Meshtastic ADV v1.1.1

Fixed

• Cyrillic input distinguishes sch → сч from w / shch → щ, so Schyot
  produces «Счёт» (#109). Use one-key w for щ instead of the former sch shortcut;
  shh remains шх so Ashhabad still produces «Ашхабад».
  Digraphs still finish at the UTF-8 byte limit, rejected keys cannot overwrite
  earlier text, and inserting emoji clears the pending transliteration key.
• Fn+H opens a complete two-page Cyrillic key map and returns to the unchanged
  draft, including pending combinations and quotes. It is also available at
  Settings → Device → RU keys; the compose badge hints at FnH.
• Chat deletion stays bound to the selected conversation when a new message
  reorders the list between Del and Enter. Leaving the confirmation cancels it.
• SD profile discovery distinguishes missing files from I/O errors, so a
  temporarily unreadable backup cannot be replaced by clean-install defaults.
  Profile transactions also release their SD mount after allocation failures.
• The internal profile marker is replaced without first deleting the old one;
  retries repair a missing marker even when the SD profile is already current.
• Damaged radio-mode records with an unterminated BLE address are rejected
  without reading beyond the saved field.
• Restored favourite IDs reconcile into the onboard node database, including
  later discoveries. A phone unstar updates the portable set even if the
  engine's existing flag was already false.
• Companion owner-name edits preserve the full owner snapshot, including
  licensed and unmessagable flags. Editing waits until that snapshot arrives.
• Companion messages report failed GATT writes, disconnects and a ten-minute
  missing-ACK timeout instead of remaining in the sending state indefinitely.
  Outstanding sends have a fixed eight-entry capacity and never grow the heap.
• The node picker includes the full 150-node onboard database, sorts before
  truncating, and applies Smart / Last heard / Name / Hops consistently in
  companion mode, including the selected long/short name style.
• Empty WiFi/MQTT text fields are saved, allowing credentials to be cleared.
• A completely pinned NodeDB rejects a new identity safely when no slot can be
  evicted, instead of advancing beyond its allocated storage and rebooting.
• Long diagnostic log lines are truncated before checking their final byte,
  preventing an out-of-bounds read (and possible write) in the PhoneAPI formatter.

Release engineering

• HIL can carry PhoneAPI over an owned SSH tunnel through the Zoo host, without
  administrator access, Mac route changes or server deployment. Tunnel loss
  fails the run; USB safety recovery and the original device identity remain enforced.
• Release HIL now requires an identity-pinned, renewable meshtastic-zoo TCP
  window. Lost ownership or an unacknowledged return fails the gate without
  preventing USB safety recovery; no lease secrets enter public evidence.
• Release host checks now run the production SD transaction code with injected
  filesystem failures and UI behavior regressions under AddressSanitizer/UBSan,
  alongside bounded-send, timeout rollover and address-parser checks.
• Firmware CI exercises the actual patched log formatter at empty, exact-limit
  and overlong inputs under AddressSanitizer/UBSan.
• Finishing a failed publication derives the visual HIL matrix size from
  the exact release tag, including the new RU key-map screens, and explicitly
  verifies filesystem recovery, WiFi completion, reboot stability and zero writes.
• The release HIL suite adds deletion-during-arrival scenarios for DMs and
  channels and verifies companion owner flags and snapshot invalidation.
• Failed initial production TCP streams explicitly close their host-side
  connection. Long soaks retain their last completed snapshot on failure and
  emit bounded progress logs without weakening the no-reconnect release gate.
• Favourite-row HIL assertions no longer depend on which DM was previously
  opened. Privacy-safe failure evidence redacts XML values before serialization,
  so placeholder text cannot break JUnit uploads precisely when a test fails.

