@alteriom/painlessmesh 2.0.3 → 2.1.1

package/src/arduino/wifi.hpp

@@ -23,6 +23,14 @@
 
 extern painlessmesh::logger::LogClass Log;
 
+/**
+ * Defined when Mesh::tcpListening() exists, so a node can be asked whether
+ * its TCP listener is in LISTEN rather than having that inferred from a
+ * peer eventually connecting. Code that must build against older releases
+ * too can test for it with #ifdef.
+ */
+#define PAINLESSMESH_HAS_TCP_LISTENING 1
+
 namespace painlessmesh {
 namespace wifi {
 class Mesh : public painlessmesh::Mesh<Connection> {
@@ -883,7 +891,7 @@ class Mesh : public painlessmesh::Mesh<Connection> {
     // then had a bridge's listener. AsyncTCP keeps its pcb private, so
     // SO_REUSEADDR cannot be set from here; not re-binding is the fix.
     if (_tcpListener != nullptr) {
-      if (_tcpListener->status() == 1) {
+      if (_tcpListener->status() == TCP_STATE_LISTEN) {
         Log(CONNECTION,
             "tcpServerInit(): listener on port %d already listening, kept\n",
             _meshPort);
@@ -905,6 +913,28 @@ class Mesh : public painlessmesh::Mesh<Connection> {
     return;
   }
 
+  /**
+   * Whether this node's TCP listener exists and is in LISTEN.
+   *
+   * The state peers depend on and nothing else reports: a node whose
+   * listener was never created (#466 crashed before it could be) or was
+   * re-created not listening (#435's promoted bridge served nothing for two
+   * minutes) is reachable only through connections it made outbound, and
+   * nothing can join through it. Cheap enough to put in a health report.
+   */
+  bool tcpListening() {
+    return _tcpListener != nullptr && _tcpListener->status() == TCP_STATE_LISTEN;
+  }
+
+  /**
+   * lwIP's `LISTEN`, which AsyncServer::status() returns as the pcb's state
+   * on both cores (ESPAsyncTCP and ESP32Async/AsyncTCP alike). Named rather
+   * than written as 1 because status() also answers 0 -- lwIP's CLOSED --
+   * when the server holds no pcb at all, so the literal read as if it
+   * conflated the two. It does not: a listener is listening, or it is not.
+   */
+  static constexpr uint8_t TCP_STATE_LISTEN = 1;
+
   /**
    * Establish TCP connection to mesh network
    *
@@ -1521,12 +1551,15 @@ class Mesh : public painlessmesh::Mesh<Connection> {
 
  protected:
   friend class ::StationScan;
+  // init() sets all of these; the defaults are init()'s own, so a node
+  // that is asked about its AP before init() answers something true
+  // rather than whatever the stack held.
   TSTRING _meshSSID;
   TSTRING _meshPassword;
-  uint8_t _meshChannel;
-  uint8_t _meshHidden;
-  uint8_t _meshMaxConn;
-  uint16_t _meshPort;
+  uint8_t _meshChannel = 1;
+  uint8_t _meshHidden = 0;
+  uint8_t _meshMaxConn = MAX_CONN;
+  uint16_t _meshPort = 5555;
 
   IPAddress _apIp;
   StationScan stationScan;
@@ -2467,7 +2500,7 @@ class Mesh : public painlessmesh::Mesh<Connection> {
     // stop/re-init, was not listening, and nothing looked. This task runs
     // every thirty seconds on a bridge: if the listener is not in LISTEN
     // (1 on both cores) it is re-created, and the log says so.
-    if (_tcpListener != nullptr && _tcpListener->status() != 1) {
+    if (_tcpListener != nullptr && _tcpListener->status() != TCP_STATE_LISTEN) {
       Log(ERROR,
           "sendBridgeStatus(): TCP listener on port %d is in state %u, not "
           "LISTEN; re-creating it\n",
@@ -2727,41 +2760,44 @@ class Mesh : public painlessmesh::Mesh<Connection> {
 
