If you carry your SquachWatch around, update. The crash some people saw after an hour or so in busy places is found and fixed, and it had nothing to do with SquachMesh — it was in the Bluetooth scanner every board runs. Details below.
SquachMesh messages
Two SquachWatches that share a five-word phrase can now message each other. Pick one of 24 ready-made lines, or type your own — up to 48 characters on the payphone keypad or the QWERTY board. It is still a work in progress, like the rest of SquachMesh, and what is still open is at the bottom.
Red means a person. A message arrives as a filled red bubble over the visitor, with the sender's name in it. The black-and-pink chat is the two Squachys talking to each other; nobody sent that.
It asks before sending. Tapping a line only selects it and quotes it back — Send "On my way."? — and SEND sends it. A typed message comes back from the keyboard shown large, with EDIT and SEND. On a screen of two dozen small targets and a resistive panel, a wrong tap should cost a second tap, not a message you did not mean.
The phrase is five words, from a list of 314 hacker and cryptid words — about 41 bits. One of you ROLLs one and reads it out; the other ENTERs the same five words in the same order. The picker is two steps with big keys: an alphabet, then that letter's words, with a BACK that undoes exactly one step. Setting a phrase freezes the screen for about three seconds, on purpose, and the screen says so first: the phrase goes through 20,000 rounds of PBKDF2-HMAC-SHA256, which every guess an attacker makes has to pay too. It happens only when a phrase is set; the key is stored, and boot never repeats it.
The cryptography is AES-128-CCM with an 8-byte tag. The nonce is the sender's Bluetooth address plus a counter that is reserved in flash before it is used, so it cannot repeat even across a crash. A message replayed from another address fails authentication; one replayed from the same address is dropped as already seen. Every board rebuilds two golden message frames at boot — frames made by a completely separate implementation, Python's cryptography — and refuses to send or read anything if a single byte differs. The SquachMesh menu shows ERR if that ever happens.
Typed messages go out in parts. A Bluetooth 4.2 advert is 31 bytes and the ESP32 on these boards has nothing bigger, so a message travels as up to three sealed parts of sixteen characters (A–Z, 0–9, space and . , ? ! ' -), rotating through the broadcast for thirty seconds. Each part is authenticated on its own, and nothing is shown until every part has landed.
What it does not hide: that you sent something, and when. The contents are encrypted; the fact of a message is not. The SquachMesh warning screen says so.
A tutorial runs the first time MESSAGES is switched on — seven cards, one tap each, with a DEMO Squachy and an arrow pointing at what to press. SKIP ends it, and the ? on the message screen replays it. It never transmits anything, so it is safe to go through before you have a phrase.
Messages need everyone on this release. Nothing released before it can send or read one. Boards on v1.5.23 still see newer ones as visitors.
The crash in busy places
Two soaks at work crashed at 63 and 80 minutes, both with about 12 KB of heap free and nothing bigger than 300 bytes in one piece. With SquachMesh switched off entirely, it still lost memory steadily.
The cause was in NimBLE, the Bluetooth library. Under active scanning it keeps a record of every device until that device answers a scan request — and a device that never answers, or that walks off, or that is a phone rotating its address, is kept forever, because the only other cleanup runs at the end of a scan and this scan never ends. The busier the room, the faster it grew.
The scan now restarts once a minute through NimBLE's own stop and start, which clears that list without racing the task that writes to it. The diagnostics screen has a FLUSHED row showing what each restart gave back.
Measured on hardware afterwards: free heap flat past 90 minutes with SquachMesh transmitting and without, and one board carried through a 2 hour 25 minute drive home — 56 new detections on the way — without a crash. Before the fix, the same board did not see 81 minutes.
Visits
The visitor stays for as long as the other board is in range. He used to say goodbye after a minute and then, with the other board still right there, walk straight back in. He leaves when the other board does.
The message button beside him is bigger — 32×22 instead of 20×13 — because it is the only way into messages and it was hard to see and harder to hit.
The web emulator
SquachMesh had been compiled out of the web emulator altogether. It is in now, along with a second SquachWatch that only exists in the page: bring it nearby, dress it (outfit, shades, nickname, custom name), have it send a line or type a message, and it answers what you send it. It speaks real SquachMesh adverts and message frames to the real firmware, so it turns up exactly when a board would. The one thing that is not real is the cipher — a stand-in, because a browser has no ESP32 hardware AES.
Also in this release
A QWERTY keyboard behind the payphone keypad, for anybody who hates multi-tap. The button to switch is on both boards, and the choice is remembered. It types on release, through a filter for the stray readings a resistive panel gives as a finger lifts.
THE GIBSON background's top label had lost its first four characters under the settings icon; it has them back.
What is still open
The QWERTY board's touch filter is tuned against synthetic data, not recordings from a real resistive panel. If it types the wrong key or doubles a letter, the payphone keypad is the robust option.
Largest free block drifts down under heavy detection activity — 21.5 to 18.4 KB on one long run, 20.5 to 17.4 KB on another — while free heap stays flat. That is fragmentation, not a leak, and rotation still works at 17 KB. Whether it levels off over a full day is not yet known.
The broadcaster role has been soaked only on ST7789 boards, not on ILI9341 or AWOK. If a board stops being able to rotate, the largest-block number on the diagnostics screen is where to look.
The Bluetooth address is the stable public one, as the warning screen says. Deliberately deferred, not overlooked.
A message replayed at a freshly booted receiver will be shown once. The replay table is not kept across a reboot, and with no shared clock there is nothing to reject it on.