#include <gtest/gtest.h>
#include <algorithm>
#include <array>
#include <vector>
#include <cstring>
#include <type_traits>

#include "helpers/ota/MotaContainer.h"
#include "helpers/ota/MerkleTree.h"
#include "helpers/ota/BlockBitmap.h"
#include "helpers/ota/Multihash.h"
#include "helpers/ota/FirmwareInfo.h"
#include "helpers/ota/MotaSeederProto.h"
#include "helpers/ota/MotaSourceSerial.h"
#include "helpers/ota/FolderMotaStore.h"
#include "helpers/ota/SignerAllowlist.h"
#include "helpers/ota/OtaStore.h"
#include "helpers/ota/OtaProtocol.h"
#include "helpers/ota/OtaManager.h"
#include "helpers/ota/OtaDeflate.h"
#include "helpers/ota/OtaApply.h"
#include "helpers/ota/OtaBlInfo.h"
#include "helpers/ota/OtaFlashLayout_nrf52.h"
#include "helpers/ota/OtaSdBootToken.h"
#include "helpers/ota/OtaSdAuthRecord.h"
#include "mota_vectors.h"   // auto-generated by tools/mota/gen_vectors.py

extern "C" {
  #include "helpers/ota/detools/detools.h"   // vendored detools 0.53.0 embeddable decoder
}

using namespace mesh::ota;

static std::vector<uint8_t> boot_manifest_bytes();

TEST(OtaBootResult, AcceptsOnlyOtafixApplyDiagnostics) {
  EXPECT_EQ(ota_nrf52_boot_result_or_zero(0x90), 0x90);
  EXPECT_EQ(ota_nrf52_boot_result_or_zero(0x9F), 0x9F);
  EXPECT_EQ(ota_nrf52_boot_result_or_zero(0xB0), 0xB0);
  EXPECT_EQ(ota_nrf52_boot_result_or_zero(0xB8), 0xB8);
  EXPECT_EQ(ota_nrf52_boot_result_or_zero(0xBC), 0xBC);
  EXPECT_EQ(ota_nrf52_boot_result_or_zero(0xBD), 0xBD); // retained-source authorization/handoff failure
  EXPECT_EQ(ota_nrf52_boot_result_or_zero(0xC0), 0xC0);
  EXPECT_EQ(ota_nrf52_boot_result_or_zero(0xC8), 0xC8);
  EXPECT_EQ(ota_nrf52_boot_result_or_zero(0xCF), 0xCF);
  EXPECT_TRUE(ota_nrf52_boot_update_result(0xC8));
  EXPECT_FALSE(ota_nrf52_boot_update_result(0xB8));

  EXPECT_EQ(ota_nrf52_boot_result_or_zero(0x00), 0x00);
  EXPECT_EQ(ota_nrf52_boot_result_or_zero(0x4C), 0x00); // shutdown reason
  EXPECT_EQ(ota_nrf52_boot_result_or_zero(0x51), 0x00); // QSPI handoff
  EXPECT_EQ(ota_nrf52_boot_result_or_zero(0x53), 0x00); // SD handoff
  EXPECT_EQ(ota_nrf52_boot_result_or_zero(0xD4), 0x00); // legacy handoff
  EXPECT_EQ(ota_nrf52_boot_result_or_zero(0xED), 0x00); // expanded handoff
  EXPECT_EQ(ota_nrf52_boot_result_or_zero(0xE0), 0x00); // retired handoff remains non-result
  EXPECT_EQ(ota_nrf52_boot_result_or_zero(0xBE), 0x00);
}

TEST(OtaPolicy, TrustedAutoInstallIsStrictlyForwardOnly) {
  EXPECT_FALSE(ota_trusted_auto_version_allows(0, 0x01170104u));
  EXPECT_FALSE(ota_trusted_auto_version_allows(0x01170103u, 0));
  EXPECT_FALSE(ota_trusted_auto_version_allows(0x01170103u, 0x01170102u));
  EXPECT_FALSE(ota_trusted_auto_version_allows(0x01170103u, 0x01170103u));
  EXPECT_TRUE(ota_trusted_auto_version_allows(0x01170103u, 0x01170104u));
}

