Release DeskOS 1.8.0 for production

README.md

@@ -6,19 +6,19 @@
 
 <p align="center"><strong>A bright, touch-first MeshCore desk for the SenseCAP Indicator D1L.</strong></p>
 
-DeskOS **1.8.0-rc.6** is the release candidate for the SenseCAP Indicator D1L.
+DeskOS **1.8.0** is the stable release for the SenseCAP Indicator D1L.
 It uses the production `full_feature` profile with conditional SD-primary retained history
 (`conditional` storage mode).
 
-[Release candidate](https://github.com/n30nex/DeskOS-MeshCore/releases/tag/v1.8.0-rc.6)
+[Stable release](https://github.com/n30nex/DeskOS-MeshCore/releases/tag/v1.8.0)
 · [Browser flasher](https://flasher.canadaverse.org/)
 · [User guide](docs/USER_GUIDE_D1L.md)
 · [Product page](https://canadaverse.org/deskos/)
 
 The previous stable release is
 [1.7.12](https://github.com/n30nex/DeskOS-MeshCore/releases/tag/v1.7.12).
 
-## What the candidate improves
+## What is new in 1.8.0
 
 - **Received hop counts** use the saved packet path. A nearby Public message
   no longer appears as 63 hops because of a fixed companion placeholder.
@@ -70,7 +70,7 @@ The previous stable release is
 - An ordinary update can finish without optional SD storage. Fresh clean
   installations retain the complete three-stage verification.
 
-See the [candidate release notes](docs/RELEASE_NOTES_1.8.0-rc.6.md) for the full
+See the [release notes](docs/RELEASE_NOTES_1.8.0.md) for the full
 change and validation record. Earlier releases remain documented in the
 [roadmap](docs/ROADMAP.md) and their release notes.
 

docs/COMPANION_3BYTE_COMPATIBILITY.md

@@ -1,6 +1,6 @@
 # BLE and 3-Byte Companion Compatibility
 
-Updated for DeskOS 1.8.0-rc.6
+Updated for DeskOS 1.8.0
 
 MeshCore DeskOS D1L must be compatible with MeshCore companion clients in both meanings used by current MeshCore references.
 

docs/DESKOS_MESHCORE_FEATURE_PARITY.md

@@ -1,6 +1,6 @@
 # DeskOS interface and MeshCore parity
 
-This is the current product capability ledger for DeskOS 1.8.0-rc.6 on the
+This is the current product capability ledger for DeskOS 1.8.0 on the
 SenseCAP Indicator D1L. The original mobile baseline was reviewed on 2026-08-08 against the official
 [MeshCore Android listing](https://play.google.com/store/apps/details?id=com.liamcottle.meshcore.android)
 and [MeshCore iOS 1.47.0 listing](https://apps.apple.com/gb/app/meshcore/id6742354151).
@@ -30,7 +30,7 @@ the board/app documentation. DeskOS uses its own implementation and artwork;
 no WadaMesh source, fonts or assets were copied into the firmware.
 
 The target is a useful touch workflow on the 480×480 D1L. Existing phone
-interoperability remains required. **This candidate does not claim complete
+interoperability remains required. **This release does not claim complete
 WadaMesh feature parity.** The older mobile-completion states below do not
 close the additional differences in this table.
 

docs/KNOWN_LIMITATIONS.md

@@ -1,4 +1,4 @@
-# DeskOS D1L 1.8.0-rc.6 limitations
+# DeskOS D1L 1.8.0 limitations
 
 The RC1 channel dead-end (#320) and Contacts navigation gap (#321) are fixed in
 the 1.2 implementation. These are the remaining intentional product limits:
@@ -37,7 +37,7 @@ SD-primary storage.
 - New messages use a plausible sender timestamp or the trusted local arrival
   time. Older retained rows without either remain labelled `time unknown`.
 - Optional Indicator temperature, humidity, and CO2 sensor integration remains
-  future work and is not represented as live data in 1.8.0-rc.6.
+  future work and is not represented as live data in 1.8.0.
 