 #if defined(ESP32) || defined(ESP8266)
   /**
-   * Read the start of an HTTP response body, bounded in bytes and in time
-   *
-   * The gateway used to discard the body, so a service that answers a refusal
-   * with a 2xx (CallMeBot, issue #450) was reported as delivered, and a
-   * failure reached the origin node as a bare status. When the length is
-   * known and small the whole body is taken; otherwise up to maxBytes are
-   * read from the stream, waiting at most GATEWAY_RESPONSE_HEAD_TIMEOUT_MS,
-   * which keeps a large or chunked page from eating the heap or the
-   * cooperative scheduler.
+   * The start and the end of the response body (gateway::ResponseExcerpt),
+   * read from the stream for at most GATEWAY_RESPONSE_HEAD_TIMEOUT_MS and
+   * GATEWAY_RESPONSE_SCAN_BYTES. A body that fits whole is read whole. A
+   * chunked body is read through gateway::ChunkedBodyDecoder: the raw stream
+   * carries the framing, which getString() would remove but only by keeping
+   * the whole body.
    */
-  static TSTRING readResponseHead(HTTPClient& http, size_t maxBytes) {
+  static TSTRING readResponseExcerpt(HTTPClient& http) {
     const int size = http.getSize();
-    if (size >= 0 && static_cast<size_t>(size) <= maxBytes) {
+    if (size >= 0 &&
+        static_cast<size_t>(size) <=
+            gateway::GATEWAY_RESPONSE_HEAD_BYTES + gateway::GATEWAY_RESPONSE_TAIL_BYTES) {
       return http.getString();
     }
-    TSTRING head;
+    gateway::ResponseExcerpt excerpt;
     WiFiClient* stream = http.getStreamPtr();
-    if (stream == nullptr) return head;
+    if (stream == nullptr) return excerpt.text();
+    const bool chunked =
+        size < 0 && gateway::transferEncodingIsChunked(http.header("Transfer-Encoding"));
+    gateway::ChunkedBodyDecoder decoder(excerpt);
     const uint32_t deadline =
         millis() + gateway::GATEWAY_RESPONSE_HEAD_TIMEOUT_MS;
-    while (head.length() < maxBytes &&
-           static_cast<int32_t>(deadline - millis()) > 0) {
+    bool more = true;
+    while (more && static_cast<int32_t>(deadline - millis()) > 0) {
       int available = stream->available();
       if (available <= 0) {
         if (!stream->connected()) break;
         delay(1);
         continue;
       }
-      while (available-- > 0 && head.length() < maxBytes) {
+      while (more && available-- > 0) {
         const int c = stream->read();
         if (c < 0) break;
-        head += static_cast<char>(c);
+        more = chunked ? decoder.add(static_cast<char>(c))
+                       : excerpt.add(static_cast<char>(c));
       }
     }
-    return head;
+    return excerpt.text();
   }
 #endif
 
@@ -2836,8 +2872,13 @@ class Mesh : public painlessmesh::Mesh<Connection> {
           // that genuinely stopped answering NODE_SYNC still gets reaped even
           // under continuous gateway traffic from other peers.
           const auto blockingStartedMs = millis();
+          // `retryable` is the gateway's word to the origin node on whether
+          // the identical request may be sent again: 0 whenever it may have
+          // reached the server, so a retry cannot deliver it twice.
           auto finish = [this, &pkg, ingress, blockingStartedMs](
-                            bool ok, uint16_t code, const TSTRING& err) {
+                            bool ok, uint16_t code, const TSTRING& err,
+                            int8_t retryable, const TSTRING& response = TSTRING(),
+                            uint32_t retryAfterMs = 0) {
             const auto stalledMs = millis() - blockingStartedMs;
             auto refreshed = gateway::refreshPeerWatchdogs(*this, stalledMs);
             if (refreshed > 0) {
@@ -2847,27 +2888,28 @@ class Mesh : public painlessmesh::Mesh<Connection> {
                   static_cast<unsigned>(refreshed),
                   static_cast<unsigned long>(stalledMs));
             }
-            this->sendGatewayAck(pkg, ok, code, err, ingress);
+            this->sendGatewayAck(pkg, ok, code, err, ingress, response, retryable,
+                                 retryAfterMs);
           };
 