TEST(OtaCapability, LiveMaximumTracksTheApplicationReassemblyLimit) {
  EXPECT_EQ(ota_max_block_capability(), 2048u);
  EXPECT_EQ(ota_max_block_capability(), OTA_MAX_BLOCK);
  EXPECT_LE(ota_max_block_capability(), OTA_DATA_V2_MAX_ENCODED);
}

TEST(OtaBootPackage, StorageProfilesAndSdGeometryAreExact) {
  EXPECT_EQ(OTA_BL_PROFILE_SD_BOOT_UPDATE, 0x09u);
  EXPECT_EQ(OTA_BL_PROFILE_INTERNAL_BOOT_UPDATE, 0x0Au);
  EXPECT_EQ(OTA_BL_PROFILE_QSPI_BOOT_UPDATE, 0x0Eu);
  EXPECT_EQ(OTA_BL_REQUIRED_APP_CODEC_MASK, 0x0005u);
  EXPECT_EQ(GPREGRET2_OTA_STAGE_SD, 0x53u);
  EXPECT_TRUE(ota_bootloader_image_geometry_valid(
      OTA_BOOT_IMAGE_SIZE, OTA_BOOT_IMAGE_SIZE));
  EXPECT_FALSE(ota_bootloader_image_geometry_valid(
      OTA_BOOT_IMAGE_SIZE - 1u, OTA_BOOT_IMAGE_SIZE));
  EXPECT_FALSE(ota_bootloader_image_geometry_valid(
      OTA_BOOT_IMAGE_SIZE, OTA_BOOT_IMAGE_SIZE - 1u));
  EXPECT_TRUE(ota_bootloader_scratch_headroom_valid(
      true, MOTA_NRF52_APP_BASE_S140_V6,
      OTA_BOOT_SCRATCH_START - MOTA_NRF52_APP_BASE_S140_V6,
      OTA_BOOT_SCRATCH_START));
  EXPECT_FALSE(ota_bootloader_scratch_headroom_valid(
      false, MOTA_NRF52_APP_BASE_S140_V6, 1u, OTA_BOOT_SCRATCH_START));
  EXPECT_FALSE(ota_bootloader_scratch_headroom_valid(
      true, MOTA_NRF52_APP_BASE_S140_V6,
      OTA_BOOT_SCRATCH_START - MOTA_NRF52_APP_BASE_S140_V6 + 1u,
      OTA_BOOT_SCRATCH_START));

  const uint32_t safe_span = OTA_BOOT_SCRATCH_START - MOTA_NRF52_APP_BASE_S140_V6;
  const uint32_t live_size = safe_span - 0x1000u;
  EXPECT_TRUE(ota_bootloader_scratch_bank_geometry_valid(
      OTA_BOOT_BANK_ERASED_FALLBACK, 0xFFFFu, UINT32_MAX, live_size, safe_span));
  EXPECT_TRUE(ota_bootloader_scratch_bank_geometry_valid(
      OTA_BOOT_BANK_VALID_APP, 0u, UINT32_MAX, live_size, safe_span));
  EXPECT_TRUE(ota_bootloader_scratch_bank_geometry_valid(
      OTA_BOOT_BANK_VALID_APP, 1u, live_size, live_size, safe_span));
  EXPECT_FALSE(ota_bootloader_scratch_bank_geometry_valid(
      OTA_BOOT_BANK_VALID_APP, 1u, live_size - 1u, live_size, safe_span));
  EXPECT_FALSE(ota_bootloader_scratch_bank_geometry_valid(
      OTA_BOOT_BANK_VALID_APP, 1u, safe_span + 1u, live_size, safe_span));
  EXPECT_FALSE(ota_bootloader_scratch_bank_geometry_valid(
      0x00FFu, 0u, 0u, live_size, safe_span));
}

