  puts("PASS auto");
+}
+static void conflicts() {
+  Preferences::reset(); MyMesh node; active(node);
+  assert(!node.validateMeshtextChannelChange(1,channel("#mt-longturbo")));
+  assert(!node.validateMeshtextChannelChange(1,channel("#r2-emergency")));
+  node.commit(1,channel("#mt-longturbo")); assert(!node._mt_active && !node.radio.p.enabled());
+  node.commit(1,{}); assert(node._mt_active);
+  assert(node.validateMeshtextChannelChange(1,channel("#mt-emergency",32)));
+  node.commit(1,channel("#mt-emergency",32)); node.commit(0,{});
+  assert(!node._mt_active && !node.radio.p.enabled());
+  assert(node.isMeshtextChannel(node.stored[1]));
+  assert(!node.sendMeshtextText(node.stored[1],"x",1));
+  node.commit(1,{}); node._prefs.freq=915; node.commit(0,channel("#mt-longfast"));
+  assert(!node._mt_active && strstr(node._mt_status,"ambiguous"));
+  assert(!node.validateMeshtextChannelChange(0,channel("#mt-longfast")));
+  assert(node.saveMeshtextSettings(mesh::mt::Region::US,0) && node._mt_active);
+  assert(node.saveMeshtextSettings(mesh::mt::Region::EU868,0) && node._mt_active);
+  assert(!node.validateMeshtextChannelChange(0,channel("#mt-shortturbo")));
+  node.commit(0,channel("#mt-shortturbo")); assert(!node._mt_active);
+  node.commit(0,channel("#mt-longfast")); assert(node._mt_active);
+  assert(node.saveMeshtextSettings(mesh::mt::Region::EU868,2)); assert(!node._mt_active);
+  assert(node.saveMeshtextSettings(mesh::mt::Region::EU868,1)); assert(node._mt_active);
+  assert(std::fabs(node.radio.p.secondary.params.freq-869.525f)<0.0001f);
+  node._radio_available=false; node.refreshMeshtextProfile(); assert(!node._mt_active);
+  node._radio_available=true; node.refreshMeshtextProfile(); assert(node._mt_active);
+  node.commit(0,channel("ordinary")); assert(!node._mt_active && !node.radio.p.enabled());
+  assertUntouched(node); puts("PASS conflicts");
+}
+static void manual() {
+  Preferences::reset(); MyMesh node; node.beginMeshtext();
+  node.cli("set radio2 906.875,250,11,5,rxtx,80"); node.advance(2000);
+  const auto saved_files=node.fs.files; const auto saved=node._radio_profiles.savedSecondaryConfig();
+  node.commit(0,channel("#mt-longfast")); assert(node._mt_active);
+  assert(node.radio.p.secondary.params.freq==906.875f && node.radio.p.secondary.params.preamble==16);
+  assert(node._radio_profiles.savedSecondaryConfig().params==saved.params && node.fs.files==saved_files);
+  node.cli("set tempradio2 909.5,62.5,7,5,rx,1,80"); node.advance(2000);
+  assert(!node._mt_active && node.radio.p.secondary_temporary);
+  assert(node.radio.p.secondary.params.protocol==mesh::RadioProfileProtocol::MeshCore);
+  node.advance(60000); assert(node._mt_active && !node.radio.p.secondary_temporary);
+  node.commit(0,{}); assert(!node._mt_active);
+  assert(node.radio.p.secondary.params==saved.params && node.fs.files==saved_files);
+  node.cli("set radio2 off"); node.advance(2000); const auto off_files=node.fs.files;
+  node.commit(0,channel("#mt-longfast")); assert(!node._mt_active && !node.radio.p.enabled());
+  node.commit(0,{}); assert(!node.radio.p.enabled() && node.fs.files==off_files);
+  node.cli("set radio2 auto"); node.advance(2000); node.commit(0,channel("#mt-longfast"));
+  assert(node._mt_active && node._radio_profiles.autoSecondaryActive());
+  // An external/temporary owner is not ours to disable when a channel vanishes.
+  auto external=node.radio.p.secondary; external.params.freq=910.25; external.params.bw=125;
+  external.params.sf=8; external.params.cr=5; external.params.preamble=80;
+  external.params.protocol=mesh::RadioProfileProtocol::MeshCore;
+  node.radio.p.setSecondary(external,false); node.refreshMeshtextProfile();
+  assert(!node._mt_active && node.radio.p.secondary.params==external.params);
+  node.commit(0,{}); assert(node.radio.p.secondary.params==external.params);
+  assertUntouched(node);
+  puts("PASS manual");
+}
+static void settings() {
+  Preferences::reset(); MyMesh node; active(node); assert(node._mt_node && node._mt_packet_id);
+  assert(node.saveMeshtextSettings(mesh::mt::Region::ANZ,1));
+  assert(Preferences::blob.size()==40 && Preferences::writes==1);
+  const auto committed=Preferences::blob; Preferences::fail_write=true;
+  assert(!node.saveMeshtextSettings(mesh::mt::Region::US,2));
+  assert(node._mt_region==mesh::mt::Region::ANZ && node._mt_slot==1 && Preferences::blob==committed);
+  assert(!node._mt_settings_valid && !node._mt_active && !node.radio.p.enabled());
+  Preferences::fail_write=false; node.foreign_pending=true;
+  const auto writes=Preferences::writes; assert(!node.saveMeshtextSettings(mesh::mt::Region::US,0));
+  assert(Preferences::writes==writes); node.foreign_pending=false;
+  assert(!node.saveMeshtextSettings(mesh::mt::Region::US,1025));
+  assert(node.saveMeshtextSettings(mesh::mt::Region::ANZ,1) && node._mt_active);
+  MyMesh reboot; reboot.stored[0]=node.stored[0]; reboot.beginMeshtext();
+  assert(reboot._mt_region==mesh::mt::Region::ANZ && reboot._mt_slot==1 && reboot._mt_active);
+  Preferences::blob[5]=1; MyMesh corrupt; corrupt.stored[0]=node.stored[0]; corrupt.beginMeshtext();
+  assert(!corrupt._mt_settings_valid && !corrupt._mt_active && !corrupt.radio.p.enabled());
+  char reply[160]; assert(corrupt.handleMeshtextCommand("set mt.region us",reply,sizeof(reply)));
+  assert(!strncmp(reply,"OK",2) && corrupt._mt_active && corrupt._mt_settings_valid);
+  assert(corrupt.handleMeshtextCommand("set mt.slot 1junk",reply,sizeof(reply)) && !strncmp(reply,"Error",5));
+  assert(corrupt.handleMeshtextCommand("get mt.status",reply,sizeof(reply)) && strstr(reply,"RX time-shared"));
+  assert(!corrupt.handleMeshtextCommand("get unknown",reply,sizeof(reply)));
+  // The atomic blob may have committed despite failed readback: suspend RAM,
+  // then reconstruct the committed choice only after a successful new read.
+  Preferences::fail_read=true;
+  assert(!corrupt.saveMeshtextSettings(mesh::mt::Region::ANZ,2));
+  assert(!corrupt._mt_settings_valid && !corrupt._mt_active && !corrupt.radio.p.enabled());
+  Preferences::fail_read=false; MyMesh readback;
+  readback.stored[0]=corrupt.stored[0]; readback.beginMeshtext();
+  assert(readback._mt_active && readback._mt_region==mesh::mt::Region::ANZ && readback._mt_slot==2);
+  Preferences::fail_write=true; assert(!readback.eraseMeshtextSettings());
+  assert(!readback._mt_active && !readback._mt_settings_valid && !readback.radio.p.enabled());
+  Preferences::fail_write=false; assert(readback.eraseMeshtextSettings() && Preferences::blob.empty());
+  assert(readback._mt_region==mesh::mt::Region::Unset && readback._mt_slot==0);
+  assert(readback._mt_hop_limit==7);
+  readback.refreshMeshtextProfile(); assert(!readback._mt_active);
+  Preferences::fail_begin=true; assert(!corrupt.eraseMeshtextSettings());
+  assert(!corrupt._mt_active && !corrupt._mt_settings_valid && !corrupt.radio.p.enabled());
+  Preferences::fail_begin=false;
+  assertUntouched(node); assertUntouched(reboot); assertUntouched(corrupt); puts("PASS settings");
+}
+static const uint8_t rx_frame[]=@RX_FRAME@,rx_retry[]=@RX_RETRY@,rx_dm[]=@RX_DM@,
+                     rx_ack[]=@RX_ACK@,rx_other[]=@RX_OTHER@;
+static bool receiveFrame(MyMesh& node,const uint8_t* bytes,size_t size,float snr=3) {
+  return node.onForeignRadioFrame(bytes,size,1,node.radio.p.generation[1],snr,-90);
+}
+static bool validUtf8(const uint8_t* text,size_t size) {
+  uint8_t frame[255]; return mesh::mt::encodeText(1,1,3,"LongFast",mesh::mt::DefaultPsk,16,
+      reinterpret_cast<const char*>(text),size,frame)!=0;
+}
+static void receive() {
+  Preferences::reset(); MyMesh node; active(node);
+  assert(!node.onForeignRadioFrame(rx_frame,sizeof(rx_frame),0,node.radio.p.generation[1],3,-90));
+  assert(!node.onForeignRadioFrame(rx_frame,sizeof(rx_frame),1,node.radio.p.generation[1]-1,3,-90));
+  assert(!receiveFrame(node,rx_dm,sizeof(rx_dm))); assert(!receiveFrame(node,rx_other,sizeof(rx_other)));
+  assert(node.offline.empty());
+  assert(receiveFrame(node,rx_frame,sizeof(rx_frame),100));
+  assert(node.offline.size()==1 && node._mt_received==1 && node._notifications.calls==1);
+  auto envelope=node.offline.back(); assert(envelope[0]==RESP_CODE_CHANNEL_MSG_RECV_V3);
+  assert(envelope[1]==127 && envelope[2]==0 && envelope[3]==0 && envelope[4]==0);
+  assert(envelope[5]==0 && envelope[6]==TXT_TYPE_PLAIN && envelope.size()<=MAX_FRAME_SIZE);
+  uint32_t timestamp=0; memcpy(&timestamp,envelope.data()+7,sizeof(timestamp));
+  assert(timestamp==node.clock.epoch);
+  assert(validUtf8(envelope.data()+11,envelope.size()-11));
+  assert(!memcmp(envelope.data()+11,"!11223344: ",11));
+  assert(envelope.size()==175); // 153 ASCII bytes remain; no partial euro scalar.
+  ChannelDetails policy; assert(node.getChannel(0,policy));
+  assert(!memcmp(node._notifications.key,policy.channel.secret,32));
+  assert(memcmp(node._notifications.key,mesh::mt::DefaultPsk,16));
+  assert(receiveFrame(node,rx_frame,sizeof(rx_frame)) && node.offline.size()==1);
+  node.offline_capacity=1; assert(receiveFrame(node,rx_retry,sizeof(rx_retry)));
+  assert(node._mt_received==1 && !node._mt_seen.seen(0x11223344,102));
+  node.offline_capacity=4; node.app_target_ver=1; node.serial.connected=true;
+  assert(receiveFrame(node,rx_retry,sizeof(rx_retry)) && node._mt_received==2);
+  assert(node.offline.back()[0]==RESP_CODE_CHANNEL_MSG_RECV && node.offline.back()[1]==0);
+  assert(node.serial.frames.size()==1 && node.serial.frames[0][0]==PUSH_CODE_MSG_WAITING);
+  assert(receiveFrame(node,rx_ack,sizeof(rx_ack)) && node._mt_received==3);
+  assertUntouched(node); // request-ACK produces no radio response, no relay
+  node.offline_capacity=6;
+  uint8_t ordinary_key[32]={1};
+  node.app_target_ver=3;
+  assert(node.queueChannelText(0,ordinary_key,-100,255,123,"negative",false));
+  assert(node.offline.back()[1]==128 && node.offline.back()[5]==255);
+  assert(node.queueChannelText(0,ordinary_key,std::numeric_limits<float>::quiet_NaN(),0,124,"nan",false));
+  assert(node.offline.back()[1]==0);
+  uint8_t empty_secret[32]={}; assert(!node.queueChannelText(MAX_GROUP_CHANNELS,empty_secret,0,0,0,"x",false));
+  assert(!node.queueChannelText(0,empty_secret,0,0,0,nullptr,false));
+  puts("PASS receive");
+}
+static void transmit() {
+  Preferences::reset(); MyMesh node; active(node); assertUntouched(node);
+  uint8_t request[32]={CMD_SEND_CHANNEL_TXT_MSG,TXT_TYPE_PLAIN,0};
+  memcpy(request+7,"hello",5); node.command(request,12);
+  assert(node.ok && node.error==-1 && node.foreign.size()==1 && !node.meshcore_sends);
+  assert(node.foreign_profile==1 && node.foreign_generation==node.radio.p.generation[1]);
+  mesh::mt::DecodedText decoded; auto& frame=node.foreign.back();
+  assert(mesh::mt::decodeText(frame.data(),frame.size(),"LongFast",mesh::mt::DefaultPsk,16,1,decoded));
+  assert(!strcmp(decoded.text,"hello"));
+  assert(decoded.hop_limit==7 && decoded.hop_start==7 && decoded.hops==0);
+  assert(frame[12]==0xe7); // limit/start 7, no want-ACK or MQTT flag.
+  assert(!mesh::mt::decodeText(frame.data(),frame.size(),"LongFast",mesh::mt::DefaultPsk,16,node._mt_node,decoded));
+  node.command(request,12); assert(!node.ok && node.error==ERR_CODE_BAD_STATE && node.foreign.size()==1);
+  node.foreign_pending=false; node.onForeignRadioSendComplete(true); node.onForeignRadioSendComplete(false);
+  assert(node._mt_sent==1 && node._mt_failed==1);
+  char oversized[229]; memset(oversized,'x',sizeof(oversized));
+  assert(!node.sendMeshtextText(node.stored[0],oversized,sizeof(oversized)));
+  assert(!node.sendMeshtextText(node.stored[0],"x\0y",3));
+  node._mt_packet_id=UINT32_MAX; assert(node.sendMeshtextText(node.stored[0],"last",4));
+  node.foreign_pending=false; assert(node._mt_packet_id==0 && !node.sendMeshtextText(node.stored[0],"x",1));
+  assert(node.offline.empty() && node._notifications.calls==0); puts("PASS transmit");
+}
+static void applySet(MyMesh& node,int index,const ChannelDetails& value,int key_size=16) {
+  uint8_t frame[66]={CMD_SET_CHANNEL,static_cast<uint8_t>(index)};
+  memcpy(frame+2,value.name,32); memcpy(frame+34,value.channel.secret,key_size); node.command(frame,34+key_size);
+}
+static void commands() {
+  Preferences::reset(); MyMesh node; active(node); ChannelDetails raw;
+  auto original=node.stored[0]; original.channel.tx_radio=mesh::RADIO_TX_BOTH; node.commit(0,original);
+  uint8_t get[]={CMD_GET_CHANNEL,0}; node.command(get,sizeof(get));
+  assert(node.serial.frames.size()==1 && node.serial.frames[0].size()==50);
+  assert(!memcmp(node.serial.frames[0].data()+34,original.channel.secret,16));
+  applySet(node,0,original); assert(node.ok && node.getChannelForSave(0,raw));
+  assert(raw.channel.tx_radio==mesh::RADIO_TX_BOTH && !memcmp(raw.channel.secret,original.channel.secret,32));
+  auto custom=channel("#mt-longfast",16); node.save_result=false; applySet(node,0,custom);
+  assert(node.error==ERR_CODE_FILE_IO_ERROR && !node.ok && node.getChannelForSave(0,raw));
+  assert(!memcmp(raw.channel.secret,original.channel.secret,32)); node.save_result=true;
+  applySet(node,0,custom); assert(node.ok && node.getChannelForSave(0,raw));
+  assert(!memcmp(raw.channel.secret,custom.channel.secret,32) && raw.channel.tx_radio==mesh::RADIO_TX_AUTO);
+  applySet(node,1,channel("#mt-longturbo")); assert(node.error==ERR_CODE_BAD_STATE && !node.ok);
+  applySet(node,1,channel("#mt-mt-room")); assert(node.error==ERR_CODE_ILLEGAL_ARG && !node.ok);
+  auto aes256=channel("#mt-longfast",32); applySet(node,0,aes256,32);
+  assert(node.ok && node.getChannelForSave(0,raw) && !memcmp(raw.channel.secret,aes256.channel.secret,32));
+  // Original two-byte GET is still a 16-byte response; opt-in GET exposes 32.
+  node.command(get,sizeof(get)); assert(node.serial.frames[0].size()==50);
+  uint8_t extended_get[]={CMD_GET_CHANNEL,0,32}; node.command(extended_get,sizeof(extended_get));
+  assert(node.serial.frames[0].size()==66 && !memcmp(node.serial.frames[0].data()+34,aes256.channel.secret,32));
+  auto rename=aes256; strcpy(rename.name,"#mt-LoNgFaSt"); applySet(node,0,rename);
+  assert(node.ok && node.getChannelForSave(0,raw) && !memcmp(raw.channel.secret,aes256.channel.secret,32));
+  node.save_result=false; auto changed=channel("#mt-longfast",32); changed.channel.secret[20]^=0x80;
+  applySet(node,0,changed,32);
+  assert(node.error==ERR_CODE_FILE_IO_ERROR && !node.ok && node.getChannelForSave(0,raw));
+  assert(!memcmp(raw.channel.secret,aes256.channel.secret,32)); node.save_result=true;
+  auto downgrade=channel("#mt-longfast",16); applySet(node,0,downgrade,32);
+  assert(node.ok && node.getChannelForSave(0,raw) && mesh::Utils::isZeroes(raw.channel.secret+16,16));
+  auto mc=channel("private",32); applySet(node,1,mc,32);
+  assert(node.error==ERR_CODE_UNSUPPORTED_CMD && !node.ok);
+  node.commit(1,channel("ordinary")); uint8_t get_mc[]={CMD_GET_CHANNEL,1,32}; node.command(get_mc,sizeof(get_mc));
+  assert(node.serial.frames[0].size()==50); node.commit(1,{});
+  applySet(node,0,{}); assert(node.ok && !node._mt_active && !node.radio.p.enabled());
+  assertUntouched(node); puts("PASS commands");
+}
+static void privateCLI() {
+  Preferences::reset(); MyMesh node; node.beginMeshtext(); char reply[256];
+  const char* key128="0102030405060708090a0b0c0d0e0f10";
+  const char* key256="0102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F20";
+  char command[160]; snprintf(command,sizeof(command),"set mt.channel 0 mt-longfast %s",key256);
+  assert(node.handleMeshtextCommand(command,reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+  assert(node._mt_active && node._radio_profiles.autoSecondaryActive());
+  auto expected=channel("mt-longfast",32); assert(!memcmp(node.stored[0].channel.secret,expected.channel.secret,32));
+  assert(!strstr(reply,key256) && !strstr(reply,key128));
+  assert(node.handleMeshtextCommand("get mt.channel 0",reply,sizeof(reply)));
+  assert(strstr(reply,"AES-256") && strstr(reply,"key not displayed") && !strstr(reply,key256));
+  const auto previous=node.stored[0]; node.save_result=false;
+  snprintf(command,sizeof(command),"set mt.channel 0 mt-longfast %s",key128);
+  assert(node.handleMeshtextCommand(command,reply,sizeof(reply)) && !strncmp(reply,"Error",5));
+  assert(!memcmp(node.stored[0].channel.secret,previous.channel.secret,32));
+  assert(node.handleMeshtextCommand("delete mt.channel 0",reply,sizeof(reply)) && !strncmp(reply,"Error",5));
+  assert(!memcmp(node.stored[0].channel.secret,previous.channel.secret,32)); node.save_result=true;
+  for(const char* invalid:{"set mt.channel -1 mt-longfast AQ==", "set mt.channel 8 mt-longfast AQ==",
+      "set mt.channel 999999999999999999999 mt-longfast AQ==", "set mt.channel 1 ordinary AQ==",
+      "set mt.channel 1 #mt-mt-room AQ==", "set mt.channel 1 mt-longfast BADKEY",
+      "set mt.channel 1 mt-longfast 0102030405060708090a0b0c0d0e0f1Z",
+      "set mt.channel 1 mt-longfast 00000000000000000000000000000000",
+      "set mt.channel 1 mt-longfast AQ== extra", "set mt.channel 1 mt-longfast",
+      "delete mt.channel 0 extra", "get mt.channel 0 extra"}) {
+    assert(node.handleMeshtextCommand(invalid,reply,sizeof(reply)) && !strncmp(reply,"Error",5));
+    assert(!node.stored[1].name[0] && !memcmp(node.stored[0].channel.secret,previous.channel.secret,32));
+  }
+  assert(node.handleMeshtextCommand("set mt.channel 1 mt-team AQ==",reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+  assert(node._mt_active && !memcmp(node.stored[1].channel.secret,mesh::mt::DefaultPsk,16));
+  assert(node.handleMeshtextCommand("delete mt.channel 0",reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+  assert(!node._mt_active && !node.radio.p.enabled());
+  assert(node.handleMeshtextCommand("set mt.preset longfast",reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+  assert(!node._mt_active); node.advance(2000);
+  assert(node._mt_active && node._radio_profiles.manualSecondaryConfigured());
+  const auto saved_files=node.fs.files;
+  assert(node.handleMeshtextCommand("delete mt.channel 1",reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+  assert(!node._mt_active && node.radio.p.enabled() && node.fs.files==saved_files);
+  assert(node.radio.p.secondary.params.protocol==mesh::RadioProfileProtocol::MeshCore);
+  assert(node.handleMeshtextCommand("set mt.channel 1 mt-team AQ==",reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+  assert(node._mt_active);
+  assert(node.handleMeshtextCommand("get mt.channel 1",reply,sizeof(reply)) && strstr(reply,"AES-128"));
+  assert(node.handleMeshtextCommand("set mt.preset notapreset",reply,sizeof(reply)) && !strncmp(reply,"Error",5));
+  for(const char* line:{"set mt.channel 0 mt-team ABCD", " SET\tMT.CHANNEL\t0\tmt-team\tABCD"}) {
+    const auto* key=mesh::cli::terminalPasswordInput(line); assert(key && !strcmp(key,"ABCD"));
+    assert(mesh::cli::shouldMaskTerminalInput(line));
+  }
+  for(const char* line:{"set mt.channel 0 mt-team", "set mt.channel 0", "get mt.channel 0"}) {
+    assert(!mesh::cli::shouldMaskTerminalInput(line));
+  }
+  assertUntouched(node); puts("PASS cli");
+}
+static void hops() {
+  Preferences::reset(); MyMesh node; active(node); char reply[256];
+  assert(node._mt_hop_limit==7 && Preferences::writes==0);
+  assert(node.handleMeshtextCommand("get mt.hops",reply,sizeof(reply)) && !strcmp(reply,"> 7"));
+  for(uint8_t limit:{0,3,7}) {
+    char command[32]; snprintf(command,sizeof(command),"set mt.hops %u",limit);
+    assert(node.handleMeshtextCommand(command,reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+    assert(node._mt_hop_limit==limit && node._mt_region==mesh::mt::Region::Unset && node._mt_slot==0);
+    assert(Preferences::blob.size()==40 && !memcmp(Preferences::blob.data(),"MT03",4));
+    assert(Preferences::blob[5]==limit && Preferences::blob[6]==0 && Preferences::blob[7]==0);
+    MyMesh reboot; reboot.stored[0]=node.stored[0]; reboot.beginMeshtext();
+    assert(reboot._mt_hop_limit==limit && reboot._mt_active && reboot._mt_region==node._mt_region && reboot._mt_slot==node._mt_slot);
+    assert(node.sendMeshtextText(node.stored[0],"hop",3));
+    const auto& frame=node.foreign.back(); mesh::mt::DecodedText decoded;
+    assert(mesh::mt::decodeText(frame.data(),frame.size(),"LongFast",mesh::mt::DefaultPsk,16,1,decoded));
+    assert(decoded.hop_limit==limit && decoded.hop_start==limit && decoded.hops==0);
+    assert(frame[12]==uint8_t(limit|(limit<<5))); node.foreign_pending=false;
+    assertUntouched(reboot);
+  }
+  const auto writes=Preferences::writes; const auto committed=Preferences::blob;
+  for(const char* invalid:{"set mt.hops 8","set mt.hops -1","set mt.hops 3junk",
+      "set mt.hops 4294967296","set mt.hops 18446744073709551615","set mt.hops 3 extra"}) {
+    assert(node.handleMeshtextCommand(invalid,reply,sizeof(reply)) && !strncmp(reply,"Error",5));
+    assert(node._mt_hop_limit==7 && Preferences::writes==writes && Preferences::blob==committed);
+  }
+  assert(!node.saveMeshtextSettings(mesh::mt::Region::US,1,8));
+  assert(node.handleMeshtextCommand("set mt.hops 3",reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+  assert(node.handleMeshtextCommand("set mt.region us",reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+  assert(node.handleMeshtextCommand("set mt.slot 2",reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+  assert(node._mt_hop_limit==3 && node._mt_region==mesh::mt::Region::US && node._mt_slot==2);
+  assert(node.saveMeshtextSettings(mesh::mt::Region::ANZ,4)); // Two arguments preserve the hop setting.
+  assert(node._mt_hop_limit==3 && node._mt_slot==4 && node._mt_region==mesh::mt::Region::ANZ);
+  assert(node.handleMeshtextCommand("set mt.hops 0",reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+  assert(node._mt_slot==4 && node._mt_region==mesh::mt::Region::ANZ && node._mt_hop_limit==0);
+  const auto before_pending=Preferences::blob; const auto pending_writes=Preferences::writes;
+  node.foreign_pending=true;
+  assert(node.handleMeshtextCommand("set mt.hops 7",reply,sizeof(reply)) && !strncmp(reply,"Error",5));
+  assert(node._mt_hop_limit==0 && node._mt_slot==4 && node._mt_region==mesh::mt::Region::ANZ);
+  assert(Preferences::blob==before_pending && Preferences::writes==pending_writes); node.foreign_pending=false;
+  Preferences::fail_write=true;
+  assert(!node.saveMeshtextSettings(mesh::mt::Region::US,1,7));
+  assert(node._mt_hop_limit==0 && node._mt_slot==4 && node._mt_region==mesh::mt::Region::ANZ);
+  assert(Preferences::blob==before_pending && !node._mt_active && !node._mt_settings_valid);
+  Preferences::fail_write=false;
+  assert(node.saveMeshtextSettings(mesh::mt::Region::ANZ,4) && node._mt_hop_limit==0);
+  assert(node.eraseMeshtextSettings() && node._mt_hop_limit==7);
+  // Python hashlib supplies this legacy MT01 image independently. Loading it
+  // defaults hops to seven without silently rewriting persistent settings.
+  const uint8_t legacy[]=@LEGACY_SETTINGS@;
+  Preferences::reset(); Preferences::blob.assign(legacy,legacy+sizeof(legacy));
+  const auto legacy_blob=Preferences::blob; MyMesh migrated;
+  migrated.stored[0]=channel("#mt-longfast"); migrated.beginMeshtext();
+  assert(migrated._mt_settings_valid && migrated._mt_active && migrated._mt_hop_limit==7);
+  assert(migrated._mt_region==mesh::mt::Region::US && migrated._mt_slot==2);
+  assert(Preferences::writes==0 && Preferences::blob==legacy_blob);
+  assert(migrated.handleMeshtextCommand("set mt.hops 3",reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+  assert(Preferences::writes==1 && !memcmp(Preferences::blob.data(),"MT03",4) && Preferences::blob[5]==3);
+  assert(migrated._mt_region==mesh::mt::Region::US && migrated._mt_slot==2);
+  MyMesh migrated_reboot; migrated_reboot.stored[0]=migrated.stored[0]; migrated_reboot.beginMeshtext();
+  assert(migrated_reboot._mt_active && migrated_reboot._mt_hop_limit==3);
+  assert(migrated_reboot._mt_region==mesh::mt::Region::US && migrated_reboot._mt_slot==2);
+  // Even a checksummed legacy reserved-byte change or MT02 out-of-range hop
+  // value remains malformed, rather than becoming an undocumented option.
+  Preferences::blob=legacy_blob; Preferences::blob[5]=1;
+  mesh::Utils::sha256(Preferences::blob.data()+12,4,Preferences::blob.data(),12);
+  MyMesh bad_legacy; bad_legacy.stored[0]=migrated.stored[0]; bad_legacy.beginMeshtext();
+  assert(!bad_legacy._mt_settings_valid && !bad_legacy._mt_active);
+  Preferences::blob=legacy_blob; memcpy(Preferences::blob.data(),"MT02",4); Preferences::blob[5]=8;
+  mesh::Utils::sha256(Preferences::blob.data()+12,4,Preferences::blob.data(),12);
+  MyMesh bad_hops; bad_hops.stored[0]=migrated.stored[0]; bad_hops.beginMeshtext();
+  assert(!bad_hops._mt_settings_valid && !bad_hops._mt_active);
+  assertUntouched(migrated); assertUntouched(migrated_reboot); puts("PASS hops");
+}
+static mesh::mt::DecodedText decodeOwnText(MyMesh& node,const char* text,size_t length) {
+  node.foreign_pending=false;
+  const uint32_t expected_packet=node._mt_packet_id;
+  assert(node.sendMeshtextText(node.stored[0],text,length));
+  const auto& raw=node.foreign.back(); mesh::mt::DecodedText decoded;
+  assert(mesh::mt::decodeText(raw.data(),raw.size(),"LongFast",mesh::mt::DefaultPsk,16,1,decoded));
+  assert(decoded.from==node._mt_node && decoded.id==expected_packet && node._mt_packet_id==expected_packet+1);
+  node.foreign_pending=false; return decoded;
+}
+static void shortname() {
+  Preferences::reset(); MyMesh node; active(node); char reply[256];
+  uint8_t meshcore_identity[32]; memcpy(meshcore_identity,node.self_id.pub_key,32);
+  const uint32_t default_node=@LOCAL_NODE@;
+  assert(node._mt_node==default_node && node._mt_default_node==default_node && !node._mt_node_override);
+  const uint32_t original_packet=node._mt_packet_id;
+  assert(node.handleMeshtextCommand("set mt.shortname MIKE",reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+  assert(!strcmp(node._mt_short_name,"MIKE") && node._mt_node==default_node && node._mt_packet_id==original_packet);
+  assert(!memcmp(meshcore_identity,node.self_id.pub_key,32));
+  assert(Preferences::blob.size()==40 && !memcmp(Preferences::blob.data(),"MT03",4));
+  assert(!memcmp(Preferences::blob.data()+12,"MIKE\0",5));
+  for(unsigned i=17;i<36;++i) assert(Preferences::blob[i]==0);
+  assert(node.handleMeshtextCommand("get mt.shortname",reply,sizeof(reply)) && strstr(reply,"MIKE"));
+  char node_id[12]; snprintf(node_id,sizeof(node_id),"!%08lx",(unsigned long)default_node);
+  assert(node.handleMeshtextCommand("get mt.node",reply,sizeof(reply)) && strstr(reply,node_id));
+  assert(node.handleMeshtextCommand("get mt.status",reply,sizeof(reply)) && strstr(reply,node_id));
+  auto decoded=decodeOwnText(node,"identity",8);
+  assert(!strcmp(decoded.text,"identity") && !strstr(decoded.text,"MIKE") && !strstr(decoded.text,node_id));
+  strcpy(node._prefs.node_name,"Different MeshCore name");
+  decoded=decodeOwnText(node,"unchanged",9);
+  assert(decoded.from==default_node && !strcmp(decoded.text,"unchanged"));
+  assert(node.handleMeshtextCommand("set mt.hops 3",reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+  assert(node.handleMeshtextCommand("set mt.region us",reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+  assert(node.handleMeshtextCommand("set mt.slot 2",reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+  assert(!strcmp(node._mt_short_name,"MIKE") && node._mt_node==default_node && !node._mt_node_override);
+  assert(node._mt_region==mesh::mt::Region::US && node._mt_slot==2 && node._mt_hop_limit==3);
+  const char* four_emoji="\xf0\x9f\x98\x80\xf0\x9f\x98\x80\xf0\x9f\x98\x80\xf0\x9f\x98\x80";
+  assert(node.saveMeshtextSettings(node._mt_region,node._mt_slot,UINT8_MAX,four_emoji));
+  assert(strlen(node._mt_short_name)==16 && !strcmp(node._mt_short_name,four_emoji));
+  assert(node._mt_hop_limit==3 && node._mt_node==default_node && !memcmp(meshcore_identity,node.self_id.pub_key,32));
+  std::string body(229,'x');
+  decoded=decodeOwnText(node,body.data(),228); assert(decoded.text_len==228);
+  const auto admissions=node.foreign_admissions;
+  assert(!node.sendMeshtextText(node.stored[0],body.data(),229) && node.foreign_admissions==admissions);
+  auto persisted=Preferences::blob; const auto packet=node._mt_packet_id;
+  for(const char* invalid:{"set mt.shortname ABCDE","set mt.shortname    ",
+      "set mt.shortname A:B","set mt.shortname A\nB","set mt.shortname \xc0\xaf",
+      "set mt.shortname \xed\xa0\x80","set mt.shortname \xf4\x90\x80\x80",
+      "set mt.shortname \xf0\x9f\x98", "set mt.shortname \xe2\x80\xae"}) {
+    assert(node.handleMeshtextCommand(invalid,reply,sizeof(reply)) && !strncmp(reply,"Error",5));
+    assert(Preferences::blob==persisted && !strcmp(node._mt_short_name,four_emoji));
+    assert(node._mt_node==default_node && node._mt_packet_id==packet);
+  }
+  const auto writes=Preferences::writes; node.foreign_pending=true;
+  assert(node.handleMeshtextCommand("set mt.shortname BOB",reply,sizeof(reply)) && !strncmp(reply,"Error",5));
+  assert(Preferences::writes==writes && Preferences::blob==persisted && !strcmp(node._mt_short_name,four_emoji));
+  node.foreign_pending=false; Preferences::fail_write=true;
+  assert(!node.saveMeshtextSettings(mesh::mt::Region::ANZ,4,7,"BOB"));
+  assert(!strcmp(node._mt_short_name,four_emoji) && Preferences::blob==persisted);
+  assert(node._mt_region==mesh::mt::Region::US && node._mt_slot==2 && node._mt_hop_limit==3);
+  assert(!node._mt_active && !node._mt_settings_valid && node._mt_node==default_node && node._mt_packet_id==packet);
+  Preferences::fail_write=false;
+  assert(node.saveMeshtextSettings(node._mt_region,node._mt_slot));
+  assert(!strcmp(node._mt_short_name,four_emoji));
+  test_random_seed=0x87654321; MyMesh reboot; reboot.stored[0]=node.stored[0]; reboot.beginMeshtext();
+  assert(reboot._mt_node==default_node && reboot._mt_default_node==default_node && !reboot._mt_node_override);
+  assert(reboot._mt_packet_id==test_random_seed && !strcmp(reboot._mt_short_name,four_emoji));
+  assert(reboot._mt_region==mesh::mt::Region::US && reboot._mt_slot==2 && reboot._mt_hop_limit==3);
+  assertUntouched(reboot);
+  assert(node.handleMeshtextCommand("set mt.shortname default",reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+  assert(!node._mt_short_name[0] && node._mt_node==default_node && node._mt_packet_id==packet);
+  memset(node._prefs.node_name,'A',31); node._prefs.node_name[31]=0;
+  decoded=decodeOwnText(node,body.data(),228);
+  assert(decoded.text_len==228 && !node.sendMeshtextText(node.stored[0],body.data(),229));
+  node._prefs.node_name[0]=0;
+  decoded=decodeOwnText(node,body.data(),228); assert(decoded.text_len==228 && !strstr(decoded.text,node_id));
+  assert(!node.sendMeshtextText(node.stored[0],body.data(),229));
+  // Validate both independently supplied 16-byte predecessors without writes.
