Add a shared MQTTRemoteCallbacks.h (ACL admin authorizer + CLI executor
adapters) and register them on the bridge in the repeater and room-server
examples right after construction, at every bridge-creation site.
Binds the RemoteControl policy engine to the slot clients: each slot registers
an onMessage callback that claims a single lock-free pending slot; the bridge
task verifies + executes it and publishes the signed response to the
originating slot. Subscriptions are reconciled live against the global master
(mqtt.remote) and per-slot (mqttN.remote) flags, so the kill switch
unsubscribes every slot and drops any in-flight command without a WSS restart.
The bridge implements the RemoteControl crypto/authorizer/executor/clock seams
privately (JWTHelper + LocalIdentity, MQTTPrefs + ACL callback, CLI callback,
millis/time). Remote commands run with a non-zero sentinel sender_timestamp so
serial-only CLI gates (prv.key, freq, erase) still refuse them.
Global: set/get mqtt.remote (master kill switch), mqtt.useacl, mqtt.admin
(admin key readable over serial only). Per-slot: set/get mqttN.remote,
following the existing mqttN.* slot-command convention. Setters only persist;
the bridge reconciles command subscriptions live, so no WSS restart is needed.
Adds mqtt_remote_enabled (global master), mqtt_use_acl, per-slot
mqtt_slot_remote_enabled[], and mqtt_admin_public_key to the /mqtt_prefs
tail. Introduces the kV1PreRemotePayloadSize (2864) decode checkpoint so a
pre-remote payload still loads as Current with the remote fields defaulting
(master off, ACL on, per-slot on). Payload version stays 1; a forward file
(2940) is held, not discarded, by older firmware. New host codec tests cover
the pre-remote migration and the full round-trip.
Pure, host-testable engine for JWT-authenticated remote serial commands:
replay protection, per-key rate limiting, command blacklist, target
filtering, and authorization ordering. All JSON/base64/crypto/clock I/O is
behind injected seams so the full pipeline is unit-tested under env:native
(23 googletest cases) without MQTT or Ed25519.
Adds JWTHelper::verifyToken (signature check + claim extraction, hex or
base64url signatures) and JWTHelper::base64UrlDecode, complementing the
existing token-creation path. Firmware-only; used by remote command auth.
Introduce a new built-in MQTT preset for the meshtexas.org service,
increasing the total number of presets to 29. This addition enhances
connectivity options for users and supports broader integration
within the MQTT ecosystem.
Enhance the MQTT stats reply to include outbox drop statistics,
providing users with better insight into message handling and
memory pressure. This change improves the clarity of the status
message and aids in diagnosing potential issues with message
delivery.
Update the CommonCLI_Observer to mask sensitive data such as passwords
and WiFi credentials in responses when accessed remotely. This change
ensures that sensitive information is only visible over serial,
enhancing security and preventing accidental exposure of credentials.
Improve the response message for the `alert test` command to clarify
that a successful test send does not guarantee automatic alerts are
enabled. This change helps prevent confusion for operators regarding
the status of the alert system after testing.
Add a new classification mechanism for MQTT slot activation to inform
users whether a slot will connect on the current hardware. This includes
detailed handling of enabled slots and their limits, improving the CLI's
ability to provide accurate feedback during configuration. Additionally,
unit tests are introduced to validate the new functionality across various
scenarios, enhancing overall robustness.
Adjust the command handling in CommonCLI_Observer to prioritize the
more specific "timezone.offset" check before the general "timezone"
check. This change prevents incorrect responses when querying the
timezone offset, improving the clarity and correctness of command
responses.
Enhance the command handling in CommonCLI_Observer to clarify the
compilation behavior under different configurations. Additionally,
optimize memory pressure checks in MQTTBridge to reduce unnecessary
heap walks, improving performance during sustained memory pressure.
This change ensures that publishes are skipped only when necessary,
enhancing overall stability.
