MeshMonitor v4.13.2

This release finishes the ATAK / CoT work, teaches MeshMonitor to respect a node that cannot transmit, adds a 3D terrain view, and catches gateways that uplink traffic their senders asked to keep off MQTT.

If you run PostgreSQL or MySQL, take this release. Those two backends re-ran every migration on each boot, and migration 030 rebuilds route_segments from scratch — 865k rows deleted and reinserted on every restart for one reporting install. SQLite was never affected.

See the release blog post for the narrative walkthrough, and the CHANGELOG for all 49 entries.

Fix first: PostgreSQL / MySQL migration ledger

The settingsKey idempotency guard was SQLite-only, so PostgreSQL and MySQL replayed all 128 migrations at every start. Both backends now record applied migrations in a ledger. (#4233)

ATAK / CoT

Packet decoding for ATAK plugin portnum 72 (TAKPacket) and portnum 78 (TAKPacketV2, zstd-compressed against the vendored TAKPacket-SDK dictionaries) — position, GeoChat, markers, routes, CASEVAC, emergency. GeoChat messages persist into Messages. (#3691 Phase 1, #4317)
ATAK contacts on every map — team-colored callsign markers with a Show ATAK Contacts toggle, STALE badge after 15 minutes, purge after 24 hours. (#3691 Phase 2)
CoT TCP feed for ATAK / WinTAK — settings-gated, streams Cursor-on-Target XML covering ATAK contacts plus every positioned Meshtastic and MeshCore node from every source. No authentication or encryption; trusted-network only. (#3691 Phase 3)

Receive-only nodes

MeshMonitor now honors lora.tx_enabled. A central server-side guard rejects every transmit path, the UI disables transmit-dependent controls with an explanation instead of failing at the radio, and config import reads live remote LoRa config so it cannot flip TX back on by accident. New Receive-only mode guide. (#4294, #4315)

MQTT

ok_to_mqtt violation detection — flags gateways that uplink packets from nodes that opted out, with 90 days of history and an ok_to_mqtt Violations report (per-gateway and per-packet views, node names, CSV export, SQL-side paging). (#4114, #4330, #4343)
Configurable downlink hop-limit override (0–7) on the embedded broker, replacing the zero-hop toggle. (#4081)
Auto-delete-by-distance applies at ingest, so an out-of-radius node never reaches the map. (#3900)

Maps

3D terrain view on Map Analysis (MapLibre + server-side DEM proxy), with node markers, neighbor links, and traceroute paths in 3D and a clean fallback without WebGL. (#3826)
Terrain Link Profile refinements — antenna AGL seeded from node altitude, clickable thin neighbor links, terrain analysis on route segments. (#4253, #4254)
ROUTER_LATE is distinguishable from ROUTER, unmessageable nodes show a badge, and the Nodes tab is now called Map. (#4295, #4325)

Also in this release

Share a node as a Meshtastic contact — QR code plus a meshtastic.org/v/#… contact link. (#4327)
NodeInfo Enrichment report — finds fields one source could fill from another and applies the fix; Copy NodeInfo gained per-field selection and overwrite. (#3837, #4244)
MeshCore Virtual Node "Allow PKI export" — a separate, default-off gate serving ExportPrivateKey(23) for tools that authenticate as the node itself. The VN port has no client authentication and the private key lets a client permanently become your node, so this is deliberately not folded into admin commands. See Virtual Node docs. (#3933, #4366)
Every PKI DM was favoriting its recipient — add_contact was pushed before every PKI direct message, and the firmware's addFromContact() sets is_favorite to shield the entry from NodeDB eviction. MeshMonitor now pushes only when the radio genuinely lacks the peer's key. (#4368)
MeshCore route names — {ROUTE_NAMES} / {HASH_SIZE} tokens, a clickable route-detail popup, and a packet-flow mini map. (#4276, #4277)
One icon system across the app, with a lint rule blocking new hardcoded glyphs. (#4217)
Auto-Ack resend attempts are configurable (1–3), Bearer API tokens work on legacy /api endpoints, security-risk warnings can be cleared, and Helm chart publishing no longer wipes older versions from the index. (#4266, #4259, #4302, #4335)

Internal

Large restructuring with no user-visible behavior change: server.ts route extraction, MeshtasticManager service extraction, an explicit connection state machine, frontend routing, a SettingsTab draft reducer, and every raw fetch() in components moved to ApiService. (#3962, #3502)