           // Check Internet connectivity
           // First check WiFi status for quick fail
           if (WiFi.status() != WL_CONNECTED) {
-            finish(false, 0, "Gateway WiFi not connected");
+            finish(false, 0, "Gateway WiFi not connected", 0);
             return true;  // Consume package - we handled it (with error)
           }
           
           // Then check actual internet access (DNS resolution)
           // This detects when WiFi is connected but router has no internet
           if (!hasActualInternetAccess()) {
-            finish(false, 0, "Router has no internet access - check WAN connection");
+            finish(false, 0, "Router has no internet access - check WAN connection", 0);
             return true;  // Consume package - we handled it (with error)
           }
           
           // Finally, check for captive portal interference
           // This detects when DNS works but HTTP requests are intercepted
           if (!detectCaptivePortal()) {
-            finish(false, 0, "Captive portal detected - requires web authentication. Check router/WiFi settings");
+            finish(false, 0, "Captive portal detected - requires web authentication. Check router/WiFi settings", 0);
             return true;  // Consume package - we handled it (with error)
           }
 
@@ -2899,7 +2941,7 @@ class Mesh : public painlessmesh::Mesh<Connection> {
                            (gateway::GATEWAY_DNS_NEGATIVE_TTL_MS - failedAgoMs) /
                            1000));
               Log(ERROR, "%s\n", dnsBuf);
-              finish(false, 0, TSTRING(dnsBuf));
+              finish(false, 0, TSTRING(dnsBuf), 0);
               return true;
             }
             IPAddress resolved;
@@ -2909,7 +2951,7 @@ class Mesh : public painlessmesh::Mesh<Connection> {
               snprintf(dnsBuf, sizeof(dnsBuf), "DNS lookup failed for %s",
                        host.c_str());
               Log(ERROR, "%s\n", dnsBuf);
-              finish(false, 0, TSTRING(dnsBuf));
+              finish(false, 0, TSTRING(dnsBuf), 0);
               return true;
             }
           }
@@ -2959,6 +3001,17 @@ class Mesh : public painlessmesh::Mesh<Connection> {
 #endif
           }
 
+          // The same id on every attempt at this call. A service that
+          // honours Idempotency-Key treats a retry as the request it already
+          // has; anything recording requests can count the copies.
+          const TSTRING requestId =
+              gateway::requestIdFor(pkg.originNode, pkg.messageId, pkg.requestNonce);
+          http.addHeader("X-Request-Id", requestId.c_str());
+          http.addHeader("Idempotency-Key", requestId.c_str());
+          // Not const: both cores declare collectHeaders(const char* keys[], ...).
+          const char* collected[] = {"Retry-After", "Transfer-Encoding"};
+          http.collectHeaders(collected, 2);
+
           // Make request (GET if no payload, POST if payload)
           if (pkg.payload.length() > 0) {
             http.addHeader("Content-Type", pkg.contentType.c_str());
@@ -2967,11 +3020,11 @@ class Mesh : public painlessmesh::Mesh<Connection> {
             httpCode = http.GET();
           }
 
-          // A 2xx is the origin's acceptance, except 203 (a proxy transformed
-          // the response) and except when the body says the service refused
-          // the request: CallMeBot answers "Too many requests" under 201 and
-          // 203 (issue #450). The body is therefore read -- bounded -- before
-          // classifying, and it is what the origin node is told on failure.
+          // HTTP semantics only: 200/201/202/204 succeed, anything else fails,
+          // and a retry is allowed only when it cannot deliver the request
+          // twice (see gateway::classifyHttpResult). Whether a service's reply
+          // means what the application wanted is the application's decision,
+          // so the start of the body goes back on success as well as failure.
           //
           // 3xx redirects are not automatically followed.
           //
@@ -2981,72 +3034,68 @@ class Mesh : public painlessmesh::Mesh<Connection> {
           TSTRING responseHead;
           if (httpCode > 0) {
             responseHead =
-                readResponseHead(http, gateway::GATEWAY_RESPONSE_HEAD_BYTES);
+                readResponseExcerpt(http);
           }
           const auto outcome =
               gateway::classifyHttpResult(httpCode, responseHead);
           success = outcome.success;
+          const TSTRING responseSummary =
+              httpCode > 0 ? gateway::summarizeResponseBody(responseHead) : TSTRING();
+          uint32_t retryAfterMs = 0;
+          if (outcome.retryable && httpCode > 0) {
+            retryAfterMs = gateway::parseRetryAfterMs(http.header("Retry-After"));
+          }
 
