Three findings on the transient-stall bail, all valid:
- Reload invalidation: a bail recorded BYPASS, but NomadNetCacheFlow::service()
accepts only MISS as a successful invalidation, so a bail during an admitted
reload reported 'Page cache invalidation failed' instead of falling through
to a live fetch. The bail now records MISS.
- Open-resource leak: the bail cleared read_open_/write_open_ (and abandoned an
open directory enumeration) without calling endRead()/abortWrite()/endList(),
leaking SD handles. The bail now releases each in-flight resource via the
seam's own teardown (bounded best-effort; a still-transient close is
accepted rather than re-pinning the op).
- Tick-vs-time: the not-ready UNAVAILABLE path returns immediately (no bus
wait), so a pure 500-tick budget could expire during a legitimate SD mount
window and disable caching for the whole session. The bail is now gated on
BOTH the tick floor AND a 10s wall-time window (service() takes a monotonic
ms clock; production passes millis(), 0 is a safe default for tests).
Regression tests: reload-invalidation bail -> NEED_LIVE (flow), flat-clock does
not bail, healable transient keeps authority, list-open (RECOVERY_END) stall
bails and releases the handle (cache).
Greptile round on ba5af76 (4/5) correctly rejected the first attempt:
the submitted-text marker was assigned in ChatScreen::on_send_clicked
AFTER the mailbox publish returned, so the main loop could take() +
admit the send and enter clear_composer() while the marker was still
empty — neither clearing the submitted text nor associating the commit
with its submission.
The marker is now recorded by the send callback itself
(UIManager::on_send_message_from_chat) immediately after the mailbox
accept, in the same LVGL lock section as the publish. The click handler
runs on the LVGL task with the LVGL mutex held (LVGLInit.cpp:160-179
wraps the whole lv_task_handler in the recursive mutex), so the marker
is visible to the main loop only after the mailbox entry is — the
take() + admit + clear sequence can never observe an empty marker for
an accepted send. clear_composer() additionally no-ops on an empty
marker, which is the retained-text path for rejected/retry sends.
The contract test is tightened to assert the marker is NOT assigned in
the click handler and IS assigned in the callback, so the race cannot
silently regress.
Verification: 181/181 contracts, tdeck + tdeck-release green.
[SENDT] send-pipeline timing and the microReticulum [PG] path-store
call-site counters now compile to no-ops unless explicitly enabled:
- DPYXIS_SEND_DIAG / -DRNS_PATHGET_DIAG added to env:tdeck base flags
- both removed by env:tdeck-release build_unflags (no-op in release)
So production tdeck/tdeck-release builds are merge-clean, while the
instrumented build stays one env/flag away for the path-request
spammer hunt. Bumps microReticulum pin to 921b3aa (same endpoint
hot-path read gate, counters gated behind RNS_PATHGET_DIAG).
Contract suite: 176/176.
[SENDT] marks: queue_wait (mailbox wait), identity_recall,
router_lock, save_message (isolated), admission_done, ui_commit_done.
Instrumentation only; to be removed before merge. Loosens one contract
pin to the save call expression (invariant preserved: save runs in
persistOutgoingMessage, not service_pending_sends).
Opening a conversation crashed the same way sending did. load_conversation()
(LVGL task, under the LVGL lock held by replace_route) ran the full open
pipeline synchronously: identity recall (ustore), display-name read, the
message-index read, and the per-message metadata reads. On this device's
degraded LittleFS each op is 0.4-2s, so a cold open of a dozen-message
conversation held the LVGL mutex past the 5s deadlock guard and asserted at
LVGLLock.h:45. The send path already got the mailbox fix; the open path never
did.
Restructure with the same pattern:
- load_conversation() (LVGL task) now only navigates + resets the list and
shows the truncated hash in the header. Same-peer re-opens return early
with zero store I/O (rows are still built).
- prepare_conversation() (main loop, called from update()) does the store
I/O between a short guard lock and a short commit lock, then commits the
header name + initial bubbles + background-fill arming under a brief
LVGL_LOCK. A generation counter discards a stale in-flight prepare when
the conversation changes mid-I/O.
- refresh() re-arms the prepare instead of re-reading under the lock.
The 1Hz store 'not found in index' fetch is pre-existing (present on
2527c6d) and is being tracked separately as a flash-wear follow-up.
Build tdeck SUCCESS, 170/170 contract tests pass.
Every message send on the device was deterministically rebooting it:
send_message() ran the full pipeline (identity recall, message
construction, RouterLock-scoped router admission, and LittleFS
persistence) synchronously on LVGL's 8 KiB task while holding the LVGL
mutex. On this device's degraded filesystem a single save takes ~7s of
400ms-2s per-op gaps, tripping the 5s LVGL deadlock guard and asserting
at LVGLLock.h:45 (assert failed: LVGL mutex timeout (5s)). The receive
path already carries the fix pattern for exactly this failure class
(see on_message_received); the send path never got it.
