Add topology-aware lighting with Rynk control

.github/ci/_lib.sh

@@ -52,13 +52,16 @@ RMK_FEATURESETS=(
     "rynk,_ble,split,storage,async_matrix"
     "rynk,storage"
     "rynk"
+    "rynk,lighting"
+    "rynk,storage,lighting"
 )
 
 # Behavioral coverage only; RMK_FEATURESETS remains the compile/clippy matrix.
 RMK_TEST_FEATURESETS=(
     ""
     "vial,host_lock,_no_usb,steno,passkey_entry"
     "rynk,_ble,split,async_matrix,storage"
+    "rynk,storage,lighting"
 )
 
 # Examples auto-discovery skiplist. Reasons:

docs/docs/main/docs/configuration/appendix.md

@@ -353,6 +353,9 @@ split_peripherals_num = 0
 ble_profiles_num = 3
 # BLE Split Central sleep timeout in seconds (0 = disabled)
 split_central_sleep_timeout_seconds = 0
+# Maximum skipped split connection events while active (0 = lowest latency)
+split_central_max_latency_powered = 30
+split_central_max_latency_battery = 30
 # Maximum macro data bytes in one Rynk macro request or response
 protocol_macro_chunk_size = 64
 # Rynk RX/TX buffer size in bytes. 488 bytes = 2*BLE maximum packet size
@@ -487,6 +490,8 @@ unlock_keys = [[0, 0], [0, 1]]
 insecure = false
 # Rynk only: move config writes into the locked tier (default: false).
 write_requires_unlock = false
+# Require physical unlock before central or split-peripheral bootloader entry.
+bootloader_requires_unlock = true
 
 # Chip-specific configuration
 # To use the default configuration, ignore this section completely

docs/docs/main/docs/configuration/host_config.md

@@ -33,6 +33,11 @@ insecure = false
 # Rynk only: move config writes (SetKeyAction, SetMacro, …) into the locked
 # tier so they also require unlock (default: false).
 write_requires_unlock = false
+
+# Rynk only: require physical unlock before central or split-peripheral
+# bootloader entry (default: true). Set false for host-managed deployment;
+# other dangerous operations remain gated.
+bootloader_requires_unlock = true
 ```
 
 ## Common Setups

docs/docs/main/docs/configuration/rmk_config.md

@@ -38,6 +38,9 @@ split_peripherals_num = 0
 ble_profiles_num = 3
 # BLE Split Central sleep timeout in seconds (0 = disabled)
 split_central_sleep_timeout_seconds = 0
+# Maximum skipped 7.5 ms split connection events while active
+split_central_max_latency_powered = 30
+split_central_max_latency_battery = 30
 # Maximum macro data bytes in one Rynk macro request or response
 protocol_macro_chunk_size = 64
 # Maximum number of auto mouse layer entries (auto-derived from [[behavior.auto_mouse_layer]] if unset)
@@ -98,6 +101,7 @@ These tune the [Rynk](../features/rynk) protocol and rarely need changing.
 
 - `ble_profiles_num`: The number of available Bluetooth profiles, default value is 3. This parameter defines how many Bluetooth paired devices the keyboard can store.
 - `split_central_sleep_timeout_seconds`: Sleep timeout for BLE split central in seconds, default value is 0 (disabled). When set to a non-zero value, the split central will enter sleep mode after this many seconds of inactivity to save power. Set to 0 to disable automatic sleep.
+- `split_central_max_latency_powered` / `split_central_max_latency_battery`: Maximum number of BLE connection events the split peripheral may skip while active, selected by whether USB power is present. Both default to 30. Lower values reduce worst-case split input and central-to-peripheral update latency at the cost of more radio wakeups and peripheral battery use. Set to 0 for the lowest latency. Sleep mode uses its own low-power connection parameters. Rynk can replace these volatile values or force/clear a runtime override with `GetSplitCentralLatency` and `SetSplitCentralLatency`; reboot restores the build-time values.
 
 ### Auto Mouse Layer Configuration
 

docs/docs/main/docs/features/rynk.md

@@ -100,10 +100,10 @@ There are three tiers:
 - **Open** — everything you normally reach for: read the keymap, change keys,
   layers, combos, macros, switch BLE profiles, reboot. These stay available so
   on-the-fly configuration is friction-free.
-- **Locked** — the dangerous ones, always gated: entering the bootloader,
-  resetting stored settings and bonds, reading the live key matrix (a keylogger
-  if left open), and clearing a BLE bond. A host tool gets a "locked" error
-  until you unlock.
+- **Locked** — the dangerous ones: entering the bootloader, resetting stored
+  settings and bonds, reading the live key matrix (a keylogger if left open),
+  and clearing a BLE bond. A host tool gets a "locked" error until you unlock.
+  Bootloader entry may be opted out separately for managed deployment setups.
 - **Config writes** — open by default, because on-the-fly configuration is the
   point. Set `write_requires_unlock = true` to move every write (keymap, macros,
   …) into the locked tier as well.
@@ -127,6 +127,17 @@ If you leave `unlock_keys` unset, the locked operations can never be unlocked 
 a safe default, but it means a fresh config can't enter the bootloader over Rynk
 or use the matrix tester until you add the keys.
 
+For a keyboard whose host is trusted to manage firmware deployment, allow only
+central and split-peripheral bootloader entry without the physical challenge:
+
+```toml title="keyboard.toml"
+[host]
+bootloader_requires_unlock = false
+```
+
+Storage reset, matrix-state reads, and BLE bond clearing remain gated. This is
+more narrowly scoped than `insecure = true`.
+
 For local development you can bypass the gate entirely:
 