TEST(OtaSdAuth, RetainedRecordBindsPurposeGeometryAndContainerDigest) {
  uint8_t digest[32];
  for (uint8_t i = 0; i < sizeof(digest); ++i) digest[i] = (uint8_t)(0x40u + i);
  uint8_t record[MOTA_SD_AUTH_LEN];
  const uint32_t total = 41330u;
  const uint32_t sectors = (total + 511u) / 512u;
  ASSERT_TRUE(mota_sd_auth_encode(record, MOTA_SD_AUTH_PURPOSE_BOOTLOADER,
                                  MOTA_BOOT_FORMAT_VER, 2048u, sectors,
                                  total, 8000000u, digest));
  EXPECT_EQ(0, memcmp(record, "MOTASDA2", 8));
  EXPECT_EQ(mota_sd_auth_rd16(record + 8), 2u);
  EXPECT_EQ(mota_sd_auth_rd16(record + 10), 72u);
  EXPECT_EQ(record[12], MOTA_SD_AUTH_PURPOSE_BOOTLOADER);
  EXPECT_EQ(record[13], MOTA_BOOT_FORMAT_VER);
  EXPECT_EQ(mota_sd_auth_rd32(record + 16), 2048u);
  EXPECT_EQ(mota_sd_auth_rd32(record + 20), sectors);
  EXPECT_EQ(mota_sd_auth_rd32(record + 24), total);
  EXPECT_EQ(mota_sd_auth_rd32(record + 28), 8000000u);
  EXPECT_EQ(0, memcmp(record + 32, digest, sizeof(digest)));
  EXPECT_TRUE(mota_sd_auth_valid(record));

  record[32] ^= 1u;
  EXPECT_FALSE(mota_sd_auth_valid(record));
  record[32] ^= 1u;
  EXPECT_FALSE(mota_sd_auth_encode(record, MOTA_SD_AUTH_PURPOSE_APP,
                                   MOTA_BOOT_FORMAT_VER, 2048u, sectors,
                                   total, 8000000u, digest));
  EXPECT_FALSE(mota_sd_auth_encode(record, MOTA_SD_AUTH_PURPOSE_APP,
                                   MOTA_APP_FORMAT_VER, 2048u, sectors + 1u,
                                   total, 8000000u, digest));
}

TEST(OtaBootPackage, ContinuityExtensionIsBackwardCompatibleAndStrictlyMonotonic) {
  uint8_t envelope[OTA_BOOT_ENVELOPE_SIZE] = {0};
  wr_u32le(envelope, OTA_BOOT_MANIFEST_MAGIC0);
  wr_u32le(envelope + 4, OTA_BOOT_MANIFEST_MAGIC1);
  envelope[8] = (uint8_t)OTA_BOOT_MANIFEST_VERSION;
  envelope[10] = (uint8_t)OTA_BOOT_MANIFEST_SIZE;
  wr_u32le(envelope + 12, OTA_BOOT_IMAGE_START);
  wr_u32le(envelope + 16, OTA_BOOT_IMAGE_SIZE);
  wr_u32le(envelope + 20, 0x239A0071u);
  memcpy(envelope + 24, "TOWER_V2_OTA", 12);
  wr_u32le(envelope + 44, OTA_BOOT_CONTINUITY_MAGIC0);
  wr_u32le(envelope + 48, OTA_BOOT_CONTINUITY_MAGIC1);
  envelope[52] = (uint8_t)OTA_BOOT_CONTINUITY_VERSION;
  envelope[54] = (uint8_t)OTA_BOOT_CONTINUITY_SIZE;
  const uint32_t candidate_version = 0x0117010Du;
  wr_u32le(envelope + 56, candidate_version);
  envelope[60] = (uint8_t)OTA_BOOT_CONTINUITY_FAMILY_S140;
  envelope[62] = 0xB6;
  wr_u32le(envelope + 64, MOTA_NRF52_APP_BASE_S140_V6);
  envelope[68] = (uint8_t)OTA_BOOT_CONTINUITY_LAYOUT_ABI;