Restructure the send path as a mailbox handoff, following the existing
CallStartMailbox / LocationShareCommandMailbox precedent:
- send_message() (LVGL task) now only validates and publishes
(destination, content, source) into a mutex-guarded single-slot
OutgoingSendMailbox. No router lock, no I/O, no message construction.
- update() services the mailbox in service_pending_sends() on the main
loop, before the big LVGL_LOCK() — the only place in the send path
that may take the router lock, block on admission, or wait on
LittleFS.
- On acceptance, a brief LVGL_LOCK in apply_outbound_result() commits
the UI (add_message / clear_composer / compose->chat navigation,
route-guarded). The admitted packed form is unpacked for display
with incoming/state flags restored.
- On rejection (storage error, router busy, queue full) the user's
input is retained for retry, matching the old behavior.
The 500-char UI cap bounds the mailbox payload.
Build tdeck SUCCESS, 170/170 contract tests pass.
Replace the flat Settings screen with a card hub + dedicated sub-views.
- Hub: 8 navigation cards (Status, Network, Identity, Radio, Delivery,
Appearance, Advanced, Transport) reusing the Network-screen card widget;
Transport stays last (danger invariant preserved).
- Tap a card -> dedicated sub-view holding that area's controls; no accordion.
- Network sub-view gains a LoRa interface toggle alongside TCP/Auto/BLE;
it two-way-mirrors the Radio page's canonical lora_enabled switch.
- Save model: simple controls apply immediately; a Save button appears only
on the form sub-views (Network, Radio, Identity).
- Identity sub-view adds a View Identity row routing to the existing lxma://
QR screen (the Status Share button already reached it).
- Focus group rebuilt per view (only-visible objects) so the auto-scroll-to-
bottom class of bug cannot recur; each sub-view entry scrolls to top.
Contracts updated for the new structure; 170/170 build-script tests pass.
tdeck build green: RAM 23.1% (75,848 B, unchanged), Flash 92.7%
(2,914,713 B, +2,640 B). Not flashed, not PR'd.
Settings held live status (GPS fix, storage/RAM/identity) that belongs
on the Status screen, plus a per-second tick() doing SPI flash stat
reads and label churn mid-scroll — the main cause of laggy scrolling.
- GPS section (sats/location/altitude/HDOP/time) -> StatusScreen
- System Info (firmware build, storage, RAM) -> StatusScreen, with
storage/RAM stat reads throttled to ~5s and stack-buffer snprintfs
instead of Arduino String concatenation
- Settings gains a Status link row (trackball-reachable) that opens
Route::STATUS; the per-second SettingsScreen tick/refresh is deleted
- Reordered sections by frequency of use: General (name/brightness/
timeout/kb-light), Notifications, Network (now includes the
TCP/Auto/BLE interface switches), Radio (LoRa + params), Delivery,
Advanced, DANGER: Transport Mode (still final)
- Identity/LXMF hashes shown in Settings were truncated duplicates of
the Status screen's full display; removed
- main.cpp publishes firmware build + GPS to the Status screen
- Contract test for the storage readout follows the code to StatusScreen
Uses the microLXMF in-process message-metadata cache (bumped pin
6bea23c -> 58a6eb0, branch feat/conversation-preview-cache):
- Reopening a conversation (and background page fill / paging) is now
O(1) in-memory once warmed instead of re-reading each message file
from SPI LittleFS (~230ms/read, ~2.3s per open measured on the T-Deck).
- The cache table is PSRAM-allocated on ESP32; a static .bss placement
starved internal DRAM and the LVGL task's 8 KiB stack allocation
failed at boot ("Failed to create LVGL task", hang at startup logo).
- Long-press full-message view now defers to the main loop: the LVGL
event handler only records the hash; tick_pending_full_message() does
load_message_content() (uncapped, no msgpack unpack) off the LVGL
task, then builds the modal. Fixes the capped (600-char) text that
the in-memory rows carry.
- A peer change cancels an in-flight background fill from the previous
conversation (it would otherwise prepend the old conversation's
rows into the new one).
Validated on the T-Deck (T-Deck Plus, 8MB PSRAM): warm opens
reads=3 sync=0-2ms total=15-35ms (was ~2.3s); cold first open per
conversation still pays ~0.6-1.2s disk while warming the cache; no
panics/watchdogs over a ~6-minute interaction session.
Host gates: microLXMF conformance 6/6 (incl. 32-assertion
test_message_metadata_cache), native reference test against pinned
58a6eb0, tdeck build SUCCESS.
On-device capture confirmed the fix (cold-boot tap: fallbacks=0,
gather=2ms, total=48ms vs 2086ms pre-fix; repeat taps no longer
perpetually fall back). All [PERF] timing markers and stage
variables are removed from refresh()/show()/render_route; the
branch is now clean of diagnostic code.
On-device [PERF] capture decomposed the remaining ~1s tap latency:
each uncached conversation costs one SPI-LittleFS metadata read
(~230ms). Repeat taps still paid 2 perpetual fallbacks (empty-
content tails never got cached), and the first tap after every
boot paid all 9 (the in-memory repop was never committed to the
index).
