deploy: e70f4f9030

cli_commands/index.html

@@ -7070,6 +7070,14 @@ command-by-command nRF52 and ESP32 build tables.</p>
 <p>The first word of a command is case-insensitive, so <code>set</code>, <code>Set</code>, and <code>SET</code>
 are equivalent, as are <code>get</code>, <code>Get</code>, and the other command verbs. The case of
 arguments such as node names, passwords, and keys is left unchanged.</p>
+<p>Repeater retries carrying the same logical request ID and original command
+bytes reuse the cached result, even when command parsing trims whitespace or
+splits arguments in place. Changing the timestamp alone does not execute the
+operation again. Normal authentication and stale-request checks still apply.
+Deferred commands and host-service replies remain bound to the full authenticated
+public key, even if permission changes move ACL entries. Removing or revoking
+the requester cancels pending execution; a running <code>setperm</code> can still acknowledge
+its own completed change to the original sender.</p>
 <p>Use the site search or your browser's Find command with everyday wording such
 as <strong>tx retries</strong>, <strong>retry attempts</strong>, <strong>serial logging</strong>, or <strong>tx power</strong>.
 <strong>Search terms</strong> below are alternative wording to help find a command, not
@@ -8213,6 +8221,10 @@ settings use a safe effective power without replacing the saved preference.</p>
 - <code>timeout_mins</code>: Duration in minutes (must be &gt; 0)</p>
 <p><strong>Notes:</strong>
 - <code>tempradio</code> is not saved to preferences and clears on reboot.
+- On repeaters, remote <code>tempradio</code> and <code>normalradio</code> wait for their exact reply
+  copies to finish, with at least one transmitted. This also covers the <code>set</code>
+  alias, case-insensitive verbs, and client correlation prefixes. Failed replies
+  cancel an unconfirmed temporary handoff; hard lease expiry still takes priority.
 - <code>normalradio</code> cancels pending and active temporary-radio windows, then
   restores the saved radio tuple after its CLI reply has drained on the
   current channel. Permanent <code>radioat</code> entries are not removed.

companion_radio_full/index.html

@@ -3112,6 +3112,10 @@ boot as described below.</p>
 <p>The full Companion is deliberately not a LoRa OTA destination: it has no
 firmware staging store, refuses <code>ota install</code>, and never advertises its own
 firmware as an mOTA image.</p>
+<p>Preference changes through the Companion protocol, WebConfig, or USB terminal
+report a storage error if saving fails, and restore their previous values.
+Settings that also change GPS or radio power-saving state restore that state;
+a busy radio rollback remains pending for recovery instead of reporting success.</p>
 <table>
 <thead>
 <tr>
@@ -3547,9 +3551,22 @@ the displaced WiFi session are canceled immediately; already accepted radio
 message transmissions are not canceled. Queued frames are retained, not a
 resumable command session, and IP matching is not authentication. Turning WiFi
 off clears both queues. Stored message history is unaffected.</p>
+<p>Ethernet also retains complete queued frames for the same IP. Unlike WiFi, it
+has no spare backlog buffer: a different IP cancels the old owner's pending
+operations and discards its queued frames before the new socket is exposed.
+This keeps Ethernet's existing four-frame memory limit. On both transports, a
+live same-IP replacement preserves pending operations; an observed disconnect,
+disabled transport, or rejected input cancels them. Already queued frames can
+still be replayed on a same-IP reconnect, but canceled operations are not resumed.</p>
 <p>Partial TCP writes retain the unsent bytes without interleaving later frames.
 After a reconnect, an incomplete frame restarts from its header; the new TCP
 connection must not receive only the old connection's trailing bytes.</p>
+<p>Binary WiFi/Ethernet frames must declare 1–176 payload bytes. Illegal lengths
+close the connection immediately, without waiting for the announced body or
+executing a truncated command. An incomplete binary header or payload has a
+five-second deadline once reception starts; reconnect to send a fresh frame.
+Ethernet raw-line terminal input has no typing deadline, but an overlong line
+also closes the connection instead of executing its prefix.</p>
 <p>USB Binary output is queued as complete length-prefixed frames. Temporary CDC
 or UART backpressure pauses the contact stream; a frame may drain through a
 smaller hardware FIFO in ordered chunks, but its remainder is retained and no

