@alteriom/painlessmesh 2.0.2 → 2.0.3

package/src/painlessmesh/gateway.hpp

@@ -568,6 +568,8 @@ class InternetHealthChecker {
    * @return true if connection succeeded
    */
   bool checkNow() {
+    // A full probe answers the question the on-demand budget exists for.
+    onDemandSpent_ = false;
     status_.checkCount++;
     status_.lastCheckTime = millis();
 
@@ -592,6 +594,27 @@ class InternetHealthChecker {
     return connected;
   }
 
+  /**
+   * @brief Probe once outside the schedule, for a caller that needs the
+   *        answer now (issue #450)
+   *
+   * A bridge's first periodic probe runs while its station is still
+   * associating and fails, and the next is a full interval away. A send in
+   * that window may spend one extra probe to learn that the uplink has come
+   * up since. One: the probe is a blocking connect with a timeout, so the
+   * budget is a single on-demand probe per periodic one. A node whose uplink
+   * really is down pays it once per interval, not on every call.
+   *
+   * @return true if Internet is reachable now
+   */
+  bool checkOnDemand() {
+    if (status_.available) return true;
+    if (onDemandSpent_) return false;
+    const bool connected = checkNow();
+    onDemandSpent_ = true;
+    return connected;
+  }
+
   /**
    * @brief Get check interval
    * @return Check interval in milliseconds
@@ -667,6 +690,13 @@ class InternetHealthChecker {
     status_.lastError = "Mock: No Internet in test environment";
     return false;
 #elif defined(ESP32) || defined(ESP8266)
+    // No station, no uplink: answer at once instead of spending the connect
+    // timeout on a link that does not exist. This is what keeps the
+    // on-demand probe cheap on a bridge whose router is down.
+    if (WiFi.status() != WL_CONNECTED) {
+      status_.lastError = "Station not connected";
+      return false;
+    }
     WiFiClient client;
     uint32_t started = millis();
 #ifdef ESP32
@@ -704,6 +734,7 @@ class InternetHealthChecker {
   // State
   InternetStatus status_;
   InternetChangedCallback_t connectivityChangedCallback_;
+  bool onDemandSpent_ = false;
 
 #ifdef PAINLESSMESH_BOOST
   bool mockConnected_ = false;
@@ -988,19 +1019,126 @@ struct HttpRequestOutcome {
 
   /** True when the client failed before any HTTP status was received. */
   bool transportError = false;
+
+  /**
+   * True when the status was success-class but the response body said the
+   * service refused the request (issue #450).
+   */
+  bool refusedByBody = false;
+
+  /**
+   * True for a 2xx the gateway cannot vouch for: anything but 200, 201, 202
+   * and 204. CallMeBot answers HTTP 208 to a message that never arrives
+   * (issue #452), so a status outside the verified set is reported as a
+   * failure that carries the body, never as a delivery.
+   */
+  bool unverifiedStatus = false;
+
+  /**
+   * One-line reason for a failure, taken from the response body when there
+   * is one; empty on success. Sized to fit a GatewayAckPackage::error.
+   */
+  TSTRING reason;
 };
 