- bump microLXMF pin c8d3156 -> 6bea23c (feat/conversation-
preview-cache): preview_valid index flag so 'cached empty'
differs from 'unpopulated'; bounded preview copy (the old
strncpy read past the non-terminated content Bytes); public
commit_index().
- refresh() re-pops empty-content tails as a valid cached
preview and arms a one-shot deferred index commit;
UIManager::update() drains it out-of-lock (flush_pending_
index_commit, between drops and mark-read) so the warmed
previews persist and the next cold boot reads them from the
index.
- fix the [PERF] skip-log total= wrap (printed p_t_diff - p_t0,
a uint32 underflow; total was already p_t_diff).
[PERF] instrumentation stays in this commit (temporary,
marked); it is removed before merge once the fix is validated
on-device.
Temporary, removable instrumentation (marked [PERF] throughout):
- refresh(): gather / diff / rebuild stage ms + metadata-fallback count,
one [PERF] convlist line per call (skip vs build)
- show(): unhide + focus-group ms
- render_route(MESSAGES): whole route window incl. hide_all_screens
All INFO-level so they survive DEBUG-off and land in the serial capture.
When a conversation's newest message is unreadable, walk the index
newest-to-oldest for the newest readable preview and queue the
unreadable messages for deletion (deferred out of the LVGL lock,
drained by UIManager::update()). The store's delete_message() commits
the index and updates last_message_hash, so the next refresh converges
to the same preview and the row never disappears over one bad message.
refresh() did heavy unnecessary work per conversation, on the LVGL
render task under the render lock:
- get_messages_for_conversation() copied the full 256-slot hash array
(8KB) just to read the newest hash (messages.back());
- load_message() on that hash read the payload file ~3x, JSON-parsed
it twice (including the large hex 'packed' blob), hex-decoded and
msgpack-unpacked the whole message — to extract a 30-char preview
and a timestamp;
- the unread badge was rendered from a hardwired 0 even though the
store maintains and persists unread_count.
Now:
- newest hash via the new O(1) MessageStore::get_last_message_hash
(index tail — always hot-tier, no I/O, no array copy);
- preview/timestamp via load_message_metadata (single open + filtered
parse, the fast path ChatScreen already uses for the same fields);
- unread badge from MessageStore::get_conversation_unread_count;
- badge cleared + mark-read on open (click) and when a message lands
in the currently-viewed chat, with the LittleFS index commit
deferred out of the LVGL lock (UIManager::update), matching the
existing deferred display-name write-through pattern.
Pins microLXMF 59ca70a (PR #10, temporary branch head) for the two new
accessors.
A message whose source identity is KNOWN but whose signature fails to
validate is spoofed or malicious and must not be rendered. The
opportunistic (on_packet) and direct (on_resource_concluded) router
paths already reject these, but the propagated (store-and-forward) path
in process_propagated_lxmf queues them without a signature check, so
UIManager::on_message_received is the single choke point that covers
all three inbound routes.
Drop the message at the top of on_message_received — before the key
request, location ingest, persistence, chat render, and notification
beep — when !signature_validated() && reason == SIGNATURE_INVALID.
SOURCE_UNKNOWN (first contact) is untouched: those still render and
trigger the bounded key request from PR #92. Validated messages are
unaffected.
Add a source-level contract test locking in the drop gate's ordering
relative to every side effect and its enum specificity.
Greptile P2 on PR #92: the per-inbound-location-frame INFOF logged peer
bytes, precise coordinates, and source-clock skew unconditionally in the
release build. The missing-map-pin investigation is closed (announce
timing, verified physically), so remove the temporary instrumentation
and its ingest_diag_result plumbing, and update the feature comment to
describe the final rate-limit semantics instead of 'remove with the
fix'.
Move the rate-limit/cooldown/cap decision out of the UIManager.cpp
anonymous namespace into a pure, header-only policy
(UI/LXMF/UnknownSourceKeyRequest.h) so it is host-testable without the
ESP/microReticulum stack. UIManager keeps only the side effect
(Transport::request_path).
Adds tests/native/test_unknown_source_key_request.{cpp,py} (24 checks,
ASan+UBSan): new-source request, 5-min cooldown boundary, re-record
resets the window, per-source independence, 64-entry cap with oldest
eviction, and steady-state cost.
on_message_received now fires a rate-limited RNS path request when an
LXMF message arrives from a SOURCE_UNKNOWN sender, mirroring Sideband's
'Query Network For Keys' button (RNS.Transport.request_path). Any peer
that already knows the source's announce (hub, phone, other node) can
answer with the cached identity, letting the NEXT message from that
peer validate and reach location ingest.
5-minute per-source cooldown, 64-entry cap. App-only diagnostic;
remove with the other ingest diagnostics once the root cause closes.
Add bounded compact page rendering, serialized Link and Resource lifecycle handling, TCP reconnect corrections, and deterministic Python RNS conformance coverage.
Physically verified anonymous index retrieval and rendering on T-Deck. Same-destination Link reuse and italic rendering remain follow-up fixes.
Torlando