+  const uint8_t mt01[]=@LEGACY_SETTINGS@,mt02[]=@LEGACY_HOPS_SETTINGS@;
+  for(unsigned version=0;version<2;++version) {
+    Preferences::reset(); const auto* old=version?mt02:mt01; Preferences::blob.assign(old,old+16);
+    const auto before=Preferences::blob; MyMesh legacy; legacy.stored[0]=channel("#mt-longfast"); legacy.beginMeshtext();
+    assert(legacy._mt_active && legacy._mt_settings_valid && !legacy._mt_short_name[0] && !legacy._mt_node_override);
+    assert(legacy._mt_node==default_node && legacy._mt_hop_limit==(version?3:7));
+    assert(Preferences::writes==0 && Preferences::blob==before);
+    assert(legacy.handleMeshtextCommand("set mt.shortname TEST",reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+    assert(Preferences::writes==1 && Preferences::blob.size()==40 && !memcmp(Preferences::blob.data(),"MT03",4));
+    assert(legacy._mt_region==mesh::mt::Region::US && legacy._mt_slot==2 && legacy._mt_hop_limit==(version?3:7));
+    assertUntouched(legacy);
+  }
+  const auto valid_image=Preferences::blob;
+  for(unsigned fault=0;fault<7;++fault) {
+    Preferences::blob=valid_image;
+    switch(fault) {
+      case 0: memset(Preferences::blob.data()+12,'X',17); break; // no NUL
+      case 1: Preferences::blob[14]=0; Preferences::blob[15]='X'; break; // non-canonical tail
+      case 2: Preferences::blob[29]=1; break; // reserved padding
+      case 3: memset(Preferences::blob.data()+12,0,17); Preferences::blob[12]=0xc0; Preferences::blob[13]=0xaf; break;
+      case 4: memset(Preferences::blob.data()+12,0,17); memcpy(Preferences::blob.data()+12,"ABCDE",5); break;
+      case 5: Preferences::blob[32]=3; break; // reserved override
+      case 6: memset(Preferences::blob.data()+32,0xff,4); break;
+    }
+    mesh::Utils::sha256(Preferences::blob.data()+36,4,Preferences::blob.data(),36);
+    MyMesh invalid; invalid.stored[0]=channel("#mt-longfast"); invalid.beginMeshtext();
+    assert(!invalid._mt_settings_valid && !invalid._mt_active && !invalid.radio.p.enabled()); assertUntouched(invalid);
+  }
+  assert(!memcmp(meshcore_identity,node.self_id.pub_key,32)); puts("PASS shortname");
+}
+static void nodeOverride() {
+  Preferences::reset(); MyMesh node; active(node); char reply[256];
+  uint8_t identity[32]; memcpy(identity,node.self_id.pub_key,32);
+  const uint32_t derived=@LOCAL_NODE@,packet=node._mt_packet_id;
+  assert(node._mt_node==derived && node._mt_default_node==derived && !node._mt_node_override);
+  for(const char* value:{"!12345678","ABCDEF01","00000004","fffffffe"}) {
+    char command[64]; snprintf(command,sizeof(command),"set mt.node %s",value);
+    const char* digits=value[0]=='!'?value+1:value; const uint32_t chosen=std::strtoul(digits,nullptr,16);
+    const uint32_t next_packet=node._mt_packet_id;
+    assert(node.handleMeshtextCommand(command,reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+    assert(node._mt_node==chosen && node._mt_node_override==chosen && node._mt_default_node==derived);
+    assert(node._mt_packet_id==next_packet && !memcmp(identity,node.self_id.pub_key,32));
+    const uint32_t image_id=uint32_t(Preferences::blob[32])|(uint32_t(Preferences::blob[33])<<8)
+        |(uint32_t(Preferences::blob[34])<<16)|(uint32_t(Preferences::blob[35])<<24);
+    assert(image_id==chosen);
+    char label[12]; snprintf(label,sizeof(label),"!%08lx",(unsigned long)chosen);
+    assert(node.handleMeshtextCommand("get mt.node",reply,sizeof(reply)) && strstr(reply,label));
+    auto decoded=decodeOwnText(node,"chosen",6); assert(decoded.from==chosen && !strcmp(decoded.text,"chosen"));
+    MyMesh reboot; reboot.stored[0]=node.stored[0]; reboot.beginMeshtext();
+    assert(reboot._mt_node==chosen && reboot._mt_node_override==chosen && reboot._mt_default_node==derived);
+    assertUntouched(reboot);
+  }
+  assert(node._mt_packet_id==packet+4);
+  assert(node.handleMeshtextCommand("set mt.shortname ID",reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+  assert(node.handleMeshtextCommand("set mt.region anz",reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+  assert(node.handleMeshtextCommand("set mt.slot 2",reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+  assert(node.handleMeshtextCommand("set mt.hops 3",reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+  assert(node._mt_node==0xfffffffe && node._mt_node_override==0xfffffffe && !strcmp(node._mt_short_name,"ID"));
+  const auto blob=Preferences::blob; const auto next_packet=node._mt_packet_id,writes=Preferences::writes;
+  for(const char* invalid:{"set mt.node 00000000","set mt.node !00000001","set mt.node 00000002",
+      "set mt.node 00000003","set mt.node FFFFFFFF","set mt.node !ffffffff",
+      "set mt.node 1234567","set mt.node 123456789","set mt.node 0x12345678",
+      "set mt.node !1234567g","set mt.node !!12345678","set mt.node 12345678 extra"}) {
+    assert(node.handleMeshtextCommand(invalid,reply,sizeof(reply)) && !strncmp(reply,"Error",5));
+    assert(node._mt_node==0xfffffffe && node._mt_node_override==0xfffffffe && Preferences::blob==blob);
+    assert(node._mt_packet_id==next_packet && Preferences::writes==writes);
+  }
+  node.foreign_pending=true;
+  assert(node.handleMeshtextCommand("set mt.node !12345678",reply,sizeof(reply)) && !strncmp(reply,"Error",5));
+  assert(node._mt_node==0xfffffffe && Preferences::blob==blob && Preferences::writes==writes); node.foreign_pending=false;
+  Preferences::fail_write=true;
+  assert(!node.saveMeshtextSettings(mesh::mt::Region::US,1,7,"BOB",0x12345678));
+  assert(node._mt_node==0xfffffffe && node._mt_node_override==0xfffffffe && !strcmp(node._mt_short_name,"ID"));
+  assert(node._mt_region==mesh::mt::Region::ANZ && node._mt_slot==2 && node._mt_hop_limit==3);
+  assert(node._mt_packet_id==next_packet && Preferences::blob==blob && !node._mt_active && !node._mt_settings_valid);
+  Preferences::fail_write=false; assert(node.saveMeshtextSettings(node._mt_region,node._mt_slot));
+  assert(node._mt_node==0xfffffffe && node._mt_node_override==0xfffffffe && node._mt_packet_id==next_packet);
+  assert(node.handleMeshtextCommand("set mt.node default",reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+  assert(node._mt_node==derived && !node._mt_node_override && node._mt_packet_id==next_packet);
+  assert(!strcmp(node._mt_short_name,"ID") && node._mt_region==mesh::mt::Region::ANZ && node._mt_slot==2 && node._mt_hop_limit==3);
+  auto decoded=decodeOwnText(node,"default",7); assert(decoded.from==derived);
+  // If NVS commits but readback fails, RAM keeps its prior identity while the
+  // backend suspends. A fresh boot may then adopt the committed override.
+  Preferences::fail_read=true; const uint32_t before_uncertain=node._mt_packet_id;
+  assert(!node.saveMeshtextSettings(node._mt_region,node._mt_slot,UINT8_MAX,nullptr,0x12345678));
+  assert(node._mt_node==derived && !node._mt_node_override && node._mt_packet_id==before_uncertain);
+  assert(!node._mt_active && !node._mt_settings_valid); Preferences::fail_read=false;
+  MyMesh reboot; reboot.stored[0]=node.stored[0]; reboot.beginMeshtext();
+  assert(reboot._mt_node==0x12345678 && reboot._mt_node_override==0x12345678 && reboot._mt_default_node==derived);
+  assert(!strcmp(reboot._mt_short_name,"ID") && reboot._mt_hop_limit==3);
+  assert(!memcmp(identity,node.self_id.pub_key,32) && !memcmp(identity,reboot.self_id.pub_key,32));
+  assertUntouched(reboot);
+  // Exercise the actual identity-refresh lifecycle after the durable-import
+  // boundary, independently hashing the imported public keys in Python.
+  Preferences::reset(); MyMesh imported; active(imported);
+  const auto original_sequence=imported._mt_packet_id;
+  assert(imported._mt_seen.remember(0x11223344,101));
+  const auto no_settings=Preferences::blob; const auto original_writes=Preferences::writes;
+  imported.self_id.pub_key[0]=43; imported.refreshMeshtextIdentity();
+  assert(imported._mt_default_node==@IMPORTED_NODE_43@ && imported._mt_node==@IMPORTED_NODE_43@);
+  assert(!imported._mt_node_override && imported._mt_packet_id==original_sequence);
+  assert(!imported._mt_seen.seen(0x11223344,101));
+  assert(Preferences::blob==no_settings && Preferences::writes==original_writes);
+  decoded=decodeOwnText(imported,"imported",8); assert(decoded.from==@IMPORTED_NODE_43@);
+  assert(imported.handleMeshtextCommand("set mt.node !12345678",reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+  const auto overridden_sequence=imported._mt_packet_id; const auto overridden_settings=Preferences::blob;
+  const auto overridden_writes=Preferences::writes;
+  assert(imported._mt_seen.remember(0x11223344,102));
+  imported.self_id.pub_key[0]=44; imported.refreshMeshtextIdentity();
+  assert(imported._mt_default_node==@IMPORTED_NODE_44@ && imported._mt_node==0x12345678);
+  assert(imported._mt_node_override==0x12345678 && imported._mt_packet_id==overridden_sequence);
+  assert(!imported._mt_seen.seen(0x11223344,102));
+  assert(Preferences::blob==overridden_settings && Preferences::writes==overridden_writes);
+  decoded=decodeOwnText(imported,"override",8); assert(decoded.from==0x12345678);
+  const auto reset_sequence=imported._mt_packet_id;
+  assert(imported.handleMeshtextCommand("set mt.node default",reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+  assert(imported._mt_node==@IMPORTED_NODE_44@ && imported._mt_default_node==@IMPORTED_NODE_44@);
+  assert(!imported._mt_node_override && imported._mt_packet_id==reset_sequence);
+  decoded=decodeOwnText(imported,"reset",5); assert(decoded.from==@IMPORTED_NODE_44@);
+  assert(imported._mt_packet_id==original_sequence+3 && imported.self_id.pub_key[0]==44);
+  puts("PASS node");
+}
+static void nodeinfo() {
+  test_random_seed=0x12345678;
+  Preferences::reset(); MyMesh node; active(node); char reply[256];
+  assertUntouched(node);
+  assert(node.handleMeshtextCommand("get mt.shortname",reply,sizeof(reply)));
+  char fallback[5]; snprintf(fallback,sizeof(fallback),"%04lx",(unsigned long)(node._mt_node&0xffff));
+  assert(strstr(reply,fallback) && strstr(reply,"manual NodeInfo only"));
+  const uint8_t expected_default[]=@NODEINFO_DEFAULT@,expected_named[]=@NODEINFO_NAMED@,
+      expected_utf8[]=@NODEINFO_UTF8@,expected_private[]=@NODEINFO_PRIVATE@;
+  const auto original_settings=Preferences::blob; const auto original_writes=Preferences::writes;
+  assert(node.handleMeshtextCommand("send mt.nodeinfo 0",reply,sizeof(reply)) && strstr(reply,"queued"));
+  assert(node.foreign.back()==std::vector<uint8_t>(expected_default,expected_default+sizeof(expected_default)));
+  assert(node.foreign_profile==1 && node.foreign_generation==node.radio.p.generation[1]);
+  assert(Preferences::blob==original_settings && Preferences::writes==original_writes);
+  const auto pending_id=node._mt_packet_id; const auto pending_count=node.foreign.size();
+  assert(node.handleMeshtextCommand("send mt.nodeinfo 0",reply,sizeof(reply)) && !strncmp(reply,"Error",5));
+  assert(node._mt_packet_id==pending_id && node.foreign.size()==pending_count);
+  assert(!node.sendMeshtextText(node.stored[0],"busy",4));
+  assert(!node.saveMeshtextSettings(mesh::mt::Region::US,0));
+  node.foreign_pending=false;
+  assert(node.handleMeshtextCommand("set mt.node !12345678",reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+  assert(node.handleMeshtextCommand("set mt.shortname MIKE",reply,sizeof(reply)) && !strncmp(reply,"OK",2));
+  strcpy(node._prefs.node_name,"Mike Carper");
+  assert(node.handleMeshtextCommand("send mt.nodeinfo 0",reply,sizeof(reply)) && strstr(reply,"queued"));
+  assert(node.foreign.back()==std::vector<uint8_t>(expected_named,expected_named+sizeof(expected_named)));
+  node.foreign_pending=false;
+  auto text=decodeOwnText(node,"hello",5);
+  assert(text.id==0x1234567a && !strcmp(text.text,"hello"));
+  const char* emojis="\xf0\x9f\x98\x80\xf0\x9f\x98\x80\xf0\x9f\x98\x80\xf0\x9f\x98\x80";
+  assert(node.saveMeshtextSettings(node._mt_region,node._mt_slot,UINT8_MAX,emojis));
+  memset(node._prefs.node_name,'A',22); strcpy(node._prefs.node_name+22,"\xe2\x82\xac" "rest");
+  assert(node.handleMeshtextCommand("get mt.shortname",reply,sizeof(reply)) && strstr(reply,"effective=\xf0\x9f\x98\x80 ("));
+  assert(node.handleMeshtextCommand("send mt.nodeinfo 0",reply,sizeof(reply)) && strstr(reply,"queued"));
+  assert(node.foreign.back()==std::vector<uint8_t>(expected_utf8,expected_utf8+sizeof(expected_utf8)));
+  assert(strlen(node._prefs.node_name)==29 && strlen(node._mt_short_name)==16); // no mutation
+  node.foreign_pending=false; node.commit(1,channel("mt-Team",32));
+  assert(node.handleMeshtextCommand("send mt.nodeinfo 1",reply,sizeof(reply)) && strstr(reply,"queued"));
+  assert(node.foreign.back()==std::vector<uint8_t>(expected_private,expected_private+sizeof(expected_private)));
+  node.foreign_pending=false;
+  const auto count=node.foreign.size(); const uint32_t packet=node._mt_packet_id;
+  node.commit(2,channel("ordinary"));
+  for(const char* bad:{"send mt.nodeinfo","send mt.nodeinfo ","send mt.nodeinfo -1",
+      "send mt.nodeinfo 8","send mt.nodeinfo 4294967296","send mt.nodeinfo 999999999999999",
+      "send mt.nodeinfo 0 extra","send mt.nodeinfo 2","send mt.nodeinfo 3"}) {
+    assert(node.handleMeshtextCommand(bad,reply,sizeof(reply)) && !strncmp(reply,"Error",5));
+    assert(node.foreign.size()==count && node._mt_packet_id==packet);
+  }
+  node.advance(3600000);
+  assert(node.foreign.size()==count && node._mt_packet_id==packet); // no hourly/periodic advert
+  node._radio_available=false; node.refreshMeshtextProfile();
+  assert(node.handleMeshtextCommand("send mt.nodeinfo 0",reply,sizeof(reply)) && !strncmp(reply,"Error",5));
+  node._radio_available=true; node.refreshMeshtextProfile();
+  strcpy(node._prefs.node_name,"\xc0\xaf");
+  assert(node.handleMeshtextCommand("send mt.nodeinfo 0",reply,sizeof(reply)) && !strncmp(reply,"Error",5));
+  assert(node.foreign.size()==count && node._mt_packet_id==packet);
+  strcpy(node._prefs.node_name,"Test");
+  node.admit_foreign=false;
+  assert(node.handleMeshtextCommand("send mt.nodeinfo 0",reply,sizeof(reply)) && !strncmp(reply,"Error",5));
+  assert(node.foreign.size()==count && node._mt_packet_id==packet+1); // failed nonce never reused
+  node.admit_foreign=true;
+  node.cli("set radio2 906.875,250,11,5,rx,16"); node.advance(2000);
+  assert(node._mt_active && !node.radio.p.canTransmit(1));
+  assert(node.handleMeshtextCommand("send mt.nodeinfo 0",reply,sizeof(reply)) && !strncmp(reply,"Error",5));
+  assert(node.foreign.size()==count && node._mt_packet_id==packet+1);
+  node.cli("set radio2 off"); node.advance(2000);
+  assert(node.handleMeshtextCommand("send mt.nodeinfo 0",reply,sizeof(reply)) && !strncmp(reply,"Error",5));
+  node.cli("set radio2 auto"); node.advance(2000);
+  node._mt_packet_id=UINT32_MAX;
+  assert(node.handleMeshtextCommand("send mt.nodeinfo 0",reply,sizeof(reply)) && strstr(reply,"queued"));
+  node.foreign_pending=false;
+  assert(node._mt_packet_id==0 && !node.sendMeshtextText(node.stored[0],"done",4));
+  assert(node.handleMeshtextCommand("send mt.nodeinfo 0",reply,sizeof(reply)) && !strncmp(reply,"Error",5));
+  MyMesh reboot; reboot.stored[0]=node.stored[0]; reboot.beginMeshtext();
+  assertUntouched(reboot); assert(!node.meshcore_sends);
+  puts("PASS nodeinfo");
+}
+int main(int argc,char** argv) {
+  assert(argc==2);
+  if(!strcmp(argv[1],"keys"))keys();
+  else if(!strcmp(argv[1],"auto"))automatic();
+  else if(!strcmp(argv[1],"conflicts"))conflicts();
+  else if(!strcmp(argv[1],"manual"))manual();
+  else if(!strcmp(argv[1],"settings"))settings();
+  else if(!strcmp(argv[1],"receive"))receive();
+  else if(!strcmp(argv[1],"transmit"))transmit();
+  else if(!strcmp(argv[1],"commands"))commands();
+  else if(!strcmp(argv[1],"cli"))privateCLI();
+  else if(!strcmp(argv[1],"hops"))hops();
+  else if(!strcmp(argv[1],"shortname"))shortname();
+  else if(!strcmp(argv[1],"node"))nodeOverride();
+  else if(!strcmp(argv[1],"nodeinfo"))nodeinfo();
+  else assert(!"unknown test case");
+}
diff --git a/test/test_cli_command_utils/test_cli_command_utils.cpp b/test/test_cli_command_utils/test_cli_command_utils.cpp
index bc1678629..e9efd818b 100644
--- a/test/test_cli_command_utils/test_cli_command_utils.cpp
+++ b/test/test_cli_command_utils/test_cli_command_utils.cpp
@@ -393,6 +393,11 @@ TEST(CLICommandUtils, MasksTerminalPasswordInput) {
   const char* wifi = "set wifi.pwd secret phrase";
   EXPECT_STREQ("secret phrase", mesh::cli::terminalPasswordInput(wifi));
   EXPECT_EQ(nullptr, mesh::cli::terminalPasswordInput("set wifi.pwd "));
+  EXPECT_FALSE(mesh::cli::shouldMaskTerminalInput("set mt.channel 1 mt-longfast "));
+  EXPECT_FALSE(mesh::cli::shouldMaskTerminalInput("get mt.channel 1"));
+  EXPECT_TRUE(mesh::cli::shouldMaskTerminalInput("set mt.channel 1 mt-longfast a"));
+  EXPECT_STREQ("secret", mesh::cli::terminalPasswordInput("SET MT.CHANNEL 1 mt-Team secret"));
+  EXPECT_STREQ("AQ==", mesh::cli::terminalPasswordInput("set mt.channel 1 mt-longfast AQ=="));
 }
 
 TEST(CLICommandUtils, BackspaceErasesAsciiAndUtf8Characters) {
diff --git a/test/test_companion_channel_alias.py b/test/test_companion_channel_alias.py
new file mode 100644
index 000000000..c6b16c977
--- /dev/null
+++ b/test/test_companion_channel_alias.py
@@ -0,0 +1,656 @@
+"""Execute Companion channel aliases with independent SHA-256 test vectors."""
+
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+from cpp_source import body
+
+ROOT = Path(__file__).resolve().parents[1]
+HASH_NAMES = (
+    "#emergency", "#r2-emergency", "#mt-emergency",
+    "#custom", "#r2-custom", "#mt-custom",
+)
+
+HARNESS = r'''
+#include <cassert>
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+#include <initializer_list>
+#include <helpers/CompanionChannelAlias.h>
+
+struct DigestVector { const char* text; uint8_t digest[32]; };
+static const DigestVector vectors[] = { @VECTORS@ };
+struct KeyDigestVector { uint8_t key[32]; size_t length; uint8_t digest[32]; };
+static const KeyDigestVector key_vectors[] = { @KEY_VECTORS@ };
+static void sha256(uint8_t* out, size_t out_length, const uint8_t* in, int in_length) {
+  assert(out && in && in_length >= 0 && out_length <= 32);
+  for (const auto& vector : vectors) {
+    if (strlen(vector.text) == static_cast<size_t>(in_length)
+        && !memcmp(vector.text, in, in_length)) {
+      memcpy(out, vector.digest, out_length);
+      return;
+    }
+  }
+  for (const auto& vector : key_vectors) {
+    if (vector.length == static_cast<size_t>(in_length) && !memcmp(vector.key, in, in_length)) {
+      memcpy(out, vector.digest, out_length);
+      return;
+    }
+  }
+  assert(!"unexpected input to independent SHA-256 oracle");
+}
+static void hashtagKey(const char* name, uint8_t out[32]) {
+  memset(out, 0, 32);
+  sha256(out, 16, reinterpret_cast<const uint8_t*>(name), strlen(name));
+}
+static void assertAlias(const char* name, CompanionChannelKind kind,
+                        bool hashtag, const char* tail) {
+  const auto parsed = parseCompanionChannelAlias(name);
+  assert(parsed.kind == kind);
+  assert(parsed.hashtag == hashtag);
+  assert(parsed.tail && !strcmp(parsed.tail, tail));
+}
+static void grammar() {
+  assertAlias("", CompanionChannelKind::MeshCore, false, "");
+  assert(parseCompanionChannelAlias(nullptr).kind == CompanionChannelKind::Invalid);
+  assertAlias("Public", CompanionChannelKind::MeshCore, false, "Public");
+  assertAlias("#emergency", CompanionChannelKind::MeshCore, true, "emergency");
+  assertAlias("r2-Public", CompanionChannelKind::Radio2, false, "Public");
+  assertAlias("#r2-emergency", CompanionChannelKind::Radio2, true, "emergency");
+  assertAlias("mt-LongFast", CompanionChannelKind::Meshtext, false, "LongFast");
+  assertAlias("#mt-emergency", CompanionChannelKind::Meshtext, true, "emergency");
+  // Routing markers must be complete, leading and case-sensitive.
+  assertAlias("r2", CompanionChannelKind::MeshCore, false, "r2");
+  assertAlias("mt", CompanionChannelKind::MeshCore, false, "mt");
+  assertAlias("R2-Public", CompanionChannelKind::MeshCore, false, "R2-Public");
+  assertAlias("#MT-emergency", CompanionChannelKind::MeshCore, true, "MT-emergency");
+  assertAlias("room-r2-Public", CompanionChannelKind::MeshCore, false, "room-r2-Public");
+  for (const auto* name : {"r2-", "#r2-", "mt-", "#mt-",
+                           "r2-#room", "mt-#room", "#r2-#room", "#mt-#room",
+                           "r2-r2-room", "r2-mt-room", "mt-r2-room", "mt-mt-room",
+                           "#r2-r2-room", "#r2-mt-room", "#mt-r2-room", "#mt-mt-room"}) {
+    assert(parseCompanionChannelAlias(name).kind == CompanionChannelKind::Invalid);
+  }
+  puts("PASS grammar");
+}
+static void canonical() {
+  struct Case { const char* display; const char* canonical; };
+  const Case cases[] = {{"Public", "Public"}, {"#emergency", "#emergency"},
+                        {"r2-Public", "Public"}, {"#r2-emergency", "#emergency"},
+                        {"mt-LongFast", "LongFast"}, {"#mt-emergency", "#emergency"}};
+  for (const auto& item : cases) {
+    char output[40];
+    assert(companionChannelCanonicalName(item.display, output, sizeof(output)));
+    assert(!strcmp(output, item.canonical));
+    // The exact terminating-NUL boundary must be accepted, never truncated.
+    assert(companionChannelCanonicalName(item.display, output, strlen(item.canonical) + 1));
+    assert(!strcmp(output, item.canonical));
+    assert(!companionChannelCanonicalName(item.display, output, strlen(item.canonical)));
+  }
+  char output[40];
+  assert(!companionChannelCanonicalName("#mt-", output, sizeof(output)));
+  assert(!companionChannelCanonicalName("#r2-mt-room", output, sizeof(output)));
+  assert(!companionChannelCanonicalName("#r2-emergency", nullptr, 40));
+  assert(!companionChannelCanonicalName(nullptr, output, sizeof(output)));
+  assert(!companionChannelCanonicalName("#r2-emergency", output, 0));
+  puts("PASS canonical");
+}
+static void keys() {
+  uint8_t canonical[32], alias[32], key[32], before[32];
+  hashtagKey("#emergency", canonical);
+  // Fixed published emergency vector also checks the Python-generated oracle.
+  const uint8_t emergency[16] = {0xe1,0xad,0x57,0x8d,0x25,0x10,0x8e,0x34,
+                                 0x48,0x08,0xf3,0x0d,0xfd,0xaa,0xf9,0x26};
+  assert(!memcmp(canonical, emergency, sizeof(emergency)));
+  for (const auto* name : {"#r2-emergency", "#mt-emergency"}) {
+    hashtagKey(name, alias);
+    memcpy(key, alias, 32);
+    resolveCompanionChannelKey(name, key, sha256);
+    assert(!memcmp(key, canonical, 32));
+    // A second resolution of a wire copy must not derive a new key.
+    resolveCompanionChannelKey(name, key, sha256);
+    assert(!memcmp(key, canonical, 32));
+    assert(memcmp(alias, canonical, 16));
+  }
+  hashtagKey("#custom", canonical);
+  for (const auto* name : {"#r2-custom", "#mt-custom"}) {
+    hashtagKey(name, key);
+    resolveCompanionChannelKey(name, key, sha256);
+    assert(!memcmp(key, canonical, 32));
+  }
+  // Unprefixed hashtag keys and non-hashtag channel keys retain exact bytes.
+  hashtagKey("#emergency", key); memcpy(before, key, 32);
+  resolveCompanionChannelKey("#emergency", key, sha256);
+  assert(!memcmp(key, before, 32));
+  for (const auto* name : {"Public", "r2-Public", "mt-LongFast",
+                           "#r2-emergency", "#mt-emergency", "#r2-mt-room"}) {
+    for (size_t i = 0; i < 16; ++i) key[i] = static_cast<uint8_t>(i + 1);
+    memset(key + 16, 0, 16); memcpy(before, key, 32);
+    resolveCompanionChannelKey(name, key, sha256);
+    assert(!memcmp(key, before, 32));
+    // A 256-bit custom PSK whose first half happens to equal the alias hash
+    // must remain a 256-bit key, rather than being replaced by a public key.
+    hashtagKey("#r2-emergency", key);
+    for (size_t i = 16; i < 32; ++i) key[i] = static_cast<uint8_t>(i + 1);
+    memcpy(before, key, 32);
+    resolveCompanionChannelKey(name, key, sha256);
+    assert(!memcmp(key, before, 32));
+  }
+  puts("PASS keys");
+}
+static void receive() {
+  for (const auto* name : {"Public", "#emergency"}) {
+    assert(companionChannelReceivePriority(name, 0) == 0);
+    assert(companionChannelReceivePriority(name, 1) == 1);
+    assert(companionChannelReceivePriority(name, 0, false) == 0);
+    assert(companionChannelReceivePriority(name, 1, false) == 1);
+  }
+  for (const auto* name : {"r2-Public", "#r2-emergency"}) {
+    assert(companionChannelReceivePriority(name, 0) == -1);
+    assert(companionChannelReceivePriority(name, 1) == 0);
+    assert(companionChannelReceivePriority(name, 0, false) == 0);
+    assert(companionChannelReceivePriority(name, 1, false) == 1);
+  }
+  for (const auto* name : {"mt-LongFast", "#mt-emergency"}) {
+    assert(companionChannelReceivePriority(name, 0) == -1);
+    assert(companionChannelReceivePriority(name, 1) == -1);
+    // Without a configured radio2, either prefix behaves as ordinary MeshCore.
+    assert(companionChannelReceivePriority(name, 0, false) == 0);
+    assert(companionChannelReceivePriority(name, 1, false) == 1);
+  }
+  for (const auto* name : {"#mt-", "#r2-mt-emergency"}) {
+    for (uint8_t origin : {0, 1}) {
+      assert(companionChannelReceivePriority(name, origin, true) == -1);
+      assert(companionChannelReceivePriority(name, origin, false) == -1);
+    }
+  }
+  puts("PASS receive");
+}
+int main(int argc, char** argv) {
+  assert(argc == 2);
+  if (!strcmp(argv[1], "grammar")) grammar();
+  else if (!strcmp(argv[1], "canonical")) canonical();
+  else if (!strcmp(argv[1], "keys")) keys();
+  else if (!strcmp(argv[1], "receive")) receive();
+  else assert(!"unknown test case");
+}
+'''
+
+RUNTIME_HARNESS = r'''
+#include <RadioProfiles.h>
+#define MAX_GROUP_CHANNELS 5
+#define MAX_PACKET_PAYLOAD 255
+namespace mesh {
+struct GroupChannel { uint8_t secret[32] = {}, hash[1] = {}, tx_radio = RADIO_TX_AUTO; };
+struct Packet { uint8_t radio_origin = 0, tx_radio = RADIO_TX_AUTO;
+                uint8_t payload[MAX_PACKET_PAYLOAD] = {}; int payload_len = 0; };
+struct Utils {
+  static void sha256(uint8_t* out, size_t length, const uint8_t* in, int in_length) {
+    ::sha256(out, length, in, in_length);
+  }
+  static bool isZeroes(const uint8_t* bytes, size_t length) {
+    for (size_t i = 0; i < length; ++i) if (bytes[i]) return false;
+    return true;
+  }
+  // The native test exercises the caller's authenticated-key gating, while
+  // substituting only the cipher primitive with an explicit key-match oracle.
+  static int MACThenDecrypt(const uint8_t* key, uint8_t*, const uint8_t* data, int length) {
+    return length == 16 && !memcmp(key, data, 16) ? 1 : 0;
+  }
+};
+}
+struct ChannelDetails { mesh::GroupChannel channel; char name[32] = {}; };
+struct Radio { mesh::RadioProfiles config; bool present = true;
+               mesh::RadioProfiles* profiles() { return present ? &config : nullptr; } };
+class BaseChatMesh {
+public:
+  ChannelDetails stored[MAX_GROUP_CHANNELS]; unsigned delivered = 0;
+  bool getChannel(int index, ChannelDetails& channel) {
+    if (index < 0 || index >= MAX_GROUP_CHANNELS) return false;
+    channel = stored[index]; return true;
+  }
+  bool setChannel(int index, const ChannelDetails& channel) {
+    if (index < 0 || index >= MAX_GROUP_CHANNELS) return false;
+    stored[index] = channel;
+    mesh::Utils::sha256(stored[index].channel.hash, sizeof(stored[index].channel.hash),
+                       channel.channel.secret,
+                       mesh::Utils::isZeroes(channel.channel.secret + 16, 16) ? 16 : 32);
+    return true;
+  }
+  void onGroupDataRecv(mesh::Packet*, uint8_t, const mesh::GroupChannel&, uint8_t*, size_t) {
+    ++delivered;
+  }
+};
+class MyMesh : public BaseChatMesh {
+public:
+  Radio radio; Radio* _radio = &radio;
+  bool isAliasRadio2Defined() const;
+  bool resolveChannelAlias(ChannelDetails&) const;
+  bool getChannel(int, ChannelDetails&);
+  bool setChannel(int, const ChannelDetails&);
+  int searchChannelsForPacket(const mesh::Packet*, const uint8_t*, mesh::GroupChannel[], int);
+  int findChannelIdxForPacket(const mesh::GroupChannel&, const mesh::Packet*);
+  bool allowGroupPacketOnRadio(mesh::Packet*);
+  void onGroupDataRecv(mesh::Packet*, uint8_t, const mesh::GroupChannel&, uint8_t*, size_t);
+  @SAVE_GETTER@
+};
+@METHODS@
+static ChannelDetails channel(const char* name) {
+  ChannelDetails value;
+  strcpy(value.name, name);
+  hashtagKey(name, value.channel.secret);
+  return value;
+}
+int main() {
+  MyMesh node;
+  node.radio.config.secondary.mode = mesh::RadioProfileMode::RxTx;
+  auto ordinary = channel("#emergency");
+  auto secondary = channel("#r2-emergency");
+  auto mt = channel("#mt-emergency");
+  ordinary.channel.tx_radio = mesh::RADIO_TX_BOTH;
+  secondary.channel.tx_radio = mesh::RADIO_TX_PRIMARY;
+  mt.channel.tx_radio = mesh::RADIO_TX_BOTH;
+  assert(node.setChannel(0, ordinary));
+  assert(node.setChannel(1, secondary));
+  assert(node.setChannel(2, mt));
+  ChannelDetails wire, raw;
+  assert(node.getChannel(1, wire));
+  assert(wire.channel.tx_radio == mesh::RADIO_TX_SECONDARY);
+  assert(!memcmp(wire.channel.secret, ordinary.channel.secret, 32));
+  uint8_t expected_hash;
+  sha256(&expected_hash, 1, ordinary.channel.secret, 16);
+  assert(wire.channel.hash[0] == expected_hash);
+  assert(node.getChannelForSave(1, raw));
+  assert(!strcmp(raw.name, secondary.name));
+  assert(!memcmp(raw.channel.secret, secondary.channel.secret, 32));
+  assert(raw.channel.tx_radio == mesh::RADIO_TX_PRIMARY);
+  // Applying the raw GET/persistence representation again must be idempotent.
+  assert(node.setChannel(1, raw) && node.getChannel(1, wire));
+  assert(!memcmp(wire.channel.secret, ordinary.channel.secret, 32));
+  assert(node.getChannel(2, wire));
+  assert(wire.channel.tx_radio == mesh::RADIO_TX_OFF);
+  assert(!memcmp(wire.channel.secret, ordinary.channel.secret, 32));
+  assert(node.getChannelForSave(2, raw));
+  assert(!memcmp(raw.channel.secret, mt.channel.secret, 32));
+  assert(raw.channel.tx_radio == mesh::RADIO_TX_BOTH);
+  // Both Rx and RxTx define the secondary profile. The real RadioProfiles
+  // transmit permission remains distinct from the channel's routing policy.
+  for (auto mode : {mesh::RadioProfileMode::Rx, mesh::RadioProfileMode::RxTx}) {
+    node.radio.config.secondary.mode = mode;
+    assert(node.isAliasRadio2Defined());
+    assert(node.getChannel(0, wire) && wire.channel.tx_radio == mesh::RADIO_TX_BOTH);
+    assert(node.getChannel(1, wire) && wire.channel.tx_radio == mesh::RADIO_TX_SECONDARY);
+    assert(node.getChannel(2, wire) && wire.channel.tx_radio == mesh::RADIO_TX_OFF);
+    assert(node.radio.config.canTransmit(1) == (mode == mesh::RadioProfileMode::RxTx));
+  }
+
+  mesh::Packet packet;
+  packet.payload[0] = wire.channel.hash[0]; packet.payload_len = 17;
+  memcpy(packet.payload + 1, ordinary.channel.secret, 16);
+  mesh::GroupChannel matches[4];
+  assert(node.allowGroupPacketOnRadio(&packet));
+  assert(packet.tx_radio == mesh::RADIO_TX_AUTO); // the ordinary primary slot wins
+  assert(node.searchChannelsForPacket(&packet, packet.payload, matches, 4) == 1);
+  assert(node.findChannelIdxForPacket(matches[0], &packet) == 0);
+  packet.radio_origin = 1;
+  assert(node.allowGroupPacketOnRadio(&packet));
+  assert(packet.tx_radio == mesh::RADIO_TX_SECONDARY); // bound before local delivery
+  assert(node.searchChannelsForPacket(&packet, packet.payload, matches, 4) == 1);
+  assert(node.findChannelIdxForPacket(matches[0], &packet) == 1);
+  uint8_t data = 0;
+  node.onGroupDataRecv(&packet, 0, matches[0], &data, 1);
+  assert(node.delivered == 1 && packet.tx_radio == mesh::RADIO_TX_SECONDARY);
+
+  ChannelDetails empty;
+  assert(node.setChannel(0, empty));
+  packet.tx_radio = mesh::RADIO_TX_AUTO;
+  assert(node.allowGroupPacketOnRadio(&packet));
+  assert(packet.tx_radio == mesh::RADIO_TX_SECONDARY); // alias-only secondary admission
+  packet.radio_origin = 0;
+  packet.tx_radio = mesh::RADIO_TX_AUTO;
+  assert(!node.allowGroupPacketOnRadio(&packet)); // authenticated alias on wrong radio
+  assert(packet.tx_radio == mesh::RADIO_TX_AUTO);
+  packet.payload[1] ^= 1;
+  assert(node.allowGroupPacketOnRadio(&packet)); // hash match alone is insufficient
+  packet.payload[1] ^= 1;
+  assert(node.setChannel(1, empty));
+  for (uint8_t origin : {0, 1}) {
+    packet.radio_origin = origin;
+    assert(node.searchChannelsForPacket(&packet, packet.payload, matches, 4) == 0);
+    assert(node.findChannelIdxForPacket(wire.channel, &packet) == -1);
+    assert(!node.allowGroupPacketOnRadio(&packet)); // configured MT cannot enter MeshCore
+    uint8_t blocked_data = 0;
+    const auto before_delivery = node.delivered;
+    node.onGroupDataRecv(&packet, 0, wire.channel, &blocked_data, 1);
+    assert(node.delivered == before_delivery);
+  }
+  // Both disabled secondary profile and an absent profile ignore routing markers.
