fix: MeshCore silent-bulk circuit + Nomad /media timeout + Ratspeak overlays

.github/workflows/flatpak.yaml

@@ -67,10 +67,6 @@ jobs:
       - name: Clone Ratspeak stack (rsReticulum, rsLXMF)
         env:
           WORKSPACE_ROOT: ${{ github.workspace }}/.rsstack
-          # Keep in sync with reticulum-sidecar.yaml / ratspeak-stack-ci-pins.env.
-          RS_RETICULUM_REF: e16bd152256a5caffb704446bbe15530c1b20f48
-          RS_LXMF_REF: c3d8b44942e7726dbbe6bb53e0976d4c72134119
-          RS_NOMAD_REF: ec6b6dde23addf9d8248b794238baaa6498fe171
         run: bash scripts/clone-ratspeak-stack.sh
 
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8

.github/workflows/reticulum-sidecar.yaml

@@ -3,14 +3,8 @@ name: Reticulum sidecar
 permissions:
   contents: read
 
-# Stacked Nomad file/metadata work: pin siblings until upstream PRs merge, then float again.
-# ratspeak/rsReticulum#26, ratspeak/rsLXMF#7 (rsNomad#7 merged — float). Keep in sync with
-# scripts/ratspeak-stack-ci-pins.env and RATSPEAK_STACK_PR_ENTRIES in scripts/update.sh.
-env:
-  RS_RETICULUM_REF: e16bd152256a5caffb704446bbe15530c1b20f48
-  RS_LXMF_REF: c3d8b44942e7726dbbe6bb53e0976d4c72134119
-  RS_NOMAD_REF: ec6b6dde23addf9d8248b794238baaa6498fe171
-
+# Float rsReticulum / rsLXMF / rsNomad to origin/main; open feature PRs are overlays
+# (see reticulum-sidecar/patches/README.md — ReplyFile #26, LXMF attachments #7).
 on:
   workflow_dispatch:
   push:

AGENTS.md

@@ -118,7 +118,7 @@ Adding a cross-boundary feature:
 
 **Local Linux CI (optional):** Container mode — `act:ci`, `act:tests`, `act:pr`, … (needs a Docker-compatible engine + act; Podman preferred). Host mode — `act:ci:native`, `act:tests:native`, … (no container engine). See [docs/ci-cd.md](docs/ci-cd.md). macOS/Windows packaging uses native `dist:mac` / `dist:win`. **`dist:mac`** / **`dist:mac:publish`** always run **`scripts/verify-mac-packaging.mjs`** (ZIP + DMG symlink asserts, no raw `.app` CI uploads). macOS signing env (`CSC_LINK`, `CSC_KEY_PASSWORD`, `APPLE_ID`, `APPLE_APP_SPECIFIC_PASSWORD`, `APPLE_TEAM_ID`, `CSC_IDENTITY_AUTO_DISCOVERY`) is scoped to **`macos-latest`** jobs in `release.yaml` / `build.yaml`; partial-secret validation fails the release job when `CSC_LINK` is set but notarization secrets are missing.
 