 See [`DESKOS_MESHCORE_FEATURE_PARITY.md`](DESKOS_MESHCORE_FEATURE_PARITY.md)
 for the complete mobile-to-D1L outcome matrix.
@@ -49,6 +49,6 @@ editable plain-text excerpts, without structured cross-client quote identifiers.
 Drafts use prepared SD and remain session-only without it; the 72-entry limit
 never silently evicts another draft. Clipboard text stays on this D1L and
 clears when locked or restarted. See the pinned WadaMesh section of the existing parity
-record for each area. This candidate retains the earlier physical acceptance
-limits: candidate-specific phone results belong in the release record, and signed
-SD installation/rollback and an RP2040 reflash need separate physical tests.
+record for each area. Exact hardware acceptance and any remaining test limits belong in the tagged
+release record. A stable release does not claim complete WadaMesh parity or
+sensor responses that were not observed.

docs/RC1_RELEASE_EXECUTION_D1L.md

@@ -1,9 +1,9 @@
 # DeskOS D1L release execution
 
-## Current release procedure: 1.8.0-rc.6
+## Current release procedure: 1.8.0
 
-The maintainer re-enabled GitHub Actions for RC6. Dispatch the existing
-`d1l-ci` workflow on the exact candidate ref with the SD bridge included.
+The maintainer re-enabled GitHub Actions for the 1.8 production release. Dispatch the existing
+`d1l-ci` workflow on the exact release ref with the SD bridge included.
 Require successful host checks, MeshCore conformance, RP2040 build and ESP32
 build/packaging jobs. Download that run's `d1l-release-package` artifact and
 verify its source commit, manifest, signed update and checksums. Use that
@@ -40,7 +40,7 @@ requests it. The 1.0 procedure below is historical.
 5. Verify the exact running version/commit, identity, display, radio and
    retained storage. Exercise the changed behavior using production firmware.
    Record any physical update/phone paths that were not exercised explicitly.
-6. Merge the tested source, tag `v1.8.0-rc.6`, and publish it as a prerelease.
+6. Merge the tested source, tag `v1.8.0`, and publish it as the latest stable release after acceptance.
    Freshly download every asset and compare its bytes with staging. Update the
    existing flasher catalog and Canadaverse DeskOS page, then verify their
    public content and downloads. Remove obsolete build outputs only after

docs/RELEASE_CHECKLIST.md

@@ -9,9 +9,9 @@ SD-primary retained history when prepared storage is ready, visible live-only
 operation otherwise, and without silent default-NVS fallback. Historical RC2
 artifacts remain bound to their original `core_1_0` profile.
 
-## 1.8.0-rc.6 release candidate
+## 1.8.0 production release
 
-The maintainer re-enabled GitHub Actions for this candidate. Use the existing
+The maintainer re-enabled GitHub Actions for this production release. Use the existing
 workflow's exact-source signed package; the attached D1L remains the physical
 acceptance target on the Pi 5.
 
@@ -38,7 +38,7 @@ acceptance target on the Pi 5.
   are not new-candidate phone acceptance.
 - Exercise the actual flasher console against the D1L and verify its normal
   update, clean-install, failure and storage readiness paths locally.
-- Publish `v1.8.0-rc.6` as a prerelease tied to the tested source. Freshly
+- Publish `v1.8.0` as the latest stable release tied to the tested source. Freshly
   download and compare every public asset, update the product page and flasher,
   and verify public downloads and desktop/mobile layouts.
 - Retain the signed release, a device recovery copy and deployment rollback;