Full changelog

Meshtastic ADV v1.1.0

Added

• A device-bound SD profile now synchronizes all Meshtastic and ADV settings,
  including the complete favourite-node/channel set, and restores the newest
  valid generation automatically after a clean ADV reinstall. Three CRC-checked
  generations are rotated atomically; messages, history and the learned NodeDB
  cache are deliberately excluded.
• The portable ADV settings file now owns node-list presentation, companion
  selection, favourite channels/nodes, Cyrillic input, UTC and screen timeout,
  so deleting message history cannot reset preferences.

Fixed

• Favouriting a row no longer leaves the cursor on its old numeric index after
  the list re-sorts. Held-key repeat now stays attached to the original node or
  channel instead of marking several neighbours yellow.
• A missing SD, corrupt generation or interrupted restore can no longer turn a
  clean-install probe into a valid marker or let default settings overwrite the
  only backup. Restore stages and verifies every file before committing it and
  rolls the group back on failure.
• SD profile transactions and heap-heavy PhoneAPI configuration streams are
  serialized, preventing their temporary allocations from colliding on the
  no-PSRAM Cardputer.
• Successful SD writes no longer impose the five-minute failure backoff on the
  next settings change, and a change committed during streaming remains queued
  for its own generation instead of losing its dirty notification.

Release engineering

• Behavioral HIL now seeds two deterministic nodes and proves that repeated
  favourite/un-favourite key events affect exactly one identity. Host contract
  tests cover the profile allow-list, secret-bearing/excluded data boundary,
  device binding, generation rotation, clean-install gate and rollback order.
• Post-flash HIL now holds and drains native USB through the measured Cardputer
  boot window before opening a full 150-node production PhoneAPI stream.

Full changelog

Meshtastic ADV v1.0.19

Fixed

• A direct-message peer can now be added to favourites before its NodeInfo has
  arrived. The choice falls back to the messenger's local atomic settings
  instead of silently doing nothing, then migrates to the Meshtastic NodeDB
  when that peer becomes known.
• The English and Russian interface guides now document the actual controls:
  left adds the selected peer or channel to favourites and right removes it.

Release engineering

• Physical release HIL now toggles both DM-peer and channel favourites through
  the real keyboard path, proves their yellow-row framebuffer change, checks
  favourite-only alert routing, and verifies both stores after a real reboot.

Full changelog

Meshtastic ADV v1.0.18

Fixed

• Clearing a failed companion link no longer reallocates the roughly 8.5 KiB
  companion arena after NimBLE initialization has already failed and disabled
  retries for the current boot. The low-memory failure path now stays released
  even if the user forgets the unavailable peer.

Full changelog

Meshtastic ADV v1.0.17

Fixed

• A low-memory PhoneAPI configuration dump now omits its optional filesystem
  manifest and still reaches config_complete when Arduino FS cannot allocate
  a file handle, instead of rebooting the device.
• HTTP upload parsers now unwind through RAII on every request failure, and the
  diagnostics endpoint can no longer strand the shared SPI lock if JSON
  allocation fails. The web UI may fail softly without retaining request memory
  or blocking radio and storage access.

Full changelog

Meshtastic ADV v1.0.16

Fixed

• Every runtime file open owned by the ADV UI now converts Arduino FS's
  throwing shared_ptr allocation failure into an ordinary unavailable-file
  result. History scrolling/compaction, unread tracking, message/config loads,
  crash guards and saved-clock reads can no longer reboot the node solely
  because the heap is fragmented.
• The early radio-mode probe also catches file-handle OOM and selects the
  smaller 32-node allocation for that boot instead of adding pressure during
  NodeDB construction.
• Companion-mode NimBLE initialization now fails softly before its protected
  connect worker exists, releases the unused companion arena, and does not retry
  a partially initialized stack in a loop during the same boot.