-> **Update script sync:** When adding or removing packages from `patchedDependencies` in `pnpm-workspace.yaml`, keep `WATCH_ENTRIES` in `scripts/update.sh` in sync so the script warns on version changes to every patched dependency. When adding or removing Ratspeak overlays under `reticulum-sidecar/patches/`, keep `RATSPEAK_PATCH_ENTRIES` in `scripts/update.sh` (`check_ratspeak_patches`) in sync — `pnpm run update` queries upstream PRs (rsReticulum / rsLXMF) and warns when a local overlay can be removed. Stacked **feature** PRs that mesh-client CI pins (not overlays) live in `RATSPEAK_STACK_PR_ENTRIES` + `scripts/ratspeak-stack-ci-pins.env` (`check_ratspeak_stack_prs`) — today [rsReticulum#26](https://github.com/ratspeak/rsReticulum/pull/26) and [rsLXMF#7](https://github.com/ratspeak/rsLXMF/pull/7); clear pins when those merge. It also runs `check_ratspeak_upstream` (watched **published** releases for rsLXST / lrgp-rs / Ratspeak vs `reviewed-ref` pins, plus new `ratspeak` org repos) — keep `RATSPEAK_RELEASE_WATCH_ENTRIES` / `RATSPEAK_KNOWN_ORG_REPOS` in sync when adopting libs. LXMFace is not a published-release watch: its baseline is a vendored-file commit (`file:js/lxmface.js@<sha>`) compared with the latest GitHub commit that touched that file. `scripts/clone-ratspeak-stack.sh` floats **rsReticulum** / **rsLXMF** / **rsNomad** / **rsLXST** / **lrgp-rs** to `origin/main` (override with `RS_RETICULUM_REF` / `RS_LXMF_REF` / `RS_NOMAD_REF` / `RS_LXST_REF` / `RS_LRGP_REF`); overlays must apply or the clone fails. Ratspeak release watch uses stub-kind `games-parity` to nudge Games tab review when a published release is newer than the pin (`docs/reticulum-games-parity.md`). Peer default avatars use vendored **LXMFace** (`src/renderer/lib/reticulum/lxmface.ts`). `pnpm run update` also runs `rustup update` (or Homebrew `rust` on macOS without rustup) and `cargo build` in `reticulum-sidecar/` when `cargo` is on `PATH` (full-feature build includes `nomad-core` / rsNomad).
+> **Update script sync:** When adding or removing packages from `patchedDependencies` in `pnpm-workspace.yaml`, keep `WATCH_ENTRIES` in `scripts/update.sh` in sync so the script warns on version changes to every patched dependency. When adding or removing Ratspeak overlays under `reticulum-sidecar/patches/`, keep `RATSPEAK_PATCH_ENTRIES` in `scripts/update.sh` (`check_ratspeak_patches`) in sync — `pnpm run update` queries upstream PRs (rsReticulum / rsLXMF) and warns when a local overlay can be removed. Open upstream feature work (e.g. [rsReticulum#26](https://github.com/ratspeak/rsReticulum/pull/26) ReplyFile, [rsLXMF#7](https://github.com/ratspeak/rsLXMF/pull/7) multi-file attachments) is carried as overlays on floated `origin/main` — never as committed SHA pins. It also runs `check_ratspeak_upstream` (watched **published** releases for rsLXST / lrgp-rs / Ratspeak vs `reviewed-ref` pins, plus new `ratspeak` org repos) — keep `RATSPEAK_RELEASE_WATCH_ENTRIES` / `RATSPEAK_KNOWN_ORG_REPOS` in sync when adopting libs. LXMFace is not a published-release watch: its baseline is a vendored-file commit (`file:js/lxmface.js@<sha>`) compared with the latest GitHub commit that touched that file. `scripts/clone-ratspeak-stack.sh` floats **rsReticulum** / **rsLXMF** / **rsNomad** / **rsLXST** / **lrgp-rs** to `origin/main` (override with `RS_RETICULUM_REF` / `RS_LXMF_REF` / `RS_NOMAD_REF` / `RS_LXST_REF` / `RS_LRGP_REF` for bisect only); overlays must apply or the clone fails. Ratspeak release watch uses stub-kind `games-parity` to nudge Games tab review when a published release is newer than the pin (`docs/reticulum-games-parity.md`). Peer default avatars use vendored **LXMFace** (`src/renderer/lib/reticulum/lxmface.ts`). `pnpm run update` also runs `rustup update` (or Homebrew `rust` on macOS without rustup) and `cargo build` in `reticulum-sidecar/` when `cargo` is on `PATH` (full-feature build includes `nomad-core` / rsNomad).
 