docs/RELEASE_NOTES_1.8.0.md

@@ -0,0 +1,47 @@
+# DeskOS D1L 1.8.0
+
+DeskOS 1.8 brings the candidate-series improvements into the stable product
+for the SenseCAP Indicator D1L. It uses the full-feature profile with prepared
+SD storage for retained history and explicit live-only operation without SD.
+
+## Everyday use
+
+- Shared Chats, paged saved/discovered Contacts, Profile editing and six
+  editable quick replies make the touch interface easier to navigate.
+- Conversation drafts save to prepared SD and return after restart.
+  Plain-text quote replies and the local clipboard preserve the current draft.
+- Buffered USB input keeps complete contact imports and longer console
+  commands intact while startup, storage or a preceding response is busy.
+- Bluetooth channel sends wait for radio acceptance. A stuck radio has a
+  bounded recovery path and cannot silently leave later sends blocked.
+- Received phone messages report their stored hop count. Nearby channel
+  messages no longer show a fixed 63-hop placeholder. Older phone-cached
+  messages retain their history rather than being erased by the update.
+- Contact telemetry has sufficient companion-worker stack. Nearby discovery,
+  contact edits, confirmed DMs and authenticated repeater management retain
+  their explicit success, timeout and permission boundaries.
+- Signed local-SD updates verify the image before and after writing the
+  inactive slot. The bootloader can return to the preceding image when a new
+  image fails boot acceptance. The update screen reports that rollback and
+  refreshes the security counter after a confirmed boot. Receipt-write failures
+  report an error instead of confirmation. USB remains the recovery path.
+
+## Installation
+
+Existing DeskOS devices should use the preserving update, keeping identity,
+contacts, settings and SD data. Fresh installation uses the full-clean ESP32
+image, complete RP2040 bridge and a prepared FAT32 card. No firmware or helper
+formats the card. The package includes both USB paths, signed SD update files,
+checksums and the installation guide.
+
+## Acceptance and scope
+
+The tagged GitHub release records the final clean source, Actions run,
+artifact hashes, physical update/radio/phone results and any remaining limits.
+Only observed results count as hardware acceptance. Radio telemetry and
+discovery depend on compatible responding peers and their permissions.
+
+This release does not claim complete WadaMesh parity. English-only UI,
+138-byte message text, exclusive Wi-Fi/Bluetooth modes, no onboard GPS or
+battery sensor, and the documented unsupported advanced phone commands remain
+the product boundaries. See KNOWN_LIMITATIONS.md and the compatibility guide.

docs/ROADMAP.md

@@ -23,7 +23,8 @@
 | **1.8.0-rc.3** | WadaMesh-guided Chats, paged Contacts and filters, Profile, quick replies, and clearer device controls | Previous candidate |
 | **1.8.0-rc.4** | Conversation drafts, plain-text quoted replies and on-device clipboard | Previous candidate; radio BUSY stall reproduced after release |
 | **1.8.0-rc.5** | Bounded radio recovery, confirmed companion sends, phone discovery/telemetry and reliable contact edits | Previous candidate; received-path label and phone telemetry restart reproduced |
-| **1.8.0-rc.6** | Correct received hop counts and sufficient companion telemetry stack | Corrective candidate; exact acceptance recorded in the tagged release |
+| **1.8.0-rc.6** | Correct received hop counts and sufficient companion telemetry stack | Published corrective candidate |
+| **1.8.0** | Production release of the 1.8 messaging, companion and update improvements | Production acceptance and exact artifacts recorded in the tagged release |
 
 The release firmware is the ordinary public product. A controlled peer, Wi-Fi
 credentials, admin password, soak run, qualification firmware, or validation
@@ -255,3 +256,19 @@ fixed marker, including multi-hop DMs, and gives the companion worker the same
 stack budget as the radio owner. USB diagnostics expose its minimum free
 stack so the physical test can verify the remaining margin. It preserves
 existing message stores and does not erase already-cached phone history.
+
+## 1.8.0: production release
+
+The stable release collects the 1.8 candidate improvements: conversation
+drafts, quotes and clipboard; paged Chats/Contacts and editable Profile/quick
+replies; bounded radio recovery; confirmed phone sends and correct receive
+paths; and signed local-SD updates with flash verification and rollback.
+The final release record identifies the exact Actions package and physical
+device observations. Missing remote responses must remain explicit.
+
+Subsequent feature work remains separate: mentions, adjustable text size,
+language/keyboard improvements, automatic daylight-saving handling,
+selectable contact admission policies, and additional phone commands.
+Optional sensors and the WadaMesh Lua/web/remote application suite are future
+scope decisions. UI modularization (#6) and developer-check consolidation
+(#17) remain maintenance work rather than stable-release requirements.