+  for (bool absent : {false, true}) {
+    node.radio.config.secondary.mode = mesh::RadioProfileMode::Off; node.radio.present = !absent;
+    assert(!node.isAliasRadio2Defined());
+    assert(node.getChannel(2, wire) && wire.channel.tx_radio == mesh::RADIO_TX_BOTH);
+    assert(!memcmp(wire.channel.secret, ordinary.channel.secret, 32));
+    for (uint8_t origin : {0, 1}) {
+      packet.radio_origin = origin;
+      assert(node.allowGroupPacketOnRadio(&packet));
+      assert(node.searchChannelsForPacket(&packet, packet.payload, matches, 4) == 1);
+      assert(node.findChannelIdxForPacket(matches[0], &packet) == 2);
+    }
+    assert(node.setChannel(1, secondary) && node.getChannel(1, wire));
+    assert(wire.channel.tx_radio == mesh::RADIO_TX_PRIMARY);
+    assert(!memcmp(wire.channel.secret, ordinary.channel.secret, 32));
+    assert(node.setChannel(1, empty));
+  }
+  // Custom private keys survive both wire resolution and storage access.
+  ChannelDetails custom = secondary;
+  for (size_t i = 0; i < 16; ++i) custom.channel.secret[i] = static_cast<uint8_t>(i + 1);
+  assert(node.setChannel(3, custom) && node.getChannel(3, wire));
+  assert(!memcmp(wire.channel.secret, custom.channel.secret, 32));
+  assert(node.getChannelForSave(3, raw));
+  assert(!memcmp(raw.channel.secret, custom.channel.secret, 32));
+  custom = secondary;
+  for (size_t i = 16; i < 32; ++i) custom.channel.secret[i] = static_cast<uint8_t>(i + 1);
+  assert(node.setChannel(3, custom) && node.getChannel(3, wire));
+  assert(!memcmp(wire.channel.secret, custom.channel.secret, 32));
+  assert(node.getChannelForSave(3, raw));
+  assert(!memcmp(raw.channel.secret, custom.channel.secret, 32));
+  strcpy(custom.name, "#r2-mt-room");
+  assert(!node.setChannel(3, custom));
+  assert(!node.getChannel(-1, wire) && !node.setChannel(MAX_GROUP_CHANNELS, custom));
+  puts("PASS runtime raw/wire keys, receive aliases and radio2 fallback");
+}
+'''
+
+COMMAND_STUBS = r'''
+struct StrHelper {
+  static void strncpy(char* out, const char* in, size_t length) {
+    assert(length > 0);
+    ::strncpy(out, in, length - 1); out[length - 1] = 0;
+  }
+};
+struct Serial {
+  uint8_t frame[128] = {}; int length = 0;
+  void writeFrame(const uint8_t* data, int size) {
+    assert(size >= 0 && size <= static_cast<int>(sizeof(frame)));
+    memcpy(frame, data, size); length = size;
+  }
+};
+'''
+
+COMMAND_MEMBERS = r'''
+  Serial serial; Serial* _serial = &serial;
+  bool save_result = true, ok = false; int error = -1; unsigned save_calls = 0;
+  bool saveChannels() { ++save_calls; return save_result; }
+  void writeErrFrame(uint8_t code) { error = code; }
+  void writeOKFrame() { ok = true; }
+  void command(uint8_t*, int);
+'''
+
+COMMAND_HARNESS = r'''
+void MyMesh::command(uint8_t* cmd_frame, int len) {
+  uint8_t out_frame[128] = {};
+  error = -1; ok = false; serial.length = 0;
+  @COMMAND_BRANCHES@
+}
+static void applySet(MyMesh& node, uint8_t index, const ChannelDetails& value, int key_bytes = 16) {
+  uint8_t frame[66] = {CMD_SET_CHANNEL, index};
+  memcpy(frame + 2, value.name, 32);
+  memcpy(frame + 34, value.channel.secret, key_bytes);
+  node.command(frame, 34 + key_bytes);
+}
+static void expectRaw(MyMesh& node, uint8_t index, const ChannelDetails& expected) {
+  ChannelDetails raw;
+  assert(node.getChannelForSave(index, raw));
+  assert(!strcmp(raw.name, expected.name));
+  assert(!memcmp(raw.channel.secret, expected.channel.secret, 32));
+  assert(raw.channel.tx_radio == expected.channel.tx_radio);
+}
+static void expectGet(MyMesh& node, uint8_t index, const ChannelDetails& expected) {
+  uint8_t command[2] = {CMD_GET_CHANNEL, index};
+  node.command(command, sizeof(command));
+  assert(node.error == -1 && !node.ok && node.serial.length == 50);
+  assert(node.serial.frame[0] == RESP_CODE_CHANNEL_INFO && node.serial.frame[1] == index);
+  assert(!strcmp(reinterpret_cast<const char*>(node.serial.frame + 2), expected.name));
+  assert(!memcmp(node.serial.frame + 34, expected.channel.secret, 16));
+}
+int main() {
+  MyMesh node;
+  node.radio.config.secondary.mode = mesh::RadioProfileMode::RxTx;
+  auto original = channel("#r2-emergency");
+  original.channel.tx_radio = mesh::RADIO_TX_BOTH;
+  assert(node.setChannel(0, original));
+  expectGet(node, 0, original);
+  ChannelDetails wire;
+  assert(node.getChannel(0, wire));
+  assert(memcmp(node.serial.frame + 34, wire.channel.secret, 16)); // GET is not the wire key
+
+  // Switching the display alias without changing the canonical key preserves
+  // the user's raw manual policy, not the alias's effective secondary policy.
+  auto ordinary = channel("#emergency");
+  applySet(node, 0, ordinary);
+  assert(node.ok && node.error == -1 && node.save_calls == 1);
+  ordinary.channel.tx_radio = mesh::RADIO_TX_BOTH;
+  expectRaw(node, 0, ordinary);
+  applySet(node, 0, original);
+  assert(node.ok && node.error == -1 && node.save_calls == 2);
+  expectRaw(node, 0, original);
+  expectGet(node, 0, original);
+
+  // Failed persistence restores the exact app representation. In particular,
+  // it must not replace the stored prefixed hashtag key with its wire key.
+  node.save_result = false;
+  const auto replacement = channel("#r2-custom");
+  applySet(node, 0, replacement);
+  assert(!node.ok && node.error == ERR_CODE_FILE_IO_ERROR && node.save_calls == 3);
+  expectRaw(node, 0, original);
+  expectGet(node, 0, original);
+  node.save_result = true;
+
+  // A genuinely different private PSK resets manual routing to AUTO.
+  auto private_channel = original;
+  for (size_t i = 0; i < 16; ++i) private_channel.channel.secret[i] = static_cast<uint8_t>(i + 1);
+  private_channel.channel.tx_radio = mesh::RADIO_TX_AUTO;
+  applySet(node, 0, private_channel);
+  assert(node.ok && node.error == -1 && node.save_calls == 4);
+  expectRaw(node, 0, private_channel);
+  assert(node.getChannel(0, wire));
+  assert(!memcmp(wire.channel.secret, private_channel.channel.secret, 32));
+  // Reapplying an unchanged private key retains an explicitly saved policy.
+  private_channel.channel.tx_radio = mesh::RADIO_TX_PRIMARY;
+  assert(node.setChannel(0, private_channel));
+  applySet(node, 0, private_channel);
+  assert(node.ok && node.error == -1 && node.save_calls == 5);
+  expectRaw(node, 0, private_channel);
+
+  auto invalid = private_channel;
+  strcpy(invalid.name, "#r2-mt-emergency");
+  applySet(node, 0, invalid);
+  assert(!node.ok && node.error == ERR_CODE_ILLEGAL_ARG && node.save_calls == 5);
+  expectRaw(node, 0, private_channel);
+  const auto mt = channel("#mt-emergency");
+  applySet(node, 0, mt);
+  assert(!node.ok && node.error == ERR_CODE_UNSUPPORTED_CMD && node.save_calls == 5);
+  expectRaw(node, 0, private_channel);
+
+  // Disabled or absent radio2 permits the MT display marker only as an
+  // ordinary MeshCore channel; it does not activate Meshtext transport.
+  node.radio.config.secondary.mode = mesh::RadioProfileMode::Off;
+  applySet(node, 0, mt);
+  assert(node.ok && node.error == -1 && node.save_calls == 6);
+  expectRaw(node, 0, mt);
+  expectGet(node, 0, mt);
+  assert(node.getChannel(0, wire));
+  assert(wire.channel.tx_radio == mesh::RADIO_TX_AUTO);
+  assert(!memcmp(wire.channel.secret, ordinary.channel.secret, 32));
+  node.radio.present = false;
+  applySet(node, 0, mt);
+  assert(node.ok && node.error == -1 && node.save_calls == 7);
+  expectRaw(node, 0, mt);
+
+  // Binary framing remains 128-bit only; larger keys are not silently cut.
+  applySet(node, 0, mt, 32);
+  assert(!node.ok && node.error == ERR_CODE_UNSUPPORTED_CMD && node.save_calls == 7);
+  expectRaw(node, 0, mt);
+  applySet(node, MAX_GROUP_CHANNELS, mt);
+  assert(!node.ok && node.error == ERR_CODE_NOT_FOUND && node.save_calls == 7);
+  uint8_t bad_get[] = {CMD_GET_CHANNEL, MAX_GROUP_CHANNELS};
+  node.command(bad_get, sizeof(bad_get));
+  assert(node.error == ERR_CODE_NOT_FOUND && node.serial.length == 0);
+  puts("PASS command raw GET, canonical-key SET, rollback and unsupported transport");
+}
+'''
+
+
+def oracle_vectors():
+    vectors = ",\n".join(
+        "{" + json.dumps(name) + ",{" + ",".join(map(str, hashlib.sha256(name.encode()).digest())) + "}}"
+        for name in HASH_NAMES
+    )
+    keys = [hashlib.sha256(name.encode()).digest()[:16] for name in HASH_NAMES]
+    keys += [bytes(16), bytes(range(1, 17)),
+             hashlib.sha256(b"#r2-emergency").digest()[:16] + bytes(range(17, 33))]
+    key_vectors = ",\n".join(
+        "{{" + ",".join(map(str, key)) + "}," + str(len(key)) + ",{" +
+        ",".join(map(str, hashlib.sha256(key).digest())) + "}}" for key in keys
+    )
+    return vectors, key_vectors
+
+
+class CompanionChannelAliasTest(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        compiler = os.environ.get("CXX") or shutil.which("g++") or shutil.which("clang++")
+        if not compiler:
+            raise unittest.SkipTest("a host C++ compiler is required")
+        cls.temporary = tempfile.TemporaryDirectory(prefix="meshcore-channel-alias-")
+        cls.addClassCleanup(cls.temporary.cleanup)
+        work = Path(cls.temporary.name)
+        cls.binary = work / ("alias.exe" if sys.platform == "win32" else "alias")
+        vectors, key_vectors = oracle_vectors()
+        source = work / "alias.cpp"
+        source.write_text(HARNESS.replace("@VECTORS@", vectors).replace("@KEY_VECTORS@", key_vectors), encoding="utf-8")
+        sanitizers = (["-fsanitize=address,undefined", "-fno-sanitize-recover=all",
+                       "-fno-pie", "-no-pie"] if sys.platform.startswith("linux") else [])
+        built = subprocess.run(
+            [compiler, "-std=c++11", "-Wall", "-Wextra", "-Werror", *sanitizers,
+             "-I" + str(ROOT / "src"), str(source), "-o", str(cls.binary)],
+            capture_output=True, text=True, timeout=60,
+        )
+        if built.returncode:
+            raise AssertionError(built.stdout + built.stderr)
+
+    def run_case(self, case):
+        checked = subprocess.run([str(self.binary), case], capture_output=True, text=True, timeout=30)
+        self.assertEqual(checked.returncode, 0, checked.stdout + checked.stderr)
+        self.assertIn("PASS " + case, checked.stdout)
+
+    def test_prefix_grammar(self):
+        self.run_case("grammar")
+
+    def test_canonical_names_and_output_bounds(self):
+        self.run_case("canonical")
+
+    def test_independent_sha256_vectors_and_custom_keys(self):
+        self.run_case("keys")
+
+    def test_receive_priority_and_unconfigured_radio2_fallback(self):
+        self.run_case("receive")
+
+    def test_core_admission_precedes_group_seen_and_direct_forward(self):
+        core = (ROOT / "src/Mesh.cpp").read_text(encoding="utf-8")
+        received = body(core, "DispatcherAction Mesh::onRecvPacket(Packet* pkt)")
+        gate = re.search(
+            r"if\s*\(\(pkt->getPayloadType\(\)\s*==\s*PAYLOAD_TYPE_GRP_TXT\s*"
+            r"\|\|\s*pkt->getPayloadType\(\)\s*==\s*PAYLOAD_TYPE_GRP_DATA\)\s*"
+            r"&&\s*!allowGroupPacketOnRadio\(pkt\)\)\s*return ACTION_RELEASE;", received,
+        )
+        self.assertIsNotNone(gate, "both encrypted group types must pass admission")
+        # TRACE has an unrelated earlier direct block; check the general
+        # direct-path branch, whose relaying runs before local group delivery.
+        direct = received.index("if (pkt->isRouteDirect() && pkt->getPathHashCount() > 0)")
+        group = received.index("case PAYLOAD_TYPE_GRP_DATA:")
+        group_seen = received.index("_tables->markSeen(pkt);", group)
+        candidates = received.index("searchChannelsForPacket(pkt, &channel_hash, channels, 4)", group)
+        delivery = received.index("onGroupDataRecv(pkt,", candidates)
+        self.assertLess(gate.end(), direct)
+        self.assertLess(gate.end(), group_seen)
+        self.assertLess(group_seen, candidates)
+        self.assertLess(candidates, delivery)
+        header = (ROOT / "src/Mesh.h").read_text(encoding="utf-8")
+        self.assertRegex(header, r"virtual bool allowGroupPacketOnRadio\(Packet\* packet\)\s*\{ return true; \}")
+
+    def test_production_channel_access_and_receive_resolution(self):
+        companion = (ROOT / "examples/companion_radio/MyMesh.cpp").read_text(encoding="utf-8")
+        header = (ROOT / "examples/companion_radio/MyMesh.h").read_text(encoding="utf-8")
+        signatures = (
+            "bool MyMesh::isAliasRadio2Defined(", "bool MyMesh::resolveChannelAlias(",
+            "bool MyMesh::getChannel(", "bool MyMesh::setChannel(",
+            "int MyMesh::searchChannelsForPacket(", "int MyMesh::findChannelIdxForPacket(",
+            "bool MyMesh::allowGroupPacketOnRadio(", "void MyMesh::onGroupDataRecv(",
+        )
+        methods = "\n".join(body(companion, signature) for signature in signatures)
+        save_getter = body(header, "bool getChannelForSave(uint8_t").replace("override", "")
+        shared = HARNESS[:HARNESS.index("static void assertAlias(")]
+        vectors, key_vectors = oracle_vectors()
+        source_text = (shared + RUNTIME_HARNESS).replace("@VECTORS@", vectors).replace(
+            "@KEY_VECTORS@", key_vectors).replace("@METHODS@", methods).replace("@SAVE_GETTER@", save_getter)
+        self.run_native_program(source_text, "runtime")
+
+    def test_production_binary_get_set_raw_keys_and_rollback(self):
+        companion = (ROOT / "examples/companion_radio/MyMesh.cpp").read_text(encoding="utf-8")
+        header = (ROOT / "examples/companion_radio/MyMesh.h").read_text(encoding="utf-8")
+        signatures = ("bool MyMesh::isAliasRadio2Defined(", "bool MyMesh::resolveChannelAlias(",
+                      "bool MyMesh::getChannel(", "bool MyMesh::setChannel(")
+        methods = "\n".join(body(companion, signature) for signature in signatures)
+        save_getter = body(header, "bool getChannelForSave(uint8_t").replace("override", "")
+        command_signatures = (
+            "if (cmd_frame[0] == CMD_GET_CHANNEL && len >= 2)",
+            "if (cmd_frame[0] == CMD_SET_CHANNEL && len >= 2 + 32 + 32)",
+            "if (cmd_frame[0] == CMD_SET_CHANNEL && len >= 2 + 32 + 16)",
+        )
+        branches = " else ".join(body(companion, signature) for signature in command_signatures)
+        macros = ("CMD_GET_CHANNEL", "CMD_SET_CHANNEL", "RESP_CODE_CHANNEL_INFO",
+                  "ERR_CODE_UNSUPPORTED_CMD", "ERR_CODE_NOT_FOUND", "ERR_CODE_FILE_IO_ERROR",
+                  "ERR_CODE_ILLEGAL_ARG")
+        constants = "\n".join(re.search(r"^#define\s+" + name + r"\s+[^\r\n]+", companion,
+                                        flags=re.MULTILINE).group(0) for name in macros)
+        shared = HARNESS[:HARNESS.index("static void assertAlias(")]
+        fixture = RUNTIME_HARNESS[:RUNTIME_HARNESS.index("\nint main()")]
+        fixture = fixture.replace("class MyMesh :", COMMAND_STUBS + "\nclass MyMesh :")
+        fixture = fixture.replace("@SAVE_GETTER@", save_getter + "\n" + COMMAND_MEMBERS)
+        vectors, key_vectors = oracle_vectors()
+        source_text = (shared + constants + "\n" + fixture + COMMAND_HARNESS).replace(
+            "@VECTORS@", vectors).replace("@KEY_VECTORS@", key_vectors).replace(
+            "@METHODS@", methods).replace("@COMMAND_BRANCHES@", branches)
+        self.run_native_program(source_text, "command")
+
+    def run_native_program(self, source_text, expected):
+        compiler = os.environ.get("CXX") or shutil.which("g++") or shutil.which("clang++")
+        with tempfile.TemporaryDirectory(prefix="meshcore-channel-runtime-") as directory:
+            work = Path(directory)
+            source = work / "runtime.cpp"
+            source.write_text(source_text, encoding="utf-8")
+            binary = work / ("runtime.exe" if sys.platform == "win32" else "runtime")
+            sanitizers = (["-fsanitize=address,undefined", "-fno-sanitize-recover=all",
+                           "-fno-pie", "-no-pie"] if sys.platform.startswith("linux") else [])
+            built = subprocess.run(
+                [compiler, "-std=c++11", "-Wall", "-Wextra", "-Werror", *sanitizers,
+                 "-I" + str(ROOT / "src"), str(source), "-o", str(binary)],
+                capture_output=True, text=True, timeout=60,
+            )
+            self.assertEqual(built.returncode, 0, built.stdout + built.stderr)
+            checked = subprocess.run([str(binary)], capture_output=True, text=True, timeout=30)
+            self.assertEqual(checked.returncode, 0, checked.stdout + checked.stderr)
+            self.assertIn("PASS " + expected, checked.stdout)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/test/test_companion_lost_reply.py b/test/test_companion_lost_reply.py
index 290d5875c..9c80e166a 100644
--- a/test/test_companion_lost_reply.py
+++ b/test/test_companion_lost_reply.py
@@ -31,7 +31,8 @@ class CompanionLostReplyTests(unittest.TestCase):
         methods += "\n".join(extract_braced(source, signature) for signature in (
             "void MyMesh::onMessageRecv(",
             "void MyMesh::onCLICommandRecv(", "bool MyMesh::onSignedMessageRecv(",
-            "void MyMesh::onChannelMessageRecv(", "void MyMesh::clearExpectedAck(",
+            "void MyMesh::onChannelMessageRecv(", "bool MyMesh::queueChannelText(",
+            "void MyMesh::clearExpectedAck(",
             "void MyMesh::expireExpectedAcks(", "bool MyMesh::processAck(",
         ))
         methods += "\n" + "\n".join(extract_braced(base, signature).replace(
diff --git a/test/test_companion_meshtext.py b/test/test_companion_meshtext.py
new file mode 100644
index 000000000..1eccfc179
--- /dev/null
+++ b/test/test_companion_meshtext.py
@@ -0,0 +1,215 @@
+"""Run actual Companion Meshtext methods with real CLI/AES/SHA and bounded adapters.
+
+No PlatformIO or hardware is used. Only filesystem/NVS, the serial/UI boundary,
+and the foreign-frame queue are substituted. Protocol/profile decisions remain
+the production code, extracted without rewriting their bodies.
+"""
+
+import hashlib
+import os
+from pathlib import Path
+import re
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+
+from cpp_source import body
+from test_meshtext_chat import array, data_text, reference_frame, varint
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+class CompanionMeshtextTest(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        try:
+            import cryptography  # noqa: F401
+        except ImportError:
+            raise unittest.SkipTest("Python cryptography is required for independent receive frames")
+        compiler = os.environ.get("CXX") or shutil.which("g++") or shutil.which("clang++")
+        if not compiler:
+            raise unittest.SkipTest("a host C++ compiler is required")
+        required = ["AESCommon.cpp", "AES128.cpp", "AES256.cpp", "BlockCipher.cpp",
+                    "Crypto.cpp", "SHA256.cpp", "Hash.cpp"]
+        override = os.environ.get("MESHCORE_CRYPTO_DIR")
+        candidates = [Path(override)] if override else sorted((ROOT / ".pio/libdeps").glob("*/Crypto"))
+        crypto = next((path for path in candidates if all((path / name).is_file() for name in required)), None)
+        if not crypto:
+            raise unittest.SkipTest("an existing rweather/Crypto checkout is required (MESHCORE_CRYPTO_DIR)")
+        cls.temp = tempfile.TemporaryDirectory(prefix="meshcore-companion-mt-")
+        cls.addClassCleanup(cls.temp.cleanup)
+        work = Path(cls.temp.name)
+        # Identity.h uses a quoted Utils include. Shadow both to keep the real
+        # SHA implementation rather than the general native tests' zero hash.
+        utils = (ROOT / "test/mocks/Utils.h").read_text(encoding="utf-8")
+        fake_sha = body(utils, "static void sha256(")
+        utils = utils.replace(fake_sha, "static void sha256(uint8_t*, size_t, const uint8_t*, int);")
+        utils = utils.replace("#define CIPHER_MAC_SIZE 16", "#ifndef CIPHER_MAC_SIZE\n#define CIPHER_MAC_SIZE 16\n#endif")
+        utils = utils.replace("class Utils {", "class Utils {\npublic:\n  static bool isHexChar(char);\n  static bool fromHex(uint8_t*, int, const char*);\n  static bool isZeroes(const uint8_t* p, size_t n) {\n    for (size_t i=0;i<n;++i) { if(p[i]) return false; }\n    return true;\n  }")
+        (work / "Utils.h").write_text(utils, encoding="utf-8")
+        identity = (ROOT / "test/mocks/Identity.h").read_text(encoding="utf-8")
+        (work / "Identity.h").write_text(identity.replace('"Utils.h"', '<Utils.h>'), encoding="utf-8")
+
+        source = (ROOT / "examples/companion_radio/MyMesh.cpp").read_text(encoding="utf-8")
+        mt = (ROOT / "examples/companion_radio/MeshtextCompanion.cpp").read_text(encoding="utf-8")
+        mt = mt[mt.index("namespace {"):].rsplit("#endif", 1)[0]
+        signatures = ("bool MyMesh::isAliasRadio2Defined(", "bool MyMesh::resolveChannelAlias(",
+                      "bool MyMesh::getChannel(", "bool MyMesh::setChannel(", "bool MyMesh::queueChannelText(")
+        methods = "\n".join(body(source, signature) for signature in signatures)
+        utils_source = (ROOT / "src/Utils.cpp").read_text(encoding="utf-8")
+        # CLI keys use the production strict hexadecimal parser as well.
+        methods = ("namespace mesh {\n" + "\n".join(body(utils_source, signature) for signature in
+                   ("static uint8_t hexVal(", "bool Utils::isHexChar(", "bool Utils::fromHex("))
+                   + "\n}\n" + methods)
+        branches = " else ".join(body(source, signature) for signature in (
+            "if (cmd_frame[0] == CMD_GET_CHANNEL && len >= 2)",
+            "if (cmd_frame[0] == CMD_SET_CHANNEL && len >= 2 + 32 + 32)",
+            "if (cmd_frame[0] == CMD_SET_CHANNEL && len >= 2 + 32 + 16)",
+            "if (cmd_frame[0] == CMD_SEND_CHANNEL_TXT_MSG)",
+        ))
+        constants = []
+        for name in ("CMD_GET_CHANNEL", "CMD_SET_CHANNEL", "CMD_SEND_CHANNEL_TXT_MSG",
+                     "RESP_CODE_CHANNEL_INFO", "RESP_CODE_CHANNEL_MSG_RECV", "RESP_CODE_CHANNEL_MSG_RECV_V3",
+                     "PUSH_CODE_MSG_WAITING", "ERR_CODE_UNSUPPORTED_CMD", "ERR_CODE_NOT_FOUND",
+                     "ERR_CODE_FILE_IO_ERROR", "ERR_CODE_ILLEGAL_ARG", "ERR_CODE_BAD_STATE"):
+            constants.append(re.search(r"^#define\s+" + name + r"\s+[^\r\n]+", source, re.MULTILINE).group(0))
+        fixture = (ROOT / "test/fixtures/radio_profiles/cli_test.cpp").read_text(encoding="utf-8")
+        fixture = fixture[:fixture.index("static void permanentScheduleOrder()")]
+        text = (ROOT / "test/fixtures/companion_meshtext.cpp").read_text(encoding="utf-8")
+        payload = ("A" * 153 + "\u20ac" + "B" * 69).encode()  # 225 bytes, truncation splits a scalar
+        vectors = {
+            "@RX_FRAME@": reference_frame(data_text(payload), packet_id=101),
+            "@RX_RETRY@": reference_frame(data_text(b"retry"), packet_id=102),
+            "@RX_DM@": reference_frame(data_text(b"dm"), to=0x99887766, packet_id=103),
+            "@RX_ACK@": reference_frame(data_text(b"want ack") + b"\x18\x01", flags=0x6B, packet_id=104),
+            "@RX_OTHER@": reference_frame(b"\x08\x02\x12\x01x", packet_id=105),
+        }
+        # Independent standard User/NodeInfo wire expectations; never encode
+        # an expected NodeInfo through the production codec under test.
+        def nodeinfo_frame(sender, packet_id, long_name, short_name, name="LongFast", key=None):
+            def field(number, value):
+                return varint((number << 3) | 2) + varint(len(value)) + value
+            user = field(1, ("!%08x" % sender).encode())
+            if long_name:
+                user += field(2, long_name)
+            user += field(3, short_name) + b"\x38\x01\x48\x01"  # CLIENT_MUTE; no DMs
+            data = b"\x08\x04" + field(2, user)  # NODEINFO_APP, no want_response
+            args = {} if key is None else {"key": key}
+            return reference_frame(data, name, sender=sender, packet_id=packet_id, flags=0xE7, **args)
+        default_node = int.from_bytes(hashlib.sha256(bytes([42]) + bytes(31)).digest()[:4], "little")
+        vectors.update({
+            "@NODEINFO_DEFAULT@": nodeinfo_frame(default_node, 0x12345678, b"Test",
+                                                ("%04x" % (default_node & 0xFFFF)).encode()),
+            "@NODEINFO_NAMED@": nodeinfo_frame(0x12345678, 0x12345679, b"Mike Carper", b"MIKE"),
+            "@NODEINFO_UTF8@": nodeinfo_frame(0x12345678, 0x1234567B, b"A" * 22, "\U0001f600".encode()),
+            "@NODEINFO_PRIVATE@": nodeinfo_frame(0x12345678, 0x1234567C, b"A" * 22,
+                                                "\U0001f600".encode(), "Team", bytes(range(1, 33))),
+        })
+        text = text.replace("@FIXTURE@", fixture).replace("@CONSTANTS@", "\n".join(constants))
+        text = text.replace("@METHODS@", methods + "\n" + mt).replace("@COMMANDS@", branches)
+        for marker, frame in vectors.items():
+            text = text.replace(marker, array(frame))
+        legacy = bytearray(16)
+        legacy[:4] = b"MT01"
+        legacy[4] = 1  # Region::US; old reserved bytes 5..7 must remain zero.
+        legacy[8:12] = (2).to_bytes(4, "little")
+        legacy[12:] = hashlib.sha256(legacy[:12]).digest()[:4]
+        text = text.replace("@LEGACY_SETTINGS@", array(legacy))
+        legacy_hops = bytearray(legacy)
+        legacy_hops[:4] = b"MT02"
+        legacy_hops[5] = 3
+        legacy_hops[12:] = hashlib.sha256(legacy_hops[:12]).digest()[:4]
+        text = text.replace("@LEGACY_HOPS_SETTINGS@", array(legacy_hops))
+        public_key = bytes([42]) + bytes(31)
+        text = text.replace("@LOCAL_NODE@", str(int.from_bytes(hashlib.sha256(public_key).digest()[:4], "little")))
+        for first in (43, 44):
+            public_key = bytes([first]) + bytes(31)
+            text = text.replace("@IMPORTED_NODE_%d@" % first,
+                                str(int.from_bytes(hashlib.sha256(public_key).digest()[:4], "little")))
+        cpp = work / "companion.cpp"
+        cpp.write_text(text, encoding="utf-8")
+        cls.binary = work / ("companion.exe" if sys.platform == "win32" else "companion")
+        sanitizers = (["-fsanitize=address,undefined", "-fno-sanitize-recover=all", "-fno-pie", "-no-pie"]
+                      if sys.platform.startswith("linux") else [])
+        result = subprocess.run(
+            [compiler, "-std=c++17", "-Wall", "-Wextra", "-Werror", "-Wno-unused-parameter",
+             "-Wno-unused-variable", "-Wno-reorder", "-Wno-sign-compare",
+             "-DMESH_ENABLE_MESHTEXT_CHAT=1", "-DMESH_ENABLE_FLEET_CONTROL=1",
+             *sanitizers, "-I" + str(work), "-I" + str(crypto),
+             "-I" + str(ROOT / "test/fixtures/radio_profiles/mocks"), "-I" + str(ROOT / "test/mocks"),
+             "-I" + str(ROOT / "src"), str(cpp), str(ROOT / "src/helpers/RadioProfileCLI.cpp"),
+             str(ROOT / "src/helpers/MeshtextChat.cpp"), *[str(crypto / name) for name in required],
+             "-o", str(cls.binary)], capture_output=True, text=True, timeout=60,
+        )
+        if result.returncode:
+            raise AssertionError(result.stdout + result.stderr)
+
+    def run_case(self, name):
+        result = subprocess.run([str(self.binary), name], capture_output=True, text=True, timeout=30)
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+        self.assertIn("PASS " + name, result.stdout)
+
+    def test_public_alias_and_private_aes_keys_preserve_raw_app_state(self):
+        self.run_case("keys")
+
+    def test_automatic_profile_is_runtime_only_and_no_automatic_transmit(self):
+        self.run_case("auto")
+
+    def test_conflicts_region_slots_and_custom_channel_dependency(self):
+        self.run_case("conflicts")
+
+    def test_saved_manual_overlay_temporary_priority_and_off_veto(self):
+        self.run_case("manual")
+
+    def test_atomic_settings_corruption_write_failures_and_reboot(self):
+        self.run_case("settings")
+
+    def test_actual_offline_queue_v1_v3_utf8_dedup_and_no_reply_relay(self):
+        self.run_case("receive")
+
+    def test_explicit_app_text_transmit_only_and_bounds(self):
+        self.run_case("transmit")
+
+    def test_binary_get_set_raw_psk_and_save_failure_rollback(self):
+        self.run_case("commands")
+
+    def test_private_cli_provisioning_metadata_masking_and_transactional_delete(self):
+        self.run_case("cli")
+
+    def test_default_seven_hops_cli_override_atomic_persistence_and_legacy_migration(self):
+        self.run_case("hops")
+
+    def test_shortname_unicode_identity_text_budget_atomic_settings_and_mt03_validation(self):
+        self.run_case("shortname")
+
+    def test_node_id_override_wire_sender_persistence_default_reset_and_failures(self):
+        self.run_case("node")
+        source = (ROOT / "examples/companion_radio/MyMesh.cpp").read_text(encoding="utf-8")
+        imported = body(source, "if (cmd_frame[0] == CMD_IMPORT_PRIVATE_KEY && len >= 65)")
+        guard = re.search(r"else\s+if\s*\(hasForeignRadioFrame\(\)\)\s*\{[^}]*"
+                          r"writeErrFrame\(ERR_CODE_BAD_STATE\)", imported)
+        self.assertIsNotNone(guard, "pending Meshtext TX must block the identity import")
+        self.assertLess(guard.end(), imported.index("flushContactsBeforeReboot()"))
+        self.assertLess(guard.end(), imported.index("identity.readFrom("))
+        self.assertLess(guard.end(), imported.index("_store->saveMainIdentity(identity)"))
+        committed = body(imported, "if (_store->saveMainIdentity(identity))")
+        self.assertLess(committed.index("self_id = identity;"), committed.index("refreshMeshtextIdentity();"))
+        self.assertLess(committed.index("refreshMeshtextIdentity();"), committed.index("writeOKFrame();"))
+        self.assertEqual(imported.count("refreshMeshtextIdentity();"), 1,
+                         "the refresh belongs only to the successfully saved identity branch")
+
+    def test_manual_nodeinfo_standard_fields_shared_sequence_guards_and_no_automatic_adverts(self):
+        self.run_case("nodeinfo")
+        source = (ROOT / "examples/companion_radio/MeshtextCompanion.cpp").read_text(encoding="utf-8")
+        self.assertEqual(source.count("sendMeshtextNodeInfo("), 2,
+                         "NodeInfo has exactly one caller: the explicit CLI")
+        chat = body(source, "bool MyMesh::sendMeshtextText(")
+        self.assertNotIn("_mt_short_name", chat)
+        self.assertNotIn("node_name", chat)
+        self.assertNotIn("encodeNodeInfo", chat)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/test/test_companion_terminal_profile.py b/test/test_companion_terminal_profile.py
index 743a9c589..1e6a50274 100644
--- a/test/test_companion_terminal_profile.py
+++ b/test/test_companion_terminal_profile.py
@@ -2,6 +2,7 @@
 
 from pathlib import Path
 import re
+from cpp_source import body
 
 
 root = Path(__file__).resolve().parents[1]
@@ -82,10 +83,17 @@ assert re.search(
 assert terminal.index("handleLocalControlCommand(") < terminal.index(
     'strncmp(command, "set ", 4) == 0'
 )
-assert 'terminalOutput().print("  board\\r\\n")' in terminal
-assert 'terminalOutput().print("  version\\r\\n")' in terminal
-assert 'terminalOutput().print("  get pwrmgt.bootreason\\r\\n")' in terminal
-assert 'terminalOutput().print("  set pin <0-999999>\\r\\n")' in terminal
+# Help is emitted in bounded chunks with concatenated C++ literals. Check the
+# actual help branch rather than requiring one print() call per command.
+help_branch = body(terminal, 'if (strcmp(command, "help") == 0)')
+for help_line in ('  board\\r\\n', '  version\\r\\n',
+                  '  get pwrmgt.bootreason\\r\\n', '  set pin <0-999999>\\r\\n',
+                  '  set mt.hops <0..7> (saved; default 7)\\r\\n',
+                  '  get mt.node / get mt.shortname\\r\\n',
+                  '  set mt.node <!8hex|default> (saved; use a unique ID)\\r\\n',
+                  '  set mt.shortname <1..4 UTF-8 characters|default> (saved; NodeInfo uses 4 bytes)\\r\\n',
+                  '  send mt.nodeinfo <channel slot> (one manual advert; no automatic adverts)\\r\\n'):
+    assert help_line in help_branch
 assert re.search(
     r"#if COMPANION_FEATURE_MEMORY_DIAGNOSTICS\s+"
     r'terminalOutput\(\)\.print\("  memory\\r\\n"\);\s+#endif',
diff --git a/test/test_companion_tx_routing.py b/test/test_companion_tx_routing.py
index 0315b42f6..dad8f35b5 100644
--- a/test/test_companion_tx_routing.py
+++ b/test/test_companion_tx_routing.py
@@ -17,6 +17,7 @@ HARNESS = r'''
 #include <RadioProfiles.h>
 #include <helpers/CLICommandUtils.h>
 #include <helpers/CompanionTxRoutingCLI.h>
+#include <helpers/CompanionChannelAlias.h>
 #include <helpers/IdentityStore.h>
 #include "ContactFileTransaction.h"
 #if defined(STM32_PLATFORM)
@@ -65,14 +66,26 @@ public:
  bool canMutateContacts() const { return writable && !store.hasIncompleteContactLoad(); }
  int getTotalContactSlots() const { return contacts.size(); }
  ContactInfo* getContactPtrByIdx(int i) { return &contacts.at(i); }
- bool getChannel(int i, ChannelDetails& c) { if (i<0 || i>=MAX_GROUP_CHANNELS) return false; c=channels[i]; return true; }
+ bool getChannel(int i, ChannelDetails& c) {
+   if (i<0 || i>=MAX_GROUP_CHANNELS) return false;
+   c=channels[i];
+   if (radio.config.enabled()) {
+     auto kind=parseCompanionChannelAlias(c.name).kind;
+     if (kind==CompanionChannelKind::Radio2) c.channel.tx_radio=mesh::RADIO_TX_SECONDARY;
+     else if (kind==CompanionChannelKind::Meshtext) c.channel.tx_radio=mesh::RADIO_TX_OFF;
+   }
+   return true;
+ }
  bool setChannel(int i, const ChannelDetails& c) { if (i<0 || i>=MAX_GROUP_CHANNELS) return false; channels[i]=c; return true; }
  bool saveChannels() { ++writes; return writes_ok && store.saveChannels(this); }
  bool scheduleContactWrite(const ContactInfo&) { ++writes; return writes_ok; }
  bool flushContactsBeforeReboot() { return writes_ok; }
  bool onChannelLoaded(uint8_t i,const ChannelDetails& c) override { return setChannel(i,c); }
- bool getChannelForSave(uint8_t i,ChannelDetails& c) override { return getChannel(i,c); }
+ bool getChannelForSave(uint8_t i,ChannelDetails& c) override {
+   if (i>=MAX_GROUP_CHANNELS) return false; c=channels[i]; return true;
+ }
  bool handleTxRoutingCommand(const char*,char*,size_t);
+ bool isAliasRadio2Defined() const { return radio.config.enabled(); }
 };
 @METHODS@
 
@@ -232,6 +245,24 @@ int main() {
  for (auto& byte : node.store.fs.files["/channels2"]) byte=0;
  node.store.loadChannels(&node);
  for (auto& c : node.channels) assert(c.channel.tx_radio==mesh::RADIO_TX_AUTO);
+ // Prefix-bound routes cannot be silently overridden. With no radio2, the
+ // ordinary raw/manual policy can still be changed without rewriting the PSK.
