MeshMonitor v4.16.0-rc2

⚠️ Release candidate — not a stable release. Please test and report issues before 4.16.0 ships.

Second release candidate for 4.16.0. The headline is the MeshMapper Observer integration landing in full: any MeshCore source can now publish coverage data to MeshMapper (or LetsMesh) with a one-click preset and no extra hardware, because the Analyzer Observer can finally talk to more than one broker at a time. Alongside that, this RC is mostly a fixes release for problems that were misreporting reality — a Packet Monitor showing firmware 2.8's NodeDB replays as if they were live receptions, Position Config claiming GPS was enabled when the device had it disabled, and MeshBeacon broadcast targets that looked like they weren't saving when in fact only the read-back was broken.

It also carries one schema migration (157) and one behaviour change worth knowing about before you upgrade: a MeshCore room server with a saved password that no longer works will now switch its own auto-sync off instead of retrying forever. See Upgrade Notes.

Features

#5022 + #5027 — MeshMapper Observer (#5014), in two phases. Phase 1 extends the Analyzer Observer from one broker to N, with per-broker connection state, counters, credentials and tokens; MeshMapper's MQTT ingestion already speaks the exact wire contract our observer does, so contributing needed only multi-broker publishing. Phase 2 turns the fieldset into a broker-list editor with verified one-click presets (MeshMapper, LetsMesh US/EU, Custom), a per-broker status panel on the MeshCore Configuration view, and an OBS c/N badge on the Dashboard source card. Legacy single-broker configs keep working and are migrated to brokers[0] on first save — no DB migration, the observer config is a JSON blob.
#5026 — Duplicate button on automation rules (#5024).
#5021 — Save Security Config is re-enabled for remote nodes (#4736). The button had been hard-disabled since #1602 behind a tooltip blaming "a firmware compatibility issue"; reading AdminModule.cpp showed that premise — and a comment in our own code repeating it — was wrong.

Bug Fixes

#5038 — Packet Monitor no longer shows firmware 2.8's NodeDB replays as live receptions (#5034). Firmware 2.8 periodically re-delivers each NodeDB entry's cached position/telemetry to the connected client, synthesizing POSITION_APP/TELEMETRY_APP packets from stored data. Firmware PR #11014 stabilized the packet id and hop fields across replays (hence "same packet id, different time"), and transport_mechanism is deliberately forced to TRANSPORT_LORA for iOS compatibility, so a client could not tell them apart. This is the Packet Monitor face of #4192.
#5037 — MeshCore: a refused room-server password is no longer retried every 60 seconds forever, and can now be removed (#5036). Adds migration 157. The room-sync scheduler stamped its clock only after a successful login, so a room with a stale password stayed permanently overdue and was re-picked on every tick — on the order of 180 login floods an hour, indefinitely, plus a matching stream of rejected logins in the room operator's own logs. Every attempt now advances the clock; a refusal disables auto-sync at once and three unanswered attempts do the same. A new "Forget saved password" button sits on the room login card, reachable precisely when a bad password has locked you out — previously the only control that could stop the retries was behind the login itself.
#5035 — MeshBeacon broadcast-target region and preset now persist across a save and reboot (#5030). The device stored them correctly all along; MeshMonitor could not read them back. broadcast_targets is the only repeated message field /api/config/current returns, so its entries stayed protobufjs Message instances and were serialized through protobufjs's own toJSON(), which emits enum names rather than numbers.
#5029 — Position Config no longer shows GPS Mode as ENABLED when the device has it disabled (#5028), plus four more instances of the same class of bug. The Configuration tab initialized several fields to non-zero defaults while guarding the load path on !== undefined, so any proto3-elided zero value (false, 0) left the wrong value on screen.
#5025 — Automation engine: added the missing Arguments field to action.runScript.

Chores

#5039 — Version bump to 4.16.0-rc2.

Issues Resolved

#5034 — [BUG] Strange display of meshtastic packet monitor since 4.15.2
#5036 — MeshCore: a bad saved room-server password is retried every 60s forever, and cannot be removed
#5030 — [BUG] MeshBeacon Broadcast Targets region/preset not persisting after save and reboot
#5028 — GPS Mode always shows ENABLED in Position Config tab when device has it Disabled
#5014 — [FEAT] Add MeshMapper Bridge / Data Forwarding Integration
#5024 — feat(automation): Duplicate rule button
#4736 — [FEAT] Re-enable Save Security Config button on Remote Admin page

Upgrade Notes

Migration 157 adds roomSyncFailureCount and roomSyncLastError to meshcore_nodes. It is idempotent across SQLite, PostgreSQL and MySQL and performs no backfill — every existing room starts at zero failures, which is the correct state for one that has never failed.

Behaviour change — MeshCore room auto-sync now gives up. A room server whose saved password is refused will have its auto-sync switched off after the first refusal; one that stops answering is switched off after three consecutive unanswered logins. Both are deliberate: the previous behaviour retried forever and cost real LoRa airtime. If a room you expect to sync goes quiet, check the Rooms tab — the login card now says whether the password was refused or the login simply went unanswered, and offers a Forget saved password button. Re-enabling auto-sync clears the failure counter, so a corrected password starts from a clean slate.

MeshMapper Observer users: if you already had a single-broker observer configured, it keeps working untouched and is migrated to the new brokers[] shape the first time you save. Saving clears the stale top-level brokerUrl/tokenAudience fields. Per-broker credentials must be saved in order (config, then status, then credentials) — the UI handles this for you.