 ```toml title="keyboard.toml"

examples/use_rust/nrf54lm20_ble/src/main.rs

@@ -194,6 +194,7 @@ async fn main(spawner: Spawner) {
             unlock_keys: RYNK_UNLOCK_KEYS,
             insecure: false,
             write_requires_unlock: false,
+            bootloader_requires_unlock: true,
         },
         storage_config,
         ..Default::default()

examples/use_rust/qemu-riscv-rynk/src/main.rs

@@ -122,6 +122,7 @@ async fn main(_spawner: Spawner) {
     let rmk_config = RMK_CONFIG.init(RmkConfig {
         lock_config: LockConfig {
             insecure: true,
+            bootloader_requires_unlock: true,
             ..Default::default()
         },
         ..Default::default()

rmk-config/src/default_config/event_default.toml

@@ -39,6 +39,12 @@ channel_size = 1
 pubs = 1
 subs = 1
 
+# Unit invalidation published after authoritative lighting state changes.
+[event.lighting_changed]
+channel_size = 1
+pubs = 1
+subs = 1
+
 # Power events
 [event.battery_status]
 channel_size = 1

rmk-config/src/default_config/subscriber_default.toml

@@ -66,6 +66,13 @@ events = [
     { name = "connection_status_change" },
     { name = "sleep_state" },
     { name = "led_indicator" },
+    { name = "modifier" },
+]
+
+[[subscriber]]
+features = ["rynk", "lighting"]
+events = [
+    { name = "lighting_changed" },
 ]
 
 [[subscriber]]
@@ -80,6 +87,25 @@ events = [
     { name = "connection_status_change" },
     { name = "sleep_state" },
     { name = "led_indicator" },
+    { name = "modifier" },
+]
+
+[[subscriber]]
+features = ["rynk", "lighting", "_ble"]
+events = [
+    # Second Rynk session slot on dual-transport boards.
+    { name = "lighting_changed" },
+]
+
+[[subscriber]]
+features = ["lighting"]
+events = [
+    # lighting/processor.rs: LightingProcessor subscribes to authoritative
+    # keyboard-state invalidations on every lighting-enabled board.
+    { name = "layer_change" },
+    { name = "connection_status_change" },
+    { name = "led_indicator" },
+    { name = "sleep_state" },
 ]
 
 # --- Split-gated internal subscribers ---

rmk-config/src/layout.rs

@@ -113,6 +113,12 @@ impl LayoutInfo {
     }
 }
 
+pub(crate) struct ResolvedLayout {
+    pub blob: Vec<u8>,
+    pub keys: Vec<[u8; 2]>,
+    pub physical: crate::resolved::PhysicalLayout,
+}
+
 /// A resolved shape: every default applied. `rect2` is the L-key's second
 /// rectangle stored as center-relative offsets — its `x`/`y` are offsets from
 /// the primary center, not absolute positions (the walk resolves them).
@@ -668,6 +674,101 @@ pub(crate) fn build_layout_blob(
     Ok(miniz_oxide::deflate::compress_to_vec(&bytes, 10))
 }
 
