Merge remote-tracking branch 'upstream/master' into codex/t-deck-max-hw-model

# Conflicts:
#	meshtastic/mesh.proto

Author: h3lix1

.github/workflows/create_tag.yml

@@ -60,6 +60,7 @@ jobs:
       - name: Setup Buf
         uses: bufbuild/buf-action@v1.2.0
         with:
+          version: 1.71.0 # renovate: datasource=github-releases depName=bufbuild/buf
           github_token: ${{ github.token }}
           token: ${{ secrets.BUF_TOKEN }}
           setup_only: true

.github/workflows/pull_request.yml

@@ -16,6 +16,7 @@ jobs:
       - name: Buf PR Checks
         uses: bufbuild/buf-action@v1.2.0
         with:
+          version: 1.71.0 # renovate: datasource=github-releases depName=bufbuild/buf
           github_token: ${{ github.token }}
           token: ${{ secrets.BUF_TOKEN }}
           format: true

.github/workflows/schema-registry.yml

@@ -19,6 +19,7 @@ jobs:
       - name: Push to schema registry
         uses: bufbuild/buf-action@v1.2.0
         with:
+          version: 1.71.0 # renovate: datasource=github-releases depName=bufbuild/buf
           github_token: ${{ github.token }}
           token: ${{ secrets.BUF_TOKEN }}
           push: true

.github/workflows/snapshot-kmp.yml

@@ -21,15 +21,6 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Compute snapshot version
-        id: version
-        run: |
-          TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "v0.0.0")
-          RELEASE_VERSION="${TAG#v}"
-          IFS='.' read -r major minor patch <<< "$RELEASE_VERSION"
-          SNAPSHOT_VERSION="${major}.${minor}.$((patch + 1))-SNAPSHOT"
-          echo "snapshot=$SNAPSHOT_VERSION" >> "$GITHUB_OUTPUT"
-
       - name: Setup Java
         uses: actions/setup-java@v4
         with:
@@ -42,8 +33,19 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v4
 
+      - name: Set version name
+        run: |
+          # Name the snapshot after the latest tag (v-stripped) plus the short SHA.
+          # The `-<sha>` is a build qualifier, so Maven sorts this ABOVE the tag's
+          # release (no Renovate downgrade) yet below the next release — no patch
+          # bump needed. (The local fallback in build.gradle.kts uses a *bare*
+          # `-SNAPSHOT`, which sorts below its base, so it patch-bumps instead.)
+          BASE=$(git describe --tags --abbrev=0)
+          SHORT_SHA=${GITHUB_SHA::7}
+          echo "VERSION_NAME=${BASE#v}-${SHORT_SHA}-SNAPSHOT" >> "$GITHUB_ENV"
+
       - name: Build KMP package
-        run: packages/kmp/gradlew --no-daemon -p packages/kmp build -PVERSION_NAME=${{ steps.version.outputs.snapshot }}
+        run: packages/kmp/gradlew --no-daemon -p packages/kmp build -PVERSION_NAME=${{ env.VERSION_NAME }}
 
       - name: Publish snapshot to Maven Central
         env:
@@ -56,4 +58,4 @@ jobs:
             echo "Missing Maven Central secrets — skipping snapshot publish." >&2
             exit 0
           fi
-          packages/kmp/gradlew --no-daemon -p packages/kmp publishAllPublicationsToMavenCentralRepository -PVERSION_NAME=${{ steps.version.outputs.snapshot }}
+          packages/kmp/gradlew --no-daemon -p packages/kmp publishAllPublicationsToMavenCentralRepository -PVERSION_NAME=${{ env.VERSION_NAME }}

meshtastic/admin.options

@@ -18,6 +18,7 @@
 
 *HamParameters.call_sign max_size:8
 *HamParameters.short_name max_size:5
+*HamParameters.long_name max_size:15
 *NodeRemoteHardwarePinsResponse.node_remote_hardware_pins max_count:16
 
 *LockdownAuth.passphrase max_size:32

meshtastic/admin.proto

@@ -581,6 +581,69 @@ message LockdownAuth {
    * the locked state. Always honoured regardless of current lock state.
    */
   bool lock_now = 4;
+
+  /*
+   * Optional per-boot uptime cap on the unlocked session, in seconds.
+   * 0 = unlimited (token-only enforcement, suitable for unattended
+   * tower / infrastructure nodes).
+   *
+   * When non-zero, the firmware arms an uptime timer at unlock. On
+   * each expiry, while there is still boot-count budget, the firmware
+   * decrements the on-flash boot count in place, revokes per-
+   * connection admin auth (clients must re-authenticate to see
+   * content), re-engages the screen lock, and re-arms the timer
+   * without rebooting. Mesh routing keeps running across session
+   * boundaries; only when the boot-count budget reaches zero does
+   * the device hard-lock and reboot.
+   *
+   * Total exposure ceiling = ((resolved boot count) + 1) * max_session_seconds.
+   * The +1 accounts for the initial passphrase-unlocked session
+   * itself, since boots_remaining is the number of subsequent
+   * session rolls (each consuming one boot from the rollback ledger).
+   * The resolved boot count is the value the firmware writes into the
+   * token at unlock time: the client-supplied boots_remaining when
+   * non-zero, otherwise the firmware default (TOKEN_DEFAULT_BOOTS).
+   * Note that boots_remaining == 0 in this message means "use firmware
+   * default", NOT "zero boots" — a client computing the ceiling for
+   * display should mirror that resolution rather than multiplying the
+   * raw request value.
+   *
+   * The cap is persisted in the token, so it survives token-based
+   * auto-unlock across reboots. Explicit operator Lock Now still
+   * deletes the token and forces passphrase re-entry.
+   *
+   * Uses millis() (CPU uptime), not wall-clock time, so the cap is
+   * immune to GPS spoofing, RTC backup-battery removal, and Faraday
+   * cage isolation — none of those move the uptime counter. The only
+   * way to reset the session clock is a reboot, which costs a boot
+   * from the on-flash, HMAC-bound counter.
+   */
+  uint32 max_session_seconds = 5;
+
+  /*
+   * Disable lockdown mode. Requires a valid passphrase in the same
+   * message (the device must prove the operator owns it before
+   * reverting at-rest encryption). On success the firmware decrypts
+   * every stored config / channel / nodedb file back to plaintext,
+   * removes the wrapped DEK, unlock token, monotonic-counter, and
+   * backoff files, and reboots out of lockdown.
+   *
+   * This is the inverse of the provision/unlock path: it is how the
+   * client app's "lockdown mode" toggle returns a device to normal
+   * operation.
+   *
+   * NOT reversed by this operation: APPROTECT. Once the debug port
+   * lockout has been burned (on silicon where it is effective) it is
+   * permanent — disabling lockdown decrypts your data and removes the
+   * access gates, but the SWD/JTAG port stays locked for the life of
+   * the device (recoverable only via a full chip erase over a debug
+   * probe, which destroys all data). Clients should make this
+   * irreversibility clear at the moment lockdown is first enabled.
+   *
+   * When true the passphrase field is still required; boots_remaining,
+   * valid_until_epoch, max_session_seconds, and lock_now are ignored.
+   */
+  bool disable = 6;
 }
 