+/** Longest response-body excerpt carried in an acknowledgment error. */
+static const size_t GATEWAY_RESPONSE_REASON_MAX = 120;
+
+/**
+ * How much of a response body the gateway reads for classification and for
+ * the error it reports. Enough for a service's one-line verdict, small enough
+ * that an HTML error page cannot eat an ESP8266's heap.
+ */
+static const size_t GATEWAY_RESPONSE_HEAD_BYTES = 512;
+
+/** How long the gateway waits for that head to arrive after the status. */
+static const uint32_t GATEWAY_RESPONSE_HEAD_TIMEOUT_MS = 250;
+
+inline bool responseContains(const TSTRING& haystack, const char* needle) {
+#if defined(PAINLESSMESH_BOOST)
+  return haystack.find(needle) != std::string::npos;
+#else
+  return haystack.indexOf(needle) >= 0;
+#endif
+}
+
+/**
+ * @brief Reduce a response body to one line fit for a log or an error string
+ *
+ * Tags are dropped, whitespace collapsed and the result cut at maxLen with an
+ * ellipsis, so an HTML error page reads "Oops! Too many requests... You have
+ * called to the API to often." in a serial log instead of markup.
+ */
+inline TSTRING summarizeResponseBody(
+    const TSTRING& body, size_t maxLen = GATEWAY_RESPONSE_REASON_MAX) {
+  TSTRING out;
+  bool inTag = false;
+  bool pendingSpace = false;
+  for (size_t i = 0; i < body.length(); ++i) {
+    const char c = body[i];
+    if (c == '<') {
+      inTag = true;
+      continue;
+    }
+    if (c == '>') {
+      inTag = false;
+      pendingSpace = true;
+      continue;
+    }
+    if (inTag) continue;
+    if (c == ' ' || c == '\t' || c == '\r' || c == '\n') {
+      pendingSpace = true;
+      continue;
+    }
+    if (pendingSpace && out.length() > 0) out += ' ';
+    pendingSpace = false;
+    out += c;
+    if (out.length() >= maxLen) {
+      out += "...";
+      break;
+    }
+  }
+  return out;
+}
+
+/**
+ * @brief Does a success-class response body say the service refused the request?
+ *
+ * Some services answer a refusal with a 2xx. CallMeBot's WhatsApp API, which
+ * the sendToInternet example integrates, returns its "Too many requests" page
+ * under HTTP 201 and HTTP 203 (issue #450). The phrases are the ones seen
+ * from services this library's examples target, and they are deliberately
+ * specific: a JSON payload that merely contains the word "error" is not a
+ * refusal.
+ */
+inline bool responseBodyRefuses(const TSTRING& body) {
+  static const char* const REFUSALS[] = {"Too many requests", "Oops!"};
+  for (const char* phrase : REFUSALS) {
+    if (responseContains(body, phrase)) return true;
+  }
+  return false;
+}
+
 /**
- * @brief Classify an HTTPClient return value for the gateway acknowledgment
+ * @brief Classify an HTTPClient result for the gateway acknowledgment
  *
- * Only 200, 201, 202 and 204 count as success. Other 2xx codes (notably 203,
- * Non-Authoritative Information) indicate a cached or proxied response rather
- * than delivery to the destination service, so they are failures.
+ * A transport error (rawCode <= 0) is neither success nor an HTTP status.
+ * Only 200, 201, 202 and 204 count as delivery on the status alone, and even
+ * those are overturned by a body that says the service refused the request:
+ * CallMeBot answers "Too many requests" under 201 and 203 (issue #450). Any
+ * other 2xx is unverified. 203 means a proxy transformed the reply; 208 is
+ * what CallMeBot answers to a message that never arrives (issue #452); none
+ * of them is a delivery this library can vouch for, so they are failures
+ * that carry the body. Every failure's reason is a one-line excerpt of the
+ * body when there is one, so the origin node learns why and not only a
+ * number.
  *
  * @param rawCode The int returned by HTTPClient::GET() or ::POST()
+ * @param body The start of the response body, empty if none was read
  * @return Classified outcome, safe to place in a GatewayAckPackage
  */
-inline HttpRequestOutcome classifyHttpResult(int rawCode) {
+inline HttpRequestOutcome classifyHttpResult(int rawCode,
+                                             const TSTRING& body = TSTRING()) {
   HttpRequestOutcome outcome;
   if (rawCode <= 0) {
     outcome.transportError = true;
@@ -1008,11 +1146,151 @@ inline HttpRequestOutcome classifyHttpResult(int rawCode) {
   }
   outcome.ackStatus =
       static_cast<uint16_t>(rawCode > 0xFFFF ? 0xFFFF : rawCode);
-  outcome.success = (rawCode == 200 || rawCode == 201 || rawCode == 202 ||
-                     rawCode == 204);
+  const bool verified =
+      rawCode == 200 || rawCode == 201 || rawCode == 202 || rawCode == 204;
+  if (verified && responseBodyRefuses(body)) {
+    outcome.refusedByBody = true;
+    outcome.reason = summarizeResponseBody(body);
+    return outcome;
+  }
+  outcome.success = verified;
+  if (!verified) {
+    outcome.unverifiedStatus = rawCode >= 200 && rawCode < 300;
+    outcome.reason = summarizeResponseBody(body);
+  }
   return outcome;
 }
 