Eliminate unnecessary calls to gmtime and localtime in the
syncTimeWithNTP function. This cleanup improves code clarity
and reduces potential confusion regarding time handling.
Add checks to prevent null or zero-length hex buffers in the
bytesToHex and packetToHex functions. This guarantees that an
empty string is returned instead of an uninitialized buffer,
improving the safety of JSON serialization.
Introduce a mechanism to manage on-connect status publishing for MQTT
slots. This change allows the MQTT task to handle status updates
safely, ensuring that shared resources are accessed in a controlled
manner. The new flag `_status_publish_pending` is set in the onConnect
callback and processed in the main MQTT task loop, preventing race
conditions and improving overall stability.
Replace multiple snprintf calls with a single replyAppendf function to
improve buffer management and prevent overflow. This change enhances
the readability and maintainability of the code while ensuring that
the reply buffer is handled safely across various MQTT status and
diagnostic replies.
Enhance the documentation for the `start ota` command to clarify its
behavior when connected to a Wi-Fi network versus when using the
`start ota ap` option. This provides users with better guidance on
how to initiate OTA updates under different network conditions.
Add support for neighbor discovery and management in the MyMesh class.
This includes structures for neighbor information, methods for handling
neighbor advertisements, and control data reception. The new features
allow for dynamic neighbor management, enhancing the mesh network's
capabilities. Additionally, the maximum number of neighbors is set to
50 across various platform configurations.
Update commit logic to remove existing destination before renaming
the temporary file on ESP32. This change addresses the SPIFFS_ERR_CONFLICTING_NAME
issue, ensuring that the new preferences are published correctly.
Add tests to validate the new behavior and confirm that the
temporary file is handled appropriately.
- Allow mqtt.neighbors and mqtt.neighbors.interval in the WebConfigKeys set-key
allowlist (the CLI enforces the PSRAM guard; the stub reply handles non-PSRAM).
- Emit neighbors + neighbors_interval (hours) in the WebConfigServer config JSON.
- Add a "Publish neighbors" toggle and a "Neighbors interval (hours)" field
(12-336) to the Publishing card, with getVal() cases in webui/index.html.
- Cover both keys in test_webconfig_keys.
WebConfigHtml.h is a gitignored build artifact regenerated by the pre-build
hook from index.html, so it is not committed. Verified: test_webconfig_keys
passes and the T_Beam_S3_Supreme observer_mqtt firmware builds [SUCCESS].
Port the neighbors CLI from mqtt-bridge-implementation-flex:
- set mqtt.neighbors on|off - enable/disable periodic publishing
- set mqtt.neighbors.interval <h> - 12-336 hours (rejected, not clamped), stored ms
- get mqtt.neighbors - "on"/"off"
- get mqtt.neighbors.interval - "> <hours> hours (<ms> ms)" (ceiling division)
Both gated on WITH_MQTT_NEIGHBORS with a WITH_MQTT_BRIDGE stub replying
"Err - not supported (requires PSRAM)" on non-PSRAM builds. Handlers only write
prefs + savePrefs() — the mesh loop reads them live, so no bridge restart and no
direct bridge/MyMesh call (matches flex).
Token ordering preserved: SET tokens keep their trailing space so the shorter
"mqtt.neighbors " can precede "mqtt.neighbors.interval "; GET tokens have no
trailing space so the longer ".interval" is tested first.
Port the neighbor-discovery state machine from mqtt-bridge-implementation-flex,
adapted to this branch's MyMesh (WebConfig members shifted the insertion points;
applied by content).
- Two-stage periodic refresh in loop() driven by mqtt_neighbors_interval:
stage 1 is a zero-hop sendNodeDiscoverReq() (reuses the existing 60s window),
stage 2 (startNeighborDiscover) fires one anon-regions scope query per heard
neighbour, then finishNeighborDiscover() builds the table JSON via
MQTTMessageBuilder::buildNeighborsMessage and hands it to
bridge->requestPublishNeighbors().