           if (!outcome.transportError) {
-            char errorBuf[192];
+            char errorBuf[320];
             const char* reason = outcome.reason.c_str();
             const char* sep = outcome.reason.length() > 0 ? ": " : "";
             if (success) {
               Log(COMMUNICATION, "HTTP request completed: code=%d\n", httpCode);
-            } else if (outcome.refusedByBody) {
-              // Success-class status, refusing body. Not retryable: the
-              // service answered, and the origin node gets its words.
-              snprintf(errorBuf, sizeof(errorBuf),
-                       "HTTP %d: service refused the request%s%s", httpCode,
-                       sep, reason);
-              error = TSTRING(errorBuf);
-              Log(ERROR, "HTTP request refused by the service: %s\n", errorBuf);
             } else if (outcome.unverifiedStatus) {
-              // A 2xx outside 200/201/202/204. CallMeBot answers 208 to a
-              // message that never arrives (issue #452), so this is a
-              // failure, and the body -- the only place the service says
-              // what it did -- goes to the origin node and to the log at
-              // ERROR level, where a sketch running the default levels
-              // sees it. 203 stays retryable; the rest are final.
+              // A 2xx outside 200/201/202/204: the server answered, but not
+              // with a status this library can call a delivery. Never
+              // retried. Logged at ERROR, where a sketch on the default
+              // levels sees what the service said.
               snprintf(errorBuf, sizeof(errorBuf),
                        "HTTP %d: not a delivery the gateway can confirm%s%s",
                        httpCode, sep, reason);
               error = TSTRING(errorBuf);
               Log(ERROR, "HTTP response unverified: %s\n", errorBuf);
-            } else if (httpCode >= 500 && httpCode < 600) {
-              // 5xx server errors are retryable, log at COMMUNICATION level
+            } else if (outcome.retryable) {
+              // 429 or 503: the server says it did not take the request.
               snprintf(errorBuf, sizeof(errorBuf), "HTTP %d%s%s", httpCode, sep,
                        reason);
               error = TSTRING(errorBuf);
-              Log(COMMUNICATION, "HTTP server error: code=%d (will retry)\n", httpCode);
-            } else if (httpCode == 429) {
-              // HTTP 429 rate limit is retryable, log at COMMUNICATION level
-              snprintf(errorBuf, sizeof(errorBuf), "HTTP %d%s%s", httpCode, sep,
-                       reason);
-              error = TSTRING(errorBuf);
-              Log(COMMUNICATION, "HTTP rate limit: code=%d (will retry)\n", httpCode);
+              Log(COMMUNICATION, "HTTP %d: the server asked to retry (after %lu ms)\n",
+                  httpCode, static_cast<unsigned long>(retryAfterMs));
             } else {
-              // 1xx, 3xx, 4xx (except 429) - non-retryable, log at ERROR level
               snprintf(errorBuf, sizeof(errorBuf), "HTTP %d%s%s", httpCode, sep,
                        reason);
               error = TSTRING(errorBuf);
               Log(ERROR, "HTTP request failed: %s\n", errorBuf);
             }
           } else {
-            // Network errors (httpCode <= 0) are retryable but indicate serious issues
-            // Keep at ERROR level as they may indicate gateway connectivity problems
+            // Below HTTP. When the request may already be at the server -- a
+            // read timeout, a connection lost after sending -- it is not
+            // retried, and the error says why, so an application that
+            // resends does so knowing it may duplicate.
             error = http.errorToString(httpCode);
+            if (!outcome.retryable) {
+              error += " (the request may have reached the server; not retried)";
+            }
             Log(ERROR, "HTTP request failed: %s\n", error.c_str());
           }
 
           http.end();
 