+/**
+ * The phrase a node puts in a failed GATEWAY_ACK when it received a gateway
+ * request but serves none: a bridge that rebooted, crashed or was reflashed
+ * as a regular node announces nothing, and its peers keep routing Internet
+ * requests to it until its last bridge status ages out. The origin node
+ * recognises the phrase, forgets that node as a gateway, and retries through
+ * the next one. Changing it breaks that recognition across a mixed fleet.
+ */
+static const char GATEWAY_NOT_A_GATEWAY_PHRASE[] = "is not an Internet gateway";
+
+/**
+ * How long a destination whose name failed to resolve is refused without
+ * another lookup (issue #453). On ESP32 a DNS lookup has no timeout this
+ * library can set, so a dead name stalls the cooperative scheduler for the
+ * resolver's own patience; once a minute is survivable, once per attempt --
+ * with the origin node retrying and the bridge's own sends adding theirs --
+ * was not. On ESP8266 the core bounds HTTPClient's own lookup by the HTTP
+ * timeout, so the gateway performs no separate lookup there and this cache
+ * is never fed.
+ */
+static const uint32_t GATEWAY_DNS_NEGATIVE_TTL_MS = 60000;
+
+/**
+ * @brief The host of an http(s) URL, without scheme, port, path or query
+ *
+ * "https://api.example.com:8443/x?y" -> "api.example.com". Empty when the
+ * URL has no host.
+ */
+inline TSTRING hostFromUrl(const TSTRING& url) {
+  const char* s = url.c_str();
+  const size_t n = url.length();
+  size_t i = 0;
+  for (size_t k = 0; k + 2 < n; ++k) {
+    if (s[k] == ':' && s[k + 1] == '/' && s[k + 2] == '/') {
+      i = k + 3;
+      break;
+    }
+  }
+  size_t j = i;
+  while (j < n && s[j] != '/' && s[j] != '?' && s[j] != '#' && s[j] != ':') ++j;
+  TSTRING host;
+  for (size_t k = i; k < j; ++k) host += s[k];
+  return host;
+}
+
+/** True for a dotted-decimal IPv4 literal, which needs no DNS. */
+inline bool looksLikeIpLiteral(const TSTRING& host) {
+  if (host.length() == 0) return false;
+  for (size_t i = 0; i < host.length(); ++i) {
+    const char c = host[i];
+    if (!(c >= '0' && c <= '9') && c != '.') return false;
+  }
+  return true;
+}
+
+/**
+ * @brief A few hosts that recently failed to resolve, and when
+ *
+ * Small and fixed: a gateway talks to a handful of destinations. A host is
+ * remembered with a TTL; while it is within it, isFailing() says so and the
+ * caller answers the request without a lookup.
+ */
+class NegativeDnsCache {
+ public:
+  // An enum, not a static const member: the test suite passes it to Catch2 by
+  // reference, which needs a definition C++14 cannot give an in-class
+  // constant without an out-of-line one.
+  enum : size_t { SLOTS = 4 };
+
+  void remember(const TSTRING& host, uint32_t nowMs,
+                uint32_t ttlMs = GATEWAY_DNS_NEGATIVE_TTL_MS) {
+    Entry* slot = find(host);
+    if (slot == nullptr) {
+      slot = &entries_[0];
+      for (size_t i = 0; i < SLOTS; ++i) {
+        if (!entries_[i].used) {
+          slot = &entries_[i];
+          break;
+        }
+        if (static_cast<int32_t>(entries_[i].at - slot->at) < 0) slot = &entries_[i];
+      }
+    }
+    slot->used = true;
+    slot->host = host;
+    slot->at = nowMs;
+    slot->ttl = ttlMs;
+  }
+
+  /** Is `host` inside its negative TTL? `ageMs` receives how long ago it failed. */
+  bool isFailing(const TSTRING& host, uint32_t nowMs, uint32_t* ageMs = nullptr) {
+    Entry* slot = find(host);
+    if (slot == nullptr) return false;
+    const uint32_t age = nowMs - slot->at;
+    if (age >= slot->ttl) {
+      slot->used = false;
+      return false;
+    }
+    if (ageMs != nullptr) *ageMs = age;
+    return true;
+  }
+
+  void forget(const TSTRING& host) {
+    Entry* slot = find(host);
+    if (slot != nullptr) slot->used = false;
+  }
+
+  size_t size() const {
+    size_t n = 0;
+    for (size_t i = 0; i < SLOTS; ++i) n += entries_[i].used ? 1 : 0;
+    return n;
+  }
+
+ private:
+  struct Entry {
+    TSTRING host;
+    uint32_t at = 0;
+    uint32_t ttl = 0;
+    bool used = false;
+  };
+
+  Entry* find(const TSTRING& host) {
+    for (size_t i = 0; i < SLOTS; ++i) {
+      if (entries_[i].used && entries_[i].host == host) return &entries_[i];
+    }
+    return nullptr;
+  }
+
+  Entry entries_[SLOTS];
+};
+
 /**
  * @brief Gateway Acknowledgment Package for delivery confirmations
  *
@@ -1262,13 +1540,15 @@ class GatewayAckPackage : public plugin::SinglePackage {
  * GATEWAY_DNS_TIMEOUT_MS on ESP8266, skipped on ESP32) runs before them
  * whenever the GATEWAY_CONNECTIVITY_CACHE_MS window has expired.
  *
- * @warning One residual is not in this budget: the HTTP calls resolve their
- *          hostnames inside the platform core before their socket timeout
- *          applies, and on ESP32 that in-request resolver wait is not
- *          separately boundable in the cores this library targets. On a
- *          network with blackholed DNS the request path can therefore still
- *          exceed this ceiling on ESP32. See SECURITY.md "Gateway blocking:
- *          the mesh partition risk".
+ * @warning One residual is not in this budget: hostname resolution on ESP32
+ *          is not separately boundable in the cores this library targets.
+ *          Since issue #453 the handler performs that lookup itself on
+ *          ESP32 and remembers a failure for GATEWAY_DNS_NEGATIVE_TTL_MS, so
+ *          on a network with blackholed DNS the request path can still
+ *          exceed this ceiling on ESP32, but at most once per TTL per
+ *          destination host rather than once per attempt. On ESP8266 the
+ *          core bounds HTTPClient's own lookup by the HTTP timeout. See
+ *          SECURITY.md "Gateway blocking: the mesh partition risk".
  */
 constexpr unsigned long gatewayBlockingBudgetMs() {
   return 2UL * static_cast<unsigned long>(GATEWAY_HTTP_TIMEOUT_MS) +