ota_protocol/index.html

@@ -3931,7 +3931,7 @@ fills its own <code>leaves[i]</code> as each verified block lands.</p>
 (idempotent). On boot a node rebuilds an in-RAM present-bitmap by scanning <code>leaves[]</code> for a persistent,
 reopenable store. A hybrid nRF52 transfer is the deliberate exception: its SRAM-backed payload suffix is
 volatile, so the application refuses to adopt that staged header instead of rebuilding partial progress.</p>
-<p><strong>Resume (<code>OtaManager::resumeStaged</code> + <code>OtaStore::checkpoint</code>/<code>reopen</code>):</strong> an interrupted fetch resumes from
+<p><strong>Resume (<code>OtaManager::resumeStaged</code> + <code>OtaStore::checkpoint</code>/<code>reopenFor</code>):</strong> an interrupted fetch resumes from
 the staged container after a reboot - re-parse the stored manifest, recompute geometry, count present
 blocks, continue fetching the holes (or jump straight to COMPLETE). The checkpoint cadence (persist progress
 every N committed blocks) is runtime-tunable (<code>ota config checkpoint &lt;N&gt;</code>, 0 = only finalized containers
@@ -3942,6 +3942,10 @@ package and keeps target <code>0</code> as a MID-only wildcard. Stores keep <cod
 auto-GC, preserving resumable progress. The debug/operator equivalent is <code>ota dev resume &lt;MID8&gt;</code>; after a
 reboot the MID is mandatory, while a no-argument form may only reuse a still-active session MID. It never
 uses the <code>nullptr</code> automatic-adoption path, so a malformed MID or no active MID fails closed.
+Raw ESP32/nRF52 staging scans every valid header before adoption: address order is not creation order.
+Explicit resume selects a unique matching MID/target; automatic resume refuses multiple valid headers
+without erasing them. A leaf-marker read error is never treated as a missing block: reconnectable storage
+pauses and re-verifies after reconnection, while other storage reports failure and permits an explicit retry.
 Hybrid nRF52 staging cannot enter this resume path after an application restart, even if its flash prefix
 still contains metadata; the complete logical container must be fetched again.</p>
 <p><strong>Flash-store note (RX-safe writes):</strong> a flash page-erase halts the CPU (~85 ms on nRF52) and starves LoRa

ota_user_guide/index.html

@@ -3615,7 +3615,11 @@ target to match this node and its version to be newer than the running valid End
 <code>ota pull &lt;MID8&gt;</code> remains the deliberate override for an older or unsigned partial.
 For bring-up/debugging, <code>ota dev resume &lt;MID8&gt;</code> performs the same explicit MID-bound re-adoption without
 starting a new network fetch. After reboot it requires the MID; bare <code>ota dev resume</code> is accepted only while
-an active/requested session MID still exists, and malformed or missing identifiers are rejected.</p>
+an active/requested session MID still exists, and malformed or missing identifiers are rejected.
+If raw flash contains multiple valid staged headers, automatic resume leaves them untouched rather than
+guessing which is newest. Specify the intended MID to select its unique checkpoint; ambiguous matches are
+rejected. Temporary storage read failures no longer consume a download slot indefinitely: host storage
+pauses for reconnection, while non-reconnectable storage reports a storage error and can be retried.</p>
 <p>Recommended for most people: leave both <strong>off</strong> and update by hand. Use <code>autoinstall trusted</code> only once
 you've added the signer's key (next section) and you trust them to push updates unattended. Automatic
 admission and final apply both reject zero, equal, or older signed versions; a dishonest catalog version

radio_profiles/index.html

@@ -3128,8 +3128,19 @@ follow <code>tx.reply</code> below (both TX-capable profiles by default). Ordina
 on the primary profile by default. Use an OTA-capable build and the usual OTA
 setup on every participating node; a temporary profile does not add OTA support
 to firmware built without it.</p>
-<p>New settings take effect after a short reply allowance. Temporary periods and
-schedules live in RAM and disappear on reboot. Timer expiry also uses monotonic
+<p>Local settings take effect after a short reply allowance. On repeaters, immediate
+remote <code>radio2</code>/<code>tempradio2</code> changes (including <code>off</code>) wait until their exact reply
+copies finish, with at least one successfully transmitted. A reply that cannot
+be queued or whose copies all fail cancels the change. Queued replies have a
+five-minute deadline; an already-transmitting copy may finish under the normal
+radio watchdog. This confirms transmission, not reception by the remote client.</p>
+<p>Permanent remote changes are prepared in an uncommitted file before replying;
+the saved configuration is replaced only after reply transmission. If that
+replacement fails, the old channel remains active and the commit retries.
+Local <code>get radio2.status</code> reports this pending state. Roles without the tracked remote
+reply path require local USB for these immediate secondary-profile changes.</p>
+<p>Temporary periods and schedules live in RAM and disappear on reboot. Waiting
+for a reply does not extend a temporary lease. Timer expiry also uses monotonic
 time, so setting the clock backwards cannot extend a temporary session.</p>
 <h2 id="repeater-room-server-and-sensor-replies">Repeater, room-server, and sensor replies</h2>
 <p>These roles default to <strong><code>tx.reply both</code></strong>: locally generated replies are queued