  OtaBootloaderIdentity candidate;
  ASSERT_TRUE(ota_bootloader_manifest_parse(envelope, 0x100u, candidate,
                                             sizeof(envelope)));
  ASSERT_TRUE(candidate.continuity_present);
  EXPECT_EQ(candidate.boot_version, candidate_version);
  EXPECT_EQ(candidate.softdevice_family, 140u);
  EXPECT_EQ(candidate.softdevice_fwid, 0x00B6u);
  EXPECT_EQ(candidate.app_base, MOTA_NRF52_APP_BASE_S140_V6);

  OtaBootloaderIdentity legacy = candidate;
  legacy.continuity_present = false;
  legacy.crc_ok = true;
  EXPECT_FALSE(ota_bootloader_sd_retained_auth_ready(
      legacy, 140u, 0x00B6u, MOTA_NRF52_APP_BASE_S140_V6, 1u));
  candidate.crc_ok = true;
  EXPECT_TRUE(ota_bootloader_sd_retained_auth_ready(
      candidate, 140u, 0x00B6u, MOTA_NRF52_APP_BASE_S140_V6, 1u));
  EXPECT_EQ(ota_bootloader_continuity_gate(
                legacy, candidate, candidate_version, 140u, 0x00B6u,
                MOTA_NRF52_APP_BASE_S140_V6, 1u),
            OTA_BOOT_CONTINUITY_OK); // one-time v1 bootstrap
  EXPECT_EQ(ota_bootloader_continuity_gate(
                legacy, candidate, candidate_version + 1u, 140u, 0x00B6u,
                MOTA_NRF52_APP_BASE_S140_V6, 1u),
            OTA_BOOT_CONTINUITY_OUTER_VERSION);

  OtaBootloaderIdentity installed = candidate;
  installed.boot_version = candidate_version - 1u;
  EXPECT_EQ(ota_bootloader_continuity_gate(
                installed, candidate, candidate_version, 140u, 0x00B6u,
                MOTA_NRF52_APP_BASE_S140_V6, 1u),
            OTA_BOOT_CONTINUITY_OK);
  installed.boot_version = candidate_version;
  EXPECT_EQ(ota_bootloader_continuity_gate(
                installed, candidate, candidate_version, 140u, 0x00B6u,
                MOTA_NRF52_APP_BASE_S140_V6, 1u),
            OTA_BOOT_CONTINUITY_NOT_NEWER);
  EXPECT_EQ(ota_bootloader_continuity_gate(
                legacy, candidate, candidate_version, 140u, 0x00B7u,
                MOTA_NRF52_APP_BASE_S140_V6, 1u),
            OTA_BOOT_CONTINUITY_PLATFORM);

  EXPECT_FALSE(ota_bootloader_version_valid(0x02040100u));
  EXPECT_FALSE(ota_bootloader_version_valid(UINT32_MAX));
  EXPECT_TRUE(ota_bootloader_version_valid(0x020401FFu));
  candidate.boot_version = UINT32_MAX;
  EXPECT_EQ(ota_bootloader_continuity_gate(
                legacy, candidate, UINT32_MAX, 140u, 0x00B6u,
                MOTA_NRF52_APP_BASE_S140_V6, 1u),
            OTA_BOOT_CONTINUITY_OUTER_VERSION);
  candidate.boot_version = candidate_version;

  envelope[48] ^= 1u;
  EXPECT_FALSE(ota_bootloader_manifest_parse(envelope, 0x100u, candidate,
                                              sizeof(envelope)));
}