package/src/painlessmesh/logger.hpp

@@ -30,6 +30,19 @@ typedef enum {
   DEBUG = 1 << 11
 } LogLevel;
 
+// Log() is printf-like. In the desktop test build the compiler is told so,
+// and -Wall -Werror in CI then rejects any argument that does not match its
+// specifier. That class of bug reached main twice in routePackage(): size_t
+// through %d/%u, and a DeserializationError object through %u (CodeQL
+// cpp/wrong-type-format-argument). The check is kept to the desktop build on
+// purpose: ESP-IDF 5 makes uint32_t `unsigned long`, so on ESP32 every %u of
+// a node id would warn, harmlessly, in every user's build.
+#if defined(PAINLESSMESH_BOOST) && defined(__GNUC__)
+#define PAINLESSMESH_LOG_FORMAT __attribute__((format(printf, 3, 4)))
+#else
+#define PAINLESSMESH_LOG_FORMAT
+#endif
+
 class LogClass {
  public:
   // Where messages go instead of Serial. The sketch owns framing: on a board
@@ -83,7 +96,7 @@ class LogClass {
     Serial.println();
     return;
   }
-  void operator()(LogLevel type, const char *format...) {
+  void operator()(LogLevel type, const char *format...) PAINLESSMESH_LOG_FORMAT {
     if (type & types) {  // Print only the message types set for output
       va_list args;
       va_start(args, format);

package/src/painlessmesh/mesh.hpp

@@ -98,6 +98,9 @@ struct PendingInternetRequest {
   TSTRING destination = "";        ///< Internet destination URL
   TSTRING payload = "";            ///< Request payload
   internetResultCallback_t callback;  ///< User callback for result
+  /// Why the last attempt failed, when retries were spent waiting for a
+  /// gateway; the final callback reports it instead of a bare retry count.
+  TSTRING lastError = "";
 
   /**
    * Check if this request has timed out
@@ -243,6 +246,37 @@ class Mesh : public ntp::MeshTime, public plugin::PackageHandler<T> {
     painlessmesh::ntp::addPackageCallback(this->callbackList, (*this));
     painlessmesh::router::addPackageCallback(this->callbackList, (*this));
 
