upstream dev sync + bump to 1.18

docs/ARCHITECTURE.md

@@ -233,7 +233,7 @@ Path_len byte:
 
 **Flood routing**: Packet has no destination path. Each relay node appends its identity hash to `path[]` and retransmits. Priority decreases with hop count. `allowPacketForward()` is the gatekeeper.
 
-**Direct routing**: Packet carries a source-routed `path[]`. Each relay node checks if the first path hash matches its own identity, removes itself, and forwards. Path is built from previous flood packets' accumulated hashes.
+**Direct routing**: Packet carries a source-routed `path[]`. Each relay node checks if the first path hash matches its own identity, removes itself, and forwards. Path is built from previous flood packets' accumulated hashes. Every forwarded direct packet, ACKs included (upstream 1.18.0), waits `getDirectRetransmitDelay()`; extra multi-ACKs and the final ACK are 300 ms apart.
 
 **Deduplication**: `SimpleMeshTables` maintains a circular buffer of 160 packet hashes (8 bytes each, SHA-256 truncated); ACKs are deduped through the same packet-hash path. `wasSeen()` is a pure query; call sites insert explicitly via `markSeen()` to prevent duplicate processing and retransmission.
 
@@ -727,7 +727,7 @@ default) is migrated to 3200 once (`zc.aoff_set`).
 Autonomous operation features:
 - **Authentication**: Password-based login with timestamp replay protection (120s window)
 - **Permission levels**: GUEST(0), READ_ONLY(1), READ_WRITE(2), ADMIN(3)
-- **Region filtering**: `RegionMap` with transport key matching per flood packet
+- **Region filtering**: `RegionMap` with transport key matching per flood packet. Un-scoped floods (`mesh::isUnscopedFlood()`: plain floods, and transport floods with code 0 as upstream 1.18.0) go to the wildcard `*`, whose deny-flood flag and `flood.max.unscoped` apply to both; upstream exempts the code-0 case from both (LLD 02 section 16)
 - **Rate limiting**: 4 requests per 120s (discovery), 4 per 180s (anonymous), 4 failed logins per 180s
 - **Node discovery**: answers discovery requests only while forwarding is on. With `advert.interval` and `flood.advert.interval` both `0` the node is hidden and does not answer, as upstream (`isHiddenNode()`); the request still counts against the discovery rate limit
 - **Neighbor tracking**: RSSI/SNR/name/timestamp table (`CONFIG_ZEPHCORE_MAX_NEIGHBOURS`, default 50 slots)

docs/CLI_commands.md

@@ -102,6 +102,7 @@ Every clock set (these commands, GPS, the app, mesh time sync, SNTP) is also wri
 | Command | Description |
 |---------|-------------|
 | `room.post <message>` | Post a message to the shared room as the server itself (system post). Pushed to clients like any other post. |
+| `set repeat on` | Replies `ERR - repeat now deprecated`, as upstream (1.18.0): a room server never forwards other nodes' packets. `set repeat off` and `get repeat` are the common commands |
 
 ---
 
@@ -125,6 +126,8 @@ Regions control which flood packets the repeater forwards. The region tree is hi
 | `region list allowed` | List all regions that allow floods |
 | `region list denied` | List all regions that deny floods |
 
+**Un-scoped floods:** plain floods, and transport floods whose first code is `0` (no region computes `0`; as upstream 1.18.0). The wildcard `*` decides them: `region denyf *` stops forwarding them, and `flood.max.unscoped` limits their hops. Upstream applies neither to the code-`0` case; ZephCore applies both. A reply to such a request is sent un-scoped.
+
 **Region load format:** one region per line, indented with spaces to indicate depth. Append `F` after the name to mark flood-allowed (otherwise flood is denied by default).
 
 **`region def` format:** space-separated tokens; a cursor starts at `*`. Each token is `name` (create child of cursor, advance cursor to it) or `name|jump` / `name,jump` (create child of cursor, then move cursor to the existing region `jump`). Does **not** auto-save — follow with `region save`. Reply is the updated region tree. Example — branched tree: `region def west pnw or pdx|pnw wa sw-wa`. Example — flat list: `region def west|* pnw|* or|* pdx|*`.
@@ -434,7 +437,7 @@ four radio parameters together, since they are one interop-critical set.
 | `set direct.txdelay <value>` | | Accepted for prefs compatibility — **ignored** (direct.txdelay is adaptive) |
 | `set backoff.multiplier <m>` | 0.0–2.0 | *(ZephCore only)* Per-dupe reactive backoff multiplier (0 = disable reactive backoff) |
 | `set flood.max <count>` | 0–64 | Maximum flood retransmit hops |
-| `set flood.max.unscoped <count>` | 0–64 | Hop limit for un-scoped floods only (default 64 = same as flood.max); scoped/transport floods still use flood.max |
+| `set flood.max.unscoped <count>` | 0–64 | Hop limit for un-scoped floods only, including transport floods with code `0` (default 64 = same as flood.max); scoped/transport floods still use flood.max |
 | `set flood.max.advert <count>` | 0–64 | Hop limit for ADVERT floods only (default 8); curbs advert churn independent of flood.max |
 | `set flood.advert.interval <hours>` | `0` (off) or 3–168 | How often the repeater floods its own advertisement. `0` disables periodic flood adverts. With `advert.interval` also `0` the repeater is hidden: it stops answering node discovery requests (`discover.neighbors`, the app's discover) as well. |
 | `set advert.interval <mins>` | `0` (off) or min–240 | How often the repeater sends local (zero-hop) advertisements. `0` — the default — disables them. Stored halved (the pref holds minutes/2), so odd values round down. |

docs/OFFGRID.md

@@ -46,4 +46,4 @@ On a 2.4 GHz preset there is no off-grid frequency, and the display and the CLI
 
 Up to 1.17.7 the display toggle turned forwarding on without changing the frequency, so a companion
 could end up repeating on the live mesh. A node left in that state stops forwarding when it boots
-1.17.8 or later, and shows off-grid mode as off.
+1.18.0 or later, and shows off-grid mode as off.