TEST(OtaBootPackage, CandidateContinuityEnvelopeHasOneCanonicalFinalOffset) {
  auto make_image = [](uint32_t manifest_offset) {
    std::vector<uint8_t> image(OTA_BOOT_IMAGE_SIZE, 0xFF);
    wr_u32le(image.data(), OTA_NRF52840_RAM_END);
    wr_u32le(image.data() + 4, OTA_BOOT_IMAGE_START + 0x101u);
    uint8_t* caps = image.data() + 0x400u;
    memset(caps, 0, 16u);
    memcpy(caps, "MOTABLDR", 8u);
    caps[8] = MOTA_BOOT_FORMAT_VER;
    caps[10] = (uint8_t)OTA_BL_REQUIRED_APP_CODEC_MASK;
    caps[12] = OTA_BL_PROFILE_SD_BOOT_UPDATE;
    uint8_t* envelope = image.data() + manifest_offset;
    memset(envelope, 0, OTA_BOOT_ENVELOPE_SIZE);
    wr_u32le(envelope, OTA_BOOT_MANIFEST_MAGIC0);
    wr_u32le(envelope + 4, OTA_BOOT_MANIFEST_MAGIC1);
    envelope[8] = (uint8_t)OTA_BOOT_MANIFEST_VERSION;
    envelope[10] = (uint8_t)OTA_BOOT_MANIFEST_SIZE;
    wr_u32le(envelope + 12, OTA_BOOT_IMAGE_START);
    wr_u32le(envelope + 16, OTA_BOOT_IMAGE_SIZE);
    wr_u32le(envelope + 20, OTA_XIAO_BOARD_ID_BASE);
    memcpy(envelope + 24, OTA_XIAO_BOOT_DEVICE_NAME,
           OTA_BOOT_DEVICE_NAME_SIZE);
    wr_u32le(envelope + 44, OTA_BOOT_CONTINUITY_MAGIC0);
    wr_u32le(envelope + 48, OTA_BOOT_CONTINUITY_MAGIC1);
    envelope[52] = (uint8_t)OTA_BOOT_CONTINUITY_VERSION;
    envelope[54] = (uint8_t)OTA_BOOT_CONTINUITY_SIZE;
    wr_u32le(envelope + 56, 0x0117010Du);
    envelope[60] = (uint8_t)OTA_BOOT_CONTINUITY_FAMILY_S140;
    envelope[62] = 0x23u;
    envelope[63] = 0x01u;
    wr_u32le(envelope + 64, MOTA_NRF52_APP_BASE_S140_V7);
    envelope[68] = (uint8_t)OTA_BOOT_CONTINUITY_LAYOUT_ABI;
    wr_u32le(envelope + 40,
             ota_boot_image_crc32(image.data(), image.size(), manifest_offset + 40));
    return image;
  };

  OtaBootloaderIdentity identity;
  auto canonical = make_image(OTA_BOOT_CANDIDATE_MANIFEST_OFFSET);
  ASSERT_TRUE(ota_bootloader_candidate_identity_from_image(
      canonical.data(), canonical.size(), identity));
  EXPECT_TRUE(ota_bootloader_candidate_identity_canonical(identity));
  EXPECT_EQ(identity.manifest_offset, 0x9FB4u);

  auto relocated = make_image(0x8000u);
  ASSERT_TRUE(ota_bootloader_identity_from_image(
      relocated.data(), relocated.size(), identity)); // installed/legacy scanner remains generic
  EXPECT_FALSE(ota_bootloader_candidate_identity_canonical(identity));
  EXPECT_FALSE(ota_bootloader_candidate_identity_from_image(
      relocated.data(), relocated.size(), identity));

  OtaStoreRam<OTA_BOOT_IMAGE_SIZE> store;
  OtaBootloaderCapsMarker caps;
  ASSERT_TRUE(store.begin((uint32_t)canonical.size()));
  ASSERT_TRUE(store.write(0, canonical.data(), (uint32_t)canonical.size()));
  EXPECT_TRUE(ota_bootloader_external_image_metadata(
      store, 0, OTA_BL_PROFILE_SD_BOOT_UPDATE, identity, caps));
  EXPECT_EQ(identity.manifest_offset, OTA_BOOT_CANDIDATE_MANIFEST_OFFSET);