+ MyMesh aliased;
+ strcpy(aliased.channels[1].name,"#r2-emergency");
+ aliased.channels[1].channel.secret[0]=42;
+ aliased.radio.config.secondary.mode=mesh::RadioProfileMode::RxTx;
+ auto alias_cmd=[&](const char* text) { assert(aliased.handleTxRoutingCommand(text,reply,sizeof(reply))); };
+ alias_cmd("get tx.channel 1"); assert(strstr(reply,"active=radio2"));
+ alias_cmd("set tx.channel 1 radio"); assert(strstr(reply,"prefix controls routing"));
+ assert(aliased.writes==0 && aliased.channels[1].channel.tx_radio==mesh::RADIO_TX_AUTO);
+ alias_cmd("set tx.channel 1 radio2"); assert(!strncmp(reply,"OK",2) && aliased.writes==0);
+ aliased.radio.config.secondary.mode=mesh::RadioProfileMode::Off;
+ alias_cmd("set tx.channel 1 radio"); assert(!strncmp(reply,"OK",2));
+ assert(aliased.channels[1].channel.tx_radio==mesh::RADIO_TX_PRIMARY);
+ assert(aliased.channels[1].channel.secret[0]==42);
+ assert(aliased.store.fs.files["/channels2"][68+36]==42);
+ aliased.radio.config.secondary.mode=mesh::RadioProfileMode::Rx;
+ alias_cmd("get tx.channel 1"); assert(strstr(reply,"active=off") && strstr(reply,"unavailable"));
 }
 '''
 
@@ -266,9 +297,9 @@ class CompanionTxRoutingTest(unittest.TestCase):
 
     def test_phone_protocol_updates_preserve_same_channel_policy(self):
         source = (ROOT / 'examples/companion_radio/MyMesh.cpp').read_text()
-        command = source[source.index('const bool have_previous = getChannel(channel_idx, previous);'):]
+        command = source[source.index('const bool have_previous = getChannelForSave(channel_idx, previous);'):]
         command = command[:command.index('} else if (cmd_frame[0] == CMD_SIGN_START')]
-        self.assertIn('!memcmp(channel.channel.secret, previous.channel.secret, sizeof(channel.channel.secret))', command)
+        self.assertIn('!memcmp(wire_channel.channel.secret, previous_wire_channel.channel.secret, sizeof(channel.channel.secret))', command)
         self.assertIn('channel.channel.tx_radio = previous.channel.tx_radio;', command)
         self.assertIn('setChannel(channel_idx, previous);', command)
         self.assertIn('handleTxRoutingCommand(command, reply, reply_size)',
diff --git a/test/test_contact_import/test_contact_import.cpp b/test/test_contact_import/test_contact_import.cpp
index efc501e06..fb50248e9 100644
--- a/test/test_contact_import/test_contact_import.cpp
+++ b/test/test_contact_import/test_contact_import.cpp
@@ -37,10 +37,26 @@ public:
 };
 class Tables : public mesh::MeshTables {
 public:
-  bool wasSeen(const mesh::Packet*) override { return false; }
-  void markSeen(const mesh::Packet*) override {}
+  // Existing admission tests do not deduplicate. Opt in for receive-order
+  // regressions with a real payload/type hash, deliberately excluding profile.
+  bool deduplicate = false, have_seen = false;
+  unsigned seen_queries = 0, seen_marks = 0;
+  uint8_t seen_hash[MAX_HASH_SIZE] = {};
+  bool wasSeen(const mesh::Packet* packet) override {
+    if (!deduplicate) return false;
+    ++seen_queries;
+    uint8_t hash[MAX_HASH_SIZE];
+    packet->calculatePacketHash(hash);
+    return have_seen && !memcmp(hash, seen_hash, sizeof(hash));
+  }
+  void markSeen(const mesh::Packet* packet) override {
+    if (!deduplicate) return;
+    ++seen_marks;
+    packet->calculatePacketHash(seen_hash);
+    have_seen = true;
+  }
   void markSent(const mesh::Packet*) override {}
-  void clear(const mesh::Packet*) override {}
+  void clear(const mesh::Packet*) override { have_seen = false; }
 };
 class Chat : public BaseChatMesh {
 public:
@@ -57,6 +73,12 @@ public:
   bool writable = true;
   uint8_t max_hops = 1;
   unsigned discovered = 0, stored = 0, full = 0;
+  bool forward_packets = false, reject_primary_groups = false;
+  bool bind_secondary_groups = false, packet_group_search = false;
+  uint32_t direct_forward_delay = 0;
+  unsigned group_admissions = 0, group_searches = 0, received_groups = 0;
+  uint8_t last_search_origin = 0xFF;
+  mesh::GroupChannel primary_group, secondary_group, received_group;
   Chat(Radio& radio, Clock& clock, RNG& rng, RTC& rtc,
        StaticPoolPacketManager& pool, Tables& tables)
       : BaseChatMesh(radio, clock, rng, rtc, pool, tables) {}
@@ -64,7 +86,40 @@ public:
   bool shouldAutoAddContactType(uint8_t) const override { return auto_add; }
   uint8_t getAutoAddMaxHops() const override { return max_hops; }
   bool canMutateContacts() const override { return writable; }
-  bool allowPacketForward(const mesh::Packet*) override { return false; }
+  bool allowPacketForward(const mesh::Packet*) override { return forward_packets; }
+  uint32_t getDirectRetransmitDelay(const mesh::Packet*) override { return direct_forward_delay; }
+  bool allowGroupPacketOnRadio(mesh::Packet* packet) override {
+    ++group_admissions;
+    // Stub only the application's policy, not the core admission/order path.
+    if (reject_primary_groups && packet->radio_origin == 0) return false;
+    if (bind_secondary_groups && packet->radio_origin == 1) {
+      packet->tx_radio = mesh::RADIO_TX_SECONDARY;
+    }
+    return true;
+  }
+  int searchChannelsForPacket(const mesh::Packet* packet, const uint8_t* hash,
+                             mesh::GroupChannel channels[], int max_matches) override {
+    if (!packet_group_search) {
+      return BaseChatMesh::searchChannelsForPacket(packet, hash, channels, max_matches);
+    }
+    ++group_searches;
+    last_search_origin = packet->radio_origin;
+    const auto& channel = packet->radio_origin == 1 ? secondary_group : primary_group;
+    if (max_matches < 1 || channel.hash[0] != hash[0]) return 0;
+    channels[0] = channel;
+    return 1;
+  }
+  void onGroupDataRecv(mesh::Packet* packet, uint8_t type,
+                       const mesh::GroupChannel& channel, uint8_t* data, size_t len) override {
+    if (!packet_group_search) {
+      BaseChatMesh::onGroupDataRecv(packet, type, channel, data, len);
+      return;
+    }
+    ++received_groups;
+    received_group = channel;
+    // Native AES is a no-op mock. Production Utils/HMAC and the core channel
+    // search/decrypt path run, but these tests make no plaintext/AES assertion.
+  }
   void onContactsFull() override { ++full; }
   bool putBlobByKey(const uint8_t*, int, const uint8_t*, int) override {
     ++stored;
@@ -123,6 +178,43 @@ protected:
     uint8_t raw[MAX_TRANS_UNIT];
     return chat.importContact(raw, packet.writeTo(raw));
   }
+  void configureGroupSearch() {
+    chat.packet_group_search = true;
+    memset(chat.primary_group.secret, 0, sizeof(chat.primary_group.secret));
+    memset(chat.secondary_group.secret, 0, sizeof(chat.secondary_group.secret));
+    memset(chat.primary_group.secret, 1, 16);
+    memset(chat.secondary_group.secret, 2, 16);
+    // Simulate the supported one-byte channel-hash collision. Authentication
+    // must distinguish these keys, not the packet's channel hash alone.
+    chat.primary_group.hash[0] = chat.secondary_group.hash[0] = 17;
+  }
+  mesh::Packet groupPacket(const mesh::GroupChannel& channel, uint8_t route = ROUTE_TYPE_FLOOD) {
+    mesh::Packet packet;
+    packet.header = route | (PAYLOAD_TYPE_GRP_TXT << PH_TYPE_SHIFT);
+    packet.setPathHashSizeAndCount(1, 0);
+    memset(packet.payload, 0, sizeof(packet.payload));
+    uint8_t data[CIPHER_BLOCK_SIZE] = {};
+    const uint32_t timestamp = 10;
+    memcpy(data, &timestamp, sizeof(timestamp));
+    memcpy(data + 5, "hello", 5);
+    packet.payload[0] = channel.hash[0];
+    packet.payload_len = 1 + mesh::Utils::encryptThenMAC(
+        channel.secret, packet.payload + 1, data, sizeof(data));
+    return packet;
+  }
+  bool queueReceived(mesh::Packet packet, uint8_t origin) {
+    auto* received = chat.obtainNewPacket();
+    if (received == nullptr) return false;
+    packet.radio_profile = packet.radio_origin = origin;
+    packet.radio_generation = packet.radio_origin_generation = radio.config.generation[origin];
+    packet.radio_local = packet.radio_bound = false;
+    packet.radio_reply = packet.radio_reply_force = false;
+    packet.tx_radio = mesh::RADIO_TX_AUTO;
+    *received = packet;
+    pool.queueInbound(received, 0);
+    chat.loop();
+    return true;
+  }
 };
 
 TEST_F(ContactImport, ExplicitImportBypassesDiscoveryFiltersOnlyForThatPacket) {
@@ -306,6 +398,108 @@ TEST_F(ContactImport, ContactRoutingAlsoControlsAcknowledgementsAndReturnedPaths
   EXPECT_EQ(1, pool.getOutboundByIdx(0)->radio_profile);
   EXPECT_EQ(1, pool.getOutboundByIdx(1)->radio_profile);
 }
+
+TEST_F(ContactImport, GroupAdmissionRejectsWrongProfileBeforeGlobalDeduplication) {
+  radio.dual = true;
+  radio.config.secondary.mode = mesh::RadioProfileMode::RxTx;
+  radio.config.cross = mesh::RadioCrossMode::Off;
+  tables.deduplicate = true;
+  chat.reject_primary_groups = true;
+  configureGroupSearch();
+  const auto packet = groupPacket(chat.secondary_group);
+
+  ASSERT_TRUE(queueReceived(packet, 0));
+  EXPECT_EQ(chat.group_admissions, 1u);
+  EXPECT_EQ(chat.group_searches, 0u);
+  EXPECT_EQ(chat.received_groups, 0u);
+  EXPECT_EQ(tables.seen_queries, 0u);
+  EXPECT_EQ(tables.seen_marks, 0u);
+  EXPECT_FALSE(tables.wasSeen(&packet));
+  EXPECT_EQ(pool.getFreeCount(), 8);
+
+  // Exactly the same wire payload must remain eligible on its allowed radio.
+  ASSERT_TRUE(queueReceived(packet, 1));
+  EXPECT_EQ(chat.group_admissions, 2u);
+  EXPECT_EQ(chat.group_searches, 1u);
+  EXPECT_EQ(chat.last_search_origin, 1);
+  EXPECT_EQ(chat.received_groups, 1u);
+  EXPECT_EQ(tables.seen_marks, 1u);
+  EXPECT_TRUE(tables.wasSeen(&packet));
+  EXPECT_EQ(pool.getFreeCount(), 8);
+
+  ASSERT_TRUE(queueReceived(packet, 1));
+  EXPECT_EQ(chat.group_admissions, 3u);
+  EXPECT_EQ(chat.group_searches, 1u);
+  EXPECT_EQ(chat.received_groups, 1u);
+  EXPECT_EQ(tables.seen_marks, 1u);
+}
+
+TEST_F(ContactImport, PacketAwareGroupSearchUsesCapturedOriginAndAuthenticatedKey) {
+  radio.dual = true;
+  radio.config.secondary.mode = mesh::RadioProfileMode::RxTx;
+  configureGroupSearch();
+  const auto secondary_packet = groupPacket(chat.secondary_group);
+  uint8_t plaintext[MAX_PACKET_PAYLOAD];
+  ASSERT_GT(mesh::Utils::MACThenDecrypt(chat.secondary_group.secret, plaintext,
+      secondary_packet.payload + 1, secondary_packet.payload_len - 1), 0);
+  ASSERT_EQ(mesh::Utils::MACThenDecrypt(chat.primary_group.secret, plaintext,
+      secondary_packet.payload + 1, secondary_packet.payload_len - 1), 0);
+
+  // The transceiver reports primary while a delayed secondary packet is
+  // processed. The packet-aware hook must receive the captured RX origin.
+  ASSERT_EQ(radio.receiveProfile(), 0);
+  ASSERT_TRUE(queueReceived(secondary_packet, 1));
+  EXPECT_EQ(chat.last_search_origin, 1);
+  EXPECT_EQ(chat.received_groups, 1u);
+  EXPECT_EQ(memcmp(chat.received_group.secret, chat.secondary_group.secret, PUB_KEY_SIZE), 0);
+  ASSERT_TRUE(queueReceived(secondary_packet, 0));
+  EXPECT_EQ(chat.last_search_origin, 0);
+  EXPECT_EQ(chat.received_groups, 1u); // same hash, wrong authenticated key
+  ASSERT_TRUE(queueReceived(groupPacket(chat.primary_group), 0));
+  EXPECT_EQ(chat.received_groups, 2u);
+  EXPECT_EQ(memcmp(chat.received_group.secret, chat.primary_group.secret, PUB_KEY_SIZE), 0);
+  EXPECT_EQ(chat.group_searches, 3u);
+  EXPECT_EQ(pool.getFreeCount(), 8);
+}
+
+TEST_F(ContactImport, GroupAdmissionBindsDirectRelayBeforeCrossProfileFanout) {
+  radio.dual = true;
+  radio.config.secondary.mode = mesh::RadioProfileMode::RxTx;
+  radio.config.cross = mesh::RadioCrossMode::On;
+  tables.deduplicate = true;
+  chat.forward_packets = chat.reject_primary_groups = chat.bind_secondary_groups = true;
+  chat.direct_forward_delay = 100;
+  configureGroupSearch();
+  auto packet = groupPacket(chat.secondary_group, ROUTE_TYPE_DIRECT);
+  chat.self_id.pub_key[0] = 0x42;
+  packet.setPathHashSizeAndCount(1, 2);
+  packet.path[0] = chat.self_id.pub_key[0];
+  packet.path[1] = 0x93;
+
+  ASSERT_TRUE(queueReceived(packet, 0));
+  EXPECT_EQ(tables.seen_queries, 0u);
+  EXPECT_EQ(tables.seen_marks, 0u);
+  EXPECT_EQ(pool.getOutboundTotal(), 0);
+  EXPECT_EQ(pool.getFreeCount(), 8);
+
+  ASSERT_TRUE(queueReceived(packet, 1));
+  EXPECT_EQ(chat.group_admissions, 2u);
+  EXPECT_EQ(chat.group_searches, 0u); // direct relay returns before local search
+  EXPECT_EQ(chat.received_groups, 0u);
+  EXPECT_EQ(tables.seen_marks, 1u);
+  ASSERT_EQ(pool.getOutboundTotal(), 1); // cross=on must not add a primary copy
+  const auto* relayed = pool.getOutboundByIdx(0);
+  ASSERT_NE(relayed, nullptr);
+  EXPECT_EQ(relayed->radio_profile, 1);
+  EXPECT_EQ(relayed->radio_origin, 1);
+  EXPECT_EQ(relayed->tx_radio, mesh::RADIO_TX_SECONDARY);
+  EXPECT_TRUE(relayed->radio_bound);
+  EXPECT_FALSE(relayed->radio_reply);
+  EXPECT_FALSE(relayed->radio_reply_force);
+  EXPECT_EQ(relayed->getPathHashCount(), 1);
+  EXPECT_EQ(relayed->path[0], 0x93);
+  EXPECT_EQ(pool.getFreeCount(), 7);
+}
 } // namespace
 
 int main(int argc, char** argv) {
diff --git a/test/test_meshtext_auto_radio2_hil.py b/test/test_meshtext_auto_radio2_hil.py
new file mode 100644
index 000000000..485e10ef8
--- /dev/null
+++ b/test/test_meshtext_auto_radio2_hil.py
@@ -0,0 +1,234 @@
+"""Host-only checks of the preset sweep; never opens a hardware port."""
+import contextlib
+import io
+import pathlib
+import random
+import struct
+import sys
+from types import SimpleNamespace
+import unittest
+from unittest.mock import Mock, patch
+
+sys.path.insert(0, str(pathlib.Path(__file__).resolve().parents[1] / "tools" / "hil"))
+import meshtext_auto_radio2 as hil
+
+
+class SweepPlanTests(unittest.TestCase):
+    def test_meshtext_help_exposes_stock_peer_port_without_opening_hardware(self):
+        output = io.StringIO()
+        with patch.object(sys, "argv", ["meshtext_auto_radio2.py", "--help"]), \
+                patch.object(hil, "Companion") as companion, \
+                patch.object(hil, "StockPeer") as stock, \
+                contextlib.redirect_stdout(output), self.assertRaises(SystemExit) as exit_result:
+            hil.main()
+        self.assertEqual(exit_result.exception.code, 0)
+        self.assertIn("Meshtext Companion / stock-peer", output.getvalue())
+        self.assertIn("--stock-port", output.getvalue())
+        self.assertNotIn("meshtastic", output.getvalue().lower())
+        companion.assert_not_called()
+        stock.assert_not_called()
+
+    def test_us_centers_and_native_stable_presets(self):
+        expected = {
+            "LongFast": 906.875, "ShortTurbo": 926.75,
+            "ShortFast": 918.875, "ShortSlow": 920.625,
+            "MediumFast": 913.125, "MediumSlow": 914.875,
+            "LongTurbo": 908.75, "LongMod": 902.6875,
+            "LongSlow": 905.3125, "MediumTurbo": 925.25,
+        }
+        self.assertEqual(sum(p.stock_enum is not None for p in hil.PRESETS), 9)
+        for preset in hil.PRESETS:
+            self.assertEqual(preset.frequency, expected[preset.name])
+            self.assertEqual(preset.describe()["preamble"], 16)
+
+    def test_alias_selection_and_rejections(self):
+        self.assertEqual(hil.choose_presets("long_moderate")[0].name, "LongMod")
+        for value in ("", "longfast,longfast", "not-a-preset"):
+            with self.assertRaises(hil.TestFailure):
+                hil.choose_presets(value)
+
+    def test_auto_profile_readback(self):
+        profile = hil.parse_profile("> 906.875,250.000,11,5,rxtx,16; auto-owned")
+        self.assertEqual(profile, (906.875, 250, 11, 5, "rxtx", 16))
+        with self.assertRaises(hil.TestFailure):
+            hil.parse_profile("> off")
+
+    def test_queue_envelopes(self):
+        body = bytes((1, 0, 0)) + struct.pack("<I", 123456) + b"!12345678: test"
+        for packet in (b"\x08" + body, b"\x11\x00\x00\x00" + body):
+            value = hil.decode_channel_frame(packet)
+            self.assertEqual(value["channel"], 1)
+            self.assertEqual(value["timestamp"], 123456)
+            self.assertEqual(value["text"], b"!12345678: test")
+        self.assertIsNone(hil.decode_channel_frame(b"\x0a"))
+        with self.assertRaises(hil.TestFailure):
+            hil.decode_channel_frame(b"\x08")
+
+    def test_temporary_profile_status_dialects(self):
+        for value in ("> off", "off", "TempRadio inactive"):
+            self.assertTrue(hil.temporary_off(value))
+        for value in ("> 1 min left", "TempRadio active", "TempRadio inactive; scheduled"):
+            self.assertFalse(hil.temporary_off(value))
+
+
+class SweepPolicyTests(unittest.TestCase):
+    def test_traffic_counts_preserve_the_configured_threshold(self):
+        case = {"v4_to_v3": [{"received": True}] * 3,
+                "v3_to_v4": [{"received": True}, {"received": False}, {"received": True}]}
+        self.assertEqual(hil.assess_traffic(case, 3), [
+            {"direction": "v3_to_v4", "received": 2, "attempted": 3, "required": 3}])
+        self.assertEqual(case["traffic_counts"]["v4_to_v3"], {"received": 3, "attempted": 3})
+        self.assertFalse(hil.assess_traffic(case, 2))
+
+    def test_seeded_gap_jitter_is_reproducible_and_zero_is_unchanged(self):
+        gaps = []
+        with patch.object(hil.time, "sleep") as sleep:
+            for _ in range(2):
+                rng = random.Random(0x12345678)
+                packets = [{} for _ in range(4)]
+                for packet in packets:
+                    hil.pause_after_packet(packet, 1, 0.5, rng)
+                gaps.append([packet["gap_after_seconds"] for packet in packets])
+            self.assertEqual(gaps[0], gaps[1])
+            self.assertTrue(all(1 <= gap <= 1.5 for gap in gaps[0]))
+            rng = Mock()
+            packet = {}
+            hil.pause_after_packet(packet, 1, 0, rng)
+            rng.uniform.assert_not_called()
+            sleep.assert_called_with(1)
+            self.assertEqual(packet["gap_after_seconds"], 1)
+
+    def run_fake(self, *, continue_on_loss=False, lose_first=True, reboot=False,
+                 reboot_loss=False, auto_clear=False):
+        presets = [hil.PRESETS[1], hil.PRESETS[0]]
+        state = SimpleNamespace(alias="", rebooted=False, configured=[], commands=[])
+
+        class FakeCompanion:
+            max_channels = 2
+
+            def __init__(self, port):
+                self.port = SimpleNamespace(write=self.write, flush=lambda: None)
+
+            def write(self, frame):
+                state.rebooted = True
+                return len(frame)
+
+            def start(self):
+                return {"primary": {"public_key_prefix": "unchanged"}}
+
+            def close(self):
+                pass
+
+            def channel_name(self, slot):
+                return "normal"
+
+            def cli(self, command):
+                state.commands.append(command)
+                if command.startswith("set mt.channel "):
+                    state.alias = command.split()[3]
+                elif command.startswith("delete mt.channel "):
+                    state.alias = ""
+                if command in ("get tempradio", "get tempradio2"):
+                    return "> off"
+                if command == "get radio":
+                    return "unchanged-primary"
+                if command == "get mt.status":
+                    return "> Meshtext; active; TX=0 RX=0 fail=0" if state.alias else "> Meshtext; no Meshtext channels; TX=0 RX=0 fail=0"
+                if command == "get radio2":
+                    return "auto-owned" if state.alias else "> off (automatic allowed)"
+                return "> diagnostic"
+
+            def mt_node(self):
+                return 0x12345678
+
+            def wait_auto(self, preset):
+                return {"radio2": "auto-owned", "status": "active"}
+
+            def send_text(self, slot, token):
+                pass
+
+            def wait_text(self, slot, from_node, token, timeout):
+                lost = ((lose_first and state.alias == presets[0].alias and not state.rebooted)
+                        or (reboot_loss and state.rebooted))
+                return {"received": not lost}
+
+        class FakeStock:
+            node = 0x87654321
+
+            def __init__(self, port):
+                pass
+
+            def configure(self, preset, key, tx, hops):
+                state.configured.append(preset.name)
+                return {"readback": {"use_preset": True, "channel_num": 0, "bandwidth": preset.bandwidth,
+                                     "spread_factor": preset.sf, "coding_rate": preset.cr,
+                                     "tx_power": tx, "hop_limit": hops}}
+
+            def packets_since(self, timestamp, sender):
+                return []
+
+            def wait_packet(self, sender, predicate, since, timeout):
+                return {"id": 1}
+
+            def send_text(self, token, hops):
+                return SimpleNamespace(id=1)
+
+            def close(self):
+                pass
+
+        args = SimpleNamespace(key_bits=128, region="auto", tx_power=-9, hops=7,
+                               minimum_received=3, messages_per_direction=3,
+                               continue_on_loss=continue_on_loss, gap_seconds=1, gap_jitter_seconds=0.5,
+                               companion_port="fake-v4", stock_port="fake-v3", channel_slot=1,
+                               quiet_seconds=1, timeout=15, nodeinfo=False, reboot=reboot,
+                               auto_clear=auto_clear, output=pathlib.Path("unused-mocked-report.json"))
+        with patch.object(hil, "Companion", FakeCompanion), patch.object(hil, "StockPeer", FakeStock), \
+                patch.object(hil.time, "sleep"), patch.object(hil, "write_report") as writer, \
+                patch.object(hil.importlib.metadata, "version", return_value="mock"), \
+                patch.object(hil.secrets, "token_hex", return_value="12345678"), \
+                contextlib.redirect_stdout(io.StringIO()):
+            report = hil.run(args, presets)
+        writer.assert_called_once_with(args.output, report)
+        return report, state
+
+    def test_default_loss_policy_is_failfast_with_diagnostics(self):
+        report, state = self.run_fake()
+        self.assertEqual(state.configured, ["ShortTurbo"])
+        self.assertEqual(report["result"], "FAIL")
+        self.assertEqual(report["failed_cases"], ["ShortTurbo"])
+        case = report["cases"][0]
+        self.assertEqual(case["traffic_counts"]["v3_to_v4"]["received"], 0)
+        for name in ("status_after_traffic", "radio2_after_traffic",
+                     "radio2_status_after_traffic", "radio2_scan_after_traffic"):
+            self.assertIn(name, case)
+
+    def test_continue_on_loss_collects_both_cases_but_still_fails(self):
+        report, state = self.run_fake(continue_on_loss=True)
+        self.assertEqual(state.configured, ["ShortTurbo", "LongFast"])
+        self.assertEqual([case["result"] for case in report["cases"]], ["FAIL", "PASS"])
+        self.assertEqual(report["result"], "FAIL")
+        self.assertIn("ShortTurbo", report["failure"]["message"])
+        self.assertEqual(report["gap_jitter_seed"], 0x12345678)
+        for case in report["cases"]:
+            for direction in ("v4_to_v3", "v3_to_v4"):
+                self.assertTrue(all(1 <= packet["gap_after_seconds"] <= 1.5 for packet in case[direction]))
+
+    def test_continued_loss_does_not_skip_reboot_and_reboot_loss_is_strict(self):
+        report, state = self.run_fake(continue_on_loss=True, reboot=True, reboot_loss=True)
+        self.assertTrue(state.rebooted)
+        self.assertEqual(report["reboot_persistence"]["result"], "FAIL")
+        self.assertEqual(report["result"], "FAIL")
+        self.assertIn("after reboot in v3_to_v4", report["failure"]["message"])
+
+    def test_successful_reboot_and_auto_clear_leave_final_profile_readded(self):
+        report, state = self.run_fake(continue_on_loss=True, lose_first=False, reboot=True, auto_clear=True)
+        self.assertEqual(report["result"], "PASS")
+        self.assertEqual(report["reboot_persistence"]["result"], "PASS")
+        self.assertEqual(report["auto_clear"]["result"], "PASS")
+        self.assertIn("no Meshtext channels", report["auto_clear"]["removed"]["mt_status"])
+        self.assertEqual(state.alias, "mt-longfast")
+        self.assertEqual(report["failed_cases"], [])
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/test/test_meshtext_auto_radio2_hil_sdk.py b/test/test_meshtext_auto_radio2_hil_sdk.py
new file mode 100644
index 000000000..4c627330c
--- /dev/null
+++ b/test/test_meshtext_auto_radio2_hil_sdk.py
@@ -0,0 +1,175 @@
+"""Host-only stock SDK/boot-readback contracts; no SDK installation or serial IO."""
+
+import copy
+from pathlib import Path
+import sys
+from types import ModuleType, SimpleNamespace
+import unittest
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "tools" / "hil"))
+import meshtext_auto_radio2 as hil
+
+
+class MeshInterfaceError(Exception):
+    pass
+
+
+class PresetEnum:
+    values = {p.stock_enum: index for index, p in enumerate(hil.PRESETS) if p.stock_enum}
+
+    @classmethod
+    def keys(cls):
+        return cls.values.keys()
+
+    @classmethod
+    def Value(cls, name):
+        return cls.values[name]
+
+
+def fake_sdk():
+    package = ModuleType("meshtastic")
+    package.__path__ = []
+    protobuf = ModuleType("meshtastic.protobuf")
+    protobuf.__path__ = []
+    channel = ModuleType("meshtastic.protobuf.channel_pb2")
+    channel.Channel = SimpleNamespace(PRIMARY=1)
+    config = ModuleType("meshtastic.protobuf.config_pb2")
+    config.Config = SimpleNamespace(DeviceConfig=SimpleNamespace(CLIENT_MUTE=1),
+                                    LoRaConfig=SimpleNamespace(US=1, ModemPreset=PresetEnum))
+    interface = ModuleType("meshtastic.mesh_interface")
+    interface.MeshInterface = SimpleNamespace(MeshInterfaceError=MeshInterfaceError)
+    util = ModuleType("meshtastic.util")
+    util.to_node_num = int
+    package.protobuf, package.mesh_interface = protobuf, interface
+    protobuf.channel_pb2, protobuf.config_pb2 = channel, config
+    return {module.__name__: module for module in (package, protobuf, channel, config, interface, util)}
+
+
+class Node:
+    def __init__(self):
+        self.localConfig = SimpleNamespace(device=SimpleNamespace(role=0),
+                                           lora=SimpleNamespace(modem_preset=0))
+        self.channels = [SimpleNamespace(role=0, settings=SimpleNamespace(
+            name="before", psk=b"old", uplink_enabled=True, downlink_enabled=True))]
+        self.calls = []
+        self.written_lora = None
+        self.nodeNum = 0x12345678
+
+    def ensureSessionKey(self):
+        self.calls.append("session")
+
+    def beginSettingsTransaction(self):
+        self.calls.append("begin")
+
+    def writeChannel(self, index):
+        self.calls.append(("channel", index))
+
+    def writeConfig(self, name):
+        self.calls.append(("config", name))
+        if name == "lora":
+            self.written_lora = copy.deepcopy(self.localConfig.lora)
+
+    def commitSettingsTransaction(self):
+        self.calls.append("commit")
+
+
+class StockConfigurationTests(unittest.TestCase):
+    def configure(self, preset, *, normalized=False, handshake_misses=0, session_misses=0,
+                  readback_cr=None):
+        node = Node()
+        session_reads = []
+
+        def session_node(node_num):
+            self.assertEqual(node_num, node.nodeNum)
+            session_reads.append(True)
+            return {} if len(session_reads) <= session_misses else {"adminSessionPassKey": b"mock-key"}
+
+        iface = SimpleNamespace(localNode=node, myInfo=SimpleNamespace(my_node_num=0x12345678),
+                                metadata=SimpleNamespace(firmware_version="mock-stable"), close=lambda: None,
+                                _getOrCreateByNum=session_node)
+        stock = hil.StockPeer.__new__(hil.StockPeer)
+        stock.iface = iface
+        attempts = []
+
+        def connect():
+            attempts.append(True)
+            if len(attempts) <= handshake_misses:
+                raise MeshInterfaceError("transient simulated boot handshake")
+            # The official stock boot helper derives BW/SF from the preset.
+            if normalized and preset.stock_enum:
+                node.localConfig.lora.bandwidth = preset.bandwidth
+                node.localConfig.lora.spread_factor = preset.sf
+            if readback_cr is not None:
+                node.localConfig.lora.coding_rate = readback_cr
+            stock.iface = iface
+
+        stock.connect = connect
+        with patch.dict(sys.modules, fake_sdk()), patch.object(hil.time, "sleep"), \
+                patch.object(hil.time, "monotonic", side_effect=range(1, 250)):
+            result = stock.configure(preset, bytes(range(16)), -9, 7)
+        return node, result, attempts
+
+    def test_nine_native_presets_clear_bw_sf_and_keep_native_cr_with_hash_slot(self):
+        for preset in hil.PRESETS:
+            if not preset.stock_enum:
+                continue
+            with self.subTest(preset=preset.name):
+                node, result, _ = self.configure(preset)
+                lora = node.written_lora
+                self.assertTrue(lora.use_preset)
+                self.assertEqual(lora.modem_preset, PresetEnum.Value(preset.stock_enum))
+                # Stock clamps a zero CR to 5 instead of selecting preset CR.
+                self.assertEqual((lora.bandwidth, lora.spread_factor, lora.coding_rate), (0, 0, preset.cr))
+                self.assertEqual((lora.channel_num, lora.override_frequency, lora.frequency_offset), (0, 0, 0))
+                self.assertEqual((lora.region, lora.tx_power, lora.hop_limit), (1, -9, 7))
+                self.assertTrue(lora.tx_enabled and lora.ignore_mqtt)
+                self.assertFalse(lora.config_ok_to_mqtt)
+                self.assertEqual(node.calls, ["session", "begin", ("config", "device"),
+                                              ("config", "lora"), ("channel", 0), "commit"])
+                self.assertEqual(node.channels[0].settings.name, preset.name)
+                self.assertEqual(node.channels[0].settings.psk, bytes(range(16)))
+                self.assertFalse(node.channels[0].settings.uplink_enabled)
+                self.assertFalse(node.channels[0].settings.downlink_enabled)
+                self.assertEqual(result["node"], "!12345678")
+
+    def test_native_stock_boot_normalization_is_not_a_readback_failure(self):
+        for preset in hil.PRESETS:
+            if preset.stock_enum:
+                with self.subTest(preset=preset.name):
+                    node, _, _ = self.configure(preset, normalized=True)
+                    self.assertEqual(node.written_lora.bandwidth, 0)
+                    self.assertEqual(node.written_lora.spread_factor, 0)
+                    self.assertEqual(node.localConfig.lora.bandwidth, preset.bandwidth)
+
+    def test_custom_mediumturbo_tuple_and_explicit_calculated_slot(self):
+        preset = next(p for p in hil.PRESETS if p.name == "MediumTurbo")
+        node, _, _ = self.configure(preset)
+        lora = node.written_lora
+        self.assertFalse(lora.use_preset)
+        self.assertEqual((lora.bandwidth, lora.spread_factor, lora.coding_rate), (500, 9, 5))
+        self.assertEqual(lora.channel_num, 47)
+        self.assertEqual(node.channels[0].settings.name, "MediumTurbo")
+
+    def test_transient_meshinterface_handshake_error_retries(self):
+        _, _, attempts = self.configure(hil.PRESETS[0], handshake_misses=1)
+        self.assertEqual(len(attempts), 2)
+
+    def test_async_admin_session_is_ready_before_writes(self):
+        node, _, _ = self.configure(hil.PRESETS[0], session_misses=3)
+        self.assertEqual(node.calls[0:2], ["session", "begin"])
+
+    def test_missing_admin_session_aborts_without_writing(self):
+        with self.assertRaisesRegex(hil.TestFailure, "admin session setup timed out"):
+            self.configure(hil.PRESETS[0], session_misses=100)
+
+    def test_zero_or_wrong_cr_is_not_accepted_as_native_readback(self):
+        for preset_name, observed_cr in (("LongFast", 0), ("LongSlow", 5)):
+            preset = next(p for p in hil.PRESETS if p.name == preset_name)
+            with self.subTest(preset=preset_name, cr=observed_cr):
+                with self.assertRaisesRegex(hil.TestFailure, "configuration readback did not match"):
+                    self.configure(preset, readback_cr=observed_cr)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/test/test_meshtext_chat.py b/test/test_meshtext_chat.py
new file mode 100644
index 000000000..e7b5a5aa7
--- /dev/null
+++ b/test/test_meshtext_chat.py
@@ -0,0 +1,491 @@
+"""Execute the bounded MT codec with real Crypto AES and an independent oracle.
+
+No PlatformIO, hardware or downloaded sources are used. Set MESHCORE_CRYPTO_DIR
+to an existing rweather/Crypto checkout, or use the cached PlatformIO dependency.
+The Python cryptography package independently generates encrypted wire vectors.
+"""
+
+import os
+from pathlib import Path
+import shutil
+import struct
+import subprocess
+import sys
+import tempfile
+import unittest
+
+ROOT = Path(__file__).resolve().parents[1]
+DEFAULT_KEY = bytes.fromhex("d4f1bb3a20290759f0bcffabcf4e6901")
+FROM, PACKET_ID = 0x11223344, 0x89ABCDEF
+
+
+def varint(value):
+    encoded = bytearray()
+    while value >= 128:
+        encoded.append((value & 127) | 128)
+        value >>= 7
+    encoded.append(value)
+    return bytes(encoded)
+
+
+def data_text(text):
+    return b"\x08\x01\x12" + varint(len(text)) + text
+
+
+def data_nodeinfo(long_name, short_name, sender):
+    # Independent handwritten schema oracle: User fields 1/2/3/7/9 only.