- Peer overlay at NEIGHBOR_DISCOVER_PEER_BASE lets scope-query RESPONSE packets
from non-ACL neighbours decrypt: searchPeersByHash prepends heard neighbours
(bounded by MAX_CLIENTS), getPeerSharedSecret derives the secret on the fly,
and onPeerDataRecv routes both overlay-index and ACL-client-that-is-a-neighbour
responses into handleNeighborDiscoverResponse.
- Entries ordered most- to least-useful (recent, then stronger SNR) so the JSON
builder's tail-drop keeps the useful head.
- `discover.scopes` CLI command (manual trigger), with a WITH_MQTT_BRIDGE stub
replying "requires PSRAM" on non-PSRAM builds.
- Reports schedule to the bridge each loop via setNeighborsSchedule().
- Uses ArduinoJson v7 JsonDocument (not deprecated DynamicJsonDocument).
All gated on WITH_MQTT_NEIGHBORS. Reuses the existing MQTTBridge* member.
Verified: T_Beam_S3_Supreme_SX1262_repeater_observer_mqtt builds [SUCCESS].
Port the periodic-neighbors publication from mqtt-bridge-implementation-flex,
adapted to this branch's structure:
- Add MQTT_PUBLICATION_NEIGHBORS ("neighbors") to the pure MQTTTopicRouter
instead of flex's messageTypeSuffix() helper (this branch already routes
every publication type through mqttBuildPublicationTopic()). Neighbors is a
MeshCore/custom publication type, so it resolves to
meshcore/{iata}/{device}/neighbors and honors custom templates.
- Deliberately do NOT port flex's "all message types to MeshRank" change:
this branch documents and host-tests a packets-only MeshRank contract
(MQTTPresets.h, MQTT_IMPLEMENTATION.md, MeshRankContractIsPacketsOnly). So
neighbors follows status/raw and is rejected on MeshRank slots.
- WITH_MQTT_NEIGHBORS guard (PSRAM + MAX_NEIGHBOURS) gates all new surface.
- MSG_NEIGHBORS message type + enum-drift static_assert.
- Persistent ~10KB PSRAM neighbors buffer allocated/freed via the existing
MQTTRuntimeBufferLifecycle path (allocate/release), not the ctor as flex did.
- Core1->Core0 handoff: requestPublishNeighbors() (mesh) fills the buffer with
a release store; the MQTT task consumes it with an acquire load, publishes
via publishNeighbors() (QoS1, retain = preset->allow_retain, custom=false),
and clears the pending flag. A second snapshot is dropped while one is
in flight.
- setNeighborsSchedule()/NeighborsPhase let the mesh report the timer summary;
formatMqttStatusReply() gains a "nbr: <when>/<last>" field via formatDuration.
Also fix the on-connect status publish (publishStatusToSlot) to honor
preset->allow_retain instead of hardcoding retain=true, matching the periodic
publishStatus() path. Brokers with allow_retain=false (e.g. the waev MeshCore
preset) reject retained publishes, so the on-connect status was being dropped
there. This is flex followup 028a5dca, reconciled to this branch's custom-slot
default of non-retained.
Extends the host topic-router test to cover the neighbors type across all
routes and freezes the new enum value. Bridge itself is on-target only.
Add buildNeighborsMessage to the pure MQTTPayloadBuilder core and a thin
delegating wrapper + NeighborsMessageEntry alias on MQTTMessageBuilder, so
the neighbors topic is built by the same firmware-facing API as status/
packet/raw while the layout logic stays exercisable by native tests.
The document is bounded to the publish buffer: entries arrive ordered most-
to least-useful and the tail is dropped once the next entry would overflow,
so a fixed PSRAM buffer can never be handed truncated JSON.
Uses ArduinoJson v7 idioms (.to<JsonObject>()/.add<JsonObject>()) to stay
warning-clean under -Werror, unlike the deprecated createNested* forms.
