Require a real raw-table save for same-value channel SETs. This repairs the false acknowledgement after successful constructor recovery of an older backup followed by a failed candidate write.
Keep resolved alias keys, raw AUTO policy and runtime generation untouched. Preserve GET and unchanged contact behavior, changed-policy validation and indeterminate-publication quarantine.
Cover real stale-backup creation, failure/retry, reboot and exact old-skip controls. Add actual alias/BaseChatMesh and raw app-key regression tests on all four backends. Verified 117 related host tests, 16 final caller rechecks, four firmware qualifications and linked nRF52 crypto checks.
Latch only channel storage on Indeterminate writer outcomes, including failed transaction setup. Preserve ordinary failure retries, confirmed rollback, contacts and the live accepted channel keys.
Exercise actual CLI and binary callers with all four storage backends, reboot behavior and exact missing-latch negative controls. Share TX storage failure diagnostics to retain the strict Wio-E5 Mini flash gate.
Verified 103 related host tests, four platform firmware qualifications and linked nRF52 crypto/stack checks. A separate stale-backup constructor/no-op acknowledgement case remains under audit.
Extract the production transaction move state and helper used by recovery. Check inventory invalidation, late rename errors, no-op success and unknown post-move metadata without replacing recovery policy.
Keep exact former rename-result behavior as a negative control for both misleading return directions.
Provide InternalFS for the actual FileRead helper and forbid default File construction in the STM32 fixture. Verify empty and missing handles retain the requested owner and null owners use the safe fallback without I/O.
Retain existing identity transaction and migration authority checks.
Extract the production contact flush, retry and UI shutdown helpers instead of leaving stale fixture-only methods. Keep rollover negative controls and cover volatile contacts, accepted dirty work, authoritative repair and rebuild failures.
Release cached path snapshots before resetting contacts while retaining the requesting transport and table revision for a complete stream restart. Keep explicit session cancellation unchanged and avoid copying uncached contact buffers.
Cover cached and uncached recovery, transport isolation, empty reloads, backpressure, and the former cancellation as a negative control.
Recheck cached immutable paths before resetting the live table after raw I/O failure. Keep accepted RAM mutations, current jobs and save deadlines when reads recover; stronger source or publication uncertainty still forces full recovery. Use the existing recovery byte and a fixed scratch buffer, with no cache allocation or eviction.
Cover full-cache transient recovery, persistent I/O and checksum failures, nRF unread-scope restoration, active ESP jobs, real uncertain publication and unchanged lazy deadlines with sanitizer tests and restored-reset negative controls.
Compile the actual contact recovery flag and accessor in the sleep harness used by CI. Check that pending repair wakes the loop while a retained source flag alone does not. Retain all six temporary-radio, terminal and nRF52 lease variants and their original sleep assertions.
Do not classify legacy or page-name stat errors as unread payloads. Keep candidate contact files unchanged, retry source selection, and use bounded volatile operation if authority remains unknown. Cover legacy absence, downgrade leftovers, cleanup-time metadata recovery and persistent faults with actual-source sanitizer tests and restored-bug negative controls.
Verify fallback namespace moves before accepting publication or rollback. Reload readable contact images at a safe host boundary, discard only unreadable contact data after bounded retries, and permit volatile operation when storage cannot recover. Preserve unrelated stores and fail explicit durability requests truthfully.
Keep existing flash, RAM, OTA and capability limits by streaming nRF52 preferences through the validated wire table and sharing identical contact deadline resets. Add fault-injection, sanitizer, legacy-image parity and CLI lifecycle regressions.
Provide canonical Full recipes for Waveshare S3 LR1121 and Wio Tracker L2 while retaining directly buildable USB and BLE compatibility recipes. Cover hardware inheritance, menu selection, and exact Full mappings in the release profile tests.
Verify public images after every rename attempt, expose publication outcomes, and use an independent CRC32C fingerprint so valid IEEE-CRC-tailed images cannot mask a stale target. Preserve persistent formats and reject directories for empty images.
Reconcile uncertain migration journals before choosing filesystem authority. Preserve retained contact snapshots when page publication is unconfirmed without clearing dirty state or acknowledging the new page generation.
Add readback, rename, CRC-tail, migration reboot/quarantine, and snapshot eviction regressions. Keep complete RAK Full Companion within the unchanged OTA ceiling through equivalent code compaction, with no feature or validation cuts.
Keep tracked reply generations stable in feature-off builds as well as optional transport builds. After ACK copies drain, let expired temporary profiles restore saved settings while failed permanent commits stay staged and retry.
Cover packet generations, rollover, persistent commit faults, cancellation and eventual commit across feature-off, Meshtext and Ethernet configurations. Document ACK ownership and post-reply storage retry behavior.
mikecarper