+    user_id = ("!%08x" % sender).encode("ascii")
+    user = b"\x0a" + varint(len(user_id)) + user_id
+    if long_name:
+        user += b"\x12" + varint(len(long_name)) + long_name
+    user += b"\x1a" + varint(len(short_name)) + short_name
+    user += b"\x38\x01\x48\x01"  # CLIENT_MUTE=1, is_unmessagable=true.
+    return b"\x08\x04\x12" + varint(len(user)) + user
+
+
+def reference_frame(data, name="LongFast", key=DEFAULT_KEY, *, to=0xFFFFFFFF,
+                    sender=FROM, packet_id=PACKET_ID, flags=0x63):
+    from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+    channel_hash = 0
+    for byte in name.encode() + key:
+        channel_hash ^= byte
+    header = struct.pack("<III4B", to, sender, packet_id, flags, channel_hash, 0, 0)
+    encryptor = Cipher(algorithms.AES(key), modes.CTR(struct.pack("<QQ", packet_id, sender))).encryptor()
+    return header + encryptor.update(data) + encryptor.finalize()
+
+
+def array(value):
+    return "{" + ",".join(map(str, value)) + "}"
+
+
+def literal(value):
+    return '"' + "".join("\\x%02x" % byte for byte in value) + '"'
+
+
+HARNESS = r'''
+#include <helpers/MeshtextChat.h>
+#include <cassert>
+#include <cmath>
+#include <cstdio>
+#include <cstring>
+#include <initializer_list>
+using namespace mesh::mt;
+struct Golden {
+  uint8_t key[32]; size_t key_len; const char* name; const char* text; size_t text_len;
+  uint8_t frame[255]; size_t frame_len;
+};
+static const Golden golden[] = { @GOLDEN@ };
+// Stock 2.7.26 Router::perhapsEncode marks Data.bitfield present even when
+// config_ok_to_mqtt and want_response are both false: field 9 is 0x48,0x00.
+static const Golden stock_zero_bitfield[] = { @STOCK_ZERO_BITFIELD@ };
+struct NodeInfoGolden {
+  uint8_t key[32]; size_t key_len; const char* name;
+  const char* long_name; size_t long_name_len; const char* short_name; size_t short_name_len;
+  uint32_t from, id; uint8_t hops; uint8_t frame[255]; size_t frame_len;
+};
+static const NodeInfoGolden node_info_golden[] = { @NODEINFO_GOLDEN@ };
+struct Malformed { const char* label; uint8_t frame[255]; size_t length; };
+static const Malformed malformed[] = { @MALFORMED@ };
+struct Modem {
+  Region region; Preset preset; bool valid; float frequency, bandwidth; uint8_t sf, cr;
+};
+static const Modem modems[] = { @MODEMS@ };
+static void presets() {
+  Preset preset = Preset::LongFast;
+  for (const auto* name : {"ShortTurbo", "ShortFast", "ShortSlow", "MediumTurbo", "MediumFast",
+                          "MediumSlow", "LongTurbo", "LongFast", "LongMod", "LongSlow"}) {
+    assert(parsePreset(name, preset)); assert(!strcmp(presetName(preset), name));
+  }
+  assert(parsePreset("LongModerate", preset) && preset == Preset::LongModerate);
+  assert(parsePreset("longfast", preset) && preset == Preset::LongFast);
+  assert(parsePreset("shortturbo", preset) && preset == Preset::ShortTurbo);
+  assert(parsePreset("LoNgTuRbO", preset) && preset == Preset::LongTurbo);
+  assert(parsePreset("LONGMODERATE", preset) && preset == Preset::LongModerate);
+  for (const auto* invalid : {"", "Long-Fast", "LongUltra", "mt-LongFast", "LongFast "}) {
+    preset = Preset::LongFast;
+    assert(!parsePreset(invalid, preset) && preset == Preset::LongFast);
+  }
+  assert(!parsePreset(nullptr, preset));
+  assert(presetName(static_cast<Preset>(255)) == nullptr);
+  for (const auto& test : modems) {
+    mesh::RadioProfileParams params;
+    params.freq = 123; const auto original = params;
+    assert(modemConfig(test.region, test.preset, params) == test.valid);
+    if (!test.valid) { assert(params == original); continue; }
+    assert(std::fabs(params.freq - test.frequency) < 0.0001f);
+    assert(params.bw == test.bandwidth && params.sf == test.sf && params.cr == test.cr);
+    assert(params.preamble == 16 && params.protocol == mesh::RadioProfileProtocol::Meshtext);
+    assert(modemConfig(test.region, test.preset, params, 1));
+    const float start = test.region == Region::US ? 902 : test.region == Region::EU868 ? 869.4f
+                      : test.region == Region::EU433 ? 433 : 915;
+    const uint32_t width = test.region == Region::US ? 26000 : test.region == Region::EU868 ? 250
+                         : test.region == Region::EU433 ? 1000 : 13000;
+    const uint32_t slots = width / static_cast<uint32_t>(test.bandwidth);
+    assert(std::fabs(params.freq - (start + test.bandwidth / 2000)) < 0.0001f);
+    assert(modemConfig(test.region, test.preset, params, slots));
+    const auto last = params;
+    assert(!modemConfig(test.region, test.preset, params, slots + 1) && params == last);
+    assert(!modemConfig(test.region, test.preset, params, 0xffffffffU) && params == last);
+  }
+  mesh::RadioProfileParams params;
+  assert(!modemConfig(Region::Unset, Preset::LongFast, params));
+  assert(!modemConfig(static_cast<Region>(255), Preset::LongFast, params));
+  assert(!modemConfig(Region::US, static_cast<Preset>(255), params));
+  puts("PASS presets");
+}
+static void frames() {
+  for (const auto& test : golden) {
+    uint8_t frame[MaxFrameSize + 2]; memset(frame, 0xa5, sizeof(frame));
+    const size_t length = encodeText(0x11223344, 0x89abcdef, 3, test.name, test.key, test.key_len,
+                                     test.text, test.text_len, frame);
+    assert(length == test.frame_len && !memcmp(frame, test.frame, length));
+    assert(frame[MaxFrameSize] == 0xa5 && frame[MaxFrameSize + 1] == 0xa5);
+    DecodedText decoded;
+    assert(decodeText(test.frame, test.frame_len, test.name, test.key, test.key_len, 0x99887766, decoded));
+    assert(decoded.from == 0x11223344 && decoded.id == 0x89abcdef);
+    assert(decoded.hop_limit == 3 && decoded.hop_start == 3 && decoded.hops == 0);
+    assert(decoded.text_len == test.text_len && !memcmp(decoded.text, test.text, test.text_len));
+    assert(decoded.text[decoded.text_len] == 0);
+    memcpy(frame, test.frame, test.frame_len); frame[12] = (7 << 5) | 2;
+    assert(decodeText(frame, length, test.name, test.key, test.key_len, 0x99887766, decoded));
+    assert(decoded.hops == 5 && decoded.hop_start == 7 && decoded.hop_limit == 2);
+    frame[12] = 3; // older hop-start-less packets remain readable
+    assert(decodeText(frame, length, test.name, test.key, test.key_len, 0x99887766, decoded));
+    assert(decoded.hops == 0);
+    assert(!decodeText(frame, length, test.name, test.key, test.key_len, 0x11223344, decoded));
+    frame[13] ^= 1;
+    assert(!decodeText(frame, length, test.name, test.key, test.key_len, 0x99887766, decoded));
+  }
+  assert(!memcmp(DefaultPsk, golden[0].key, 16));
+  puts("PASS frames");
+}
+static void malformed_frames() {
+  for (const auto& test : malformed) {
+    DecodedText decoded;
+    decoded.id = 123; strcpy(decoded.text, "unchanged"); decoded.text_len = 9;
+    if (decodeText(test.frame, test.length, "LongFast", DefaultPsk, 16, 0x99887766, decoded)) {
+      fprintf(stderr, "accepted malformed vector: %s\n", test.label); assert(false);
+    }
+    assert(decoded.id == 123 && decoded.text_len == 9 && !strcmp(decoded.text, "unchanged"));
+  }
+  puts("PASS malformed");
+}
+static void node_info_frames() {
+  static_assert(MaxLongNameSize == 24, "stock long-name limit");
+  static_assert(MaxShortNameSize == 4, "stock short-name max_size:5 includes NUL");
+  for (const auto& test : node_info_golden) {
+    uint8_t frame[MaxFrameSize + 2]; memset(frame, 0xa5, sizeof(frame));
+    const size_t length = encodeNodeInfo(test.from, test.id, test.hops, test.name, test.key, test.key_len,
+                                         test.long_name, test.long_name_len,
+                                         test.short_name, test.short_name_len, frame);
+    // Full independent encrypted-frame equality also proves exact standard User
+    // fields, matching nonce/header, and absence of Data.want_response/keys/MAC.
+    assert(length == test.frame_len && !memcmp(frame, test.frame, length));
+    assert(frame[length] == 0xa5 && frame[MaxFrameSize] == 0xa5 && frame[MaxFrameSize + 1] == 0xa5);
+    assert((frame[12] & 0x18) == 0); // Neither want_ack nor via_mqtt.
+    assert((frame[12] & 7) == test.hops && (frame[12] >> 5) == test.hops);
+    assert(frame[14] == 0 && frame[15] == 0);
+    DecodedText decoded; decoded.id = 123; strcpy(decoded.text, "unchanged");
+    assert(!decodeText(frame, length, test.name, test.key, test.key_len, 0x99887766, decoded));
+    assert(decoded.id == 123 && !strcmp(decoded.text, "unchanged")); // NodeInfo RX still ignored.
+  }
+  puts("PASS nodeinfo");
+}
+static void node_info_bounds() {
+  uint8_t frame[MaxFrameSize]; memset(frame, 0xa5, sizeof(frame));
+  const auto invalid = [&](uint32_t from, uint32_t id, uint8_t hops, const char* name,
+                           const uint8_t* key, size_t key_len, const char* long_name, size_t long_len,
+                           const char* short_name, size_t short_len) {
+    assert(!encodeNodeInfo(from, id, hops, name, key, key_len, long_name, long_len, short_name, short_len, frame));
+    for (uint8_t byte : frame) assert(byte == 0xa5); // Rejection writes no partial packet.
+  };
+  char long_name[MaxLongNameSize + 1]; memset(long_name, 'L', sizeof(long_name));
+  char short_name[MaxShortNameSize + 1]; memset(short_name, 'S', sizeof(short_name));
+  for (uint32_t from : {0U, 1U, 2U, 3U, 0xffffffffU})
+    invalid(from, 1, 7, "LongFast", DefaultPsk, 16, "long", 4, "shrt", 4);
+  invalid(4, 0, 7, "LongFast", DefaultPsk, 16, "long", 4, "shrt", 4);
+  invalid(4, 1, 8, "LongFast", DefaultPsk, 16, "long", 4, "shrt", 4);
+  for (const auto* name : {static_cast<const char*>(nullptr), "", "123456789012"})
+    invalid(4, 1, 7, name, DefaultPsk, 16, "long", 4, "shrt", 4);
+  for (size_t key_len : {size_t(0), size_t(1), size_t(15), size_t(17), size_t(31), size_t(33)})
+    invalid(4, 1, 7, "LongFast", DefaultPsk, key_len, "long", 4, "shrt", 4);
+  invalid(4, 1, 7, "LongFast", nullptr, 16, "long", 4, "shrt", 4);
+  invalid(4, 1, 7, "LongFast", DefaultPsk, 16, nullptr, 0, "shrt", 4);
+  invalid(4, 1, 7, "LongFast", DefaultPsk, 16, "long", 4, nullptr, 4);
+  invalid(4, 1, 7, "LongFast", DefaultPsk, 16, "long", 4, "", 0);
+  for (size_t size : {MaxLongNameSize + 1, size_t(-1)})
+    invalid(4, 1, 7, "LongFast", DefaultPsk, 16, long_name, size, "shrt", 4);
+  for (size_t size : {MaxShortNameSize + 1, size_t(-1)})
+    invalid(4, 1, 7, "LongFast", DefaultPsk, 16, "long", 4, short_name, size);
+  const char* bad_names[] = {"\0", "\xc0\xaf", "\xe0\x80\x80", "\xed\xa0\x80",
+                            "\xf0\x80\x80\x80", "\xf4\x90\x80\x80", "\x80", "\xc2", "\xe2\x82"};
+  const size_t bad_lengths[] = {1, 2, 3, 3, 4, 4, 1, 1, 2};
+  for (size_t i = 0; i < sizeof(bad_lengths) / sizeof(bad_lengths[0]); ++i) {
+    invalid(4, 1, 7, "LongFast", DefaultPsk, 16, bad_names[i], bad_lengths[i], "shrt", 4);
+    invalid(4, 1, 7, "LongFast", DefaultPsk, 16, "long", 4, bad_names[i], bad_lengths[i]);
+  }
+  const char embedded_nul[] = {'a', 0, 'b'};
+  invalid(4, 1, 7, "LongFast", DefaultPsk, 16, embedded_nul, 3, "shrt", 4);
+  invalid(4, 1, 7, "LongFast", DefaultPsk, 16, "long", 4, embedded_nul, 3);
+  assert(!encodeNodeInfo(4, 1, 7, "LongFast", DefaultPsk, 16, "long", 4, "shrt", 4, nullptr));
+  // Exact-length byte arrays need no trailing NUL; the codec never scans them.
+  assert(encodeNodeInfo(4, 1, 7, "LongFast", DefaultPsk, 16,
+                        long_name, MaxLongNameSize, short_name, MaxShortNameSize, frame));
+  assert(encodeNodeInfo(4, 1, 0, "LongFast", DefaultPsk, 16, "", 0, "a", 1, frame));
+  // A single non-ASCII scalar can occupy the complete four-byte stock field.
+  assert(encodeNodeInfo(4, 1, 3, "LongFast", DefaultPsk, 16, "\xc3\xa9", 2, "\xf0\x9f\x9a\x80", 4, frame));
+  puts("PASS nodeinfo_bounds");
+}
+static void argument_bounds() {
+  uint8_t frame[MaxFrameSize] = {};
+  char text[MaxTextSize + 2]; memset(text, 'x', sizeof(text));
+  assert(encodeText(1, 1, 7, "LongFast", DefaultPsk, 16, text, MaxTextSize, frame));
+  for (size_t length : {size_t(0), MaxTextSize + 1, size_t(0xffffffffU)})
+    assert(!encodeText(1, 1, 3, "LongFast", DefaultPsk, 16, text, length, frame));
+  assert(!encodeText(0, 1, 3, "LongFast", DefaultPsk, 16, text, 1, frame));
+  assert(!encodeText(0xffffffffU, 1, 3, "LongFast", DefaultPsk, 16, text, 1, frame));
+  assert(!encodeText(1, 0, 3, "LongFast", DefaultPsk, 16, text, 1, frame));
+  assert(!encodeText(1, 1, 8, "LongFast", DefaultPsk, 16, text, 1, frame));
+  assert(encodeText(1, 1, 3, "12345678901", DefaultPsk, 16, text, 1, frame));
+  for (const auto* name : {static_cast<const char*>(nullptr), "", "123456789012", "01234567890123456789012345678901xx"})
+    assert(!encodeText(1, 1, 3, name, DefaultPsk, 16, text, 1, frame));
+  for (size_t key_length : {size_t(0), size_t(1), size_t(15), size_t(17), size_t(31), size_t(33)})
+    assert(!encodeText(1, 1, 3, "LongFast", DefaultPsk, key_length, text, 1, frame));
+  assert(!encodeText(1, 1, 3, "LongFast", nullptr, 16, text, 1, frame));
+  assert(!encodeText(1, 1, 3, "LongFast", DefaultPsk, 16, nullptr, 1, frame));
+  assert(!encodeText(1, 1, 3, "LongFast", DefaultPsk, 16, text, 1, nullptr));
+  const char* invalid_utf8[] = {"\0", "\xc0\xaf", "\xe0\x80\x80", "\xed\xa0\x80",
+                              "\xf0\x80\x80\x80", "\xf4\x90\x80\x80", "\x80", "\xc2", "\xe2\x82"};
+  const size_t lengths[] = {1, 2, 3, 3, 4, 4, 1, 1, 2};
+  for (size_t i = 0; i < sizeof(lengths) / sizeof(lengths[0]); ++i)
+    assert(!encodeText(1, 1, 3, "LongFast", DefaultPsk, 16, invalid_utf8[i], lengths[i], frame));
+  const char nul_text[] = {'a', 0, 'b'};
+  assert(!encodeText(1, 1, 3, "LongFast", DefaultPsk, 16, nul_text, 3, frame));
+  DecodedText decoded;
+  assert(!decodeText(nullptr, 50, "LongFast", DefaultPsk, 16, 0, decoded));
+  assert(!decodeText(frame, 0, "LongFast", DefaultPsk, 16, 0, decoded));
+  assert(!decodeText(frame, 256, "LongFast", DefaultPsk, 16, 0, decoded));
+  assert(!decodeText(frame, 50, "LongFast", nullptr, 16, 0, decoded));
+  assert(!decodeText(frame, 50, nullptr, DefaultPsk, 16, 0, decoded));
+  puts("PASS bounds");
+}
+static void extensions() {
+  const uint8_t frame[] = @EXTENSION_FRAME@;
+  DecodedText decoded;
+  assert(decodeText(frame, sizeof(frame), "LongFast", DefaultPsk, 16, 0x99887766, decoded));
+  assert(decoded.text_len == 1 && !strcmp(decoded.text, "x"));
+  // Header ACK/request flags do not make this passive decoder transmit.
+  const uint8_t requests[] = @REQUEST_FRAME@;
+  assert(decodeText(requests, sizeof(requests), "LongFast", DefaultPsk, 16, 0x99887766, decoded));
+  puts("PASS extensions");
+}
+static void stock_zero_bitfield_frames() {
+  for (const auto& test : stock_zero_bitfield) {
+    DecodedText decoded;
+    assert(decodeText(test.frame, test.frame_len, test.name, test.key, test.key_len,
+                      0x99887766, decoded));
+    assert(decoded.from == 0x11223344 && decoded.id == 0x89abcdef);
+    assert(decoded.hop_limit == 7 && decoded.hop_start == 7 && decoded.hops == 0);
+    assert((test.frame[12] & 0x18) == 0); // Stock SDK requested neither ACK nor MQTT.
+    assert(decoded.text_len == test.text_len && !memcmp(decoded.text, test.text, test.text_len));
+    assert(decoded.text[decoded.text_len] == 0);
+  }
+  puts("PASS stock_zero_bitfield");
+}
+static void dedup() {
+  SeenPackets seen;
+  assert(!seen.seen(1, 1));
+  assert(seen.remember(1, 1)); assert(seen.seen(1, 1)); assert(!seen.remember(1, 1));
+  assert(seen.remember(2, 1)); // same ID from another sender is distinct
+  assert(!seen.remember(0, 1) && !seen.remember(1, 0) && !seen.remember(0xffffffffU, 1));
+  seen.clear(); assert(!seen.seen(1, 1));
+  for (uint32_t i = 1; i <= SeenPackets::Capacity; ++i) assert(seen.remember(1, i));
+  assert(seen.seen(1, 1)); assert(seen.remember(1, 33)); assert(!seen.seen(1, 1));
+  // Invalid data never poisons dedup; the subsequent valid frame is accepted.
+  seen.clear(); DecodedText decoded;
+  for (const auto& test : malformed)
+    if (decodeText(test.frame, test.length, "LongFast", DefaultPsk, 16, 0x99887766, decoded))
+      seen.remember(decoded.from, decoded.id);
+  assert(!seen.seen(0x11223344, 0x89abcdef));
+  assert(decodeText(golden[0].frame, golden[0].frame_len, "LongFast", DefaultPsk, 16, 0x99887766, decoded));
+  assert(seen.remember(decoded.from, decoded.id));
+  assert(!seen.remember(decoded.from, decoded.id));
+  // Successful own TX uses the same pair cache to suppress over-air echoes.
+  seen.clear(); assert(seen.remember(0x11223344, 0x89abcdef));
+  assert(seen.seen(0x11223344, 0x89abcdef));
+  puts("PASS dedup");
+}
+int main(int argc, char** argv) {
+  assert(argc == 2);
+  if (!strcmp(argv[1], "presets")) presets();
+  else if (!strcmp(argv[1], "frames")) frames();
+  else if (!strcmp(argv[1], "malformed")) malformed_frames();
+  else if (!strcmp(argv[1], "nodeinfo")) node_info_frames();
+  else if (!strcmp(argv[1], "nodeinfo_bounds")) node_info_bounds();
+  else if (!strcmp(argv[1], "bounds")) argument_bounds();
+  else if (!strcmp(argv[1], "extensions")) extensions();
+  else if (!strcmp(argv[1], "stock_zero_bitfield")) stock_zero_bitfield_frames();
+  else if (!strcmp(argv[1], "dedup")) dedup();
+  else assert(false);
+}
+'''
+
+
+def vectors():
+    inputs = [(DEFAULT_KEY, "LongFast", b"hello"),
+              (bytes(range(32)), "LongTurbo", "caf\u00e9 \U0001f6f0\ufe0f".encode()),
+              (bytes(range(16)), "LongMod", bytes(range(33, 127))),
+              (DEFAULT_KEY, "LongFast", b"a" * 127),
+              (DEFAULT_KEY, "LongFast", b"b" * 128),
+              (bytes(range(32)), "LongTurbo", b"c" * 228),
+              (DEFAULT_KEY, "LongFast", "\u0080\u07ff\u0800\ud7ff\ue000\uffff\U00010000\U0010ffff".encode())]
+    golden = []
+    for key, name, text in inputs:
+        frame = reference_frame(data_text(text), name, key)
+        golden.append("{" + array(key) + "," + str(len(key)) + ',"' + name + '",'
+                      + literal(text) + "," + str(len(text)) + "," + array(frame) + "," + str(len(frame)) + "}")
+    stock_zero_bitfield = []
+    for key, name in [(bytes(range(16)), "ShortTurbo"), (bytes(range(32)), "LongFast")]:
+        text = "stock field9 zero caf\u00e9".encode()
+        # Independently encrypted exact stock Data shape, not our encodeText:
+        # TEXT_MESSAGE_APP + UTF-8 payload + OPTIONAL uint32 bitfield=0.
+        data = data_text(text) + b"\x48\x00"
+        frame = reference_frame(data, name, key, flags=0xE7)
+        stock_zero_bitfield.append("{" + array(key) + "," + str(len(key)) + ',"' + name + '",'
+                                   + literal(text) + "," + str(len(text)) + ","
+                                   + array(frame) + "," + str(len(frame)) + "}")
+    node_inputs = [(DEFAULT_KEY, "LongFast", b"MeshCore", b"CORE", FROM, 7),
+                   (bytes(range(32)), "LongTurbo", ("\u00e9" * 12).encode(), "\U0001f680".encode(), 0xABCDEF12, 0),
+                   (bytes(range(16)), "LongMod", b"L" * 24, "\u00e9\u00e9".encode(), 4, 3),
+                   (bytes(range(32)), "private", b"", b"a", 0xFFFFFFFE, 1)]
+    node_inputs += [(DEFAULT_KEY, "LongFast", "\u6d4b\u8bd5".encode(), "\u6d4bA".encode(), FROM, hops)
+                    for hops in (2, 4, 5, 6)]
+    node_info = []
+    for offset, (key, name, long_name, short_name, sender, hops) in enumerate(node_inputs):
+        packet_id = PACKET_ID + offset
+        frame = reference_frame(data_nodeinfo(long_name, short_name, sender), name, key,
+                                sender=sender, packet_id=packet_id, flags=hops | (hops << 5))
+        node_info.append("{" + array(key) + "," + str(len(key)) + ',"' + name + '",'
+                         + literal(long_name) + "," + str(len(long_name)) + ","
+                         + literal(short_name) + "," + str(len(short_name)) + ","
+                         + str(sender) + "U," + str(packet_id) + "U," + str(hops) + ","
+                         + array(frame) + "," + str(len(frame)) + "}")
+    bad_data = {
+        "empty Data": b"", "missing port": b"\x12\x01x", "missing text": b"\x08\x01",
+        "empty text": b"\x08\x01\x12\x00", "other app": b"\x08\x02\x12\x01x",
+        "wrong port wire": b"\x0a\x01\x01\x12\x01x", "wrong payload wire": b"\x08\x01\x10\x01",
+        "truncated length": b"\x08\x01\x12\x80", "oversized length": b"\x08\x01\x12\xff\x01x",
+        "field zero": b"\x00" + data_text(b"x"), "unknown group wire": data_text(b"x") + b"\x53",
+        "overflow varint": b"\xff" * 9 + b"\x02", "noncanonical tag": b"\x88\x00\x01\x12\x01x",
+        "duplicate port": data_text(b"x") + b"\x08\x01", "duplicate text": data_text(b"x") + b"\x12\x01y",
+        "UTF8 surrogate": data_text(b"\xed\xa0\x80"), "embedded NUL": data_text(b"x\x00y"),
+        "proxied DM dest": data_text(b"x") + b"\x25" + struct.pack("<I", 0x99887766),
+        "invalid boolean": data_text(b"x") + b"\x18\x02", "bad source wire": data_text(b"x") + b"\x28\x01",
+        "truncated fixed32": data_text(b"x") + b"\x25\x00\x00",
+        "truncated unknown fixed64": data_text(b"x") + b"\x51\x00",
+        "long text": data_text(b"x" * 229),
+    }
+    rejected = [(label, reference_frame(data)) for label, data in bad_data.items()]
+    rejected += [("DM", reference_frame(data_text(b"x"), to=0x99887766)),
+                 ("zero sender", reference_frame(data_text(b"x"), sender=0)),
+                 ("reserved sender", reference_frame(data_text(b"x"), sender=0xFFFFFFFF)),
+                 ("zero packet ID", reference_frame(data_text(b"x"), packet_id=0)),
+                 ("short header", reference_frame(data_text(b"x"))[:15]),
+                 ("overlong frame", bytes(250))]
+    malformed = ["{\"" + label + "\"," + array(frame) + "," + str(len(frame)) + "}" for label, frame in rejected]
+    extension = reference_frame(data_text(b"x") + b"\x50\x81\x01\x59" + bytes(8)
+                                + b"\x62\x03abc\x6d" + bytes(4))
+    request = reference_frame(data_text(b"x") + b"\x18\x01", flags=0x6B)
+    presets = [("ShortTurbo", 500000, 7, 5), ("ShortFast", 250000, 7, 5),
+               ("ShortSlow", 250000, 8, 5), ("MediumTurbo", 500000, 9, 5),
+               ("MediumFast", 250000, 9, 5), ("MediumSlow", 250000, 10, 5),
+               ("LongTurbo", 500000, 11, 8), ("LongFast", 250000, 11, 5),
+               ("LongModerate", 125000, 11, 8), ("LongSlow", 125000, 12, 8)]
+    modems = []
+    for region, start, end in [("US", 902000000, 928000000), ("EU868", 869400000, 869650000),
+                               ("EU433", 433000000, 434000000), ("ANZ", 915000000, 928000000)]:
+        for preset, bandwidth, sf, cr in presets:
+            name = "LongMod" if preset == "LongModerate" else preset
+            name_hash = 5381
+            for byte in name.encode():
+                name_hash = (name_hash * 33 + byte) & 0xFFFFFFFF
+            slots = (end - start) // bandwidth
+            frequency = (start + bandwidth // 2 + (name_hash % slots) * bandwidth) / 1e6 if slots else 0.0
+            modems.append("{Region::" + region + ",Preset::" + preset + "," + str(bool(slots)).lower()
+                          + "," + str(frequency) + "f," + str(bandwidth / 1000) + "f," + str(sf) + "," + str(cr) + "}")
+    return (HARNESS.replace("@GOLDEN@", ",\n".join(golden)).replace("@MALFORMED@", ",\n".join(malformed))
+            .replace("@STOCK_ZERO_BITFIELD@", ",\n".join(stock_zero_bitfield))
+            .replace("@NODEINFO_GOLDEN@", ",\n".join(node_info))
+            .replace("@MODEMS@", ",\n".join(modems)).replace("@EXTENSION_FRAME@", array(extension))
+            .replace("@REQUEST_FRAME@", array(request)))
+
+
+class MeshtextChatTest(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        try:
+            import cryptography  # noqa: F401
+        except ImportError:
+            raise unittest.SkipTest("Python cryptography is required for the independent AES oracle")
+        compiler = os.environ.get("CXX") or shutil.which("g++") or shutil.which("clang++")
+        if not compiler:
+            raise unittest.SkipTest("a host C++ compiler is required")
+        required = ["AESCommon.cpp", "AES128.cpp", "AES256.cpp", "BlockCipher.cpp", "Crypto.cpp"]
+        override = os.environ.get("MESHCORE_CRYPTO_DIR")
+        candidates = [Path(override)] if override else sorted((ROOT / ".pio/libdeps").glob("*/Crypto"))
+        crypto = next((path for path in candidates if all((path / item).is_file() for item in required)), None)
+        if not crypto:
+            raise unittest.SkipTest("an existing rweather/Crypto dependency is required (MESHCORE_CRYPTO_DIR)")
+        cls.temp = tempfile.TemporaryDirectory(prefix="meshcore-mt-codec-")
+        cls.addClassCleanup(cls.temp.cleanup)
+        work = Path(cls.temp.name)
+        source = work / "chat.cpp"
+        source.write_text(vectors(), encoding="utf-8")
+        cls.binary = work / ("chat.exe" if sys.platform == "win32" else "chat")
+        sanitizers = (["-fsanitize=address,undefined", "-fno-sanitize-recover=all", "-fno-pie", "-no-pie"]
+                      if sys.platform.startswith("linux") else [])
+        result = subprocess.run(
+            [compiler, "-std=c++11", "-Wall", "-Wextra", "-Werror", "-Wno-unused-parameter",
+             "-DMESH_ENABLE_MESHTEXT_CHAT=1",
+             *sanitizers, "-I" + str(ROOT / "src"), "-I" + str(crypto), str(source),
+             str(ROOT / "src/helpers/MeshtextChat.cpp"), *[str(crypto / item) for item in required],
+             "-o", str(cls.binary)], capture_output=True, text=True, timeout=60,
+        )
+        if result.returncode:
+            raise AssertionError(result.stdout + result.stderr)
+
+    def run_case(self, name):
+        result = subprocess.run([str(self.binary), name], capture_output=True, text=True, timeout=30)
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+        self.assertIn("PASS " + name, result.stdout)
+
+    def test_modem_presets_regions_and_strict_slots(self):
+        self.run_case("presets")
+
+    def test_actual_aes128_aes256_against_independent_golden_frames(self):
+        self.run_case("frames")
+
+    def test_malformed_protobuf_utf8_and_broadcast_only(self):
+        self.run_case("malformed")
+
+    def test_explicit_standard_nodeinfo_aes128_aes256_all_hops_and_no_receive(self):
+        self.run_case("nodeinfo")
+
+    def test_nodeinfo_stock_name_utf8_and_argument_bounds(self):
+        self.run_case("nodeinfo_bounds")
+
+    def test_argument_and_text_bounds(self):
+        self.run_case("bounds")
+
+    def test_safe_unknown_fields_and_no_request_response_action(self):
+        self.run_case("extensions")
+
+    def test_stock_present_zero_bitfield_broadcast_hops7_aes128_and_aes256(self):
+        self.run_case("stock_zero_bitfield")
+
+    def test_dedup_only_valid_packets_and_own_tx(self):
+        self.run_case("dedup")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/test/test_meshtext_license.py b/test/test_meshtext_license.py
new file mode 100644
index 000000000..c68dd290c
--- /dev/null
+++ b/test/test_meshtext_license.py
@@ -0,0 +1,203 @@
+"""Qualify linked chat code and ship its MIT notice without touching firmware."""
+import hashlib
+import json
+from pathlib import Path
+import shutil
+import struct
+import subprocess
+import sys
+import tempfile
+import unittest
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "scripts"))
+import package_meshtext_license as license
+import firmware_memory_manifest as memory
+import firmware_build_recipe as recipe
+import package_cascade_release as release
+
+SYMBOLS = ("_ZN4mesh2mt10encodeTextEj", "_ZN4mesh2mt10decodeTextEj",
+           "_ZN6MyMesh16sendMeshtextTextEj", "_ZN6MyMesh19onForeignRadioFrameEj",
+           "_ZN4mesh10Dispatcher22queueForeignRadioFrameEj")
+
+
+def elf32(path, symbols=SYMBOLS, flags=6, undefined=(), zero=()):
+    names, table = bytearray(b"\0"), bytearray(16)
+    data = b"CODE" * max(1, len(symbols))
+    for i, name in enumerate(symbols):
+        offset = len(names)
+        names += name.encode() + b"\0"
+        table += struct.pack("<IIIBBH", offset, 0x40000000 + i * 4,
+                             0 if name in zero else 4, 0x12, 0, 0 if name in undefined else 1)
+    payload = 52 + 4 * 40
+    strings = payload + len(data)
+    symtab = strings + len(names)
+    header = b"\x7fELF\x01\x01\x01" + bytes(9)
+    header += struct.pack("<HH5I6H", 2, 40, 1, 0, 0, 52, 0, 52, 0, 0, 40, 4, 0)
+    sections = bytes(40)
+    sections += struct.pack("<10I", 0, 1, flags, 0x40000000, payload, len(data), 0, 0, 4, 0)
+    sections += struct.pack("<10I", 0, 3, 0, 0, strings, len(names), 0, 0, 1, 0)
+    sections += struct.pack("<10I", 0, 2, 0, 0, symtab, len(table), 2, 1, 4, 16)
+    path.write_bytes(header + sections + data + names + table)
+
+
+class MeshtextLicenseTest(unittest.TestCase):
+    def qualify(self, build, stem):
+        output = stem.parent / (stem.name + ".capabilities.json")
+        result = subprocess.run([sys.executable, str(ROOT / "scripts/check_firmware_capabilities.py"),
+            "--image", str(build / "firmware.elf"), "--output", str(output),
+            "--target", "test_companion_radio_usb", "--platform", "ESP32_PLATFORM",
+            "--build-profile", "standard"], capture_output=True, text=True)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        return json.loads(output.read_text())
+
+    @unittest.skipUnless(sys.platform.startswith("linux"), "requires a Linux ELF compiler")
+    def test_compiler_produced_symbols_qualify_chat_and_notice(self):
+        compiler = shutil.which("g++")
+        if compiler is None:
+            self.skipTest("g++ is not installed")
+        # Do not build symbol spellings from SYMBOLS: the compiler must independently
+        # produce the Itanium name lengths that the production matcher recognizes.
