DeskOS 1.7.12 phone companion repair and local release

[n30nex]

DeskOS 1.7.12 completes the phone companion repair on the SenseCAP Indicator D1L. Initial secure synchronization no longer resets the device, empty channel slots can be added from the official app, and radio acknowledgements now produce the app's actual Delivered state. Authenticated repeater status and console replies pass through correctly, including valid UTF-8 names, and requests use fresh authenticated routes with flood fallback.

This also ships the existing navigation and discoverability improvements, explicit Wi-Fi/BLE mode switching, and production installers for the full-feature profile. Preserving USB updates verify the application before selecting its boot slot, including devices previously updated from SD. Local packaging records the exact clean source, pinned toolchain, SBOM, hashes and signed update identity without claiming a GitHub Actions build.

Validation was performed locally on the Pi 5:

• ESP32-S3 full_feature/conditional build with pinned ESP-IDF 5.5.4, plus a clean production RP2040 bridge build with the pinned Arduino core.
• 140 focused protocol, native radio, Unicode, UI-contract and packaging checks passed; 57 packaging/provenance checks passed after the final USB installer correction.
• The actual packaged preserving updater installed commit 59cb0cd. Application and boot selection hashes were verified on the D1L. Identity, settings and prepared SD data were retained.
• Official MeshCore Android 1.49.0: authenticated encrypted bonded connection, contact/channel sync, test channel creation/removal and reconnect, incoming DM and confirmed outgoing DM, repeater login/status and a Unicode console response.
• Local Pi node services remained running during RF tests. The D1L also reconnected to its saved Wi-Fi network and rendered all nine cached map tiles.
• Production package checksums, Ed25519 update signature, blank factory-state regions, and artifact/source provenance passed.

The newly built RP2040 UF2 was packaged but the existing working bridge was not reflashed. Signed SD installation/rollback was not physically exercised in this session. Advanced companion commands outside DeskOS's supported protocol remain explicitly disabled, and Wi-Fi/BLE remain exclusive modes.

Firmware builds and tests stayed local at the maintainer's request. One separately approved temporary Pi Actions job recovered the existing signing key; the runner and temporary remote branch were removed afterward. No build jobs were dispatched.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[n30nex]

BLE phone startup-burst repair is now on b28821a6821857f863227b505e0415d5a74cd2a9.

Evidence:

• Real Android session on the preceding build remained securely connected at MTU 517 but recorded exactly one RX queue drop, with zero unsupported or malformed commands.
• Root fix: bounded BLE companion queue depth increased from 4 to 16.
• Focused BLE suite: 12 passed.
• Actions run 32410067146: all five jobs passed.
• Firmware SHA-256: 41c35587acd6e42f57621106675e28339d0df789cecdd80587aad607b708209e.
• Application-only flash at 0x20000 verified by esptool.
• Live firmware reports exact commit b28821a6, healthy retained state, and unchanged boot nonce through testing.
• Concurrent startup acceptance: 18/18 commands, 35/35 responses, all 16 contacts, RX drops 0, malformed 0, unsupported 0, no reboot.

Awaiting final real-phone UI confirmation before merge.

[n30nex]

Companion phone follow-up is deployed on the attached D1L at commit \5ad8c07e04c8e571fe44f2e78c6af84f5592cc6a\ (Actions run 32469046908).

• Reset Path now serializes MeshCore's unknown/flood path as signed byte \

[n30nex]

Latest exact D1L candidate is 3bea33e.\n\n- GitHub Actions run 32559635193: all five jobs passed.\n- ESP32-S3 application SHA-256:

[n30nex]

Deep phone-companion repair candidate is now bb12df55408af33dc4213b713e0dd8e4203ad36f.

• Local full suite: 2,586 passed, 13 skipped; focused BLE/contact/admin suite: 74 passed.
• Actions run 32577402385: all five jobs passed.
• ESP32-S3 app SHA-256: 11ed0b3407b664f6502ff804dc32357383792520b9ee58ea54742dcee12879c8.
• Application-only flash at 0x20000 verified by esptool on the exact authorized D1L.
• Post-flash device reports exact commit bb12df55, version 1.7.12, full_feature, conditional SD, 17 retained contacts, 64-contact capacity, healthy BLE advertising, zero protocol/drop/malformed/error counters, and unchanged healthy boot nonce during checks.
• Repairs cover complete new-contact pushes, all-channel message sync/timestamps/senders, reconnect unread notification, queued phone adverts, safe Clock Sync, contact-store migration, trailing-name cleanup on phone serialization, Guest/Admin separation including reconnects, and explicit Disabled responses for unsupported advanced commands.

Real MeshCore phone workflow acceptance is the remaining gate before publishing this candidate to the public flasher.

[n30nex]

D1L retry-role fix and exact-device evidence

Commit 0367184fb14ba637c70bb9d7c1f32554d591d537 prevents an opposite Guest/Admin phone retry from rewriting an in-flight repeater login's access role. Same-intent retries still join the existing radio request; conflicting retries fail without cancelling it.

• Focused BLE/admin tests: 60 passed
• CI: all five jobs passed in run 32956920950
• App artifact: 2,256,480 bytes
• App SHA-256: 4c289687f5c16e718231c63157ce020f0f1be035ed7988986e8a9ca2816bef2a
• Deployment: preserving application-only write at 0x20000 on the qualified D1L; settings, identity, contacts, channels, partitions, SD, and RP2040 were not rewritten
• Post-flash: version 1.7.12, exact commit 0367184f, board seeed_indicator_d1l, health OK, BLE active/advertising, 28 contacts and 1 channel retained

Remaining physical acceptance: repeat Guest and Admin login from the MeshCore phone app, including a quick duplicate tap/retry, and confirm the displayed role and command permissions remain correct.

[n30nex]

Exact D1L UI/UX candidate evidence

Candidate: cb4636e60ebca48641c15ac7863c30fc09020fde

• Local full suite: 2,586 passed, 13 skipped
• GitHub Actions: run 32962472049 completed successfully; host checks, MeshCore conformance, RP2040 bridge build, and D1L firmware build all passed at the exact candidate SHA.
• Published app image: meshcore_deskos_d1l.bin, 2,256,624 bytes, SHA-256 463d4771beba36662b8729c5ac92023a0edf90d6bf9b31cefc558433cacae660.
• All 33 checksummed artifact files verified locally.
• Exact D1L identity was verified through the stable 1a86:7523 serial target with no competing serial owner.
• Preserving app-only flash completed at 0x20000; esptool verified the written hash. Bootloader, partition table, OTA data, NVS, SD, and RP2040 were not written.
• Quiet post-flash probe passed twice with no RF transmit: DeskOS 1.7.12, exact build commit, board/UI healthy, radio ready, BLE advertising, retained onboarding/device role, 1 channel, and 28 contacts. Uptime increased normally between samples.
• CI-generated 480x480 UI sheets report no overflow, truncation, text collision, missing labels, or undersized touch targets for the changed flows.

Public flasher remains unchanged. Physical touchscreen and phone acceptance are still required before merge/release: Home labels/pressed feedback, Clear nearby wording, Admin/Guest login, nested Back navigation, Sign out, and BLE phone behavior.