  // A second CRC-valid base identity still counts when its adjacent BLM2
  // extension is only half present. These coupled values are the fixed point
  // for this deterministic image. Counting continuity first would wrongly
  // discard the decoy and disagree with a deployed legacy updater.
  auto ambiguous = canonical;
  const uint32_t corrupt_decoy = 0x200u;
  memcpy(ambiguous.data() + corrupt_decoy,
         ambiguous.data() + OTA_BOOT_CANDIDATE_MANIFEST_OFFSET,
         OTA_BOOT_MANIFEST_SIZE);
  wr_u32le(ambiguous.data() + corrupt_decoy + 44, OTA_BOOT_CONTINUITY_MAGIC0);
  wr_u32le(ambiguous.data() + corrupt_decoy + 48, 0x21444142u); // "BAD!"
  wr_u32le(ambiguous.data() + OTA_BOOT_CANDIDATE_MANIFEST_OFFSET + 40,
           0x614E59E1u);
  wr_u32le(ambiguous.data() + corrupt_decoy + 40, 0x4A03F7A2u);
  ASSERT_EQ(ota_boot_image_crc32(
                ambiguous.data(), ambiguous.size(),
                OTA_BOOT_CANDIDATE_MANIFEST_OFFSET + 40), 0x614E59E1u);
  ASSERT_EQ(ota_boot_image_crc32(
                ambiguous.data(), ambiguous.size(), corrupt_decoy + 40),
            0x4A03F7A2u);
  EXPECT_FALSE(ota_bootloader_candidate_identity_from_image(
      ambiguous.data(), ambiguous.size(), identity));
  ASSERT_TRUE(store.begin((uint32_t)ambiguous.size()));
  ASSERT_TRUE(store.write(0, ambiguous.data(), (uint32_t)ambiguous.size()));
  EXPECT_FALSE(ota_bootloader_external_image_metadata(
      store, 0, OTA_BL_PROFILE_SD_BOOT_UPDATE, identity, caps));

  // The same malformed extension is harmless when its base CRC is invalid;
  // only the canonical CRC-valid identity is selected and interpreted.
  auto bad_crc_decoy = canonical;
  memcpy(bad_crc_decoy.data() + corrupt_decoy,
         bad_crc_decoy.data() + OTA_BOOT_CANDIDATE_MANIFEST_OFFSET,
         OTA_BOOT_MANIFEST_SIZE);
  wr_u32le(bad_crc_decoy.data() + corrupt_decoy + 44,
           OTA_BOOT_CONTINUITY_MAGIC0);
  wr_u32le(bad_crc_decoy.data() + corrupt_decoy + 48, 0x21444142u);
  wr_u32le(bad_crc_decoy.data() + corrupt_decoy + 40, 0xA5A5A5A5u);
  wr_u32le(bad_crc_decoy.data() + OTA_BOOT_CANDIDATE_MANIFEST_OFFSET + 40, 0u);
  wr_u32le(bad_crc_decoy.data() + OTA_BOOT_CANDIDATE_MANIFEST_OFFSET + 40,
           ota_boot_image_crc32(
               bad_crc_decoy.data(), bad_crc_decoy.size(),
               OTA_BOOT_CANDIDATE_MANIFEST_OFFSET + 40));
  ASSERT_NE(ota_boot_image_crc32(
                bad_crc_decoy.data(), bad_crc_decoy.size(), corrupt_decoy + 40),
            0xA5A5A5A5u);
  EXPECT_TRUE(ota_bootloader_candidate_identity_from_image(
      bad_crc_decoy.data(), bad_crc_decoy.size(), identity));
  ASSERT_TRUE(store.begin((uint32_t)bad_crc_decoy.size()));
  ASSERT_TRUE(store.write(0, bad_crc_decoy.data(),
                          (uint32_t)bad_crc_decoy.size()));
  EXPECT_TRUE(ota_bootloader_external_image_metadata(
      store, 0, OTA_BL_PROFILE_SD_BOOT_UPDATE, identity, caps));

