Dan Vybiral
41eb4a559f
A second adversarial review pass (11 confirmed findings, 2 critical) hit the crash and failure paths the on-device happy path never touches. Six root causes, fixed at the root rather than per-symptom: 1. Migration was not crash-atomic (CRITICAL). Chunks landed one rename at a time, so a power cut mid-migration left a valid oldest-first PREFIX that the loader preferred over the still-intact old file -- permanently showing only the oldest few hundred messages. There is now a commit marker (/msgs/store.ok) written only after full verification: its absence means the segment set is provisional, and the loader wipes those segments and re-reads the old file. The 60 s migration retry on a sick card therefore no longer risks history. 2. Migration assumed a linear ring (CRITICAL) but its retry paths run mid-session, after appendMessage may have wrapped it -- producing segments in slot order (first_seq > last_seq, scrambled history that per-segment read-back could not detect) before deleting the old file. It now walks the ring chronologically, skips tombstones (which it used to persist as ghost records), and verification additionally requires strictly increasing seqs within and across segments. 3. A partially-failed append was retried by appending the same batch again, duplicating records (or misaligning every later record if the failure split one). Segments now carry a rewrite_open flag meaning "file content untrusted": the scheduler REPAIRS such a segment with a full rewrite (header + records, tmp+rename) before any append can target it, and the repair absorbs the unflushed tail. 4. Post-resync appends targeted deleted files (headerless segments) and could push a chunk's range past the 256-record gather cap, silently dropping records the watermark already called durable. Fixed by the same repair-first rule: retable marks every chunk rewrite_open. 5. Resync deleted every on-disk segment up front, so a same-card wedge recovery left the whole history RAM-only for minutes. It no longer deletes anything: same-key files are replaced by each repair's rename, and leftovers are swept only once the re-land is complete. 6. A stale worker descriptor could be committed twice after persistHistoryNow drained past a busy worker (double-counted totals, duplicate table entries), and a leaked redirty flag could make the drain re-compact one segment ~28 times and then report failure. uiHistWaitWorkerIdle now always drops the descriptor and the flag, marking the abandoned job's segment for repair instead. The drain also refuses to run at all while a worker is still writing -- with FF_FS_LOCK=0, removing or renaming a path under a stalled open handle can cross-link clusters and corrupt the volume. Also: the loader applies a strictly-monotonic seq filter, so duplicate or out-of-order records from any interrupted write are dropped at load and the affected segment is rewritten; append commits credit their own segment by key instead of blindly crediting the last table entry. Builds verified: all five SD-relevant touch envs. Signed-off-by: Dan Vybiral <dan.vybiral@greencode.cz>
A real touchscreen UI for your mesh radio. · open source · GPL-3.0
Touch-UI MeshCore companion-radio firmware for the LilyGo T-Deck / T-Deck Plus and Heltec V4 + TFT (ESP32-S3).
An LVGL touch UI — map, chat, contacts, channels, settings — split out of
meshcomod. The app depends on a
MeshCore fork via PlatformIO lib_deps.
Boards
See DEVICES.md for the full support matrix, install paths and per-board status.
- LilyGo T-Deck / T-Deck Plus — env
LilyGo_TDeck_companion_radio_touch(stable) - Heltec V4 + TFT + CHSC6x touch — env
heltec_v4_tft_companion_radio_usb_tcp_touch(stable) - Tanmatsu (ESP32-P4) — built from
tanmatsu/(ESP-IDF), ships via the Tanmatsu app store - Elecrow ThinkNode M9 — env
ThinkNode_M9_companion_radio_touch(beta) - RAK WisMesh Tap V2 (RAK3312) — env
rak_tap_v2_companion_radio_touch(beta)
Architecture
This repo holds only the app: the companion_radio glue, the ui-touch
LVGL UI, the two boards' glue/variants, and platformio.ini. The MeshCore
core is not vendored here — it's pulled as a library via lib_deps from the
ALLFATHER-BV/meshcomod monorepo
(the same repo as the non-touch firmware), pinned by a lean source-only core-*
git tag. The touch-app files this repo owns (TouchPrefsStore, WifiRuntimeStore,
the transports, …) are dropped from the lib via -DMC_VENDORED_TOUCH_APP so they
aren't compiled twice. The build is byte-identical to the original in-tree
meshcomod firmware.
Build
PlatformIO pulls the core fork and all libraries automatically:
pio run -e heltec_v4_tft_companion_radio_usb_tcp_touch # Heltec V4 TFT
pio run -e LilyGo_TDeck_companion_radio_touch # LilyGo T-Deck
# or just `pio run` to build both
Flash with the NVS-preserving 4-component chain (bootloader / partitions /
boot_app0 / firmware at 0x0 / 0x8000 / 0xe000 / 0x10000) so saved Wi-Fi
credentials survive — not a merged image, which 0xFF-pads and wipes NVS.
Contributing
Contributions are welcome — see CONTRIBUTING.md. One topic per PR; inbound contributions are accepted under the project's GPL-3.0 license.
License
GPL-3.0-or-later — see LICENSE. wadamesh is copyleft: anyone who distributes a build or a fork must also make their source available under the GPL. This keeps the UI open and concentrates community effort instead of fragmenting it into closed forks.
wadamesh incorporates and depends on MeshCore (MIT, © Scott Powell / rippleradios.com) and other third-party components — see NOTICE for the full list and their licenses. MeshCore-derived files keep their MIT notices; the combined work is distributed under the GPL (MIT is GPL-compatible). The MeshCore fork that wadamesh builds against stays MIT on purpose, so its Wi-Fi/BLE hooks remain upstreamable to MeshCore.