docs/USER_GUIDE_D1L.md

@@ -1,6 +1,6 @@
-# MeshCore DeskOS D1L 1.8.0-rc.6 User Guide
+# MeshCore DeskOS D1L 1.8.0 User Guide
 
-## Phone receive paths and telemetry in 1.8.0-rc.6
+## Phone receive paths and telemetry in 1.8.0
 
 Incoming channel messages report the received packet's hop count, including
 zero hops when no repeater forwarded it. The radio path can differ from the
@@ -307,7 +307,9 @@ restart before attempting another install. Updates cannot be triggered over RF.
 
 When the write completes, choose **Reboot to Update** and confirm it. The new
 image starts in pending-verification state. A successful normal boot confirms
-it; a failed boot rolls back to the previous working slot. The published USB
+it; a failed boot rolls back to the previous working slot. The update screen
+reports that rollback. SD updates can take tens of minutes; keep D1L powered
+until the reboot prompt appears. The published USB
 app BIN and full-clean 8 MB BIN remain the recovery paths if local update is
 unavailable.
 

main/app_main.c

@@ -50,6 +50,9 @@ void app_main(void)
         ESP_LOGE(TAG, "secure random unavailable; identity/channel creation disabled: %s",
                  esp_err_to_name(secure_random_ret));
     }
+    /* Buffer UART input before startup/storage work or either console can
+     * delay consuming a complete host command. */
+    ESP_ERROR_CHECK(d1l_usb_console_init());
     esp_err_t nvs_ret = nvs_flash_init();
     d1l_health_monitor_init(nvs_ret);
     d1l_event_log_init();

main/comms/usb_console.c

@@ -8,6 +8,8 @@
 #include <stdlib.h>
 #include <string.h>
 
+#include "driver/uart.h"
+#include "driver/uart_vfs.h"
 #include "esp_attr.h"
 #include "esp_err.h"
 #include "esp_heap_caps.h"
@@ -9911,6 +9913,24 @@ static void handle_line(const d1l_usb_command_view_t *command)
     }
 }
 
+esp_err_t d1l_usb_console_init(void)
+{
+#if CONFIG_ESP_CONSOLE_UART
+    const uart_port_t port = (uart_port_t)CONFIG_ESP_CONSOLE_UART_NUM;
+    if (!uart_is_driver_installed(port)) {
+        /* The polling VFS only has the hardware FIFO. A complete contact URI
+         * can exceed it while the console is emitting the preceding reply. */
+        const esp_err_t ret = uart_driver_install(port, 1024, 0, 0, NULL, 0);
+        if (ret != ESP_OK) {
+            return ret;
+        }
+    }
+    uart_vfs_dev_use_driver(port);
+#endif
+    setvbuf(stdin, NULL, _IONBF, 0);
+    return ESP_OK;
+}
+
 void d1l_usb_console_run(void)
 {
     static char line[256] EXT_RAM_BSS_ATTR;

main/comms/usb_console.h

@@ -1,7 +1,9 @@
 #pragma once
 
+#include "esp_err.h"
 #include "storage/factory_reset.h"
 
+esp_err_t d1l_usb_console_init(void);
 void d1l_usb_console_run(void);
 void d1l_usb_console_run_factory_reset_recovery(
     const d1l_factory_reset_status_t *boot_status);

main/d1l_config.h

@@ -1,7 +1,7 @@
 #pragma once
 
 #define D1L_FIRMWARE_NAME "MeshCore DeskOS D1L"
-#define D1L_FIRMWARE_VERSION "1.8.0-rc.6"
+#define D1L_FIRMWARE_VERSION "1.8.0"
 #define D1L_CONSOLE_SCHEMA 1
 
 #define D1L_DISPLAY_WIDTH 480