+    // Every node answers a gateway request it cannot serve. A bridge that
+    // reboots, crashes or is reflashed as a regular node announces nothing
+    // -- only a bridge stepping down in-process sends `leaving` -- so its
+    // peers keep it in knownBridges until its last status ages out
+    // (bridgeTimeoutMs, 60 s) and may route every Internet request to it.
+    // A regular node had no GATEWAY_DATA handler and dropped them without a
+    // word; the origin waited out its request timeout, 30 s, each time.
+    // Found on the HIL rig while validating 2.0.3.
+    //
+    // Registered first, so a gateway's own handler (initGatewayInternetHandler
+    // in wifi.hpp, or a test's stand-in) is always the second: this one
+    // stays silent whenever any other GATEWAY_DATA handler exists.
+    this->callbackList.onPackage(
+        protocol::GATEWAY_DATA,
+        [this](protocol::Variant& variant, std::shared_ptr<T> ingress,
+               uint32_t) {
+          if (this->callbackList.count(protocol::GATEWAY_DATA) > 1) {
+            return false;  // this node is a gateway; its handler answers
+          }
+          auto pkg = variant.to<gateway::GatewayDataPackage>();
+          char errorBuf[96];
+          snprintf(errorBuf, sizeof(errorBuf), "Node %u %s",
+                   static_cast<unsigned>(this->nodeId),
+                   gateway::GATEWAY_NOT_A_GATEWAY_PHRASE);
+          Log(logger::ERROR,
+              "GATEWAY_DATA from node %u answered: %s\n",
+              static_cast<unsigned>(pkg.originNode), errorBuf);
+          this->sendGatewayAck(pkg, false, 0, TSTRING(errorBuf), ingress);
+          return true;
+        });
+
     // Seed delivery-confirmation ids with a random value so they do not
     // restart at 1 after a reboot — a delayed ACK for a pre-reboot
     // message could otherwise match a fresh message's id and report a
@@ -1349,7 +1383,8 @@ class Mesh : public ntp::MeshTime, public plugin::PackageHandler<T> {
     
     size_t removed = sizeBefore - knownBridges.size();
     if (removed > 0) {
-      Log(GENERAL, "cleanupExpiredBridges(): Removed %u expired bridges\n", removed);
+      Log(GENERAL, "cleanupExpiredBridges(): Removed %lu expired bridges\n",
+          static_cast<unsigned long>(removed));
     }
   }
 
@@ -1432,6 +1467,31 @@ class Mesh : public ntp::MeshTime, public plugin::PackageHandler<T> {
     return internetHealthChecker.hasLocalInternet();
   }
 
