chore(protobufs): regenerate the nanopb headers

Comment-only. Picks up the reassembly-contract rewording from
meshtastic/protobufs#1054 and, incidentally, three admin.proto comments the
committed headers had already drifted on relative to the submodule pointer.

Generated with nanopb 0.4.9.1, matching the version stamped in the existing
headers. No struct, tag, size macro, or field descriptor changed.

src/mesh/generated/meshtastic/admin.pb.h

@@ -186,7 +186,7 @@ typedef struct _meshtastic_LockdownAuth {
  token at unlock time: the client-supplied boots_remaining when
  non-zero, otherwise the firmware default (TOKEN_DEFAULT_BOOTS).
  Note that boots_remaining == 0 in this message means "use firmware
- default", NOT "zero boots" - a client computing the ceiling for
+ default", NOT "zero boots" — a client computing the ceiling for
  display should mirror that resolution rather than multiplying the
  raw request value.
 
@@ -196,7 +196,7 @@ typedef struct _meshtastic_LockdownAuth {
 
  Uses millis() (CPU uptime), not wall-clock time, so the cap is
  immune to GPS spoofing, RTC backup-battery removal, and Faraday
- cage isolation - none of those move the uptime counter. The only
+ cage isolation — none of those move the uptime counter. The only
  way to reset the session clock is a reboot, which costs a boot
  from the on-flash, HMAC-bound counter. */
     uint32_t max_session_seconds;
@@ -213,7 +213,7 @@ typedef struct _meshtastic_LockdownAuth {
 
  NOT reversed by this operation: APPROTECT. Once the debug port
  lockout has been burned (on silicon where it is effective) it is
- permanent - disabling lockdown decrypts your data and removes the
+ permanent — disabling lockdown decrypts your data and removes the
  access gates, but the SWD/JTAG port stays locked for the life of
  the device (recoverable only via a full chip erase over a debug
  probe, which destroys all data). Clients should make this
@@ -504,13 +504,13 @@ typedef struct _meshtastic_AdminMessage {
         uint32_t toggle_muted_node;
         /* Request a single frame of the device's display framebuffer.
      The frame is delivered to the local client as FromRadio.display_frame
-     chunks (see DisplayFrame in mesh.proto) - there is no AdminMessage
+     chunks (see DisplayFrame in mesh.proto). There is no AdminMessage
      response. Local connection only: a node receiving this over the mesh,
      or a build without a display, ignores it. During active mirroring it
      forces one frame on the next redraw even if the screen is unchanged. */
         bool get_display_frame_request;
         /* Enable (true) or disable (false) continuous mirroring of the device
-     display - unlike most bool verbs in this oneof, false is meaningful.
+     display. Unlike most bool verbs in this oneof, false is meaningful.
      While enabled, the device sends a DisplayFrame after each screen
      redraw that changed the framebuffer, as FromRadio.display_frame
      chunks; the first frame arrives immediately and acts as the

src/mesh/generated/meshtastic/mesh.pb.h

@@ -1316,10 +1316,13 @@ typedef PB_BYTES_ARRAY_T(384) meshtastic_DisplayFrame_data_t;
  over BLE/serial/TCP. Frames larger than one chunk are split by byte offset;
  a chunk with offset + data length == total_size completes the frame.
  Chunks of one frame arrive contiguously (no other display_frame between
- them; display_palette messages may interleave) and in offset order
- (FromRadio is a reliable ordered stream), so clients may reassemble into
- a single buffer without reordering. A frame whose streaming has begun is always drained to
- completion, even if mirroring is disabled mid-frame. */
+ them; display_palette messages may interleave) and in offset order, so a
+ client never has to reorder. It does have to check for loss: the queue to
+ the client drops its oldest entry when full, and a frame in flight can be
+ truncated when mirroring is disabled. A client MUST verify that offset
+ equals the number of bytes it has already accumulated for this frame_id,
+ and discard the partial frame on any gap or frame_id change. An incomplete
+ frame must never be rendered. */
 typedef struct _meshtastic_DisplayFrame {
     /* Display width in pixels. */
     uint16_t width;
@@ -1327,10 +1330,12 @@ typedef struct _meshtastic_DisplayFrame {
     uint16_t height;
     /* Pixel encoding of data. */
     meshtastic_DisplayFrame_Format format;
-    /* Frame counter, constant across the chunks of one frame so the client
- can detect interleaving or loss. Increments per captured frame, wraps
- at uint32 range, and restarts from 1 on device reboot - treat any
- change as "a new frame", not as an ordering guarantee. */
+    /* Frame counter, constant across the chunks of one frame, so a change
+ marks the start of a new frame. It cannot reveal loss WITHIN a frame,
+ since every chunk of that frame carries the same value; only offset
+ contiguity can. Increments per captured frame, wraps at uint32 range,
+ and restarts from 1 on device reboot, so treat any change as "a new
+ frame" rather than as an ordering guarantee. */
     uint32_t frame_id;
     /* Byte offset of this chunk within the full frame buffer. */
     uint32_t offset;
@@ -1411,15 +1416,15 @@ typedef struct _meshtastic_LockdownStatus {
     /* Current lockdown state being reported. */
     meshtastic_LockdownStatus_State state;
     /* For LOCKED: machine-readable reason. Known values:
-   "needs_auth"        - storage already unlocked, client must auth
-   "token_missing"     - no boot token on flash
-   "token_expired"     - boot token wall-clock TTL elapsed
-   "token_boots_zero"  - boot token boot-count TTL exhausted
-   "token_hmac_fail"   - token tampered or wrong device
-   "token_dek_fail"    - token DEK decrypt failed
-   "token_wrong_size"  - token file corrupted
-   "token_bad_magic"   - token file corrupted
-   "not_provisioned"   - should generally use NEEDS_PROVISION state instead
+   "needs_auth"        — storage already unlocked, client must auth
+   "token_missing"     — no boot token on flash
+   "token_expired"     — boot token wall-clock TTL elapsed
+   "token_boots_zero"  — boot token boot-count TTL exhausted
+   "token_hmac_fail"   — token tampered or wrong device
+   "token_dek_fail"    — token DEK decrypt failed
+   "token_wrong_size"  — token file corrupted
+   "token_bad_magic"   — token file corrupted
+   "not_provisioned"   — should generally use NEEDS_PROVISION state instead
  Other values may be added; clients should treat unknown values as
  "locked, ask for passphrase". */
     char lock_reason[32];
@@ -1577,7 +1582,7 @@ typedef struct _meshtastic_DeviceMetadata {
     bool has_xeddsa;
     /* Describes the device's screen when one is present; absent on display-less
  builds. Lets clients gate display-mirroring UI (see DisplayFrame) and
- adapt to the panel - e.g. expect slow refresh from EINK, or offer
+ adapt to the panel, e.g. expect slow refresh from EINK, or offer
  tap-to-touch when has_touch is set. */
     bool has_display;
     meshtastic_DisplayInfo display;