Adds three test_mqtt_payload_builder cases: self+entry round-trip, empty
table / null scopes, and bounded-growth tail-drop under a tight buffer.
Append mqtt_neighbors_enabled(u8) + mqtt_neighbors_interval(u32) to the
observer tail of MQTTPrefs. The layout is kept byte-identical to the flex
neighbors build: the enable flag lands in the old struct's zeroed trailing
padding (offset 2857) and the interval begins exactly at the former baseline
(2860), so sizeof grows 2860 -> 2864 (net +4 bytes). offsetof static_asserts
lock the layout so a mismatch fails the build.
The codec now accepts three v1 payload sizes: register 2860 as a
"pre-neighbors" Current payload so an in-lineage upgrade reads its existing
/mqtt_prefs and defaults the neighbors tail (off / 24h). Because 2864 is the
shared Current baseline, a /mqtt_prefs written by either the flex build or this
firmware is interchangeable.
Add the 12/24/336h interval constants, neighbors defaults, and a load-time
interval clamp that keeps persisted values inside the signed-delta millis()
scheduling window. Extend the host codec suite with a pre-neighbors migration
case and neighbors round-trip coverage.
Dev-channel assets are now named <env>-v1.16.0-dev-<hash>.bin so a
downloaded file identifies its channel at a glance; production names are
unchanged (tag unset). The tag sits between version and hash, lowercase
letters only — the flasher-side parsers (gen-slim ASSET_RE, /releases
Worker label+dedupe, flasher.js stale-URL recovery) were made
tag-tolerant first and are already deployed. Filename-end hash
extraction (release pruning) is position-independent and unaffected.
Pushing this intentionally triggers a beta build: that publish is what
applies the new naming. The Worker's dedupe collapses the untagged
9276b6a generation and the new tagged one to the newest per env, so the
flasher never lists both.
The flasher's Version dropdown is feed-driven now (/releases on the
firmware-proxy Worker lists both channels), so the beta channel needs no
config of its own: drop the config-beta.json derivation and the
update-firmware.py --config call (which would exit nonzero once
config.json's observer entries become github defs with no embedded
filenames). The flasher commit is now scoped to beta/v/ and the counter.
The release body gets the dev-channel warning + firmware-notes.html via
gh_retry'd 'gh release edit' (non-fatal), serving as this channel's
dropdown changelog.
MUST land before the flasher config.json conversion, together with the
matching production-workflow change (26db31f6 on observer-firmware).
Workflow-only commit: pushing this triggers no build.
firmware-notes.html's setup-guide link feeds config.json's notes on the
next production build, so the fix propagates with the webconfig merge.
Kept identical to the MQTT_INTERNALS.md wording on observer-firmware to
avoid a merge conflict.
Flip gen-slim-manifests.py to its new --bin-dir mode (flasher repo PR #1):
beta/v manifests now come from out/ — the assets actually uploaded to the
release — instead of the derived config-beta.json, which the /releases
feed migration will retire. STATIC_PATH already exists in this workflow's
env and stays the manifest download host.
Workflow-only commit (.github/** is in paths-ignore): pushing this
triggers no build; the change is exercised by the next real push to
observer-firmware-dev.
A merge conflict resolution collapsed the `// node name` comment and its
`_display->setCursor(0, 0)` call onto a single line, which commented out
the cursor reset. The node name then rendered at whatever cursor position
was left over from the previous frame (the end of the IP: line), so it
trailed the IP address and wrapped onto the next line instead of appearing
at the top of the home screen.
Split the comment and setCursor back onto separate lines so the name is
drawn at (0, 0) again.
Run 29708863985 had every build shard green and then died here:
HTTP 503 ... (https://api.github.com/repos/agessaman/MeshCore/releases)
Error: Process completed with exit code 1
'gh release create' hit a transient 503 during a GitHub incident and, under
'bash -e', threw away ~15 minutes of building across 14 runners. Nothing was
wrong with the code.