 **Pre-commit hook order:**
 

docs/ci-cd.md

@@ -90,7 +90,7 @@ Path-filtered on `reticulum-sidecar/**` and related scripts:
 1. **`lint` job (ubuntu-latest)** — `cargo fmt --check` + `cargo clippy` with `rns-stack,rns-ble,rns-rnode-tcp` (`-D warnings`)
 2. **Build matrix** — stub + full-stack `cargo test` and release builds on Linux, macOS, and Windows (including WoA arm64 jobs)
 
-CI and local **dev** clones float the `.rsstack/` workspace via `scripts/clone-ratspeak-stack.sh` to `origin/main` (overlays must apply; override with `RS_RETICULUM_REF` / `RS_LXMF_REF` / `RS_NOMAD_REF` / `RS_LXST_REF` / `RS_LRGP_REF` for bisect). When CI must build against open stacked ratspeak PRs, `scripts/ratspeak-stack-ci-pins.env` supplies defaults under `CI=true` (tracked by `RATSPEAK_STACK_PR_ENTRIES` in `scripts/update.sh`; see [reticulum-sidecar/patches/README.md](../reticulum-sidecar/patches/README.md#stacked-upstream-feature-prs-ci-pins)). **Release** packaging (`scripts/build-reticulum-sidecar-release.mjs`) runs the same clone and records the resolved commit SHAs for all five crates in `.rsstack/RESOLVED_SHAS.txt` so artifacts retain the exact source revisions used — pin via `RS_*_REF` when a release must not float.
+CI and local **dev** clones float the `.rsstack/` workspace via `scripts/clone-ratspeak-stack.sh` to `origin/main` (overlays must apply; optional `RS_RETICULUM_REF` / `RS_LXMF_REF` / `RS_NOMAD_REF` / `RS_LXST_REF` / `RS_LRGP_REF` for bisect only — CI never pins Ratspeak SHAs). Open upstream feature PRs needed before they land on `main` (e.g. [rsReticulum#26](https://github.com/ratspeak/rsReticulum/pull/26) ReplyFile, [rsLXMF#7](https://github.com/ratspeak/rsLXMF/pull/7) multi-file attachments) are carried as overlays under `reticulum-sidecar/patches/` and tracked by `RATSPEAK_PATCH_ENTRIES` in `scripts/update.sh`. **Release** packaging (`scripts/build-reticulum-sidecar-release.mjs`) runs the same clone and records the resolved commit SHAs for all five crates in `.rsstack/RESOLVED_SHAS.txt` so artifacts retain the exact source revisions used — set `RS_*_REF` only when a release must not float.
 
 Local parity: `pnpm run reticulum:sidecar:clippy:full`, `pnpm run check:reticulum-sidecar` (pre-commit full-feature). See [development-environment.md](development-environment.md#reticulum-sidecar-optional).
 
@@ -185,14 +185,14 @@ Automated dependency updates are configured in `.github/dependabot.yml`:
 - **GitHub Actions:** Grouped into one PR
 - **Open PRs:** `open-pull-requests-limit: 0` — Dependabot scans but does **not** open PRs.
   Dependency bumps are applied manually via `pnpm run update` (`scripts/update.sh`), which
-  also runs dedupe, Ratspeak overlay PR checks, stacked feature-PR pin watches
-  ([rsReticulum#26](https://github.com/ratspeak/rsReticulum/pull/26) ReplyFile,
-  [rsLXMF#7](https://github.com/ratspeak/rsLXMF/pull/7) multi-file attachments — see
-  `scripts/ratspeak-stack-ci-pins.env`), and an upstream release / new-org-repo watch
-  (rsLXST, lrgp-rs, Ratspeak Games-parity when a newer published release exists, LXMFace
-  `js/lxmface.js` commit). Sibling **rsReticulum** /
+  also runs dedupe, Ratspeak overlay PR checks
+  ([rsReticulum#26](https://github.com/ratspeak/rsReticulum/pull/26) ReplyFile and
+  [rsLXMF#7](https://github.com/ratspeak/rsLXMF/pull/7) multi-file attachments are overlays
+  on floated `origin/main` — see `reticulum-sidecar/patches/README.md`), and an upstream
+  release / new-org-repo watch (rsLXST, lrgp-rs, Ratspeak Games-parity when a newer published
+  release exists, LXMFace `js/lxmface.js` commit). Sibling **rsReticulum** /
   **rsLXMF** / **rsNomad** / **rsLXST** / **lrgp-rs** float to `origin/main` via
-  `clone-ratspeak-stack.sh` (overlays must apply; CI may pin open stacked PRs). See AGENTS.md §6.
+  `clone-ratspeak-stack.sh` (overlays must apply; no committed SHA pins). See AGENTS.md §6.
 