-          // Send acknowledgment back. Transport errors carry status 0, the
-          // value handleGatewayAck() treats as a retryable network error.
-          finish(success, outcome.ackStatus, error);
+          // Send acknowledgment back, with the verdict on retrying and the
+          // start of whatever the server said.
+          finish(success, outcome.ackStatus, error, outcome.retryable ? 1 : 0,
+                 responseSummary, retryAfterMs);
 #else
         // Non-ESP platform - send error
-        finish(false, 0, "HTTP client not available on this platform");
+        finish(false, 0, "HTTP client not available on this platform", 0);
 #endif
 
           return true;  // Consume package - we have processed it and sent
@@ -3220,16 +3269,25 @@ class Mesh : public painlessmesh::Mesh<Connection> {
   }
 
 #ifdef ESP32
-  WiFiEventId_t eventScanDoneHandler;
-  WiFiEventId_t eventSTAStartHandler;
-  WiFiEventId_t eventSTADisconnectedHandler;
-  WiFiEventId_t eventSTAGotIPHandler;
+  // Event ids the core hands back from onEvent(); stop() removes all four.
+  // 0 is never issued (the core's ids start at 1 and 0 means "no
+  // callback"), so removeEvent(0) is a no-op on a node stopped before
+  // init() rather than a walk of the core's callback list for garbage.
+  WiFiEventId_t eventScanDoneHandler = 0;
+  WiFiEventId_t eventSTAStartHandler = 0;
+  WiFiEventId_t eventSTADisconnectedHandler = 0;
+  WiFiEventId_t eventSTAGotIPHandler = 0;
 #elif defined(ESP8266)
   WiFiEventHandler eventSTAConnectedHandler;
   WiFiEventHandler eventSTADisconnectedHandler;
   WiFiEventHandler eventSTAGotIPHandler;
 #endif  // ESP8266
-  AsyncServer* _tcpListener;
+  // Null until tcpServerInit() creates it. Every reader checks for null
+  // first, and one of them (tcpServerInit() itself, since 2.1.0) runs before
+  // anything has assigned it -- on an uninitialised pointer that check
+  // passed on garbage and the delete that followed crashed the node before
+  // it served a single connection (#466).
+  AsyncServer* _tcpListener = nullptr;
   std::shared_ptr<Task> bridgeStatusTask;
   // millis() of the last status broadcast, periodic or brought forward by a
   // topology change; the latter is held to one every five seconds.
@@ -3242,11 +3300,11 @@ class Mesh : public painlessmesh::Mesh<Connection> {
   enum ElectionState { ELECTION_IDLE, ELECTION_SCANNING, ELECTION_COLLECTING };
 
   struct BridgeCandidate {
-    uint32_t nodeId;
-    int8_t routerRSSI;
-    uint8_t routerChannel;
-    uint32_t uptime;
-    uint32_t freeMemory;
+    uint32_t nodeId = 0;
+    int8_t routerRSSI = 0;
+    uint8_t routerChannel = 0;
+    uint32_t uptime = 0;
+    uint32_t freeMemory = 0;
   };
 
   bool bridgeFailoverEnabled = true;
@@ -3301,11 +3359,19 @@ class Mesh : public painlessmesh::Mesh<Connection> {
   size_t lastSelectedBridgeIndex = 0;   // For round-robin selection
 
   // Bridge coordination monitoring callbacks and state
+  // Constructed by name, not as an aggregate: with default member
+  // initializers this is not an aggregate under gnu++11, which the ESP32
+  // Arduino 2.x core still builds with, and `= {priority, role, load,
+  // millis()}` below needs a constructor to land on there.
   struct BridgeCoordinationState {
-    uint8_t priority;
+    uint8_t priority = 0;
     TSTRING role;
-    uint8_t load;
-    uint32_t lastSeen;
+    uint8_t load = 0;
+    uint32_t lastSeen = 0;
+    BridgeCoordinationState() {}
+    BridgeCoordinationState(uint8_t priority_, const TSTRING& role_,
+                            uint8_t load_, uint32_t lastSeen_)
+        : priority(priority_), role(role_), load(load_), lastSeen(lastSeen_) {}
   };
   std::map<uint32_t, BridgeCoordinationState> lastBridgeCoordinationState;
   std::function<void(const plugin::BridgeCoordinationPackage&, uint32_t)> bridgeCoordinationCallback;