+        source = """
+namespace mesh {
+namespace mt {
+unsigned encodeText(unsigned value) { return value + 1; }
+unsigned decodeText(unsigned value) { return value + 2; }
+}
+class Dispatcher {
+public: unsigned queueForeignRadioFrame(unsigned);
+};
+unsigned Dispatcher::queueForeignRadioFrame(unsigned value) { return value + 3; }
+}
+class MyMesh {
+public:
+    unsigned sendMeshtextText(unsigned);
+    unsigned onForeignRadioFrame(unsigned);
+};
+unsigned MyMesh::sendMeshtextText(unsigned value) { return value + 4; }
+unsigned MyMesh::onForeignRadioFrame(unsigned value) { return value + 5; }
+extern "C" void _start() {}
+"""
+        with tempfile.TemporaryDirectory() as folder:
+            root = Path(folder)
+            input_path = root / "linked.cpp"
+            input_path.write_text(source)
+            result = subprocess.run([compiler, "-m32", "-O0", "-fno-pie", "-no-pie",
+                "-fno-exceptions", "-fno-rtti", "-fno-stack-protector", "-nostdlib",
+                "-Wl,-e,_start", "-Wl,--build-id=none", str(input_path),
+                "-o", str(root / "firmware.elf")], capture_output=True, text=True)
+            self.assertEqual(result.returncode, 0, result.stderr)
+            codec, chat = license.meshtext_evidence(root / "firmware.elf")
+            self.assertEqual(len(codec), 2)
+            self.assertEqual(len(chat), 5)
+            manifest = self.qualify(root, root / "compiled")
+            self.assertIn(license.CAPABILITY, manifest["capabilities"])
+            self.assertEqual(manifest["verification"][0]["source"], "linked ELF symbols")
+            self.assertEqual(license.collect_build_notice(root, root / "compiled").read_bytes(),
+                             license.notice_bytes())
+
+    def test_only_allocated_defined_executable_symbols_qualify(self):
+        with tempfile.TemporaryDirectory() as folder:
+            path = Path(folder) / "firmware.elf"
+            elf32(path)
+            codec, chat = license.meshtext_evidence(path)
+            self.assertEqual(len(codec), 2)
+            self.assertEqual(len(chat), 5)
+            for flags in (0, 2, 4):
+                elf32(path, flags=flags)
+                self.assertEqual(license.meshtext_evidence(path), ([], []))
+            for missing in SYMBOLS:
+                elf32(path, undefined=(missing,))
+                self.assertFalse(license.meshtext_evidence(path)[1])
+                elf32(path, zero=(missing,))
+                self.assertFalse(license.meshtext_evidence(path)[1])
+            path.write_bytes(b"debug strings " + b"\0".join(s.encode() for s in SYMBOLS))
+            self.assertEqual(license.meshtext_evidence(path), ([], []))
+
+    def test_partial_codec_still_requires_license_but_never_advertises_chat(self):
+        with tempfile.TemporaryDirectory() as folder:
+            root = Path(folder)
+            elf32(root / "firmware.elf", symbols=SYMBOLS[:1])
+            manifest = self.qualify(root, root / "partial")
+            self.assertNotIn(license.CAPABILITY, manifest["capabilities"])
+            self.assertEqual(manifest["third_party_notices"][0]["license"], "MIT")
+            self.assertEqual(license.collect_build_notice(root, root / "partial").read_bytes(), license.notice_bytes())
+
+    def test_unaffected_builds_reject_stale_output_notice(self):
+        with tempfile.TemporaryDirectory() as folder:
+            root = Path(folder)
+            elf32(root / "firmware.elf", symbols=("unrelated_defined_function",))
+            manifest = self.qualify(root, root / "plain")
+            self.assertNotIn("third_party_notices", manifest)
+            self.assertIsNone(license.collect_build_notice(root, root / "plain"))
+            notice = license.sidecar(root / "plain")
+            notice.write_bytes(license.notice_bytes())
+            with self.assertRaisesRegex(ValueError, "stale"):
+                license.collect_build_notice(root, root / "plain")
+            self.assertEqual(notice.read_bytes(), license.notice_bytes())
+
+    def test_notice_is_hashed_staged_and_recipe_bound_without_binary_changes(self):
+        with tempfile.TemporaryDirectory() as folder:
+            root = Path(folder)
+            build, output = root / "build", root / "out"
+            build.mkdir(); output.mkdir()
+            elf32(build / "firmware.elf")
+            label = "v1.17.1.9-halo-keymind-cascade-dev"
+            version = label + "-deadbeef"
+            stem = output / ("test_companion_radio_usb-" + version)
+            manifest = self.qualify(build, stem)
+            self.assertIn(license.CAPABILITY, manifest["capabilities"])
+            self.assertEqual(manifest["verification"][0]["source"], "linked ELF symbols")
+            app, merged = b"qualified-application", b"qualified-merged"
+            (output / (stem.name + ".bin")).write_bytes(app)
+            (output / (stem.name + "-merged.bin")).write_bytes(merged)
+            notice = license.collect_build_notice(build, stem)
+            self.assertEqual(notice.read_bytes(), license.notice_bytes())
+            self.assertEqual(license.collect_build_notice(build, stem), notice)
+            report = dict(schema_version=1, passed=True, available_internal_bytes=80000,
+                          required_heap_bytes=50000, largest_internal_region_bytes=80000,
+                          required_contiguous_bytes=5120,
+                          elf_sha256=hashlib.sha256((build / "firmware.elf").read_bytes()).hexdigest(), target="build_env")
+            (build / "firmware.memory.json").write_text(json.dumps(report))
+            memory.package_report(build, stem)
+            proof = memory.validate_package(stem)
+            self.assertEqual(proof["files"][notice.name], hashlib.sha256(notice.read_bytes()).hexdigest())
+            records = release.collect_artifacts(output, version)
+            self.assertEqual(sum(path == notice for path in records[0]["files"]), 1)
+            self.assertTrue(recipe.package_occupied(stem))
+            commit = "deadbeef" + "0" * 32
+            status = root / "status"
+            status.write_text("state=completed\nexit_code=0\n"
+                f"working_directory={root}\noutput_directory=out\nsource_commit={commit}\n"
+                f"firmware_version={label}\nfirmware_profile=cascade\n"
+                "radio_frequency=909.5\nradio_bandwidth=500\nradio_sf=5\nradio_cr=5\n")
+            result = subprocess.run([sys.executable, str(ROOT / "scripts/package_cascade_release.py"),
+                "--input", str(output), "--output", str(root / "stage"), "--build-status", str(status),
+                "--version", "1.17.1.9", "--commit", commit], capture_output=True, text=True)
+            self.assertEqual(result.returncode, 0, result.stderr)
+            staged = root / "stage/companion"
+            self.assertEqual((staged / notice.name).read_bytes(), license.notice_bytes())
+            self.assertIn(notice.name, (staged / "TARGET-MANIFEST.json").read_text())
+            self.assertIn(notice.name, (staged / "SHA256SUMS.txt").read_text())
+            self.assertEqual((output / (stem.name + ".bin")).read_bytes(), app)
+            self.assertEqual((output / (stem.name + "-merged.bin")).read_bytes(), merged)
+            notice.write_bytes(b"tampered")
+            with self.assertRaisesRegex(ValueError, "mismatched"):
+                memory.validate_package(stem)
+            notice.unlink()
+            with self.assertRaisesRegex(ValueError, "missing"):
+                memory.validate_package(stem)
+
+    def test_license_only_package_blocks_resume_and_missing_metadata_is_rejected(self):
+        with tempfile.TemporaryDirectory() as folder:
+            root = Path(folder)
+            stem = root / "occupied"
+            license.sidecar(stem).write_bytes(license.notice_bytes())
+            self.assertTrue(recipe.package_occupied(stem))
+            (root / "occupied.capabilities.json").write_text(json.dumps({"capabilities": [license.CAPABILITY]}))
+            with self.assertRaisesRegex(ValueError, "lacks"):
+                license.validate_artifact_notice(stem)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/test/test_meshtext_transport.py b/test/test_meshtext_transport.py
new file mode 100644
index 000000000..169050dc6
--- /dev/null
+++ b/test/test_meshtext_transport.py
@@ -0,0 +1,354 @@
+"""Run the actual Dispatcher foreign-frame ownership and isolation contract."""
+from pathlib import Path
+import os
+import shutil
+import subprocess
+import tempfile
+import unittest
+from test_radio_receive_contract import method
+from test_radio_profile_scan import HARNESS as SCAN_HARNESS
+
+ROOT = Path(__file__).resolve().parents[1]
+HARNESS = r'''
+#include <Dispatcher.h>
+#include <helpers/StaticPoolPacketManager.h>
+#include <cassert>
+#include <cstring>
+#include <vector>
+using namespace mesh;
+class Clock : public MillisecondClock {
+public: unsigned long now=1000; unsigned long getMillis() override { return now; }
+};
+class TestRadio : public Radio {
+public:
+  RadioProfiles p;
+  uint8_t active=0;
+  bool supported=true, receiving=false, complete=false, sending=false, start_ok=true, carrier=false;
+  bool incoming=false;
+  unsigned sends=0, finishes=0, recovery=0, processed=0;
+  RadioParamApplyResult prepare=RadioParamApplyResult::APPLIED;
+  std::vector<uint8_t> sent;
+  TestRadio() {
+    p.primary.freq=909.5f; p.primary.bw=500; p.primary.sf=5; p.primary.cr=5;
+    p.secondary.params=p.primary; p.secondary.params.protocol=RadioProfileProtocol::Meshtext;
+    p.secondary.params.preamble=16; p.secondary.mode=RadioProfileMode::RxTx;
+  }
+  RadioProfiles* profiles() override { return &p; }
+  const RadioProfiles* profiles() const override { return &p; }
+  bool supportsMeshtext() const override { return supported; }
+  uint8_t receiveProfile() const override { return active; }
+  int recvRaw(uint8_t* bytes,int) override {
+    if (!incoming) return 0;
+    incoming=false; bytes[0]=0x11;bytes[1]=0;bytes[2]=0x23;return 3;
+  }
+  void onReceiveProcessed() override { ++processed; }
+  uint32_t getEstAirtimeFor(int) override { return 100; }
+  uint32_t getProfileAirtime(uint8_t,int,uint8_t=0) override { return 100; }
+  float packetScore(float,int) override { return 1; }
+  RadioParamApplyResult prepareTransmitProfile(uint8_t n) override {
+    if (prepare==RadioParamApplyResult::APPLIED) active=n;
+    return prepare;
+  }
+  bool startSendRaw(const uint8_t* bytes,int len) override {
+    ++sends;sent.assign(bytes,bytes+len);sending=start_ok;complete=false;return start_ok;
+  }
+  bool isSendComplete() override { return complete; }
+  void onSendFinished() override { ++finishes;sending=false; }
+  bool isInRecvMode() const override { return !sending; }
+  bool isReceiving() override { return receiving; }
+  bool isCarrierWaveActive() const override { return carrier; }
+  bool recoverRadio(bool) override { ++recovery;return true; }
+};
+class TestDispatcher : public Dispatcher {
+public:
+  unsigned foreign_rx=0, mc_rx=0, raw_logs=0, mc_sent=0;
+  bool allow_foreign=true;
+  unsigned long duty_window=3600000;
+  std::vector<bool> done;
+  TestDispatcher(TestRadio& r, Clock& c, StaticPoolPacketManager& m):Dispatcher(r,c,m) {}
+  using Dispatcher::queueForeignRadioFrame;
+  using Dispatcher::hasForeignRadioFrame;
+  using Dispatcher::setRadioAvailable;
+  using Dispatcher::getTransmitProfileMask;
+  using Dispatcher::getNextQueueWakeDelay;
+  DispatcherAction onRecvPacket(Packet*) override { ++mc_rx;return ACTION_RELEASE; }
+  void logRxRaw(float,float,const uint8_t*,int) override { ++raw_logs; }
+  bool onForeignRadioFrame(const uint8_t* bytes,size_t length,uint8_t profile,uint32_t generation,float,float) override {
+    assert(length==3 && bytes[0]==0x11 && profile==1 && generation);++foreign_rx;return false;
+  }
+  void onForeignRadioSendComplete(bool ok) override { done.push_back(ok); }
+  bool allowForeignRadioTransmit() const override { return allow_foreign; }
+  unsigned long getDutyCycleWindowMs() const override { return duty_window; }
+  void onSendComplete(Packet*) override { ++mc_sent; }
+  bool queue(const uint8_t* b,size_t n=3) { return queueForeignRadioFrame(b,n,1,_radio->profiles()->generation[1]); }
+};
+struct Fixture {
+  Clock clock;TestRadio radio;StaticPoolPacketManager manager{8};TestDispatcher d{radio,clock,manager};
+  Fixture() { d.begin(); }
+  void tick(unsigned delta=1) { clock.now+=delta;d.loop(); }
+};
+static const uint8_t bytes[]={0x11,0,0x23};
+static Packet* newPacket(TestDispatcher& d,uint8_t policy=RADIO_TX_BOTH) {
+  auto* p=d.obtainNewPacket();assert(p);p->header=ROUTE_TYPE_FLOOD | (PAYLOAD_TYPE_GRP_TXT<<2);
+  p->tx_radio=policy;p->payload[0]=0x12;p->payload_len=1;return p;
+}
+int main() {
+  { Fixture f;assert(f.d.queue(bytes));assert(f.d.hasOutbound());assert(!f.d.queue(bytes));
+    uint32_t delay=99;assert(f.d.getNextQueueWakeDelay(delay) && delay==0);
+    f.tick();assert(f.radio.sends==1 && f.radio.active==1 && f.radio.sent==std::vector<uint8_t>(bytes,bytes+3));
+    f.tick(20);assert(f.radio.sends==1 && f.d.done.empty());
+    f.radio.complete=true;f.tick();assert(f.d.done.size()==1 && f.d.done[0]);
+    assert(!f.d.hasOutbound() && f.radio.finishes==1 && f.radio.p.tx_packets[1]==1);
+    assert(f.d.getNumSentFlood()==0 && f.d.getNumSentDirect()==0 && f.d.getTotalAirTime()==21);
+  }
+  { Fixture f;f.radio.active=1;f.radio.incoming=true;f.tick();
+    assert(f.d.foreign_rx==1 && !f.d.mc_rx && !f.d.raw_logs && f.d.getLastMeshCoreRecvMillis()==0);
+    assert(f.radio.processed==1 && f.d.getNumRecvFlood()==0 && f.radio.p.rx_packets[1]==1);
+    f.radio.p.secondary.mode=RadioProfileMode::Off;f.radio.incoming=true;f.tick();
+    assert(f.d.foreign_rx==1 && !f.d.raw_logs && !f.d.mc_rx);
+  }
+  { Fixture f;assert(f.d.queue(bytes));++f.radio.p.generation[1];f.tick();
+    assert(f.radio.sends==0 && f.d.done.size()==1 && !f.d.done[0] && !f.d.hasOutbound());
+  }
+  { Fixture f;f.radio.start_ok=false;assert(f.d.queue(bytes));f.tick();f.tick(2000);
+    assert(f.radio.sends==1 && f.d.done.size()==1 && !f.d.done[0] && !f.d.hasOutbound());
+  }
+  { Fixture f;assert(f.d.queue(bytes));f.tick();f.tick(1151);
+    assert(f.radio.sends==1 && f.radio.finishes==1 && f.radio.recovery==1);
+    assert(f.d.done.size()==1 && !f.d.done[0] && !f.d.hasOutbound());f.tick(10000);assert(f.radio.sends==1);
+  }
+  { Fixture f;assert(f.d.queue(bytes));f.tick();f.d.setRadioAvailable(false);f.tick(10000);
+    assert(f.radio.sends==1 && f.radio.finishes==1 && f.d.done.size()==1 && !f.d.done[0]);
+    assert(!f.d.queue(bytes) && !f.d.hasOutbound());
+  }
+  { Fixture f;assert(f.d.queue(bytes));f.tick();++f.radio.p.generation[1];f.radio.complete=true;f.tick();
+    assert(f.d.done.size()==1 && !f.d.done[0] && f.radio.finishes==1);
+  }
+  { Fixture f;f.radio.prepare=RadioParamApplyResult::FAILED;assert(f.d.queue(bytes));f.tick();
+    assert(f.radio.sends==0 && f.d.done.size()==1 && !f.d.done[0]);
+  }
+  { Fixture f;assert(f.d.queue(bytes));f.d.allow_foreign=false;f.tick();
+    assert(f.radio.sends==0 && f.d.done.size()==1 && !f.d.done[0] && !f.d.queue(bytes));
+  }
+  { Fixture f;assert(f.d.queue(bytes));f.tick();f.d.begin();
+    assert(f.radio.finishes==1 && f.d.done.size()==1 && !f.d.done[0] && !f.d.hasOutbound());
+  }
+  { Fixture f;f.radio.prepare=RadioParamApplyResult::BUSY;assert(f.d.queue(bytes));f.tick();f.tick(8151);
+    assert(f.radio.sends==0 && f.d.done.size()==1 && !f.d.done[0] && f.radio.recovery==1);
+  }
+  { Fixture f;f.radio.receiving=true;assert(f.d.queue(bytes));f.tick();f.tick(201);
+    assert(f.radio.sends==0 && f.d.hasOutbound());f.radio.receiving=false;f.tick(201);assert(f.radio.sends==1);
+  }
+  { Fixture f;auto* p=newPacket(f.d);f.radio.p.cross=RadioCrossMode::On;
+    assert(!f.radio.p.canCross() && f.d.getTransmitProfileMask(p)==1);
+    assert(f.d.sendPacket(p,0));assert(f.manager.getOutboundTotal()==1);f.tick();
+    assert(f.radio.sends==1 && f.radio.active==0);f.radio.complete=true;f.tick();assert(f.d.mc_sent==1);
+    auto* denied=newPacket(f.d,RADIO_TX_SECONDARY);assert(!f.d.sendPacket(denied,0));
+    assert(f.manager.getOutboundTotal()==0 && f.radio.sends==1);
+  }
+  { Fixture f;auto* p=newPacket(f.d,RADIO_TX_PRIMARY);assert(f.d.sendPacket(p,0));f.tick();
+    assert(f.d.queue(bytes));f.tick();assert(f.radio.sends==1);f.radio.complete=true;f.tick();
+    f.tick();assert(f.radio.sends==2 && f.radio.active==1);f.radio.complete=true;f.tick();
+    assert(f.d.done.size()==1 && f.d.done[0] && f.d.mc_sent==1);
+  }
+  { Fixture f;f.d.duty_window=200;f.d.begin();assert(f.d.queue(bytes));f.tick();
+    f.clock.now+=100;f.radio.complete=true;f.d.loop();assert(f.d.getRemainingTxBudget()==0);
+    assert(f.d.queue(bytes));f.tick(100);assert(f.radio.sends==1);
+    f.tick(101);assert(f.radio.sends==2);
+  }
+  { Fixture f;assert(f.d.queue(bytes));f.tick();f.radio.complete=true;f.tick();
+    assert(f.d.queue(bytes));auto* p=newPacket(f.d,RADIO_TX_PRIMARY);assert(f.d.sendPacket(p,0));f.tick();
+    assert(f.radio.sends==2 && f.radio.active==0);f.radio.complete=true;f.tick();f.tick();
+    assert(f.radio.sends==3 && f.radio.active==1);
+  }
+  { Fixture f;f.radio.supported=false;assert(!f.d.queue(bytes));f.radio.supported=true;
+    assert(!f.d.queueForeignRadioFrame(bytes,3,0,f.radio.p.generation[0]));
+    assert(!f.d.queueForeignRadioFrame(bytes,3,1,f.radio.p.generation[1]+1));
+    assert(!f.d.queue(nullptr));assert(!f.d.queue(bytes,0));uint8_t full[256]={};assert(!f.d.queue(full,256));
+    f.radio.carrier=true;assert(!f.d.queue(bytes));f.radio.carrier=false;
+    f.radio.p.secondary.mode=RadioProfileMode::Rx;assert(!f.d.queue(bytes));
+  }
+}
+'''
+
+
+class MeshtextTransportTest(unittest.TestCase):
+    def compile_and_run(self, text, extra_flags=()):
+        compiler = shutil.which('g++') or shutil.which('clang++')
+        self.assertIsNotNone(compiler)
+        with tempfile.TemporaryDirectory() as folder:
+            cpp, exe = Path(folder)/'test.cpp', Path(folder)/'test.exe'
+            (Path(folder)/'Arduino.h').write_text('#pragma once\n#include <cstdint>\n#include <cmath>\n')
+            cpp.write_text(text)
+            result = subprocess.run([compiler, '-std=c++17', '-Wall', '-Wextra',
+                *extra_flags, '-I', folder, '-I', str(ROOT/'src'), str(cpp), '-o', str(exe)],
+                capture_output=True, text=True)
+            self.assertEqual(result.returncode, 0, result.stderr[-12000:])
+            run = subprocess.run([str(exe)], capture_output=True, text=True)
+            self.assertEqual(run.returncode, 0, run.stdout + run.stderr)
+
+    def test_actual_dispatcher(self):
+        compiler = shutil.which('g++') or shutil.which('clang++')
+        self.assertIsNotNone(compiler)
+        with tempfile.TemporaryDirectory() as folder:
+            cpp, exe = Path(folder)/'test.cpp', Path(folder)/'test.exe'
+            cpp.write_text(HARNESS)
+            flags = ['-std=c++17', '-Wall', '-Wextra', '-DMESH_ENABLE_MESHTEXT_CHAT=1']
+            if os.name != 'nt':
+                flags += ['-fsanitize=address,undefined', '-fno-omit-frame-pointer', '-fno-pie', '-no-pie']
+            result = subprocess.run([compiler, *flags,
+                '-I', str(ROOT/'test/mocks'), '-I', str(ROOT/'src'),
+                str(ROOT/'src/Dispatcher.cpp'), str(ROOT/'src/Packet.cpp'),
+                str(ROOT/'src/helpers/StaticPoolPacketManager.cpp'), str(cpp), '-o', str(exe)],
+                capture_output=True, text=True)
+            self.assertEqual(result.returncode, 0, result.stderr[-12000:])
+            env = os.environ.copy()
+            env['ASAN_OPTIONS'] = env.get('ASAN_OPTIONS', '') + ':detect_leaks=0'
+            run = subprocess.run([str(exe)], capture_output=True, text=True, env=env)
+            self.assertEqual(run.returncode, 0, run.stdout + run.stderr)
+
+    def test_protocol_retune_and_rollback(self):
+        source = (ROOT/'src/helpers/radiolib/RadioLibWrappers.cpp').read_text()
+        names = [('uint8_t', 'beginReconfigure'), ('void', 'endReconfigure'),
+            ('void', 'serviceProfileScan')] + [('mesh::RadioParamApplyResult', n) for n in
+            ('tuneProfile', 'prepareTransmitProfile', 'tryRestoreCodingRate', 'trySetParams', 'trySetPrimaryParams')]
+        methods = '\n'.join(method(source, f'{kind} RadioLibWrapper::{name}(') for kind, name in names)
+        methods += '\n' + method(source, 'mesh::RadioParamApplyResult RadioLibWrapper::prepareTransmitProfile(uint8_t profile, bool')
+        wrapper = (ROOT/'src/helpers/radiolib/CustomSX1262Wrapper.h').read_text()
+        methods += '\n' + method(wrapper, 'void setProfileStandbyWarm(').replace(
+            'void setProfileStandbyWarm(bool enabled) override',
+            'void RadioLibWrapper::setProfileStandbyWarm(bool enabled)')
+        harness = SCAN_HARNESS.split('@METHODS@')[0]
+        harness = harness.replace('uint16_t _physical_preamble=32;', '''
+  uint16_t _physical_preamble=32;
+  mesh::RadioProfileProtocol _physical_protocol=mesh::RadioProfileProtocol::MeshCore;
+  mesh::RadioProfileProtocol applied_protocol=mesh::RadioProfileProtocol::MeshCore;
+  unsigned protocol_writes=0;
+  bool protocol_fail=false;
+  bool applyProtocol(mesh::RadioProfileProtocol p) {
+    ++protocol_writes;
+    if (protocol_fail && p==mesh::RadioProfileProtocol::Meshtext) return false;
+    applied_protocol=p;return true;
+  }''')
+        cases = r'''
+int main() {
+  using Protocol=mesh::RadioProfileProtocol;
+  using Result=mesh::RadioParamApplyResult;
+  {
+    RadioLibWrapper w;
+    mesh::RadioProfileConfig cfg;cfg.params=w._profiles.primary;
+    cfg.params.protocol=Protocol::Meshtext;cfg.mode=mesh::RadioProfileMode::RxTx;
+    w._profiles.setSecondary(cfg,false);
+    assert(w._profiles.preamble(1,128)==16 && w._profiles.automaticPreambleFits());
+    assert(w.tuneProfile(1)==Result::APPLIED);
+    assert(w._physical_protocol==Protocol::Meshtext && w.applied_protocol==Protocol::Meshtext);
+    assert(w.protocol_writes==1 && w._physical_preamble==16);
+    assert(w.tuneProfile(0)==Result::APPLIED);
+    assert(w._physical_protocol==Protocol::MeshCore && w.applied_protocol==Protocol::MeshCore);
+    assert(w.protocol_writes==2);
+    const auto generation=w._profiles.generation[1];
+    cfg.params.protocol=Protocol::MeshCore;w._profiles.setSecondary(cfg,false);
+    assert(w._profiles.generation[1]==generation+1);
+  }
+  {
+    RadioLibWrapper w;mesh::RadioProfileConfig cfg;cfg.params=w._profiles.primary;
+    cfg.params.protocol=Protocol::Meshtext;cfg.mode=mesh::RadioProfileMode::RxTx;
+    w._profiles.setSecondary(cfg,false);w.protocol_fail=true;
+    assert(w.tuneProfile(1)==Result::FAILED);
+    assert(w._physical_protocol==Protocol::MeshCore && w.applied_protocol==Protocol::MeshCore);
+    assert(w._active_profile==0 && w._profile_generation==1);
+    assert(w.protocol_writes==2);
+  }
+  {
+    RadioLibWrapper w;mesh::RadioProfileConfig cfg;cfg.params=w._profiles.primary;
+    cfg.params.protocol=Protocol::Meshtext;cfg.mode=mesh::RadioProfileMode::RxTx;
+    w._profiles.setSecondary(cfg,false);w.failRxStarts=1;
+    assert(w.tuneProfile(1)==Result::FAILED);
+    assert(w._physical_protocol==Protocol::MeshCore && w.applied_protocol==Protocol::MeshCore);
+    assert(w._active_profile==0 && w.isInRecvMode());
+  }
+  {
+    mesh::RadioProfiles p;p.primary.freq=909.5;p.primary.bw=500;p.primary.sf=5;p.primary.cr=5;
+    p.secondary.params=p.primary;p.secondary.params.protocol=Protocol::Meshtext;
+    p.secondary.mode=mesh::RadioProfileMode::RxTx;
+    for (auto cross: {mesh::RadioCrossMode::Off,mesh::RadioCrossMode::On,mesh::RadioCrossMode::Auto}) {
+      p.cross=cross;assert(!p.canCross());assert(p.transmitMask(0)==1 && p.transmitMask(1)==2);
+    }
+  }
+}
+'''
+        self.compile_and_run(harness + methods + cases, ['-DMESH_ENABLE_MESHTEXT_CHAT=1'])
+
+    def test_sx1262_wire_settings_and_deep_recovery(self):
+        wrapper = (ROOT/'src/helpers/radiolib/CustomSX1262Wrapper.h').read_text()
+        wire = method(wrapper, 'bool applyProtocol(').replace(' override', '')
+        chip_source = (ROOT/'src/helpers/radiolib/CustomSX1262.h').read_text()
+        protocol = method(chip_source, 'int16_t setProfileProtocol(')
+        source = (ROOT/'src/helpers/radiolib/RadioLibWrappers.cpp').read_text()
+        restore = method(source, 'bool RadioLibWrapper::restoreAfterDeepInit()')
+        harness = r'''
+#include <cassert>
+#include <cstdint>
+#include <RadioProfiles.h>
+#include <helpers/radiolib/SX1262ProfileSwitchState.h>
+#define RADIOLIB_ERR_NONE 0
+#define RADIOLIB_SX126X_LORA_CRC_ON 1
+#define RADIOLIB_SX126X_LORA_HEADER_EXPLICIT 0
+#define RADIOLIB_SX126X_LORA_IQ_STANDARD 0
+#define STATE_IDLE 0
+struct SX1262 {
+  uint8_t sync=0x12;bool crc=false,explicit_header=false,iq=true;
+  size_t preambleLengthLoRa=32;
+  uint8_t crcTypeLoRa=1,implicitLen=255,headerType=0,invertIQEnabled=0;
+  unsigned step=0,fail_at=0;
+  int status() { return ++step==fail_at ? -1 : 0; }
+  int setSyncWord(uint8_t n) { sync=n;return status(); }
+  int setCRC(uint8_t n) { crc=n==1;return status(); }
+  int explicitHeader() { explicit_header=true;return status(); }
+  int invertIQ(bool n) { iq=n;return status(); }
+  int setPreambleLength(uint16_t) { return 0; }
+};
+struct CustomSX1262: SX1262 {
+  SX1262ProfileSwitchState _profileSwitch{false};
+  @PROTOCOL@
+};
+struct RadioLibWrapper {
+  CustomSX1262 chip;CustomSX1262* _radio=&chip;
+  bool _rx_ps_armed=true,_params_valid=true,_dbm_valid=false,_rx_boosted_gain_valid=false;
+  int state=1;uint8_t _cur_sf=11,_cur_cr=5;float _cur_freq=906.875,_cur_bw=250;
+  int8_t _cur_dbm=22;bool _cur_rx_boosted_gain=false;
+  mesh::RadioProfileProtocol _physical_protocol=mesh::RadioProfileProtocol::Meshtext;
+  bool radioDeepInit() { chip.sync=0x12;chip.step=0;return true; }
+  bool registerInterruptAction() { return true; }
+  bool applyParams(float,float,uint8_t,uint8_t) { return true; }
+  uint16_t currentPreambleLength() { return 16; }
+  int applyCachedTxPower(int8_t) { return 0; }
+  bool applyRxBoostedGainMode(bool) { return true; }
+  void recalibrateNoiseFloor() {}
+  @WIRE@
+  bool restoreAfterDeepInit();
+};
+@RESTORE@
+int main() {
+  using Protocol=mesh::RadioProfileProtocol;
+  for (Protocol p: {Protocol::MeshCore,Protocol::Meshtext}) {
+    RadioLibWrapper w;assert(w.applyProtocol(p));
+    assert(w.chip.sync==(p==Protocol::MeshCore ? 0x12 : 0x2b));
+    assert(w.chip.crc && w.chip.explicit_header && !w.chip.iq);
+  }
+  for (unsigned fail=1;fail<=4;++fail) {
+    RadioLibWrapper w;w.chip.fail_at=fail;assert(!w.applyProtocol(Protocol::Meshtext));
+  }
+  RadioLibWrapper w;assert(w.restoreAfterDeepInit());
+  assert(w.chip.sync==0x2b && w.chip.crc && w.chip.explicit_header && !w.chip.iq);
+  assert(!w._rx_ps_armed && w.state==STATE_IDLE);
+  w._physical_protocol=Protocol::MeshCore;assert(w.restoreAfterDeepInit());assert(w.chip.sync==0x12);
+}
+'''
+        self.compile_and_run('#include <initializer_list>\n' + harness.replace('@WIRE@',wire)
+                             .replace('@PROTOCOL@',protocol).replace('@RESTORE@',restore),
+                             ['-DMESH_ENABLE_MESHTEXT_CHAT=1'])
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/test/test_radio_profile_auto.py b/test/test_radio_profile_auto.py
new file mode 100644
index 000000000..c60b10230
--- /dev/null
+++ b/test/test_radio_profile_auto.py
@@ -0,0 +1,375 @@
+"""Run the production profile CLI's RAM-only automatic ownership layer."""
+from pathlib import Path
+import os
+import shutil
+import subprocess
+import tempfile
+import unittest
+
+
+ROOT = Path(__file__).resolve().parents[1]
+HARNESS = r'''
+// Reuse only the existing memory FS/radio fixture; run dedicated scenarios.
+#define main existing_cli_main
+#include "test/fixtures/radio_profiles/cli_test.cpp"
+#undef main
+
+static mesh::RadioProfileConfig candidate(float frequency = 910.5f) {
+  mesh::RadioProfileConfig config;
+  config.mode = mesh::RadioProfileMode::RxTx;
+  config.params.freq = frequency; config.params.bw = 250;
+  config.params.sf = 11; config.params.cr = 5; config.params.preamble = 16;
+  config.params.protocol = mesh::RadioProfileProtocol::Meshtext;
+  return config;
+}
+
+static void rewriteCRC(std::vector<uint8_t>& image) {
+  uint32_t crc = 0xffffffffU;
+  for (size_t i = 0; i < image.size() - 4; ++i) {
+    crc ^= image[i];
+    for (unsigned bit = 0; bit < 8; ++bit) crc = (crc >> 1) ^ ((crc & 1) ? 0xedb88320U : 0);
+  }
+  memcpy(image.data() + image.size() - 4, &crc, 4);
+}
+
+static void lifetime() {
+  Fixture f;
+  const auto config = candidate();
+  assert(f.cli.canAutoSecondary());
+  assert(f.cli.requestAutoSecondary(config));
+  assert(f.cli.autoSecondaryActive());
+  assert(f.radio.p.secondary.params == config.params);
+  assert(strstr(f.cmd("get radio2"), "auto-owned"));
+  const auto generation = f.radio.p.generation[1];
+  for (unsigned i = 0; i < 8; ++i) {
+    assert(f.cli.requestAutoSecondary(config)); f.advance(1, false);
+    assert(f.radio.p.generation[1] == generation);
+  }
+  assert(!f.cli.requestAutoSecondary(candidate(911.5f))); // no last-request-wins conflict
+  assert(f.radio.p.secondary.params == config.params);
+  assert(f.fs.files.empty()); // RF adoption never writes flash
+  f.cli.clearAutoSecondary();
+  assert(!f.cli.autoSecondaryActive() && !f.radio.p.enabled());
+  const auto cleared = f.radio.p.generation[1];
+  f.cli.clearAutoSecondary(); f.advance(1, false);
+  assert(f.radio.p.generation[1] == cleared && f.fs.files.empty());
+  auto invalid = config; invalid.mode = mesh::RadioProfileMode::Off;
+  assert(!f.cli.requestAutoSecondary(invalid));
+  invalid = config; invalid.params.freq = 0;
+  assert(!f.cli.requestAutoSecondary(invalid));
+}
+
+static void savedIntent() {
+  Fixture f(true);
+  assert(f.cli.requestAutoSecondary(candidate()));
+  f.cmd("set radio2.cross off");
+  assert(f.cli.savePrimaryPreamble(120));
+  f.cmd("set tx.reply radio2 force");
+  assert(f.cli.autoSecondaryActive());
+  const auto image = f.fs.files["/radio_profiles"];
+  assert(image.size() == 24 && image[2] == 2 && image[3] == 0);
+  Radio reboot; mesh::RadioProfileCLI restored;
+  restored.begin(&f.fs, &reboot, &f.clock, true);
+  assert(!reboot.p.enabled() && restored.canAutoSecondary());
+  assert(!restored.manualSecondaryConfigured());
+
+  f.cmd("set radio2 off");
+  assert(!f.cli.autoSecondaryActive() && !f.cli.canAutoSecondary());
+  assert(f.fs.files["/radio_profiles"][3] == 0x80);
+  f.advance(2000);
+  assert(!f.radio.p.enabled());
+  restored.begin(&f.fs, &reboot, &f.clock);
+  assert(!restored.canAutoSecondary() && !restored.requestAutoSecondary(candidate()));
+
+  // Version 1 cannot distinguish explicit Off from unused Off. Preserve it.