 ### Testing Dependabot PRs locally
 

docs/development-environment.md

@@ -119,7 +119,7 @@ pnpm run reticulum:sidecar:build
 
 This writes `reticulum-sidecar/target/debug/mesh-client-reticulum` (macOS/Linux) or `.exe` on Windows.
 
-**First-time / recover the stack workspace:** from the mesh-client repo root, run `./scripts/clone-ratspeak-stack.sh`. That script clones (or updates) the repo-local `.rsstack/` workspace checkouts `rsReticulum`, `rsLXMF`, `rsNomad`, `rsLXST`, and `lrgp-rs`, floats each to **`origin/main`** by default, and applies mesh-client overlays (fails if a patch will not apply). For bisect or a known-good pin, set `RS_RETICULUM_REF` / `RS_LXMF_REF` / `RS_NOMAD_REF` / `RS_LXST_REF` / `RS_LRGP_REF` to a SHA or ref before running the clone script.
+**First-time / recover the stack workspace:** from the mesh-client repo root, run `./scripts/clone-ratspeak-stack.sh`. That script clones (or updates) the repo-local `.rsstack/` workspace checkouts `rsReticulum`, `rsLXMF`, `rsNomad`, `rsLXST`, and `lrgp-rs`, floats each to **`origin/main`** by default, and applies mesh-client overlays (fails if a patch will not apply). For bisect only, set `RS_RETICULUM_REF` / `RS_LXMF_REF` / `RS_NOMAD_REF` / `RS_LXST_REF` / `RS_LRGP_REF` to a SHA or ref before running the clone script — CI and normal updates never pin Ratspeak SHAs.
 
 When those `.rsstack/` checkouts already exist, `pnpm run reticulum:sidecar:build` applies required overlays via `scripts/ensure-rsReticulum-patches.sh` before compiling with `rns-stack,rns-ble,rns-rnode-tcp`. See [`reticulum-sidecar/patches/README.md`](../reticulum-sidecar/patches/README.md) for overlay details.
 

docs/reticulum.md

@@ -492,7 +492,7 @@ Firmware `.zip` files are selected locally (no in-app GitHub download). Disconne
 
 ## Building the sidecar (development)
 
-`rns-stack` builds need the repo-local `.rsstack/` workspace checkouts `rsReticulum`, `rsLXMF`, `rsNomad`, `rsLXST`, and `lrgp-rs` (see `scripts/clone-ratspeak-stack.sh`). That script floats each to `origin/main` by default (bisect with `RS_RETICULUM_REF` / `RS_LXMF_REF` / `RS_NOMAD_REF` / `RS_LXST_REF` / `RS_LRGP_REF`) and applies mesh-client overlays for rsReticulum/rsLXMF (fails if a patch will not apply). CI may pin open stacked feature PRs ([rsReticulum#26](https://github.com/ratspeak/rsReticulum/pull/26), [rsLXMF#7](https://github.com/ratspeak/rsLXMF/pull/7)) via `scripts/ratspeak-stack-ci-pins.env` — tracked by `pnpm run update`. Peer list / detail default avatars use [LXMFace](https://github.com/ratspeak/LXMFace) (`src/renderer/lib/reticulum/lxmface.ts`) when no custom Lucide icon is set.
+`rns-stack` builds need the repo-local `.rsstack/` workspace checkouts `rsReticulum`, `rsLXMF`, `rsNomad`, `rsLXST`, and `lrgp-rs` (see `scripts/clone-ratspeak-stack.sh`). That script floats each to `origin/main` by default (optional bisect with `RS_RETICULUM_REF` / `RS_LXMF_REF` / `RS_NOMAD_REF` / `RS_LXST_REF` / `RS_LRGP_REF`) and applies mesh-client overlays for rsReticulum/rsLXMF (fails if a patch will not apply). Open upstream feature PRs such as [rsReticulum#26](https://github.com/ratspeak/rsReticulum/pull/26) and [rsLXMF#7](https://github.com/ratspeak/rsLXMF/pull/7) are carried as overlays (not SHA pins) — tracked by `pnpm run update`. Peer list / detail default avatars use [LXMFace](https://github.com/ratspeak/LXMFace) (`src/renderer/lib/reticulum/lxmface.ts`) when no custom Lucide icon is set.
 