Add a gh_retry helper (5 attempts, exponential backoff 10/20/40/80s) around the
create and upload calls. 'until' in a condition does not trip -e, so the helper
is safe in this shell.
Deliberate choices:
- The existence check is NOT retried: 'release does not exist' is the expected
answer on a first run and retrying would only burn backoff. A 5xx there falls
through to create, which now tolerates an already-existing release.
- Prune failures no longer fail the job. Pruning is housekeeping that runs AFTER
a successful upload; leaving stale assets until the next run beats reporting
failure for a build whose binaries are already published.
- The prune's second 'gh release view' is gone — it reuses the asset list already
fetched, removing an API call as well as an unretried failure point.
Retry helper unit-tested for the success, transient-recovery, and
exhaustion paths.
Production (build-observer-firmwares.yml) has the identical fragility and should
get the same treatment; not changed here to keep this scoped to the beta channel.
Three real regressions from the 2026-07-19 upstream merge, all invisible to the
two prescribed smoke builds:
- heltec_tracker_v2/HeltecTrackerV2Board.cpp: the FEM trio
(setLoRaFemLnaEnabled/canControlLoRaFemLna/isLoRaFemLnaEnabled) was duplicated
verbatim by auto-merge, and upstream's new powerOff() (35f654ce) used
P_LORA_PA_POWER unguarded — a macro defined only for the tracker_v2 envs, while
heltec_tracker_v1_1 compiles the same board file. Guarded it the same way
LoRaFEMControl.cpp already guards that macro.
- SimpleMeshTables.h: the tracker variants pull in TFT_eSPI, whose
TFT_eSPI_ESP32_S3.h defines FS_NO_GLOBALS. That suppresses FS.h's own
'using fs::File', so File never reached global scope and every TU routed
through it failed with "'File' has not been declared" — here and at
simple_repeater/MyMesh.h:158. Restore the using when FS_NO_GLOBALS is set.
Explicit fs::File is not an option: File is also the global type on the
nRF52/RP2040 paths, which have no fs namespace.
- ST7735Display.cpp: upstream's HSPI fix (d30d8ed7) guarded on
HELTEC_LORA_V3 || HELTEC_TRACKER_V2. heltec_tracker_v1_1 matches neither and
fell through to &SPI1, which is not instantiated on ESP32. Added it to the guard.
Also parks LilyGo_TLora_V2_1_1_6_{repeater,room_server}_observer_mqtt with a
trailing underscore (the nibble_screen_connect convention from b8f1fad6), which
also excludes them from the workflows' enumeration regex. That board does NOT
fit and never did: 2,069,397 / 1,966,080 = 105.3% on flex, with no webconfig and
no upstream merge. It has been failing on production all along — the release
ships 30 envs, not 32 — hidden because build.sh does not propagate pio's exit
code. Dropping webconfig would recover ~46 KB of a ~101 KB deficit, so that is
not a fix. Rationale and options in .scratch/tlora-v2-oversize.md.
The 2026-07-19 upstream merge auto-merged two additions into the same class
bodies without conflicting, producing duplicate declarations:
examples/simple_room_server/MyMesh.h - getCADEnabled()
variants/heltec_v4/HeltecV4Board.h - setLoRaFemLnaEnabled(),
canControlLoRaFemLna(),
isLoRaFemLnaEnabled()
Same class of breakage as the RadioLibWrapper::_cad_enabled and
MyMesh::getCADEnabled() duplicates already fixed in the merge commit. These
survived because the merge was validated with the two prescribed MQTT smoke
builds, and neither of them compiles simple_room_server or the heltec_v4
variant - so CI was the first thing to touch the broken files.
Now verified across ALL 32 observer envs locally, not a sample: 32/32 build.