+  /**
+   * Can this node serve a gateway request on its own uplink right now?
+   *
+   * hasLocalInternet() is the last periodic probe's answer. On a bridge the
+   * first probe runs while the station is still associating and fails, and
+   * the next is a full interval (30 s) away, so for that whole window a send
+   * fell through to the mesh path and was refused for want of a peer (issue
+   * #450). When the flag says no and the health check is running, spend the
+   * one on-demand probe the checker allows per period: a send made after the
+   * uplink came up is then served locally, and a node whose uplink really is
+   * down pays one probe per interval, not one per call.
+   *
+   * @return true if the request should go to this node's own gateway handler
+   */
+  bool uplinkServesLocally() {
+    if (hasLocalInternet()) return true;
+    if (!isInternetHealthCheckEnabled()) return false;
+    if (internetHealthChecker.checkOnDemand()) {
+      Log(logger::COMMUNICATION,
+          "uplinkServesLocally(): on-demand probe found the uplink up\n");
+      return true;
+    }
+    return false;
+  }
+
   /**
    * Register callback for local Internet connectivity changes
    * 
@@ -1672,7 +1732,7 @@ class Mesh : public ntp::MeshTime, public plugin::PackageHandler<T> {
     // A shared gateway can execute its own gateway package locally. Keep the
     // same package handler, pending-request tracking and callback semantics,
     // but do not require a mesh peer merely to reach this node's own uplink.
-    if (hasLocalInternet()) {
+    if (uplinkServesLocally()) {
       PendingInternetRequest request;
       request.messageId = messageId;
       request.timestamp = millis();
@@ -1935,6 +1995,65 @@ class Mesh : public ntp::MeshTime, public plugin::PackageHandler<T> {
   /**
    * Handle incoming gateway acknowledgment package
    */
+ public:
+  // Public: the gateway handler in wifi.hpp, a derived class, answers with it.
+  /**
+   * Answer a gateway request: send its GATEWAY_ACK back to the origin node.
+   *
+   * A request this node originated completes locally, without a mesh hop.
+   * Otherwise the ack is routed to the origin; when the NodeTree has not yet
+   * converged enough for findRoute() to resolve it -- a freshly promoted
+   * gateway can receive data before that -- the connection the request
+   * arrived on is a valid reverse path, since every intermediate node routes
+   * the addressed ack onward toward the origin.
+   *
+   * Used by the gateway's own handler (wifi.hpp) and by the fallback every
+   * node registers for requests it cannot serve.
+   */
+  void sendGatewayAck(const gateway::GatewayDataPackage& request, bool success,
+                      uint16_t httpStatus, const TSTRING& error,
+                      std::shared_ptr<T> ingressConnection = nullptr) {
+    using namespace logger;
+
+    gateway::GatewayAckPackage ack;
+    ack.from = this->nodeId;
+    ack.dest = request.originNode;
+    ack.messageId = request.messageId;
+    ack.originNode = request.originNode;
+    ack.success = success;
+    ack.httpStatus = httpStatus;
+    ack.error = error;
+    ack.timestamp = this->getNodeTime();
+
+    if (request.originNode == this->nodeId) {
+      protocol::Variant variant(&ack);
+      this->callbackList.execute(protocol::GATEWAY_ACK, variant, nullptr, 0);
+      Log(COMMUNICATION,
+          "Completed local GATEWAY_ACK (success=%d, http=%d)\n", success,
+          httpStatus);
+      return;
+    }
+
+    auto conn = router::findRoute<T>((*this), request.originNode);
+    if (!conn && ingressConnection) {
+      conn = ingressConnection;
+      Log(COMMUNICATION,
+          "Routing GATEWAY_ACK to node %u through request ingress while "
+          "topology converges\n",
+          request.originNode);
+    }
+    if (conn) {
+      protocol::Variant variant(&ack);
+      router::send(std::move(variant), conn);
+      Log(COMMUNICATION, "Sent GATEWAY_ACK to node %u (success=%d, http=%d)\n",
+          request.originNode, success, httpStatus);
+    } else {
+      Log(ERROR, "Failed to send GATEWAY_ACK: no route to node %u\n",
+          request.originNode);
+    }
+  }
+
+ private:
   void handleGatewayAck(const gateway::GatewayAckPackage& ack) {
     using namespace logger;
     Log(COMMUNICATION, "handleGatewayAck(): msgId=%u success=%d http=%u\n",
@@ -1958,6 +2077,46 @@ class Mesh : public ntp::MeshTime, public plugin::PackageHandler<T> {
       return;
     }
 
+    // The node this request went to is not a gateway (issue found on the
+    // HIL rig while validating 2.0.3): it rebooted or was reflashed as a
+    // regular node without announcing it, and its last bridge status is
+    // still inside bridgeTimeoutMs. Forget it and send again through the
+    // next gateway at once. The retry budget is not spent: nothing was
+    // attempted against the Internet, and every such answer removes one
+    // entry from knownBridges, so this cannot loop.
+    if (gateway::responseContains(ack.error,
+                                  gateway::GATEWAY_NOT_A_GATEWAY_PHRASE)) {
+      const uint32_t staleGateway = request.gatewayNodeId;
+      bool forgot = this->forgetBridge(staleGateway);
+      if (ack.from != staleGateway) forgot = this->forgetBridge(ack.from) || forgot;
+      Log(ERROR, "handleGatewayAck(): %s; forgot it as a gateway for msgId=%u\n",
+          ack.error.c_str(), ack.messageId);
+
+      if (!forgot) {
+        // Nothing to forget, so a redispatch would reach the same node.
+        // Fall through to the ordinary failure path below.
+      } else if (this->getPrimaryBridge() == nullptr &&
+                 !this->uplinkServesLocally()) {
+        // No gateway left right now. On the rig the live bridge's first
+        // status arrived half a second after the ex-bridge answered, so an
+        // accepted request rides the ordinary retry backoff rather than
+        // failing on the spot; retryInternetRequest() reschedules while no
+        // gateway is known, and the final callback carries this reason.
+        char errorBuf[160];
+        snprintf(errorBuf, sizeof(errorBuf),
+                 "No Internet gateway available: %s", ack.error.c_str());
+        request.lastError = TSTRING(errorBuf);
+        scheduleInternetRetry(ack.messageId);
+        return;
+      } else {
+        const uint32_t messageId = ack.messageId;
+        this->addTask([this, messageId]() {
+          this->retryInternetRequest(messageId);
+        });
+        return;
+      }
+    }
+
     // Failure response - determine if retryable
     bool isRetryable = false;
     