package/src/boost/asynctcp.hpp

@@ -258,7 +258,7 @@ class AsyncServer {
 
  protected:
   boost::asio::io_context& _io_service;
-  uint16_t _port;
+  uint16_t _port = 0;
   tcp::acceptor mAcceptor;
   AcConnectHandler _connect_cb = 0;
   void* _connect_cb_arg = 0;

package/src/painlessMeshSTA.cpp

@@ -628,6 +628,9 @@ void ICACHE_FLASH_ATTR StationScan::connectToAP() {
 #endif
   bool isRooted = layout::isRooted(mesh->asNodeTree());
   if (isRooted) everRooted = true;
+  // The immediate-rescan allowance is per outage, and this is the one place
+  // every scan passes through: a node with a connection has not spent it.
+  if (painlessmesh::layout::liveSubs(*mesh) > 0) rejoinScanned = false;
   if (aps.empty()) {
     // No unknown nodes found
     consecutiveEmptyScans++;
@@ -732,11 +735,42 @@ void ICACHE_FLASH_ATTR StationScan::connectToAP() {
       task.delay(interval);
       if (orphanScanBackoff < 2) orphanScanBackoff++;
     } else {
-      // else scan fast (SCAN_INTERVAL)
-      Log(CONNECTION,
-          "connectToAP(): No unknown nodes found scan rate set to "
-          "fast\n");
+      // Not connected, and this scan turned up nothing to connect to.
+      //
+      // "Fast" here is 0.5 * SCAN_INTERVAL -- fifteen seconds. For a node
+      // that still has a live connection (an AP-side child) that is soon
+      // enough: it is in the mesh and reachable while it looks for more.
+      // For a node with none it is the whole cost of the outage, and it is
+      // paid while the node's neighbours still have it in their routing
+      // tables: they keep sending to it until their own NODE_TIMEOUT, and
+      // those messages are dropped.
+      //
+      // Measured on the Alteriom HIL rig (issue #459): an ESP32-C3 closed
+      // its only uplink on a momentary nodeSync contradiction, logged
+      // "scan rate set to fast" 12 ms later, and did not scan again for
+      // exactly 15 000 ms. It was out of the mesh for 16.2 s and answered
+      // an empty node list throughout; a unicast sent to it in that window
+      // was accepted by the sender and lost. The scan that finally ran
+      // found five mesh APs at -30 to -58 dBm and was associated 1.2 s
+      // later. There was nothing to wait for.
+      //
+      // So a node with no connections left scans at once. Once per outage:
+      // `rejoinScanned` is cleared as soon as it has a connection again,
+      // so a node that is simply alone falls back to the interval instead
+      // of scanning back to back.
       task.setInterval(0.5 * SCAN_INTERVAL);
+      if (painlessmesh::layout::liveSubs(*mesh) == 0 && !rejoinScanned) {
+        rejoinScanned = true;
+        Log(CONNECTION,
+            "connectToAP(): No connections left; scanning again now rather "
+            "than in %d s\n",
+            (int)(0.5 * SCAN_INTERVAL / TASK_SECOND));
+        task.forceNextIteration();
+      } else {
+        Log(CONNECTION,
+            "connectToAP(): No unknown nodes found scan rate set to "
+            "fast\n");
+      }
     }
     mesh->stability += min(1000 - mesh->stability, (size_t)25);
   } else {