+  auto legacy = image; legacy[2] = 1; rewriteCRC(legacy);
+  f.fs.files["/radio_profiles"] = legacy;
+  restored.begin(&f.fs, &reboot, &f.clock);
+  assert(!restored.canAutoSecondary());
+}
+
+static void manualTakeover() {
+  Fixture f;
+  assert(f.cli.requestAutoSecondary(candidate()));
+  const auto intent = f.cli.secondaryIntentGeneration();
+  f.fs.fail_write = true;
+  f.cmd("set radio2 910.5,250,11,5,rxtx,16", false);
+  assert(f.cli.autoSecondaryActive() && f.cli.secondaryIntentGeneration() == intent);
+  f.fs.fail_write = false;
+  f.cmd("set radio2 910.5,250,11,5,rxtx,16");
+  assert(!f.cli.autoSecondaryActive());
+  assert(f.cli.secondaryIntentGeneration() == intent + 1);
+  assert(f.cli.manualSecondaryConfigured() && !f.cli.canAutoSecondary());
+  f.advance(2000);
+  assert(f.radio.p.secondary.params.protocol == mesh::RadioProfileProtocol::MeshCore);
+  const auto manual_generation = f.radio.p.generation[1];
+  f.cli.clearAutoSecondary();
+  assert(f.radio.p.generation[1] == manual_generation && f.radio.p.enabled());
+  f.cmd("set radio2 910.5,250,11,5,rxtx,16");
+  assert(f.cli.secondaryIntentGeneration() == intent + 2); // identical manual RF still owns intent
+  f.advance(2000);
+  assert(f.radio.p.generation[1] == manual_generation);
+  Radio reboot; mesh::RadioProfileCLI restored;
+  restored.begin(&f.fs, &reboot, &f.clock);
+  assert(restored.manualSecondaryConfigured() && !restored.canAutoSecondary());
+}
+
+static void overlay() {
+  Fixture f;
+  f.cmd("set radio2 910.5,500,8,5,rx,80"); f.advance(2000);
+  const auto saved = f.fs.files["/radio_profiles"];
+  const auto rf = f.radio.p.secondary.params;
+  assert(f.cli.useSecondaryProtocol(mesh::RadioProfileProtocol::Meshtext));
+  assert(f.radio.p.secondary.params.freq == rf.freq && f.radio.p.secondary.params.bw == rf.bw);
+  assert(f.radio.p.secondary.params.sf == rf.sf && f.radio.p.secondary.params.cr == rf.cr);
+  assert(f.radio.p.secondary.mode == mesh::RadioProfileMode::Rx);
+  assert(f.radio.p.secondary.params.preamble == 16);
+  assert(f.radio.p.secondary.params.protocol == mesh::RadioProfileProtocol::Meshtext);
+  assert(f.cli.savedSecondaryConfig().params == rf);
+  assert(f.fs.files["/radio_profiles"] == saved);
+  const auto generation = f.radio.p.generation[1];
+  for (unsigned i = 0; i < 4; ++i) {
+    assert(f.cli.useSecondaryProtocol(mesh::RadioProfileProtocol::Meshtext)); f.advance(1, false);
+    assert(f.radio.p.generation[1] == generation);
+  }
+  f.cli.clearSecondaryProtocol();
+  assert(f.radio.p.secondary.params == rf && f.fs.files["/radio_profiles"] == saved);
+  assert(!f.cli.useSecondaryProtocol(static_cast<mesh::RadioProfileProtocol>(9)));
+  assert(f.cli.useSecondaryProtocol(mesh::RadioProfileProtocol::Meshtext));
+  f.cmd("set radio2 912.5,500,8,5,rxtx,80"); f.advance(2000);
+  f.cli.clearSecondaryProtocol();
+  assert(f.radio.p.secondary.params.freq == 912.5f);
+  assert(f.radio.p.secondary.params.protocol == mesh::RadioProfileProtocol::MeshCore);
+  assert(f.radio.p.secondary.params.preamble == 80);
+}
+
+static void leasesAndSchedules() {
+  Fixture f;
+  assert(f.cli.requestAutoSecondary(candidate()));
+  f.cmd("set tempradio2 911.5,500,8,5,rxtx,1,80");
+  assert(!f.cli.canAutoSecondary() && !f.cli.autoSecondaryActive());
+  assert(!f.cli.requestAutoSecondary(candidate()));
+  f.advance(2000);
+  assert(f.radio.p.secondary_temporary && f.radio.p.secondary.params.freq == 911.5f);
+  const auto lease_generation = f.radio.p.generation[1];
+  f.cli.clearAutoSecondary(); f.cli.clearSecondaryProtocol();
+  assert(f.radio.p.generation[1] == lease_generation);
+  f.advance(60000);
+  assert(!f.radio.p.enabled() && f.cli.canAutoSecondary());
+  assert(f.cli.requestAutoSecondary(candidate()));
+  f.cmd("set radioat2 912.5,500,8,5,rxtx,+1,80");
+  assert(!f.cli.canAutoSecondary() && !f.cli.autoSecondaryActive());
+  assert(!f.cli.requestAutoSecondary(candidate()));
+  f.cmd("del radioat2 all");
+  assert(f.cli.canAutoSecondary());
+  f.cmd("set tempradioat2 912.5,500,8,5,rxtx,+1,+2,80");
+  assert(!f.cli.canAutoSecondary());
+  f.cmd("del tempradioat2 all");
+  assert(f.cli.canAutoSecondary());
+}
+
+static void primaryTemporary() {
+  Fixture f;
+  assert(f.cli.requestAutoSecondary(candidate()));
+  f.radio.p.primary_temporary = true; f.advance(1, false);
+  assert(!f.radio.p.enabled() && !f.cli.autoSecondaryActive());
+  assert(!f.cli.canAutoSecondary() && !f.cli.requestAutoSecondary(candidate()));
+  const auto generation = f.radio.p.generation[1];
+  for (unsigned i = 0; i < 4; ++i) f.advance(1, false);
+  assert(f.radio.p.generation[1] == generation);
+  f.radio.p.primary_temporary = false; f.advance(1, false);
+  assert(f.cli.autoSecondaryActive());
+}
+
+static void automaticPermission() {
+  Fixture f;
+  f.cmd("set radio2 off"); f.advance(2000);
+  assert(strstr(f.cmd("get radio2"), "manual"));
+  const auto off_image = f.fs.files["/radio_profiles"];
+  f.fs.fail_write = true; f.cmd("set radio2 auto", false);
+  assert(!f.cli.canAutoSecondary() && f.fs.files["/radio_profiles"] == off_image);
+  f.fs.fail_write = false; f.cmd("set radio2 auto");
+  assert(f.fs.files["/radio_profiles"][2] == 2 && f.fs.files["/radio_profiles"][3] == 0);
+  assert(!f.cli.canAutoSecondary()); // two-second publication barrier
+  f.advance(2000);
+  assert(f.cli.canAutoSecondary() && strstr(f.cmd("get radio2"), "automatic allowed"));
+  Radio reboot; mesh::RadioProfileCLI restored;
+  restored.begin(&f.fs, &reboot, &f.clock);
+  assert(restored.canAutoSecondary());
+  f.cmd("set tempradio2 911.5,500,8,5,rxtx,1,80");
+  f.cmd("set radio2 auto", false);
+  f.advance(2000); f.cmd("set radio2 auto", false);
+  assert(f.radio.p.secondary_temporary);
+  f.advance(60000);
+  f.cmd("set radioat2 912.5,500,8,5,rxtx,+1,80");
+  f.cmd("set radio2 auto", false);
+  assert(strstr(f.cmd("get radioat2 all"), "1@"));
+  f.cmd("del radioat2 all");
+  f.cmd("set radio2 auto"); f.advance(2000);
+  assert(f.cli.canAutoSecondary());
+}
+
+static void unmanagedTakeover() {
+  Fixture f;
+  assert(f.cli.requestAutoSecondary(candidate()));
+  auto external = candidate(912.5f);
+  external.params.protocol = mesh::RadioProfileProtocol::MeshCore;
+  external.params.preamble = 80;
+  f.radio.p.setSecondary(external, false);
+  f.cli.clearAutoSecondary();
+  assert(!f.cli.canAutoSecondary() && !f.cli.autoSecondaryActive());
+  const auto generation = f.radio.p.generation[1];
+  for (unsigned i = 0; i < 4; ++i) f.advance(1, false);
+  assert(f.radio.p.secondary.params == external.params && f.radio.p.generation[1] == generation);
+  f.cmd("set radio2 913.5,500,8,5,rxtx,80"); f.advance(2000);
+  assert(f.cli.manualSecondaryConfigured() && f.radio.p.secondary.params.freq == 913.5f);
+  assert(f.cli.useSecondaryProtocol(mesh::RadioProfileProtocol::Meshtext));
+  external.params.freq = 914.5f;
+  f.radio.p.setSecondary(external, false);
+  f.cli.clearSecondaryProtocol(); f.advance(1, false);
+  assert(f.radio.p.secondary.params == external.params);
+  assert(!f.cli.useSecondaryProtocol(mesh::RadioProfileProtocol::Meshtext));
+}
+
+static void remoteBarrier() {
+  for (bool delivered : {false, true}) {
+    Fixture f(true);
+    assert(f.cli.requestAutoSecondary(candidate()));
+    const auto generation = f.radio.p.generation[1];
+    f.cli.beginReplyCommand(); f.cmd("set radio2 912.5,500,8,5,rxtx,80"); f.cli.endReplyCommand();
+    assert(f.cli.hasReplyMutation() && !f.cli.canAutoSecondary());
+    f.advance(10000);
+    assert(f.radio.p.generation[1] == generation);
+    assert(f.cli.finishReplyMutation(delivered)); f.advance(1);
+    if (delivered) {
+      assert(f.cli.manualSecondaryConfigured() && !f.cli.autoSecondaryActive());
+      assert(f.radio.p.secondary.params.freq == 912.5f);
+    } else {
+      assert(f.cli.autoSecondaryActive() && f.radio.p.generation[1] == generation);
+      assert(f.fs.files.count("/radio_profiles") == 0);
+    }
+  }
+  Fixture f(true);
+  assert(f.cli.requestAutoSecondary(candidate()));
+  const auto generation = f.radio.p.generation[1];
+  f.cli.beginReplyCommand(); f.cmd("set radio2 off"); f.cli.endReplyCommand();
+  f.cli.clearAutoSecondary(); // alias removed while the old generation owns a reply
+  f.advance(10000);
+  assert(f.radio.p.generation[1] == generation);
+  assert(f.cli.finishReplyMutation(true)); f.advance(1);
+  assert(!f.radio.p.enabled() && !f.cli.canAutoSecondary());
+}
+
+static void storageGuards() {
+  Fixture f;
+  f.fs.files["/radio_profiles"] = {0};
+  Radio reboot; mesh::RadioProfileCLI restored;
+  restored.begin(&f.fs, &reboot, &f.clock);
+  assert(!restored.canAutoSecondary() && !restored.requestAutoSecondary(candidate()));
+  assert(!restored.useSecondaryProtocol(mesh::RadioProfileProtocol::Meshtext));
+  assert(f.fs.files["/radio_profiles"] == std::vector<uint8_t>{0});
+  restored.begin(nullptr, &reboot, &f.clock);
+  assert(!restored.canAutoSecondary());
+  Fixture valid;
+  valid.cmd("set radio2.cross off");
+  const auto before = valid.fs.files["/radio_profiles"];
+  valid.fs.fail_read_open = true;
+  restored.begin(&valid.fs, &reboot, &valid.clock);
+  assert(!restored.canAutoSecondary() && valid.fs.files["/radio_profiles"] == before);
+
+  Fixture backup;
+  backup.cmd("set radio2 910.5,500,8,5,rxtx,80");
+  const auto committed = backup.fs.files["/radio_profiles"];
+  assert(backup.fs.rename("/radio_profiles", "/radio_profiles.bak"));
+  backup.fs.files["/radio_profiles"] = {0}; backup.fs.fail_remove = true;
+  restored.begin(&backup.fs, &reboot, &backup.clock);
+  assert(restored.manualSecondaryConfigured() && reboot.p.enabled());
+  assert(!restored.canAutoSecondary());
+  assert(!restored.useSecondaryProtocol(mesh::RadioProfileProtocol::Meshtext));
+  assert(backup.fs.files["/radio_profiles.bak"] == committed);
+
+  Fixture malformed;
+  malformed.cmd("set radio2 910.5,500,8,5,rxtx,80");
+  auto image = malformed.fs.files["/radio_profiles"];
+  image[3] &= 0x7F; rewriteCRC(image); // enabled v2 profile cannot lack manual intent
+  malformed.fs.files["/radio_profiles"] = image;
+  Radio rejected;
+  restored.begin(&malformed.fs, &rejected, &malformed.clock);
+  assert(!rejected.p.enabled() && !restored.canAutoSecondary());
+}
+
+static void featureOff() {
+  Fixture f;
+  assert(!f.cli.canAutoSecondary() && !f.cli.requestAutoSecondary(candidate()));
+  assert(!f.cli.autoSecondaryActive());
+  assert(!f.cli.useSecondaryProtocol(mesh::RadioProfileProtocol::Meshtext));
+  f.cli.clearAutoSecondary(); f.cli.clearSecondaryProtocol();
+  assert(!f.radio.p.enabled() && f.fs.files.empty());
+  f.cmd("set radio2 910.5,500,8,5,rxtx,80"); f.advance(2000);
+  assert(f.radio.p.enabled() && f.fs.files["/radio_profiles"][2] == 1);
+}
+
+int main(int argc, char** argv) {
+  assert(argc == 2);
+  if (!strcmp(argv[1], "lifetime")) lifetime();
+  else if (!strcmp(argv[1], "saved_intent")) savedIntent();
+  else if (!strcmp(argv[1], "manual_takeover")) manualTakeover();
+  else if (!strcmp(argv[1], "overlay")) overlay();
+  else if (!strcmp(argv[1], "leases")) leasesAndSchedules();
+  else if (!strcmp(argv[1], "primary_temporary")) primaryTemporary();
+  else if (!strcmp(argv[1], "automatic_permission")) automaticPermission();
+  else if (!strcmp(argv[1], "unmanaged_takeover")) unmanagedTakeover();
+  else if (!strcmp(argv[1], "remote_barrier")) remoteBarrier();
+  else if (!strcmp(argv[1], "storage")) storageGuards();
+  else if (!strcmp(argv[1], "feature_off")) featureOff();
+  else return 2;
+  puts("PASS auto secondary ownership");
+}
+'''
+
+
+class RadioProfileAutoTest(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        compiler = os.environ.get("CXX") or shutil.which("g++") or shutil.which("clang++")
+        if compiler is None:
+            raise unittest.SkipTest("a host C++17 compiler is required")
+        cls.work = tempfile.TemporaryDirectory(prefix="radio-profile-auto-")
+        cls.addClassCleanup(cls.work.cleanup)
+        directory = Path(cls.work.name)
+        source = directory / "auto.cpp"
+        source.write_text(HARNESS, encoding="utf-8")
+        cls.binaries = {}
+        for enabled, fleet in ((0, 0), (1, 0), (1, 1)):
+            binary = directory / f"auto-{enabled}-{fleet}.exe"
+            result = subprocess.run([
+                compiler, "-std=c++17", "-Wall", "-Wextra",
+                f"-DMESH_ENABLE_MESHTEXT_CHAT={enabled}", f"-DMESH_ENABLE_FLEET_CONTROL={fleet}",
+                "-I", str(ROOT), "-I", str(ROOT / "test/fixtures/radio_profiles/mocks"),
+                "-I", str(ROOT / "test/mocks"), "-I", str(ROOT / "src"),
+                str(ROOT / "src/helpers/RadioProfileCLI.cpp"), str(source), "-o", str(binary),
+            ], capture_output=True, text=True, timeout=60)
+            if result.returncode:
+                raise AssertionError(result.stdout + result.stderr)
+            cls.binaries[enabled, fleet] = binary
+
+    def test_feature_off_keeps_existing_role_behavior(self):
+        self.run_case("feature_off", enabled=0, fleet=0)
+
+    def test_ownership_intent_and_precedence(self):
+        for fleet in (0, 1):
+            for case in ("lifetime", "saved_intent", "manual_takeover", "overlay", "leases",
+                         "primary_temporary", "automatic_permission", "unmanaged_takeover",
+                         "remote_barrier", "storage"):
+                with self.subTest(fleet=fleet, case=case):
+                    self.run_case(case, fleet=fleet)
+
+    def run_case(self, case, enabled=1, fleet=0):
+        result = subprocess.run([str(self.binaries[enabled, fleet]), case],
+                                capture_output=True, text=True, timeout=10)
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+        self.assertIn("PASS auto secondary", result.stdout)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/test/test_radio_profile_spiffs_missing.py b/test/test_radio_profile_spiffs_missing.py
index 07c5ccfd0..ca3e16e05 100644
--- a/test/test_radio_profile_spiffs_missing.py
+++ b/test/test_radio_profile_spiffs_missing.py
@@ -136,7 +136,7 @@ int main(int argc, char** argv) {
     else if (which == "wrong_size") { state.bytes.pop_back(); expected = Result::Invalid; }
     else if (which == "corrupt_crc") { state.bytes[7] ^= 1; expected = Result::Invalid; }
     else if (which == "future_version") {
-      state.bytes[2] = 2;
+      state.bytes[2] = 3;
       const uint32_t crc = mesh::checksum(state.bytes.data(), state.bytes.size() - 4);
       memcpy(state.bytes.data() + state.bytes.size() - 4, &crc, 4);
       expected = Result::Invalid;
diff --git a/test/test_sx1262_protocol_batching.py b/test/test_sx1262_protocol_batching.py
new file mode 100644
index 000000000..50ea98049
--- /dev/null
+++ b/test/test_sx1262_protocol_batching.py
@@ -0,0 +1,173 @@
+"""Host-only exercise of the actual SX1262 owned protocol/packet staging path."""
+from pathlib import Path
+import unittest
+
+import test_sx1262_batched_modulation as compiler
+from test_radio_receive_contract import method
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+class ProtocolBatchingTests(unittest.TestCase):
+    compile_run = compiler.BatchedModulationTests.compile_run
+
+    def test_owned_protocol_commit_errors_and_full_setup_fallback(self):
+        source = (ROOT / "src/helpers/radiolib/CustomSX1262.h").read_text()
+        state = (ROOT / "src/helpers/radiolib/SX1262ProfileSwitchState.h").read_text()
+        methods = "\n".join(method(source, signature).replace(" override", "") for signature in (
+            "int16_t setCRC(", "int16_t explicitHeader()", "int16_t invertIQ(",
+            "int16_t setProfileProtocol(", "int16_t startReceive()"))
+        harness = r'''
+#include <cassert>
+#include <cstdint>
+#include <cstddef>
+#include <string>
+@STATE@
+#define MC_SX1262_FAST_PACKET_CACHE 1
+#define RADIOLIB_ERR_NONE 0
+#define RADIOLIB_SX126X_RX_TIMEOUT_INF 0xffffff
+#define RADIOLIB_SX126X_PACKET_TYPE_LORA 1
+#define RADIOLIB_SX126X_LORA_CRC_ON 1
+#define RADIOLIB_SX126X_LORA_HEADER_EXPLICIT 0
+#define RADIOLIB_SX126X_LORA_IQ_STANDARD 0
+#define RADIOLIB_RADIO_MODE_NONE 0
+#define RADIOLIB_IRQ_RX_DEFAULT_FLAGS 1
+#define RADIOLIB_IRQ_RX_DEFAULT_MASK 2
+#define RADIOLIB_IRQ_PREAMBLE_DETECTED 3
+struct Module {
+  enum {MODE_RX=1}; std::string* trace;
+  void setRfSwitchState(int n) { assert(n==MODE_RX);*trace+='W'; }
+};
+struct SX1262 {
+  std::string trace; char fail=0; bool standbyXOSC=true;
+  size_t preambleLengthLoRa=32;
+  uint8_t crcTypeLoRa=1, implicitLen=255, headerType=0, invertIQEnabled=0;
+  uint8_t physicalSync=0x12, physicalCrc=1, physicalLen=255, physicalHeader=0, physicalIq=0;
+  bool iqWorkaroundNormal=true;
+  unsigned packetWrites=0, workaroundWrites=0, syncWrites=0;
+  uint32_t rxTimeout=0; int stagedMode=3;
+  Module module{&trace};Module* getMod() { return &module; }
+  int16_t call(char c) { trace+=c;return fail==c ? -100:0; }
+  int16_t setSyncWord(uint8_t sync) {
+    ++syncWrites;physicalSync=sync;return call('Y');
+  }
+  // Model the pinned RadioLib setPacketParams() IQ-register workaround as
+  // part of the packet commit, including an error before the command itself.
+  int16_t setPacketParams(size_t p,uint8_t crc,uint8_t len,uint8_t header,uint8_t iq) {
+    assert(p==preambleLengthLoRa);
+    ++workaroundWrites;
+    if(call('I')) return -100;
+    iqWorkaroundNormal=iq==0;
+    ++packetWrites;
+    if(call('P')) return -100;
+    physicalCrc=crc;physicalLen=len;physicalHeader=header;physicalIq=iq;return 0;
+  }
+  int16_t setCRC(uint8_t crc,uint16_t,uint16_t,bool) {
+    if(call('C')) return -100;crcTypeLoRa=crc;
+    return setPacketParams(preambleLengthLoRa,crcTypeLoRa,implicitLen,headerType,invertIQEnabled);
+  }
+  int16_t explicitHeader() {
+    if(call('E')) return -100;
+    const int rc=setPacketParams(preambleLengthLoRa,crcTypeLoRa,255,0,invertIQEnabled);
+    if(!rc) {implicitLen=255;headerType=0;}return rc;
+  }
+  int16_t invertIQ(bool enabled) {
+    if(call('i')) return -100;invertIQEnabled=enabled;
+    return setPacketParams(preambleLengthLoRa,crcTypeLoRa,implicitLen,headerType,invertIQEnabled);
+  }
+  int16_t clearIrqStatus() { return call('c'); }
+  int16_t setRx(uint32_t timeout) { assert(timeout==0xffffff);return call('R'); }
+  int16_t startReceive(uint32_t,uint32_t,uint32_t,size_t) {
+    const int rc=setPacketParams(preambleLengthLoRa,crcTypeLoRa,implicitLen,headerType,invertIQEnabled);
+    return rc ? rc:call('F');
+  }
+  uint8_t getPacketType() { call('Q');return 1; }
+};
+struct Radio: SX1262 {
+  SX1262ProfileSwitchState _profileSwitch{true};
+  bool _coldStandby=false;uint32_t _profileFastResumes=0;
+  @METHODS@
+};
+void owned(Radio& r) {
+  r._profileSwitch.rxResult(0,true);
+  r._profileSwitch.packetResult(0,r.preambleLengthLoRa,r.crcTypeLoRa,r.implicitLen,r.headerType,r.invertIQEnabled);
+  r._profileSwitch.begin(true,true);r._profileSwitch.standbyResult(0);
+  assert(r._profileSwitch.canResumeFast());r.trace.clear();
+}
+void restored(Radio& r) {
+  r._profileSwitch.end(false);r.fail=0;r.trace.clear();
+  assert(r.setProfileProtocol(0x12)==0);
+  assert(r.trace=="YCIPEIPiIP");
+  assert(r.physicalSync==0x12 && r.physicalCrc==1 && r.physicalLen==255
+      && r.physicalHeader==0 && r.physicalIq==0 && r.iqWorkaroundNormal);
+  assert(r.startReceive()==0 && r._profileSwitch.rxValid);
+}
+int main() {
+  // Staging itself is sync-only; resume performs exactly one full packet
+  // write and one IQ workaround. An acknowledged old tuple cannot skip it.
+  for(uint8_t sync:{uint8_t(0x12),uint8_t(0x2b)}) {
+    Radio r;owned(r);assert(r.setProfileProtocol(sync)==0 && r.trace=="Y");
+    assert(!r._profileSwitch.packetValid && r._profileSwitch.rxValid);
+    assert(r.packetWrites==0 && r.workaroundWrites==0);
+    assert(r.startReceive()==0 && r.trace=="YcIPWR");
+    assert(r.packetWrites==1 && r.workaroundWrites==1 && r.syncWrites==1);
+    assert(r._profileSwitch.packetValid && r._profileSwitch.rxValid);
+    assert(r.physicalSync==sync && r.iqWorkaroundNormal && r.physicalLen==255);
+  }
+  // A nonstandard prior tuple is repaired, not merely assumed compatible.
+  { Radio r;r.crcTypeLoRa=r.physicalCrc=0;r.implicitLen=r.physicalLen=16;
+    r.headerType=r.physicalHeader=1;r.invertIQEnabled=r.physicalIq=1;r.iqWorkaroundNormal=false;
+    owned(r);assert(r.setProfileProtocol(0x2b)==0);
+    assert(r.physicalCrc==0 && r.physicalHeader==1 && r.physicalIq==1);
+    assert(r.startReceive()==0 && r.packetWrites==1 && r.workaroundWrites==1);
+    assert(r.physicalCrc==1 && r.physicalHeader==0 && r.physicalIq==0 && r.iqWorkaroundNormal);
+  }
+  // Setup, partial/busy hops, disabled optimization, and a revoked RX context
+  // must execute all normal setters. No staging before acknowledged standby.
+  for(int gate=0;gate<5;++gate) {
+    Radio r;
+    if(gate==1) {r._profileSwitch.rxResult(0,true);r._profileSwitch.begin(true,true);}
+    if(gate==2) {owned(r);r._profileSwitch.enabled=false;r._profileSwitch.invalidate();}
+    if(gate==3) {owned(r);r._profileSwitch.invalidate();}
+    if(gate==4) {r._profileSwitch.rxResult(0,true);r._profileSwitch.begin(false,true);r._profileSwitch.standbyResult(0);}
+    r.trace.clear();assert(r.setProfileProtocol(0x2b)==0 && r.trace=="YCIPEIPiIP");
+    assert(r.packetWrites==3 && r.workaroundWrites==3 && !r._profileSwitch.packetValid);
+  }
+  // Sync, IRQ-clear, IQ-workaround, packet, and RX failures all revoke reuse;
+  // wrapper rollback can then restore old wire settings through full setup.
+  for(char failure:std::string("YcIPR")) {
+    Radio r;owned(r);r.fail=failure;
+    if(failure=='Y') assert(r.setProfileProtocol(0x2b)==-100);
+    else {assert(r.setProfileProtocol(0x2b)==0);assert(r.startReceive()==-100);}
+    assert(r._profileSwitch.failed() && !r._profileSwitch.rxValid && !r._profileSwitch.packetValid);
+    restored(r);
+  }
+  // Fallback setup errors propagate; no later setter hides an earlier error.
+  for(char failure:std::string("CEi")) {
+    Radio r;r.fail=failure;assert(r.setProfileProtocol(0x2b)==-100);
+    assert(r.trace.back()==failure && !r._profileSwitch.rxValid);restored(r);
+  }
+}
+'''
+        self.compile_run(harness.replace("@STATE@", state).replace("@METHODS@", methods))
+
+    def test_wrapper_uses_batched_protocol_and_pinned_iq_workaround(self):
+        wrapper = (ROOT / "src/helpers/radiolib/CustomSX1262Wrapper.h").read_text()
+        apply = method(wrapper, "bool applyProtocol(")
+        self.assertIn("setProfileProtocol(sync)", apply)
+        self.assertNotIn("setCRC(", apply)
+        radio = (ROOT / "src/helpers/radiolib/CustomSX1262.h").read_text()
+        resume = method(radio, "int16_t startReceive()")
+        self.assertIn("rc = setPacketParams(", resume)
+        self.assertLess(resume.index("rc = setPacketParams("), resume.index("rc = setRx("))
+        # The installed/pinned implementation delegates its required IQ-register
+        # repair to setPacketParams. Keep this assumption explicit and tested.
+        commands = ROOT / ".pio/libdeps/heltec_v4_2_v4_3_companion_radio_full_femon/RadioLib/src/modules/SX126x/SX126x_commands.cpp"
+        if commands.exists():
+            packet = method(commands.read_text(), "int16_t SX126x::setPacketParams(")
+            self.assertIn("fixInvertedIQ(invertIQ)", packet)
+            self.assertLess(packet.index("fixInvertedIQ("), packet.index("SPIwriteStream("))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tools/hil/mercer_mt_flash.sh b/tools/hil/mercer_mt_flash.sh
new file mode 100644
index 000000000..b998972e5
--- /dev/null
+++ b/tools/hil/mercer_mt_flash.sh
@@ -0,0 +1,241 @@
+#!/usr/bin/env bash
+# Meshtext HIL: identity-bound adapter for the actual mcfirmware.sh functions.
+# This does NOT source its startup code, install packages, stop services, or
+# recover a busy/failed transport. Logical application backups must be taken
+# separately, before entering the ROM. No erase is implicit in write-flash.
+set -euo pipefail
+umask 077
+
+adapter_die() { printf 'ERROR: %s\n' "$*" >&2; exit 1; }
+adapter_usage() {
+    printf '%s\n' \
+      'Usage: mercer_mt_flash.sh --flasher PATH --port /dev/tty... --workdir DIR' \
+      '  [--board LABEL] [--expect-mac XX:XX:XX:XX:XX:XX --flash-bytes N]' \
+      '  [--read-baud 115200|460800] [--allow-write] [--allow-erase] -- MODE ARGS' \
+      'Modes: probe; read-flash OFFSET LENGTH NEW_OUTPUT; write-flash OFFSET FILE ...;' \
+      '       erase-flash; erase-region OFFSET LENGTH' \
+      'All non-probe modes require an expected MAC and flash size. Reads must write' \
+      'new files inside workdir; writes/erases require their explicit allow flag.' \
+      'probe also enters ROM and finishes using the original identity-safe reset.'
+}
+
+adapter_flasher='' adapter_port='' adapter_workdir='' adapter_board='ESP32-S3'
+adapter_expected_mac='' adapter_expected_bytes='' adapter_read_baud=115200
+adapter_allow_write=0 adapter_allow_erase=0 adapter_session_active=0
+while (($#)); do
+    case "$1" in
+        --flasher|--port|--workdir|--board|--expect-mac|--flash-bytes|--read-baud)
+            (($# >= 2)) || adapter_die "Missing value for $1"
+            case "$1" in
+                --flasher) adapter_flasher=$2 ;;
+                --port) adapter_port=$2 ;;
+                --workdir) adapter_workdir=$2 ;;
+                --board) adapter_board=$2 ;;
+                --expect-mac) adapter_expected_mac=$2 ;;
+                --flash-bytes) adapter_expected_bytes=$2 ;;
+                --read-baud) adapter_read_baud=$2 ;;
+            esac
+            shift 2 ;;
+        --allow-write) adapter_allow_write=1; shift ;;
+        --allow-erase) adapter_allow_erase=1; shift ;;
+        --help|-h) adapter_usage; exit 0 ;;
+        --) shift; break ;;
+        *) adapter_die "Unknown option: $1" ;;
+    esac
+done
+adapter_mode=${1:-probe}
+(($# == 0)) || shift
+adapter_operation_args=("$@")
+[[ -f "$adapter_flasher" && -s "$adapter_flasher" ]] || adapter_die 'Provide the complete local mcfirmware.sh.'
+[[ "$adapter_port" == /dev/ttyACM* || "$adapter_port" == /dev/ttyUSB* ]] || adapter_die 'Select a local USB serial tty.'
+[[ -d "$adapter_workdir" ]] || adapter_die 'Create a private workdir first.'
+adapter_workdir=$(realpath -e -- "$adapter_workdir")
+[[ "$adapter_workdir" != / && "$adapter_workdir" != /home && "$adapter_workdir" != "${HOME:-}" ]] || adapter_die 'Use a dedicated run directory.'
+[[ "$adapter_read_baud" == 115200 || "$adapter_read_baud" == 460800 ]] || adapter_die 'Read baud must be 115200 or 460800.'
+if [[ -n "$adapter_expected_mac" ]]; then
+    [[ "$adapter_expected_mac" =~ ^([[:xdigit:]]{12}|([[:xdigit:]]{2}:){5}[[:xdigit:]]{2})$ ]] || adapter_die 'Expected MAC must be exactly twelve hex digits, optionally colon-separated.'
+    adapter_expected_mac=${adapter_expected_mac//:/}
+    adapter_expected_mac=${adapter_expected_mac,,}
+fi
+if [[ -n "$adapter_expected_bytes" ]]; then
+    [[ "$adapter_expected_bytes" =~ ^[0-9]+$ ]] || adapter_die 'Flash bytes must be decimal.'
+    [[ "$adapter_expected_bytes" == 8388608 || "$adapter_expected_bytes" == 16777216 ]] || adapter_die 'Only confirmed Heltec 8 MiB/16 MiB boards are in scope.'
+fi
+case "$adapter_mode" in
+    probe) ((${#adapter_operation_args[@]} == 0)) || adapter_die 'probe takes no arguments.' ;;
+    read-flash) ((${#adapter_operation_args[@]} == 3)) || adapter_die 'read-flash requires OFFSET LENGTH OUTPUT.' ;;
+    write-flash)
+        ((adapter_allow_write)) || adapter_die 'write-flash requires --allow-write.'
+        ((${#adapter_operation_args[@]} >= 2 && ${#adapter_operation_args[@]} % 2 == 0)) || adapter_die 'write-flash takes OFFSET FILE pairs only.' ;;
+    erase-flash)
+        ((adapter_allow_erase)) || adapter_die 'erase-flash requires --allow-erase.'
+        ((${#adapter_operation_args[@]} == 0)) || adapter_die 'erase-flash takes no arguments.' ;;
+    erase-region)
+        ((adapter_allow_erase)) || adapter_die 'erase-region requires --allow-erase.'
+        ((${#adapter_operation_args[@]} == 2)) || adapter_die 'erase-region requires OFFSET LENGTH.' ;;
+    *) adapter_die "Unsupported mode: $adapter_mode" ;;
+esac
+if [[ "$adapter_mode" != probe ]]; then
+    [[ -n "$adapter_expected_mac" && -n "$adapter_expected_bytes" ]] || adapter_die 'Probe first, then supply the verified expected MAC and flash bytes.'
+fi
+
+# Validate every range and file before any serial operation. Numeric arguments
+# deliberately accept decimal or 0x hex only, never shell arithmetic expressions.
+adapter_number() {
+    local input=$1
+    [[ "$input" =~ ^(0[xX][[:xdigit:]]{1,8}|[0-9]{1,10})$ ]] || adapter_die "Invalid numeric argument: $input"
+    if [[ "$input" == 0[xX]* ]]; then printf '%d\n' "$((16#${input:2}))";
+    else printf '%d\n' "$((10#$input))"; fi
+}
+adapter_check_range() {
+    local offset=$1 length=$2
+    ((length > 0 && offset >= 0 && offset + length <= adapter_expected_bytes)) || adapter_die 'Flash range is outside the confirmed board size.'
+}
+if [[ "$adapter_mode" == read-flash || "$adapter_mode" == erase-region ]]; then
+    adapter_offset=$(adapter_number "${adapter_operation_args[0]}")
+    adapter_length=$(adapter_number "${adapter_operation_args[1]}")
+    adapter_check_range "$adapter_offset" "$adapter_length"
+    if [[ "$adapter_mode" == read-flash ]]; then
+        adapter_output=$(realpath -m -- "${adapter_operation_args[2]}")
+        [[ "$adapter_output" == "$adapter_workdir"/* && ! -e "$adapter_output" && ! -L "$adapter_output" ]] || adapter_die 'Read output must be a NEW file within the dedicated workdir.'
+        [[ -d "$(dirname -- "$adapter_output")" ]] || adapter_die 'Read output parent directory must exist.'
+        adapter_operation_args[2]=$adapter_output
+    fi
+elif [[ "$adapter_mode" == write-flash ]]; then
+    for ((adapter_i=0; adapter_i<${#adapter_operation_args[@]}; adapter_i+=2)); do
+        adapter_offset=$(adapter_number "${adapter_operation_args[adapter_i]}")
+        adapter_image=$(realpath -e -- "${adapter_operation_args[adapter_i+1]}")
+        [[ -f "$adapter_image" && -s "$adapter_image" ]] || adapter_die "Missing image: $adapter_image"
+        adapter_length=$(stat -Lc '%s' -- "$adapter_image")
+        adapter_check_range "$adapter_offset" "$adapter_length"
+        adapter_operation_args[adapter_i+1]=$adapter_image
+        sha256sum -- "$adapter_image"
+    done
+fi
+for adapter_command in awk bash python3 pipx timeout udevadm fuser realpath sha256sum stat; do
+    command -v "$adapter_command" >/dev/null || adapter_die "Required command is unavailable: $adapter_command"
+done
+
+adapter_state_dir=$(mktemp -d "$adapter_workdir/.mcfirmware-session.XXXXXX")
+adapter_definitions="$adapter_state_dir/functions.sh"
+# This is the same unindented-definition convention used by meshfirmware's
+# extraction tests. No global assignment, command, trap or startup is included.
+# A changed source layout fails bash -n before these definitions are sourced.
+awk '
+    { sub(/\r$/, "") }
+    /^[A-Za-z_][A-Za-z0-9_]*\(\)[[:space:]]*\{[[:space:]]*$/ {
+        if (capture) exit 2
+        capture=1; count++
+    }
+    capture { print }
+    capture && /^}[[:space:]]*$/ { capture=0 }
+    END { if (capture || count < 100) exit 2 }
+' "$adapter_flasher" > "$adapter_definitions"
+bash -n "$adapter_definitions"
+# shellcheck source=/dev/null
+source "$adapter_definitions"
+sha256sum -- "$adapter_flasher" "$adapter_definitions"
+
+# Explicit private state only. Do not invoke the flasher's startup/cleanup.
+PWD_SCRIPT=$(dirname -- "$(realpath -e -- "$adapter_flasher")")
+FIRMWARE_ROOT=$adapter_state_dir
+DOWNLOAD_DIR="$adapter_state_dir/downloads"
+mkdir -p -- "$DOWNLOAD_DIR"
+DEVICE_PORT=$adapter_port
+DEVICE_PORT_FILE="$adapter_state_dir/selected-port"
+DEVICE_PORT_NAME_FILE="$adapter_state_dir/selected-by-id"
+ESPTOOL_PIPX_APP=''
+ESPTOOL_VERSION_OUTPUT=''
+ESPTOOL_CMD='pipx run --spec esptool esptool'
+ESP32_SAFE_BAUD=115200
+ESP32_FLASH_EXPECTED_MAC=''
+ESP32_SESSION_IS_S3=0
+ESP32_NATIVE_ROM_READY=0
+ESP32_FLASH_SELECTED_BY_ID=''
+ESP32_FLASH_EXPECTED_SERIAL=''
+ESP32_FLASH_EXPECTED_PATH_STEM=''
+BOOTLOADER_PROBE_PORT=''
+BOOTLOADER_PROBE_ACTIVE=0
+USB_RESET_FAILED=0
+USB_RESET_RECOVERED_PORT=''
+USB_RESET_EXPECTED_IDENTITY=''
+LOCKEDSERVICE='None'
+MCFIRMWARE_NO_SUDO=1
+MESH_DISABLE_1200_RECOVERY=1
+ESP32_PROBE_TIMEOUT_SECONDS=12
+NRF52_DFU_REENUMERATE_TIMEOUT_SECONDS=30
+NRF52_DFU_REENUMERATE_POLL_SECONDS=0.25
+MESHCORE_USB_RESET_TOOL_SHA256='364de4c2e100df3ec2be795fc6079722ce1790416ba5a2d04d0c53e6c87c7083'
+MESHCORE_ESP32_BOOTLOADER_TOOL_SHA256='8c48512a650892b9c8d024d926a4c7c85d9e9d30db0fddc990be6c0c108b4ea0'
+
+adapter_assert_unowned() {
+    local port=$1 output='' status=0
+    # psmisc versions on the Pi do not all accept a '--' separator. The port
+    # is already restricted to a /dev/ttyACM* or /dev/ttyUSB* path above.
+    if output=$(fuser "$port" 2>&1); then
+        printf '%s\n' "$output" >&2
+        adapter_die "A process owns $port; no owner will be killed."
+    else status=$?; fi
+    [[ "$status" == 1 && -z "$output" ]] || adapter_die "Unable to prove $port has no owners: $output"
+}
+# Scope all privilege/busy/retry boundaries; keep actual chip, USB identity,
+# esptool serial bootstrap, verification and watchdog finish implementations.
+prepare_serial_port_for_flash() { adapter_assert_unowned "$1"; }
+recover_busy_serial_port() { printf 'Busy serial port; refusing recovery.\n' >&2; return 1; }
+offer_serial_port_recovery() { return 1; }
+offer_identity_safe_1200_touch() { return 1; }
+manual_reboot_choice() { return 1; }
+esp32_recover_interrupted_transport() { return 1; }
+esp32_run_chunked_write_recovery() { return 1; }
+resolve_meshcore_usb_reset_tool() {
+    local tool="$PWD_SCRIPT/tools/meshcore_usb_reset.py"
+    meshcore_usb_reset_tool_hash_matches "$tool" || { printf 'Supply the matching bundled USB helper at %s\n' "$tool" >&2; return 1; }
+    printf '%s\n' "$tool"
+}
+resolve_meshcore_esp32_bootloader_tool() {
+    local tool="$PWD_SCRIPT/tools/meshcore_esp32_bootloader.py"
+    resolve_meshcore_usb_reset_tool >/dev/null || return 1
+    meshcore_esp32_bootloader_tool_hash_matches "$tool" || { printf 'Supply the matching bundled bootloader helper at %s\n' "$tool" >&2; return 1; }
+    printf '%s\n' "$tool"
+}
+adapter_exit_notice() {
+    if ((adapter_session_active)); then
+        printf 'Session failed or was interrupted. No automatic reset/recovery was attempted; reselect the same radio before continuing. State: %s\n' "$adapter_state_dir" >&2
+    fi
+}
+trap adapter_exit_notice EXIT
+esptool_set_variables
+[[ "$NORESET" == no-reset ]] || adapter_die 'This adapter requires esptool 5 or newer.'