 End users of **GitHub Releases** or **Flatpak** do not need Rust. Developers and contributors do.
 

package.json

@@ -149,7 +149,7 @@
     "@stoprocent/noble": "^2.8.0",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",
-    "@zip.js/zip.js": "^2.11.0",
+    "@zip.js/zip.js": "^2.14.0",
     "builder-util-runtime": "^9.7.0",
     "dompurify": "^3.4.15",
     "electron-updater": "^6.8.9",
@@ -158,7 +158,7 @@
     "i18next": "^26.4.2",
     "js-md5": "^0.8.3",
     "jsqr": "^1.4.0",
-    "jszip": "^3.10.1",
+    "jszip": "^3.10.2",
     "leaflet.markercluster": "^1.5.3",
     "lucide-react-motion": "^0.4.0",
     "mgrs": "^2.2.0",
@@ -170,7 +170,7 @@
     "react-leaflet-cluster": "^4.1.3",
     "readable-stream": "^4.7.0",
     "semver": "^7.8.5",
-    "systeminformation": "^5.33.8",
+    "systeminformation": "^5.33.10",
     "undici": "^8.10.2"
   },
   "devDependencies": {
@@ -183,24 +183,24 @@
     "@michaelhart/meshcore-decoder": "^0.3.0",
     "@playwright/test": "^1.63.0",
     "@tailwindcss/vite": "^4.3.3",
-    "@tanstack/react-virtual": "^3.14.10",
+    "@tanstack/react-virtual": "^3.14.11",
     "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.3",
     "@testing-library/user-event": "^14.6.7",
     "@types/js-md5": "^0.8.0",
     "@types/leaflet": "^1.9.22",
-    "@types/node": "^25.9.5",
+    "@types/node": "^25.9.6",
     "@types/node-forge": "^1.3.14",
     "@types/qrcode": "^1.5.6",
-    "@types/react": "^19.2.18",
-    "@types/react-dom": "^19.2.7",
-    "@typescript-eslint/eslint-plugin": "^8.69.0",
-    "@typescript-eslint/parser": "^8.69.0",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
+    "@typescript-eslint/eslint-plugin": "^8.70.0",
+    "@typescript-eslint/parser": "^8.70.0",
     "@vitejs/plugin-react": "^6.1.1",
     "@vitest/coverage-v8": "^4.1.11",
     "concurrently": "^9.2.4",
     "electron": "^44.1.1",
-    "electron-builder": "^26.16.0",
+    "electron-builder": "^26.16.1",
     "esbuild": "^0.28.2",
     "eslint": "^10.10.0",
     "eslint-config-prettier": "^10.1.8",
@@ -220,14 +220,14 @@
     "prettier": "^3.9.6",
     "prettier-plugin-sh": "^0.18.1",
     "prettier-plugin-tailwindcss": "^0.7.4",
-    "react": "^19.2.8",
-    "react-dom": "^19.2.8",
+    "react": "^19.3.0",
+    "react-dom": "^19.3.0",
     "react-leaflet": "^5.0.0",
     "recharts": "^3.10.1",
     "sort-package-json": "^3.7.1",
     "tailwindcss": "^4.3.3",
     "typescript": "^6.0.3",
-    "typescript-eslint": "^8.69.0",
+    "typescript-eslint": "^8.70.0",
     "vite": "^8.2.2",
     "vitest": "^4.1.11",
     "vitest-axe": "^1.0.0-pre.5",