package/src/painlessMeshSTA.h

@@ -62,7 +62,14 @@ class StationScan {
   // The station got an address: its link is up. Cleared once the drop
   // callbacks have judged a disconnect, so they can tell a link that was
   // up and went away from an attempt that never got that far.
-  void stationUp() { stationLinkUp = true; }
+  void stationUp() {
+    stationLinkUp = true;
+    // A link again, so the immediate-rescan allowance is restored now
+    // rather than at the next scan. Without this a node that dropped
+    // twice inside one scan interval paid the full fifteen seconds for
+    // the second drop (#459).
+    rejoinScanned = false;
+  }
   void stationDown() { stationLinkUp = false; }
   bool stationLinkUp = false;
   // The station link was closed by this node's own channel move a moment
@@ -118,10 +125,11 @@ class StationScan {
  protected:
   TSTRING ssid;
   TSTRING password;
-  painlessMesh *mesh;
-  uint16_t port;
-  uint8_t channel;
-  bool hidden;
+  // init() sets these; until then the scan belongs to no mesh and no port.
+  painlessMesh *mesh = nullptr;
+  uint16_t port = 0;
+  uint8_t channel = 0;
+  bool hidden = false;
   std::list<WiFi_AP_Record_t> aps;
 
   void requestIP(WiFi_AP_Record_t &ap);
@@ -147,6 +155,11 @@ class StationScan {
   // channel re-detection runs, and consuming those results here found them
   // already deleted, reported "wifi scan failed", and rescanned at once.
   bool scanRequested = false;
+  // Whether this node has already scanned at once on losing its last
+  // connection. Cleared the moment it has one again, so the immediate
+  // rescan is one per outage and not a scan loop: a node that is out of
+  // the mesh and finds nothing still falls back to the interval below.
+  bool rejoinScanned = false;
   // Set when the next station scan must cover every channel: the empty
   // scans have piled up and the node is looking for the channel the mesh
   // moved to. The re-detection is this task's ordinary asynchronous scan

package/src/painlessmesh/buffer.hpp

@@ -124,7 +124,7 @@ inline void ReceiveBuffer<std::string>::stringAppend(std::string &buffer,
 template <class T>
 struct PrioritizedMessage {
   T message;
-  uint8_t priority;  // 0=CRITICAL, 1=HIGH, 2=NORMAL, 3=LOW
+  uint8_t priority = 2;  // 0=CRITICAL, 1=HIGH, 2=NORMAL, 3=LOW
   
   PrioritizedMessage(const T& msg, uint8_t prio = 2) : message(msg), priority(prio) {}
 };
@@ -206,12 +206,17 @@ class SentBuffer {
   size_t requestLength(size_t buffer_length) {
     // Use highest priority message available
     auto* msg = getNextMessage();
-    if (!msg)
-      return 0;
-    else
-      // String.toCharArray automatically turns the last character into
-      // a \0, we need the extra space to deal with that annoyance
-      return (std::min)(buffer_length - 1, msg->length() + 1);
+    if (!msg) return 0;
+    // A caller with no room is owed nothing. The subtraction below leaves
+    // space for the terminator toCharArray() always writes; on an unsigned
+    // zero it wraps to SIZE_MAX instead, min() then picks the message, and
+    // the answer comes back *larger* than was asked for -- which the
+    // documented contract above forbids and read() then acts on, writing
+    // length + 1 bytes into a buffer the caller said had none.
+    if (buffer_length == 0) return 0;
+    // String.toCharArray automatically turns the last character into
+    // a \0, we need the extra space to deal with that annoyance
+    return (std::min)(buffer_length - 1, msg->length() + 1);
   }
 
   /**
@@ -313,18 +318,18 @@ class SentBuffer {
    * Get statistics about queued and sent messages
    */
   struct SendStats {
-    uint32_t totalQueued;
-    uint32_t criticalQueued;
-    uint32_t highQueued;
-    uint32_t normalQueued;
-    uint32_t lowQueued;
-    uint32_t criticalSent;
-    uint32_t highSent;
-    uint32_t normalSent;
-    uint32_t lowSent;
+    uint32_t totalQueued = 0;
+    uint32_t criticalQueued = 0;
+    uint32_t highQueued = 0;
+    uint32_t normalQueued = 0;
+    uint32_t lowQueued = 0;
+    uint32_t criticalSent = 0;
+    uint32_t highSent = 0;
+    uint32_t normalSent = 0;
+    uint32_t lowSent = 0;
     // Messages lost to the PAINLESSMESH_MAX_SENT_BUFFER_MESSAGES cap:
     // evicted from the buffer or rejected on push (issue #388)
-    uint32_t dropped;
+    uint32_t dropped = 0;
   };
 
   SendStats getStats() const {