 /*
@@ -628,6 +691,12 @@ message HamParameters {
    * Optional short name of user
    */
   string short_name = 4;
+
+  /*
+   * Optional long name of user
+   * Appended to callsign
+   */
+  string long_name = 5;
 }
 
 /*

meshtastic/clientonly.options

@@ -1,4 +1,4 @@
-*DeviceProfile.long_name max_size:40
+*DeviceProfile.long_name max_size:25
 *DeviceProfile.short_name max_size:5
 *DeviceProfile.ringtone max_size:231
 *DeviceProfile.canned_messages max_size:201

meshtastic/config.proto

@@ -965,6 +965,31 @@ message Config {
        * ITU Region 3 Amateur Radio 2m band (144-148 MHz)
        */
       ITU3_2M = 33;
+
+      /*
+       * ITU Region 1 Amateur Radio 70cm band (430-440 MHz)
+       */
+      ITU1_70CM = 34;
+
+      /*
+       * ITU Region 2 Amateur Radio 70cm band (420-450 MHz)
+       * Note: Some countries do not allocate 420-430 MHz or 440-450 MHz.
+       * Check local law!
+       */
+      ITU2_70CM = 35;
+
+      /*
+       * ITU Region 3 Amateur Radio 70cm band (430-450 MHz)
+       * Note: Some countries do not allocate 440-450 MHz. Check local law!
+       */
+      ITU3_70CM = 36;
+
+      /*
+       * ITU Region 2 Amateur Radio 1.25m '125cm' band (220-225 MHz)
+       * Note: Some countries do not allocate 220-222 MHz (Ex: USA/Canada).
+       * Check local law!
+       */
+      ITU2_125CM = 37;
     }
 
     /*
@@ -1055,6 +1080,26 @@ message Config {
        * Comparable link budget and data rate to LONG_FAST.
        */
       NARROW_SLOW = 13;
+
+      /*
+       * Tiny Fast
+       * Preset optimized for compliance with Amateur Radio restrictions with 20kHz bandwidth.
+       * Many regions limit data transmission bandwidth in lower amateur bands (2 Meter).
+       * Note: TCXO with tight tolerances (±5 ppm or better) is *absolutely required* at these narrow bandwidths.
+       * Only compatible with SX127x and SX126x chipsets.
+       * Comparable link budget and data rate to LONG_FAST.
+       */
+      TINY_FAST = 14;
+
+      /*
+       * Tiny Slow
+       * Preset optimized for compliance with Amateur Radio restrictions with 20kHz bandwidth.
+       * Many regions limit data transmission bandwidth in lower amateur bands (2 Meter).
+       * Note: TCXO with tight tolerances (±5 ppm or better) is *absolutely required* at these narrow bandwidths.
+       * Only compatible with SX127x and SX126x chipsets.
+       * Comparable link budget and data rate to LONG_MODERATE.
+       */
+      TINY_SLOW = 15;
     }
 
     enum FEM_LNA_Mode {

meshtastic/deviceonly.options

@@ -12,6 +12,22 @@
 *NodeInfoLite.hops_away int_size:8
 *NodeInfoLite.next_hop int_size:8
 
+# Flattened user fields. long_name was 40 on UserLite; trimmed to 25 here so the
+# slim header gives back ~15 B/node of RAM. Names that exceeded 24 chars on the
+# wire (max 40) get truncated on store, with sanitizeUtf8 cleaning up partial
+# multi-byte sequences at the boundary.
+*NodeInfoLite.long_name max_size:25
+*NodeInfoLite.short_name max_size:5
+*NodeInfoLite.public_key max_size:32
+# hw_model + role used to be 32-bit enums inside UserLite. We pin them to one
+# byte each on the slim header to claw back the alignment overhead.
+*NodeInfoLite.hw_model int_size:8
+*NodeInfoLite.role int_size:8
+
+# UserLite survives only as the v24 nodedb migration decode type; it must keep
+# the legacy on-disk width (40) or saves holding longer names fail to decode
+# and the whole DB is discarded. The migration copy truncates into the slim
+# header fields above.
 *UserLite.long_name max_size:40
 *UserLite.short_name max_size:5
 *UserLite.public_key max_size:32 # public key