@@ -2081,11 +2240,14 @@ class Mesh : public ntp::MeshTime, public plugin::PackageHandler<T> {
     PendingInternetRequest& request = it->second;
 
     if (request.retryCount >= request.maxRetries) {
-      // Max retries reached - fail the request
+      // Max retries reached - fail the request, with the reason the retries
+      // were spent on when there is one
       Log(logger::ERROR, "scheduleInternetRetry(): Max retries reached for msgId=%u\n",
           messageId);
       if (request.callback) {
-        request.callback(false, 0, "Max retries exceeded");
+        request.callback(false, 0,
+                         request.lastError.length() > 0 ? request.lastError
+                                                        : TSTRING("Max retries exceeded"));
       }
       pendingInternetRequests.erase(it);
       return;
@@ -2124,7 +2286,7 @@ class Mesh : public ntp::MeshTime, public plugin::PackageHandler<T> {
     //
     // Copy what the redispatch needs first: the local handler runs
     // synchronously and can erase this entry, leaving `request` dangling.
-    if (request.gatewayNodeId == this->nodeId && hasLocalInternet()) {
+    if (request.gatewayNodeId == this->nodeId && uplinkServesLocally()) {
       const uint8_t priority = request.priority;
       const uint8_t retryCount = request.retryCount;
       const TSTRING destination = request.destination;

package/src/painlessmesh/router.hpp

@@ -204,9 +204,14 @@ void routePackage(const layout::Layout<T>& layout,
 #if ARDUINOJSON_VERSION_MAJOR == 7
   protocol::Variant variant(pkg);
   if (variant.error) {
+    // The error is a DeserializationError object, not an integer: passing it
+    // through varargs is undefined behaviour. size_t is unsigned long on the
+    // 64-bit desktop build and unsigned int on ESP32/ESP8266, so it is cast
+    // to one type and printed with the matching specifier.
     Log(ERROR,
-        "routePackage(): parsing failed. err=%u, total_length=%d, data=%s<--\n",
-        variant.error, pkg.length(), pkg.c_str());
+        "routePackage(): parsing failed. err=%s, total_length=%lu, data=%s<--\n",
+        variant.error.c_str(), static_cast<unsigned long>(pkg.length()),
+        pkg.c_str());
     return;
   }
 
@@ -248,15 +253,20 @@ void routePackage(const layout::Layout<T>& layout,
   auto variant = std::make_shared<protocol::Variant>(pkg, capacity);
   
   if (variant->error) {
+    // Same two defects as the ArduinoJson 7 branch above (CodeQL
+    // cpp/wrong-type-format-argument, alerts #6-#9).
     if (variant->error == DeserializationError::NoMemory) {
       Log(ERROR,
-          "routePackage(): Message too large. length=%d, calculated_capacity=%u, "
-          "nesting_depth=%u. Consider increasing MAX_MESSAGE_CAPACITY if needed.\n",
-          pkg.length(), calculatedCapacity, nestingDepth);
+          "routePackage(): Message too large. length=%lu, calculated_capacity=%lu, "
+          "nesting_depth=%lu. Consider increasing MAX_MESSAGE_CAPACITY if needed.\n",
+          static_cast<unsigned long>(pkg.length()),
+          static_cast<unsigned long>(calculatedCapacity),
+          static_cast<unsigned long>(nestingDepth));
     } else {
       Log(ERROR,
-          "routePackage(): parsing failed. err=%u, length=%d, data=%s<--\n",
-          variant->error, pkg.length(), pkg.c_str());
+          "routePackage(): parsing failed. err=%s, length=%lu, data=%s<--\n",
+          variant->error.c_str(), static_cast<unsigned long>(pkg.length()),
+          pkg.c_str());
     }
     return;
   }