Saving observer prefs logged an ESP32 error line on every save:
[E][vfs_api.cpp:182] remove(): /mqtt_prefs.tmp does not exists or is directory
MQTTPrefsFileStore::begin() cleared a stale transaction with an unconditional
remove("/mqtt_prefs.tmp"). On the normal path there is no stale tmp - commit()
renames it away - so the remove always failed and the ESP32 VFS layer logged it
at [E] level. The save itself succeeded; the noise just reads as a fault in the
serial log at exactly the moment an operator is watching a config change.
Guard each remove on exists(), at all four sites: begin() and abort() for both
the /mqtt_prefs and /com_prefs stores. Semantics are unchanged - a genuinely
stale tmp is still cleared, and a failure to clear it still aborts the
transaction - it just stops issuing a syscall that can only fail.
Fixed here on webconfig (the 1.16.0-based line that carries the atomic store)
so it flows to flex with the rest of that work. NOT applicable to
mqtt-bridge-implementation-flex today: flex has no .tmp/rename handling at all,
so the code path does not exist there.
Verified: Heltec_v3_repeater_observer_mqtt builds; hardware confirmation of the
silenced log pending.
The build step redeclared OTA_MANIFEST_BASE_URL and OTA_CHANNEL_TAG as
${{ env.X }}, referencing the very variables it was setting. Workflow-level
env: is already inherited by every step, so this was redundant; had the
self-reference resolved empty it would have silently blanked the channel and
produced firmware with no manifest base. The verify step would have caught it,
but the risk is unnecessary.
Dispatch-only does not work in this repo. The fork's default branch is `dev`
(an upstream mirror carrying none of the observer workflows), and GitHub only
surfaces workflow_dispatch for workflows present on the DEFAULT branch — so the
beta workflow would never have appeared in the Actions UI and could not have
been run at all.
Adding fork-specific workflows to `dev` would pollute the upstream mirror and
conflict on every upstream sync, so the push trigger is the right mechanism: it
runs from the file on the pushed branch, which is exactly how the production
observer workflow already works.
workflow_dispatch is retained (harmless, and starts working if the default
branch ever changes). paths-ignore mirrors production so docs/CI-only commits
do not rebuild firmware.
Trade-off now explicit in the file: every push to observer-firmware-dev
publishes a dev build. Stage on a side branch and fast-forward when you intend
to release.
The branch was named as a one-off dated merge (merge/upstream-dev-20260719),
but it is actually the standing development line: upstream merges land here and
the dev/beta firmware channel is built from it. Rename accordingly and reframe
the handoff so future upstream merges land ON this branch rather than spawning a
new dated branch each time.
Adds a "Branch and Release Channels" section with the full production vs
dev/beta separation table (branch, workflow, release tag, manifest base,
download host, flasher config, embedded version), and restates why both channels
share FIRMWARE_VERSION: the OTA logic treats a differing base as "always an
update", so channels must separate by manifest URL, never by base version.
Also corrects the beta workflow's dispatch-only rationale, which cited a
short-lived branch name that no longer applies. Dispatch-only still stands, for
the better reason: publishing firmware that real nodes pull over the air should
be explicit, not a side effect of every commit to a dev branch.
- OTA_CHANNEL_TAG is now 'beta-dev', so the embedded version carries the
channel AND its provenance: v1.16.0.N-observer-beta-dev-<hash>. This channel
is built from the upstream-dev-merged line, so 'dev' is visible in `ver`,
the MQTT firmware_version, and SNMP rather than inferred from a branch name.
Verified on a real build; OTA version parsing is unaffected.
- config-beta.json is now written into the flasher checkout and committed,
reversing the earlier ephemeral approach: the flasher SPA loads it directly
for ?config=config-beta, so it has to be served. It is still DERIVED from
config.json on every beta build rather than hand-maintained, so the dev/beta
device list cannot drift from production.
Publishes a parallel observer firmware channel that cannot cross-contaminate
production. Manual dispatch only, so the branch is chosen in the Actions UI
rather than hardcoded here.