Full changelog

Meshtastic ADV v1.0.15

Fixed

• Optional RTTTL, speech and I2S initialization now catch allocation failures
  from constructors and setup calls as well as allocation itself. A failed
  alert leaves the mesh and UI running with the amplifier and CPU boost off.
• Enabling the optional SD-backed Unicode font now releases every partially
  acquired FATFS, file and glyph-cache resource when the fragmented heap cannot
  construct the file handle; the built-in font remains usable.
• Atomic SafeFile persistence now defers cleanly when Arduino FS cannot
  allocate its shared file implementation or temporary path. Full-atomic
  settings/history callers keep the previous committed file instead of an OOM
  reboot interrupting the node, and NodeDB no longer reports success unless
  the verified close/rename transaction actually committed.
• The dormant Meshtastic 2.8 satellite-save compatibility patch releases
  partial staging vectors without calling an allocator-capable compaction
  operation from inside its bad_alloc handler.

Full changelog

Meshtastic ADV v1.0.14

Fixed

• Optional second-screen allocation and initialization now fail softly under
  heap pressure, and a failed built-in panel wake leaves the mesh running for a
  later retry instead of pretending the dark display is ready.

Release engineering

• Release HIL now overrides meshtastic-python 2.7's hard-coded 30-second
  initial config-stream wait with an explicit bounded 90-second deadline. This
  allows a large restored NodeDB to finish its first post-boot PhoneAPI stream
  while retaining the existing fail-closed reconnect and reboot checks.
• Physical HIL performs twelve real display power-off/panel-SPI reinitialization
  cycles and rejects cumulative retained heap, unsafe headroom, a dark wake or
  an unexpected reboot.

Full changelog

Meshtastic ADV v1.0.5

Added

• Every tagged release now records a deterministic 19-frame conversation on the
  real firmware: unread navigation, typing, emoji, send status, routing ACK,
  incoming reply, reaction and a quoted Cyrillic reply. The release publishes a
  device-composited hero GIF and a screen-focused GIF for the website, GitHub and
  community posts.
• Public HIL evidence is staged through a fail-closed privacy boundary. Raw
  framebuffer captures stay on the trusted runner; uploaded text is redacted for
  fixture identities, serial paths, local IPv4/IPv6 addresses, node IDs and
  user-scoped home/temp paths, while generated media is hash-bound to the exact
  tag, source frames, timing, mockup and device image. Text evidence also has
  per-file and total byte budgets.

Changed

• The project website is now a responsive, keyboard-accessible product page with
  a clearer standalone/companion explanation, safety warnings before flashing,
  user-controlled animation, release-confidence details and concise
  troubleshooting. Legacy screenshots containing lab identities and a stale
  RU/20 example are no longer published or embedded.
• The release HIL visual matrix grows from 29 to 35 real framebuffer captures.
  Interface documentation now describes the narrow Meshtastic integration
  patches and channel acknowledgement semantics precisely, and the M5Burner card
  avoids a time-sensitive release-cadence claim.
• A public GitHub Release is now the final distribution marker: assets remain in
  a draft until M5Burner and the exact-byte web installer/media postconditions
  pass. Every external publication rechecks that the remote tag still peels to
  the exact workflow commit, making a moved tag fail closed.

Fixed

• Interrupted physical HIL recovery now keeps the verified node configuration in
  an owner-only per-run vault outside checkout/temp cleanup, binds a durable
  flash marker to that backup's filename and SHA-256, and refuses recovery
  without the exact tagged app image. Export and restore use the same pinned
  Meshtastic CLI and re-resolve the Cardputer identity around every export;
  transient private samples are removed immediately.
• The self-hosted fixture is attempt-scoped and created with exclusive,
  no-symlink semantics. Successful HIL/recovery removes only the current attempt;
  failed recovery retains its private vault with a documented repair runbook.

Full changelog

Meshtastic ADV v1.0.4

Changed

• Stable GitHub Releases now publish the reviewed, version-specific section from
  CHANGELOG.md instead of an empty generated-notes page containing only a
  comparison link. The notes are staged from the exact tag before the installer
  checkout moves to main, and a safe release rerun repairs both assets and
  notes. A stable tag with missing or ambiguous changelog notes fails before it
  can unlock the physical HIL job.

Full changelog