+/// Resolve both host-facing KLE data and the compact firmware geometry from
+/// one parse/walk. This keeps `[layout].map` the only board-layout authority.
+pub(crate) fn build_resolved_layout(
+    layout: &LayoutTomlConfig,
+    expected_encoders: Option<usize>,
+) -> Result<ResolvedLayout, String> {
+    let Some(info) = build_layout_info(layout, expected_encoders)? else {
+        return Ok(ResolvedLayout {
+            blob: Vec::new(),
+            keys: Vec::new(),
+            physical: crate::resolved::PhysicalLayout::default(),
+        });
+    };
+
+    let bytes =
+        postcard::to_allocvec(&info).map_err(|e| format!("keyboard.toml: layout blob serialize failed: {e}"))?;
+    let blob = miniz_oxide::deflate::compress_to_vec(&bytes, 10);
+    let keys = parse_map(layout.map.as_deref().unwrap_or_default(), layout.rows, layout.cols)?
+        .into_iter()
+        .filter_map(|token| match token {
+            MapToken::Key { row, col, .. } => Some([row, col]),
+            _ => None,
+        })
+        .collect();
+    let variant = &info.variants[info.default_variant as usize];
+    let physical = crate::resolved::PhysicalLayout {
+        keys: variant
+            .keys
+            .iter()
+            .map(|key| {
+                let center = fixed_point(key.rect.x, key.rect.y)
+                    .map_err(|reason| format!("layout.map key ({},{}) center {reason}", key.row, key.col))?;
+                let size = fixed_size(key.rect.w, key.rect.h)
+                    .map_err(|reason| format!("layout.map key ({},{}) size {reason}", key.row, key.col))?;
+                let rotation_centidegrees = centidegrees(key.r)
+                    .map_err(|reason| format!("layout.map key ({},{}) rotation {reason}", key.row, key.col))?;
+                Ok(crate::resolved::PhysicalKey {
+                    matrix: [key.row, key.col],
+                    center,
+                    size,
+                    rotation_centidegrees,
+                })
+            })
+            .collect::<Result<Vec<_>, String>>()?,
+    };
+
+    Ok(ResolvedLayout { blob, keys, physical })
+}
+
+fn fixed_point(x: f32, y: f32) -> Result<crate::resolved::FixedPoint3, &'static str> {
+    fn axis(value: f32) -> Result<i16, &'static str> {
+        if !value.is_finite() {
+            return Err("must be finite");
+        }
+        let raw = (value * 256.0).round();
+        if raw < i16::MIN as f32 || raw > i16::MAX as f32 {
+            return Err("does not fit signed Q8.8 key-pitch units");
+        }
+        Ok(raw as i16)
+    }
+    Ok(crate::resolved::FixedPoint3 {
+        x: axis(x)?,
+        y: axis(y)?,
+        z: 0,
+    })
+}
+
+fn fixed_size(width: f32, height: f32) -> Result<crate::resolved::FixedSize2, &'static str> {
+    fn axis(value: f32) -> Result<u16, &'static str> {
+        if !value.is_finite() || value <= 0.0 {
+            return Err("must be finite and positive");
+        }
+        let raw = (value * 256.0).round();
+        if raw < 1.0 || raw > u16::MAX as f32 {
+            return Err("does not fit unsigned Q8.8 key-pitch units");
+        }
+        Ok(raw as u16)
+    }
+    Ok(crate::resolved::FixedSize2 {
+        width: axis(width)?,
+        height: axis(height)?,
+    })
+}
+
+fn centidegrees(degrees: f32) -> Result<i16, &'static str> {
+    if !degrees.is_finite() {
+        return Err("must be finite");
+    }
+    let raw = (degrees * 100.0).round();
+    if raw < i16::MIN as f32 || raw > i16::MAX as f32 {
+        return Err("does not fit signed centidegrees");
+    }
+    Ok(raw as i16)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;