Channel separation (each of these is load-bearing, not cosmetic):
- OTA_MANIFEST_BASE_URL -> beta nodes only ever read beta manifests. This is
the one that actually keeps devices on-channel.
- Separate RELEASE_TAG: the publish step prunes all but KEEP_BUILDS hashes
WITHIN its tag, so a shared tag would make each channel delete the other's
assets.
- Separate build counter: shared counters would interleave and make OTA's
"N behind" comparison meaningless.
- Separate staticPath via a derived config-beta.json.
FIRMWARE_VERSION deliberately matches production: the OTA logic treats a
different base version as "always an update", so channels must be separated by
manifest URL, not base version. OTA_CHANNEL_TAG marks the embedded version
instead (v1.16.0.N-observer-beta-<hash>) so `ver` identifies the channel.
config-beta.json is derived per build rather than committed - a checked-in copy
would be a 56-entry duplicate of config.json that goes stale as devices are
added. Deriving keeps the beta device list identical by construction.
Two verify steps fail the build rather than publish firmware that would OTA
itself onto production: one checks the beta URL is baked into a binary (and the
production URL is not), one checks the generated manifests use the beta host.
Production's changelog and docs sync steps are omitted - those rewrite site-wide
content the production channel owns. The flasher commit is scoped to the beta
manifest dir and counter for the same reason.
Also adds OTA_CHANNEL_TAG support to build.sh. Safe for OTA version parsing:
ota_parseVersion() reads to the first '-' and ota_extractHash() takes the token
after the last, so an extra tag between them changes neither. Verified on a
real build: v1.16.0.7-observer-beta-36831271.
The observer fetches its manifest from <OTA_MANIFEST_BASE>/<OTA_VARIANT>.json,
so that URL IS the release channel. It was hardcoded to the production channel
in 28 identical places across variants/*/platformio.ini, which made a parallel
(e.g. beta) channel impossible: both channels build the same env names, so beta
devices would read the production manifest and silently flash themselves onto
production firmware.
Inject it from build.sh instead, symmetric with OTA_VARIANT (which no .ini
declares), defaulting to the production URL. Set OTA_MANIFEST_BASE_URL to
publish a parallel channel.
Removed from the .ini files rather than overridden: PLATFORMIO_BUILD_FLAGS
cannot reliably override a -D from build_flags, because SCons reorders -U/-D
and the -U can land after both -Ds, leaving the macro undefined. Verified
empirically before choosing this approach.
A default in a header was deliberately NOT added: leaving both macros undefined
on a plain 'pio run' is what keeps ESP32Board.cpp's 'ERR: OTA not configured
(build via build.sh)' guard firing, so locally built firmware is never OTA-armed.
Verified on Heltec_v3_repeater_observer_mqtt:
- plain 'pio run' -> OTA disarmed, no manifest URL in the binary
- build.sh (default) -> https://observer.gessaman.com/v
- OTA_MANIFEST_BASE_URL set -> beta URL only, production URL absent
Roadmap status was stale in two ways: Phase 6 still described WebConfigBatch.h
as spec-only/not-wired, and there was no record of the upstream merge.
- Phase 6 / Current Baseline: record that WebConfigBatch is wired and
load-bearing, document the two deliberate spec/caller asymmetries, and state
plainly what is NOT verified (the POST/drain/result/reboot sequence over real
HTTP) so the next person does not mistake green host tests for coverage.
- New "Upstream Merge Record" section: the /com_prefs finding (offset-addressed,
so NodePrefs reordering is safe - with the warning not to generalize that to
the versioned /mqtt_prefs), every conflict resolution, the setRxBoostedGain
signature change, and the cost signal that the fork is the churn source and so
merges should follow each phase rather than batch.
- Forward plan replaced with the actual remaining work in execution order.
- Merge discipline: note that Git resolved two duplicate declarations silently
and only the compiler caught them.
agessaman