  // A sole CRC-valid identity that claims a corrupt extension is not a legacy
  // image; installed diagnostics and candidate validation both fail closed.
  auto sole_half = canonical;
  wr_u32le(sole_half.data() + OTA_BOOT_CANDIDATE_MANIFEST_OFFSET + 48,
           0x21444142u);
  wr_u32le(sole_half.data() + OTA_BOOT_CANDIDATE_MANIFEST_OFFSET + 40, 0u);
  wr_u32le(sole_half.data() + OTA_BOOT_CANDIDATE_MANIFEST_OFFSET + 40,
           ota_boot_image_crc32(
               sole_half.data(), sole_half.size(),
               OTA_BOOT_CANDIDATE_MANIFEST_OFFSET + 40));
  EXPECT_FALSE(ota_bootloader_identity_from_image(
      sole_half.data(), sole_half.size(), identity));
  ASSERT_TRUE(store.begin((uint32_t)sole_half.size()));
  ASSERT_TRUE(store.write(0, sole_half.data(), (uint32_t)sole_half.size()));
  EXPECT_FALSE(ota_bootloader_external_image_metadata(
      store, 0, OTA_BL_PROFILE_SD_BOOT_UPDATE, identity, caps));

  ASSERT_TRUE(store.begin((uint32_t)relocated.size()));
  ASSERT_TRUE(store.write(0, relocated.data(), (uint32_t)relocated.size()));
  EXPECT_FALSE(ota_bootloader_external_image_metadata(
      store, 0, OTA_BL_PROFILE_SD_BOOT_UPDATE, identity, caps));
}

TEST(OtaBootPackage, SdApprovalTokenBindsTheAuthenticatedImageHash) {
  uint8_t hash[32];
  for (uint8_t i = 0; i < sizeof(hash); i++) hash[i] = i;
  uint8_t token[MOTA_SD_BOOT_TOKEN_LEN];
  mota_sd_boot_token_encode(token, MOTA_NRF52_BOOT_CONTAINER_SIZE, hash);
  EXPECT_EQ(0, memcmp(token, "MOTASDBL", 8));
  EXPECT_EQ(mota_sd_boot_token_rd32(token + 8), 1u);
  EXPECT_EQ(mota_sd_boot_token_rd32(token + 12), 64u);
  EXPECT_EQ(mota_sd_boot_token_rd32(token + 16), MOTA_NRF52_BOOT_CONTAINER_SIZE);
  EXPECT_EQ(mota_sd_boot_token_rd32(token + 20), ~MOTA_NRF52_BOOT_CONTAINER_SIZE);
  EXPECT_EQ(0, memcmp(token + MOTA_SD_BOOT_TOKEN_IMAGE_HASH_OFFSET, hash, sizeof(hash)));
  EXPECT_TRUE(mota_sd_boot_token_valid(
      token, MOTA_NRF52_BOOT_CONTAINER_SIZE, hash));

  token[MOTA_SD_BOOT_TOKEN_IMAGE_HASH_OFFSET] ^= 1u;
  EXPECT_FALSE(mota_sd_boot_token_valid(
      token, MOTA_NRF52_BOOT_CONTAINER_SIZE, hash));
  token[MOTA_SD_BOOT_TOKEN_IMAGE_HASH_OFFSET] ^= 1u;
  EXPECT_FALSE(mota_sd_boot_token_valid(
      token, MOTA_NRF52_BOOT_CONTAINER_SIZE + 1u, hash));
}

TEST(OtaBootPackage, GenericIdentityUsesBoardAndNameForCollisionSafeTarget) {
  const uint32_t shared_board_id = 0x239A0029u;
  const uint8_t gat562_name[16] = {'G','A','T','5','6','2','_','D','F','U',0,0,0,0,0,0};
  const uint8_t rak3401_name[16] = {'3','4','0','1','_','D','F','U',0,0,0,0,0,0,0,0};
  const uint8_t rak4631_name[16] = {'4','6','3','1','_','D','F','U',0,0,0,0,0,0,0,0};
  uint8_t hw_gat562[32], hw3401[32], hw4631[32];
  ASSERT_TRUE(ota_bootloader_hw_id(shared_board_id, gat562_name, hw_gat562));
  ASSERT_TRUE(ota_bootloader_hw_id(shared_board_id, rak3401_name, hw3401));
  ASSERT_TRUE(ota_bootloader_hw_id(shared_board_id, rak4631_name, hw4631));
  EXPECT_EQ(0, memcmp(hw_gat562, "NRF_BL_239A0029_GAT562_DFU", 26));
  EXPECT_EQ(0, memcmp(hw3401, "NRF_BL_239A0029_3401_DFU", 24));
  EXPECT_EQ(0, memcmp(hw4631, "NRF_BL_239A0029_4631_DFU", 24));
  EXPECT_NE(0, memcmp(hw_gat562, hw4631, sizeof(hw_gat562)));
  EXPECT_NE(0, memcmp(hw3401, hw4631, sizeof(hw3401)));
  EXPECT_EQ(ota_bootloader_target_id(shared_board_id, gat562_name), 0xD50D2D44u);
  EXPECT_EQ(ota_bootloader_target_id(shared_board_id, rak3401_name), 0x23818A80u);
  EXPECT_EQ(ota_bootloader_target_id(shared_board_id, rak4631_name), 0x2D0DF000u);