+ESP32_OPERATION_BEFORE=$NORESET
+adapter_session_active=1
+prepare_esp32_flash_session "$adapter_port" "$adapter_board"
+[[ "$ESP32_SESSION_IS_S3" == 1 ]] || adapter_die 'Probe did not identify ESP32-S3.'
+if [[ -n "$adapter_expected_mac" && "$ESP32_FLASH_EXPECTED_MAC" != "$adapter_expected_mac" ]]; then
+    adapter_die "MAC mismatch: typed $adapter_expected_mac, probe $ESP32_FLASH_EXPECTED_MAC."
+fi
+adapter_live_port=$(selected_flash_serial_port "$DEVICE_PORT")
+adapter_assert_unowned "$adapter_live_port"
+adapter_flash_output=$(run_esp32_session_esptool "$adapter_live_port" --after "$NORESET" --baud 115200 flash-id)
+printf '%s\n' "$adapter_flash_output"
+[[ "$adapter_flash_output" =~ Detected[[:space:]]flash[[:space:]]size:[[:space:]]*([0-9]+)MB ]] || adapter_die 'No unambiguous flash size was reported.'
+adapter_detected_bytes=$((BASH_REMATCH[1] * 1024 * 1024))
+if [[ -n "$adapter_expected_bytes" && "$adapter_detected_bytes" != "$adapter_expected_bytes" ]]; then
+    adapter_die "Flash size mismatch: expected $adapter_expected_bytes, detected $adapter_detected_bytes."
+fi
+printf 'VERIFIED mac=%s chip=ESP32-S3 flash_bytes=%s port=%s\n' "$ESP32_FLASH_EXPECTED_MAC" "$adapter_detected_bytes" "$adapter_live_port"
+if [[ "$adapter_mode" != probe ]]; then
+    # Re-resolve by-id and re-probe MAC for READS too. Destructive commands also
+    # repeat this inside the untouched run_esp32_session_esptool implementation.
+    adapter_live_port=$(esp32_verified_destructive_port "$DEVICE_PORT" "$adapter_mode")
+    adapter_assert_unowned "$adapter_live_port"
+    adapter_baud=115200
+    [[ "$adapter_mode" != read-flash ]] || adapter_baud=$adapter_read_baud
+    run_esp32_session_esptool "$adapter_live_port" --after "$NORESET" --baud "$adapter_baud" "$adapter_mode" "${adapter_operation_args[@]}"
+    if [[ "$adapter_mode" == read-flash ]]; then
+        [[ "$(stat -Lc '%s' -- "$adapter_output")" == "$adapter_length" ]] || adapter_die 'Backup read length differs from requested range.'
+        sha256sum -- "$adapter_output"
+    fi
+fi
+finish_esp32_flash_session "$DEVICE_PORT"
+adapter_session_active=0
+printf 'Session finished. Application boot still requires an application-level check. State: %s\n' "$adapter_state_dir"
diff --git a/tools/hil/meshtext_auto_radio2.py b/tools/hil/meshtext_auto_radio2.py
new file mode 100644
index 000000000..87b4048ed
--- /dev/null
+++ b/tools/hil/meshtext_auto_radio2.py
@@ -0,0 +1,653 @@
+#!/usr/bin/env python3
+"""Meshtext Companion / stock-peer automatic-radio2 hardware sweep.
+
+CHANGES BOTH RADIOS' SETTINGS AND TRANSMITS LoRa. The operator must back up
+and restore both radios separately. No firmware flashing or PlatformIO is used.
+One private random AES-128/256 key is held in memory, never included in the report.
+The US stock hash frequencies are intentional, not the 909.5-MHz lab baseline.
+The Companion primary modem is not changed. Other channel slots are not erased.
+
+Dependencies: pyserial, stock peer SDK, pypubsub. Run --plan without opening ports.
+The installed stable stock schema has nine matching preset enums; the
+MediumTurbo tuple is tested as an explicitly reported custom stock-radio mode.
+Use distinct USB ports, no other attached clients, and conservative TX power.
+"""
+
+from __future__ import annotations
+
+import argparse
+from collections import deque
+from dataclasses import dataclass
+from datetime import datetime, timezone
+import hashlib
+import importlib.metadata
+import json
+import os
+from pathlib import Path
+import random
+import re
+import secrets
+import struct
+import threading
+import time
+
+from esp32_companion_serial_stress import (
+    DeviceFrameReader, FrameTimeout, TransportCounters, encode_host_frame,
+    make_app_start_spec, validate_app_start_response,
+)
+
+
+class TestFailure(RuntimeError):
+    pass
+
+
+def require(condition, message):
+    if not condition:
+        raise TestFailure(message)
+
+
+@dataclass(frozen=True)
+class Preset:
+    name: str
+    bandwidth: int
+    sf: int
+    cr: int
+    stock_enum: str | None
+
+    @property
+    def alias(self):
+        return "mt-" + self.name.lower()
+
+    @property
+    def frequency_slot(self):
+        value = 5381
+        for byte in self.name.encode("ascii"):
+            value = (value * 33 + byte) & 0xffffffff
+        return value % (26000 // self.bandwidth) + 1
+
+    @property
+    def frequency(self):
+        return 902 + self.bandwidth / 2000 + (self.frequency_slot - 1) * self.bandwidth / 1000
+
+    def describe(self):
+        return {"name": self.name, "alias": self.alias, "frequency_mhz": self.frequency,
+                "frequency_slot": self.frequency_slot, "bandwidth_khz": self.bandwidth,
+                "sf": self.sf, "cr": self.cr, "preamble": 16,
+                "stock_mode": self.stock_enum or "CUSTOM (MediumTurbo tuple; no stable enum)"}
+
+
+PRESETS = (
+    Preset("LongFast", 250, 11, 5, "LONG_FAST"),
+    Preset("ShortTurbo", 500, 7, 5, "SHORT_TURBO"),
+    Preset("ShortFast", 250, 7, 5, "SHORT_FAST"),
+    Preset("ShortSlow", 250, 8, 5, "SHORT_SLOW"),
+    Preset("MediumFast", 250, 9, 5, "MEDIUM_FAST"),
+    Preset("MediumSlow", 250, 10, 5, "MEDIUM_SLOW"),
+    Preset("LongTurbo", 500, 11, 8, "LONG_TURBO"),
+    Preset("LongMod", 125, 11, 8, "LONG_MODERATE"),
+    Preset("LongSlow", 125, 12, 8, "LONG_SLOW"),
+    Preset("MediumTurbo", 500, 9, 5, None),
+)
+
+
+def choose_presets(names):
+    selected = []
+    for name in names.split(","):
+        normalized = name.strip().lower().replace("_", "")
+        if normalized in ("longmoderate", "longmod"):
+            normalized = "longmod"
+        found = next((p for p in PRESETS if p.name.lower() == normalized), None)
+        require(found is not None, "unknown preset: " + name)
+        require(found not in selected, "duplicate preset: " + name)
+        selected.append(found)
+    require(selected, "at least one preset is required")
+    return selected
+
+
+def parse_profile(reply):
+    match = re.search(r"(?:^|>\s*)([0-9.]+),([0-9.]+),(\d+),(\d+),(rx|rxtx),(\d+)", reply)
+    require(match, "radio2 did not report a modem tuple")
+    return (float(match[1]), float(match[2]), int(match[3]), int(match[4]), match[5], int(match[6]))
+
+
+def temporary_off(reply):
+    return reply in ("> off", "off", "TempRadio inactive")
+
+
+def decode_channel_frame(frame):
+    if not frame or frame[0] not in (8, 17):
+        return None
+    offset = 4 if frame[0] == 17 else 1
+    require(len(frame) >= offset + 7, "truncated Companion channel frame")
+    return {"channel": frame[offset], "path": frame[offset + 1], "type": frame[offset + 2],
+            "timestamp": struct.unpack_from("<I", frame, offset + 3)[0],
+            "text": frame[offset + 7:]}
+
+
+class Companion:
+    def __init__(self, port):
+        import serial
+        self.port = serial.Serial(port=None, baudrate=115200, timeout=0.1,
+                                  write_timeout=2, exclusive=True)
+        self.port.port, self.port.dtr, self.port.rts = port, True, False
+        self.port.open()
+        self.reader = DeviceFrameReader(TransportCounters())
+        self.max_channels = 0
+
+    def close(self):
+        self.port.close()
+
+    def request(self, payload, expected, timeout=5):
+        encoded = encode_host_frame(payload)
+        require(self.port.write(encoded) == len(encoded), "incomplete Companion write")
+        self.port.flush()
+        deadline = time.monotonic() + timeout
+        while time.monotonic() < deadline:
+            try:
+                frame = self.reader.read_frame(self.port, min(0.5, deadline - time.monotonic()))
+            except FrameTimeout:
+                continue
+            if frame[0] >= 0x80:
+                continue
+            if frame[0] == 1:
+                raise TestFailure("Companion command rejected, error " + str(frame[1:2].hex()))
+            require(frame[0] in expected, "unexpected Companion response " + str(frame[0]))
+            return frame
+        raise TestFailure("Companion response timeout for command " + str(payload[0]))
+
+    def start(self):
+        info = self.request(bytes((22, 14)), (13,))
+        require(len(info) >= 80, "truncated Companion device info")
+        self.max_channels = info[3]
+        frame = self.request(make_app_start_spec("Meshtext-Auto-HIL").payload, (5,))
+        return {"protocol": info[1], "max_channels": self.max_channels,
+                "model": info[20:60].split(b"\0")[0].decode("utf-8", "replace"),
+                "firmware": info[60:80].split(b"\0")[0].decode("utf-8", "replace"),
+                "primary": validate_app_start_response(frame)}
+
+    def cli(self, command):
+        frame = self.request(b"\x42" + command.encode("utf-8"), (0x1d,))
+        text = frame[1:].decode("utf-8", "strict").strip()
+        require(not re.match(r"(?:Error|ERR|Err)\b", text), "Companion CLI rejected " + command.split()[0])
+        return text
+
+    def channel_name(self, slot):
+        frame = self.request(bytes((31, slot)), (18,))
+        require(len(frame) >= 50, "truncated channel info")
+        return frame[2:34].split(b"\0")[0].decode("utf-8", "strict")
+
+    def mt_node(self):
+        match = re.search(r"!([0-9a-fA-F]{8})", self.cli("get mt.node"))
+        require(match, "missing Companion Meshtext node ID")
+        return int(match[1], 16)
+
+    def send_text(self, slot, token):
+        self.request(bytes((3, 0, slot)) + struct.pack("<I", int(time.time())) + token.encode(), (0,))
+
+    def wait_text(self, slot, from_node, token, timeout):
+        expected = (f"!{from_node:08x}: " + token).encode()
+        deadline = time.monotonic() + timeout
+        while time.monotonic() < deadline:
+            frame = self.request(b"\x0a", (7, 8, 10, 16, 17), timeout=min(5, max(0.1, deadline - time.monotonic())))
+            channel = decode_channel_frame(frame)
+            if channel and channel["channel"] == slot and channel["text"] == expected:
+                return {"received": True, "timestamp": channel["timestamp"], "path": channel["path"]}
+            time.sleep(0.1)
+        return {"received": False}
+
+    def wait_auto(self, preset, timeout=12):
+        deadline = time.monotonic() + timeout
+        last = ""
+        while time.monotonic() < deadline:
+            last = self.cli("get radio2")
+            if "auto-owned" in last:
+                actual = parse_profile(last)
+                desired = (preset.frequency, preset.bandwidth, preset.sf, preset.cr, "rxtx", 16)
+                if (abs(actual[0] - desired[0]) <= 0.001 and actual[1:] == desired[1:]):
+                    status = self.cli("get mt.status")
+                    require("auto radio2" in status and "; active;" in status, "Meshtext automatic profile is not active")
+                    return {"radio2": last, "status": status}
+            time.sleep(0.25)
+        raise TestFailure("automatic radio2 did not reach expected tuple: " + last)
+
+
+class StockPeer:
+    def __init__(self, port):
+        from pubsub import pub
+        self.port, self.iface = port, None
+        self.events = deque(maxlen=4096)
+        self.lock = threading.Lock()
+        pub.subscribe(self.on_packet, "meshtastic.receive")
+        self.pub = pub
+        self.connect()
+
+    def on_packet(self, packet, interface):
+        if interface is self.iface:
+            with self.lock:
+                self.events.append((time.monotonic(), packet))
+
+    def connect(self):
+        from meshtastic.serial_interface import SerialInterface
+        self.iface = SerialInterface(devPath=self.port, timeout=20)
+        require(self.iface.myInfo is not None and self.iface.localNode.localConfig is not None,
+                "stock radio configuration was not loaded")
+
+    def close(self):
+        self.pub.unsubscribe(self.on_packet, "meshtastic.receive")
+        if self.iface:
+            self.iface.close()
+            self.iface = None
+
+    @property
+    def node(self):
+        return int(self.iface.myInfo.my_node_num)
+
+    def identity(self):
+        metadata = getattr(self.iface, "metadata", None)
+        return {"node": f"!{self.node:08x}", "firmware": getattr(metadata, "firmware_version", "unknown")}
+
+    def configure(self, preset, key, tx_power, hops):
+        from meshtastic.protobuf import channel_pb2, config_pb2
+        from meshtastic.mesh_interface import MeshInterface
+        from meshtastic.util import to_node_num
+        node = self.iface.localNode
+        # The SDK's ensureSessionKey() only queues a request. Wait for its
+        # response so each subsequent write does not enqueue another request.
+        # Stock's local receive queue holds only four packets; pace writes too.
+        node.ensureSessionKey()
+        deadline = time.monotonic() + 10
+        while not self.iface._getOrCreateByNum(to_node_num(node.nodeNum)).get("adminSessionPassKey"):
+            require(time.monotonic() < deadline, "stock admin session setup timed out")
+            time.sleep(0.05)
+        node.beginSettingsTransaction()
+        time.sleep(0.75)
+        primary = node.channels[0]
+        primary.role = channel_pb2.Channel.PRIMARY
+        primary.settings.name, primary.settings.psk = preset.name, key
+        primary.settings.uplink_enabled = primary.settings.downlink_enabled = False
+        # Avoid local relaying contaminating a two-radio reception measurement.
+        node.localConfig.device.role = config_pb2.Config.DeviceConfig.CLIENT_MUTE
+        node.writeConfig("device")
+        time.sleep(0.75)
+        lora = node.localConfig.lora
+        lora.region = config_pb2.Config.LoRaConfig.US
+        lora.use_preset = preset.stock_enum is not None
+        if preset.stock_enum:
+            require(preset.stock_enum in config_pb2.Config.LoRaConfig.ModemPreset.keys(),
+                    "installed stock schema lacks " + preset.stock_enum)
+            lora.modem_preset = config_pb2.Config.LoRaConfig.ModemPreset.Value(preset.stock_enum)
+        # Clear BW/SF overrides for native presets. Stock AdminModule clamps
+        # coding_rate=0 to 5, so request the preset's CR explicitly, including 8.
+        custom_tuple = (0, 0, preset.cr) if preset.stock_enum else (preset.bandwidth, preset.sf, preset.cr)
+        lora.bandwidth, lora.spread_factor, lora.coding_rate = custom_tuple
+        # Nine native presets independently exercise the stock name-hash default.
+        # Custom MediumTurbo uses an explicit slot because stable has no enum
+        # whose stock default preset behavior can be independently compared.
+        requested_slot = 0 if preset.stock_enum else preset.frequency_slot
+        lora.channel_num, lora.override_frequency, lora.frequency_offset = requested_slot, 0, 0
+        lora.hop_limit, lora.tx_power, lora.tx_enabled = hops, tx_power, True
+        lora.config_ok_to_mqtt, lora.ignore_mqtt = False, True
+        node.writeConfig("lora")
+        time.sleep(0.75)
+        node.writeChannel(0)
+        time.sleep(0.75)
+        node.commitSettingsTransaction()
+        time.sleep(2)
+        self.iface.close()
+        self.iface = None
+        deadline = time.monotonic() + 90
+        while time.monotonic() < deadline:
+            try:
+                self.connect()
+                node = self.iface.localNode
+                observed, primary = node.localConfig.lora, node.channels[0]
+                # Stable firmware bootstraps effective BW/SF into these fields
+                # even in preset mode. The write clears overrides; normalized
+                # readback may contain zero or the preset's effective value.
+                observed_tuple = (observed.bandwidth, observed.spread_factor, observed.coding_rate)
+                tuple_matches = (all(value in (0, effective) for value, effective in zip(
+                    observed_tuple[:2], (preset.bandwidth, preset.sf)))
+                    and observed.coding_rate == preset.cr if preset.stock_enum
+                    else observed_tuple == custom_tuple)
+                good = (primary.role == channel_pb2.Channel.PRIMARY
+                        and primary.settings.name == preset.name and primary.settings.psk == key
+                        and not primary.settings.uplink_enabled and not primary.settings.downlink_enabled
+                        and observed.region == config_pb2.Config.LoRaConfig.US
+                        and observed.channel_num == requested_slot
+                        and observed.override_frequency == 0 and observed.frequency_offset == 0
+                        and observed.use_preset == (preset.stock_enum is not None)
+                        and tuple_matches
+                        and observed.tx_power == tx_power
+                        and observed.tx_enabled and observed.hop_limit == hops
+                        and not observed.config_ok_to_mqtt and observed.ignore_mqtt
+                        and node.localConfig.device.role == config_pb2.Config.DeviceConfig.CLIENT_MUTE)
+                if preset.stock_enum:
+                    good = good and observed.modem_preset == config_pb2.Config.LoRaConfig.ModemPreset.Value(preset.stock_enum)
+                if good:
+                    return {**self.identity(), "readback": {
+                        "use_preset": observed.use_preset, "modem_preset": observed.modem_preset,
+                        "channel_num": observed.channel_num, "bandwidth": observed.bandwidth,
+                        "spread_factor": observed.spread_factor, "coding_rate": observed.coding_rate,
+                        "tx_power": observed.tx_power, "hop_limit": observed.hop_limit}}
+                self.iface.close()
+                self.iface = None
+            except (OSError, TimeoutError, MeshInterface.MeshInterfaceError):
+                if self.iface:
+                    self.iface.close()
+                    self.iface = None
+            time.sleep(1)
+        raise TestFailure("stock configuration readback did not match requested private US preset")
+
+    def packets_since(self, timestamp, sender):
+        with self.lock:
+            return [p for when, p in self.events if when >= timestamp and p.get("from") == sender]
+
+    def wait_packet(self, sender, predicate, since, timeout):
+        deadline = time.monotonic() + timeout
+        while time.monotonic() < deadline:
+            for packet in self.packets_since(since, sender):
+                if predicate(packet):
+                    return packet
+            time.sleep(0.05)
+        return None
+
+    def send_text(self, token, hops):
+        return self.iface.sendText(token, destinationId="^all", wantAck=False,
+                                   wantResponse=False, channelIndex=0, hopLimit=hops)
+
+
+def text_payload(packet):
+    return packet.get("decoded", {}).get("payload")
+
+
+def print_packet_progress(label, direction, packets, total):
+    # Only receipt metadata is logged; payload tokens and keys stay out of stdout.
+    latest = packets[-1]
+    outcome = "received" if latest["received"] else "timeout"
+    elapsed = (f" in {latest['elapsed_seconds']:.3f}s"
+               if "elapsed_seconds" in latest else "")
+    received = sum(packet["received"] for packet in packets)
+    print(f"  {label} {direction}: packet {len(packets)}/{total} {outcome}{elapsed}; "
+          f"received {received}/{len(packets)}", flush=True)
+
+
+def assess_traffic(case, minimum_received):
+    counts = {direction: {"received": sum(packet["received"] for packet in case[direction]),
+                          "attempted": len(case[direction])}
+              for direction in ("v4_to_v3", "v3_to_v4")}
+    failures = [{"direction": direction, **count, "required": minimum_received}
+                for direction, count in counts.items() if count["received"] < minimum_received]
+    case["traffic_counts"], case["traffic_failure"] = counts, failures
+    return failures
+
+
+def pause_after_packet(packet, gap_seconds, jitter_seconds, rng):
+    gap = gap_seconds if jitter_seconds == 0 else rng.uniform(gap_seconds, gap_seconds + jitter_seconds)
+    packet["gap_after_seconds"] = gap
+    time.sleep(gap)
+
+
+def write_report(path, data):
+    # A report must never overwrite an earlier test; the key is not in data.
+    with path.open("x", encoding="utf-8") as stream:
+        json.dump(data, stream, indent=2)
+        stream.write("\n")
+    try:
+        os.chmod(path, 0o600)
+    except OSError:
+        pass
+
+
+def run(args, presets):
+    key = secrets.token_bytes(args.key_bits // 8)
+    run_id = secrets.token_hex(4)
+    gap_seed = int(run_id, 16)
+    gap_rng = random.Random(gap_seed)
+    report = {"schema": 1, "started_utc": datetime.now(timezone.utc).isoformat(),
+              "result": "FAIL", "run_id": run_id, "region": "US", "companion_region_setting": args.region,
+              "tx_power_dbm": args.tx_power, "hops": args.hops,
+              "key_bits": args.key_bits, "key_fingerprint": hashlib.sha256(key).hexdigest()[:16],
+              "minimum_received_per_direction": args.minimum_received,
+              "continue_on_loss": args.continue_on_loss, "gap_seconds": args.gap_seconds,
+              "gap_jitter_seconds": args.gap_jitter_seconds, "gap_jitter_seed": gap_seed,
+              "auto_clear_requested": args.auto_clear,
+              "settings_restored": False, "restore_owner": "operator",
+              "packages": {n: importlib.metadata.version(n) for n in ("pyserial", "meshtastic", "pypubsub")},
+              "cases": []}
+    companion = stock = None
+    try:
+        if args.gap_jitter_seconds:
+            print(f"Gap jitter seed={gap_seed}; packet gaps {args.gap_seconds:g}.."
+                  f"{args.gap_seconds + args.gap_jitter_seconds:g}s", flush=True)
+        companion = Companion(args.companion_port)
+        report["companion"] = companion.start()
+        require(args.channel_slot < companion.max_channels, "Companion channel slot out of range")
+        for slot in range(companion.max_channels):
+            if slot == args.channel_slot:
+                continue
+            name = companion.channel_name(slot).lstrip("#")
+            require(not name.startswith(("mt-", "r2-")),
+                    "another Meshtext/radio2 slot conflicts with the sweep; operator must back up and resolve it first")
+        require(temporary_off(companion.cli("get tempradio")), "temporary primary profile is active")
+        require(temporary_off(companion.cli("get tempradio2")), "temporary radio2 profile is active")
+        report["primary_before"] = companion.cli("get radio")
+        for command in (f"set mt.region {args.region}", "set mt.slot 0", f"set mt.hops {args.hops}",
+                        f"set tx {args.tx_power}", "set radio2.cross off", "set radio2 auto"):
+            companion.cli(command)
+        time.sleep(2.2)
+        mt_node = companion.mt_node()
+        report["companion"]["mt_node"] = f"!{mt_node:08x}"
+        stock = StockPeer(args.stock_port)
+        require(stock.node != mt_node, "stock and Companion Meshtext sender IDs collide")
+        for preset in presets:
+            case = {**preset.describe(), "result": "FAIL", "v4_to_v3": [], "v3_to_v4": []}
+            report["cases"].append(case)
+            print(f"Testing {preset.name}: {preset.frequency:.4f} MHz / {preset.bandwidth} / SF{preset.sf} / CR{preset.cr}", flush=True)
+            case["stock"] = stock.configure(preset, key, args.tx_power, args.hops)
+            observed = case["stock"]["readback"]
+            print(f"  Stock readback verified: {'preset' if observed['use_preset'] else 'custom'}, "
+                  f"slot={observed['channel_num']}, BW={observed['bandwidth']}, "
+                  f"SF={observed['spread_factor']}, CR={observed['coding_rate']}, "
+                  f"TX={observed['tx_power']} dBm, hops={observed['hop_limit']}", flush=True)
+            companion.cli(f"set mt.channel {args.channel_slot} {preset.alias} {key.hex()}")
+            case["automatic"] = companion.wait_auto(preset)
+            require(companion.cli("get radio") == report["primary_before"], "primary RF settings changed")
+            since = time.monotonic()
+            before = companion.cli("get mt.status")
+            time.sleep(args.quiet_seconds)
+            after = companion.cli("get mt.status")
+            before_tx, after_tx = re.search(r"\bTX=(\d+)", before), re.search(r"\bTX=(\d+)", after)
+            require(before_tx and after_tx and before_tx[1] == after_tx[1], "unsolicited Companion Meshtext TX during quiet window")
+            require(not stock.packets_since(since, mt_node), "unsolicited Companion Meshtext packet observed")
+            case["quiet_seconds"] = args.quiet_seconds
+            for sequence in range(args.messages_per_direction):
+                token = f"Meshtext-HIL {run_id} {preset.name} V4-V3 {sequence}"
+                started = time.monotonic()
+                companion.send_text(args.channel_slot, token)
+                packet = stock.wait_packet(mt_node, lambda p: text_payload(p) == token.encode(), started, args.timeout)
+                case["v4_to_v3"].append({"token": token, "received": packet is not None,
+                    "elapsed_seconds": round(time.monotonic() - started, 3),
+                    "packet_id": packet.get("id") if packet else None})
+                print_packet_progress(preset.name, "V4->V3", case["v4_to_v3"], args.messages_per_direction)
+                # No automatic retransmit or ACK assumption: each token is one new send.
+                pause_after_packet(case["v4_to_v3"][-1], args.gap_seconds, args.gap_jitter_seconds, gap_rng)
+                token = f"Meshtext-HIL {run_id} {preset.name} V3-V4 {sequence}"
+                started = time.monotonic()
+                sent = stock.send_text(token, args.hops)
+                received = companion.wait_text(args.channel_slot, stock.node, token, args.timeout)
+                case["v3_to_v4"].append({"token": token, **received,
+                    "elapsed_seconds": round(time.monotonic() - started, 3), "packet_id": sent.id})
+                print_packet_progress(preset.name, "V3->V4", case["v3_to_v4"], args.messages_per_direction)
+                pause_after_packet(case["v3_to_v4"][-1], args.gap_seconds, args.gap_jitter_seconds, gap_rng)
+            # Capture RX/TX/failure counters even when reception misses the threshold.
+            case["status_after_traffic"] = companion.cli("get mt.status")
+            case["radio2_after_traffic"] = companion.cli("get radio2")
+            case["radio2_status_after_traffic"] = companion.cli("get radio2.status")
+            case["radio2_scan_after_traffic"] = companion.cli("get radio2.scan")
+            traffic_failures = assess_traffic(case, args.minimum_received)
+            if traffic_failures and not args.continue_on_loss:
+                raise TestFailure(preset.name + " insufficient received messages in " + traffic_failures[0]["direction"])
+            if args.nodeinfo:
+                from meshtastic.protobuf import mesh_pb2
+                started = time.monotonic()
+                companion.cli(f"send mt.nodeinfo {args.channel_slot}")
+                packet = stock.wait_packet(mt_node, lambda p: p.get("decoded", {}).get("portnum") == "NODEINFO_APP", started, args.timeout)
+                require(packet is not None, "manual NodeInfo not received")
+                user = mesh_pb2.User()
+                user.ParseFromString(text_payload(packet))
+                require(user.id == f"!{mt_node:08x}" and user.role == 1 and user.is_unmessagable
+                        and 1 <= len(user.short_name.encode()) <= 4 and len(user.long_name.encode()) <= 24
+                        and not user.public_key and not packet["raw"].want_ack
+                        and not packet["raw"].decoded.want_response, "manual NodeInfo fields/flags invalid")
+                case["nodeinfo"] = {"received": True, "id": user.id, "role": user.role,
+                                    "long_name": user.long_name, "short_name": user.short_name}
+            case["result"] = "FAIL" if traffic_failures else "PASS"
+            print(f"{case['result']} {preset.name}: " + ", ".join(f"{d}={sum(p['received'] for p in case[d])}/{len(case[d])}" for d in ("v4_to_v3", "v3_to_v4")), flush=True)
+        if args.reboot:
+            # Reboot only the Companion; keep the stock observer connected.
+            # The NVS settings/channel remain, but the auto-owned modem is RAM-only.
+            print("Testing Companion reboot / automatic-profile reacquisition", flush=True)
+            time.sleep(max(1, args.gap_seconds))
+            old_identity = report["companion"]["primary"]["public_key_prefix"]
+            frame = encode_host_frame(b"\x13reboot")
+            require(companion.port.write(frame) == len(frame), "incomplete Companion reboot command")
+            companion.port.flush()
+            companion.close()
+            companion = None
+            time.sleep(3)
+            deadline = time.monotonic() + 90
+            while time.monotonic() < deadline:
+                candidate = None
+                try:
+                    candidate = Companion(args.companion_port)
+                    info = candidate.start()
+                except (OSError, TestFailure):
+                    if candidate:
+                        candidate.close()
+                    time.sleep(1)
+                    continue
+                companion = candidate
+                require(info["primary"]["public_key_prefix"] == old_identity,
+                        "Companion identity changed on reconnect; wrong device or lost persistence")
+                break
+            require(companion is not None, "Companion reboot reconnect timed out")
+            require(companion.mt_node() == mt_node, "Meshtext sender ID changed after reboot")
+            persistence = {"automatic": companion.wait_auto(presets[-1]), "result": "FAIL",
+                           "v4_to_v3": [], "v3_to_v4": []}
+            report["reboot_persistence"] = persistence
+            for sequence in range(args.messages_per_direction):
+                token = f"Meshtext-HIL {run_id} REBOOT V4-V3 {sequence}"
+                started = time.monotonic()
+                companion.send_text(args.channel_slot, token)
+                received = stock.wait_packet(mt_node, lambda p: text_payload(p) == token.encode(), started, args.timeout) is not None
+                persistence["v4_to_v3"].append({"token": token, "received": received})
+                print_packet_progress("Reboot", "V4->V3", persistence["v4_to_v3"], args.messages_per_direction)
+                pause_after_packet(persistence["v4_to_v3"][-1], args.gap_seconds, args.gap_jitter_seconds, gap_rng)
+                token = f"Meshtext-HIL {run_id} REBOOT V3-V4 {sequence}"
+                stock.send_text(token, args.hops)
+                received = companion.wait_text(args.channel_slot, stock.node, token, args.timeout)
+                persistence["v3_to_v4"].append({"token": token, **received})
+                print_packet_progress("Reboot", "V3->V4", persistence["v3_to_v4"], args.messages_per_direction)
+                pause_after_packet(persistence["v3_to_v4"][-1], args.gap_seconds, args.gap_jitter_seconds, gap_rng)
+            persistence["status_after_traffic"] = companion.cli("get mt.status")
+            persistence["radio2_after_traffic"] = companion.cli("get radio2")
+            persistence["radio2_status_after_traffic"] = companion.cli("get radio2.status")
+            persistence["radio2_scan_after_traffic"] = companion.cli("get radio2.scan")
+            reboot_failures = assess_traffic(persistence, args.minimum_received)
+            require(not reboot_failures, "insufficient received messages after reboot in "
+                    + (reboot_failures[0]["direction"] if reboot_failures else ""))
+            persistence["result"] = "PASS"
+        if args.auto_clear:
+            print("Testing automatic radio2 release / channel re-add", flush=True)
+            cleanup = {"result": "FAIL"}
+            report["auto_clear"] = cleanup
+
+            def capture_cleanup_state(label):
+                state = {}
+                cleanup[label] = state
+                for name, command in (("mt_status", "get mt.status"), ("radio2", "get radio2"),
+                                      ("radio2_status", "get radio2.status"), ("radio2_scan", "get radio2.scan"),
+                                      ("primary", "get radio")):
+                    state[name] = companion.cli(command)
+                require(state["primary"] == report["primary_before"], "primary RF settings changed")
+                return state
+
+            capture_cleanup_state("before")
+            companion.cli(f"delete mt.channel {args.channel_slot}")
+            removed = capture_cleanup_state("removed")
+            require(re.fullmatch(r"(?:>\s*)?off(?:\s+\(automatic allowed\))?", removed["radio2"]),
+                    "automatic radio2 did not release after the last Meshtext channel was deleted")
+            require("no Meshtext channels" in removed["mt_status"], "Meshtext backend did not become inactive after channel deletion")
+            companion.cli(f"set mt.channel {args.channel_slot} {presets[-1].alias} {key.hex()}")
+            cleanup["automatic_readded"] = companion.wait_auto(presets[-1])
+            capture_cleanup_state("readded")
+            cleanup["result"] = "PASS"
+            print("PASS automatic radio2 release / channel re-add", flush=True)
+        report["primary_after"] = companion.cli("get radio")
+        require(report["primary_after"] == report["primary_before"], "primary RF settings changed")
+        failed_cases = [case["name"] for case in report["cases"] if case["result"] != "PASS"]
+        require(not failed_cases, "traffic reception threshold failed for presets: " + ", ".join(failed_cases))
+        report["result"] = "PASS"
+    except (Exception, SystemExit, KeyboardInterrupt) as error:
+        message = str(error).replace(key.hex(), "<redacted>")
+        report["failure"] = {"type": type(error).__name__, "message": message[:500]}
+    finally:
+        report["failed_cases"] = [case["name"] for case in report["cases"] if case["result"] != "PASS"]
+        for name, device in (("stock", stock), ("companion", companion)):
+            if device:
+                try:
+                    device.close()
+                except Exception as error:
+                    report.setdefault("close_failures", []).append({"device": name, "type": type(error).__name__})
+                    report["result"] = "FAIL"
+        report["finished_utc"] = datetime.now(timezone.utc).isoformat()
+        write_report(args.output, report)
+    return report
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--companion-port")
+    parser.add_argument("--stock-port")
+    parser.add_argument("--channel-slot", type=int, default=1, help="Companion channel index to overwrite; backup separately")
+    parser.add_argument("--key-bits", type=int, choices=(128, 256), default=128)
+    parser.add_argument("--region", choices=("auto", "us"), default="auto", help="Companion inference from unambiguous US primary frequency")
+    parser.add_argument("--presets", default=",".join(p.name for p in PRESETS))
+    parser.add_argument("--tx-power", type=int, default=-9, help="conservative chip TX dBm, -9..-1 (stock 0 means maximum)")
+    parser.add_argument("--hops", type=int, default=7, help="production default 7; use 0 for an initial-hop-only lab test")
+    parser.add_argument("--messages-per-direction", type=int, default=3)
+    parser.add_argument("--minimum-received", type=int, default=1, help="connectivity threshold; report all losses, use 3 for 3/3")
+    parser.add_argument("--continue-on-loss", action="store_true", help="collect traffic losses across presets; failed cases still fail the run")
+    parser.add_argument("--timeout", type=float, default=15)
+    parser.add_argument("--gap-seconds", type=float, default=1)
+    parser.add_argument("--gap-jitter-seconds", type=float, default=0, help="seeded uniform extra delay after each packet; recorded in report")
+    parser.add_argument("--quiet-seconds", type=float, default=5)
+    parser.add_argument("--nodeinfo", action="store_true")
+    parser.add_argument("--reboot", action="store_true", help="reboot Companion at the end and verify RAM auto-profile reacquisition/chat")
+    parser.add_argument("--auto-clear", action="store_true", help="delete/re-add the final Meshtext channel and verify automatic radio2 release/reacquisition")
+    parser.add_argument("--output", type=Path)
+    parser.add_argument("--plan", action="store_true", help="print matrix without importing/opening serial interfaces")
+    args = parser.parse_args()
+    try:
+        presets = choose_presets(args.presets)
+        require(0 <= args.channel_slot <= 255, "channel slot must be 0..255")
+        require(-9 <= args.tx_power <= -1 and 0 <= args.hops <= 7, "invalid lab TX power/hops; stock TX 0 means maximum")
+        require(1 <= args.minimum_received <= args.messages_per_direction, "invalid message/reception counts")
+        require(0 < args.timeout <= 60 and args.gap_seconds >= 0 and args.gap_jitter_seconds >= 0
+                and args.quiet_seconds > 0, "invalid timing")
+        if args.plan:
+            print(json.dumps([p.describe() for p in presets], indent=2))
+            return 0
+        require(args.companion_port and args.stock_port and args.output, "ports and --output are required")
+        require(args.companion_port != args.stock_port, "ports must be distinct")
+        require(not args.output.exists() and args.output.parent.is_dir(), "choose a fresh report in an existing directory")
+        report = run(args, presets)
+        print(json.dumps({"result": report["result"], "output": str(args.output),
+                          "failure": report.get("failure"), "restore_required": True}, indent=2))
+        return 0 if report["result"] == "PASS" else 1
+    except TestFailure as error:
+        parser.error(str(error))
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())