  uint8_t invalid[16] = {'B','A','D',0,'T','A','I','L',0,0,0,0,0,0,0,0};
  EXPECT_FALSE(ota_bootloader_device_name_valid(shared_board_id, invalid));
  memset(invalid, 'A', sizeof(invalid));
  EXPECT_FALSE(ota_bootloader_device_name_valid(shared_board_id, invalid));
  EXPECT_FALSE(ota_bootloader_board_id_valid(0));
  EXPECT_FALSE(ota_bootloader_board_id_valid(UINT32_MAX));

  auto raw = boot_manifest_bytes();
  wr_u32le(raw.data() + 3, ota_bootloader_target_id(shared_board_id, rak3401_name));
  memcpy(raw.data() + 57, hw3401, sizeof(hw3401));
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse_manifest(raw.data(), raw.size(), manifest));
  OtaBootloaderIdentity installed;
  installed.present = installed.crc_ok = true;
  installed.image_start = OTA_BOOT_IMAGE_START;
  installed.image_size = OTA_BOOT_IMAGE_SIZE;
  installed.board_id = shared_board_id;
  memcpy(installed.device_name, rak3401_name, sizeof(rak3401_name));
  uint8_t mid[4] = {0x11,0x22,0x33,0x44};
  uint8_t hash8[8]; memcpy(hash8, manifest.image_hash, sizeof(hash8));
  EXPECT_EQ(ota_bootloader_confirmation_gate(manifest, installed, mid, mid, hash8),
            OTA_BOOT_CONFIRM_OK);
  wr_u32le(raw.data() + 3, shared_board_id); // raw USB ID is not the generic wire target
  ASSERT_TRUE(mota_parse_manifest(raw.data(), raw.size(), manifest));
  EXPECT_EQ(ota_bootloader_confirmation_gate(manifest, installed, mid, mid, hash8),
            OTA_BOOT_CONFIRM_TARGET);

  struct KnownIdentity { uint32_t board_id; const char* name; uint32_t target_id; };
  const KnownIdentity known[] = {
      {0x239A0029u, "GAT562_DFU",    0xD50D2D44u},
      {0x239A0071u, "TOWER_V2_OTA",   0x1150F50Eu},
      {0x239A0071u, "T096_DFU",       0x42354C85u},
      {0x239A0071u, "T1_DFU",         0xFC556FFCu},
      {0x239A0071u, "T114_DFU",       0x0C3F2902u},
      {0x239A0071u, "MESH_POCKET_OTA",0x059277F4u},
      {0x239A00B3u, "KeepteenLT1_OTA",0xDB2E7B51u},
      {0x239A0029u, "MX25_DFU",       0x026AA982u},
      {0x239A00B3u, "PROM_DFU",       0xAF79E8CCu},
      {0x28860057u, "T1KE_DFU",       0xE6F5F03Fu},
      {0x239A00DAu, "TNM3_DFU",       0x0CA41DB2u},
      {0x239A0029u, "3401_DFU",       0x23818A80u},
      {0x239A0029u, "4631_DFU",       0x2D0DF000u},
      {0x239A0029u, "RTAG_DFU",       0xC72E9C9Cu},
  };
  uint32_t targets[sizeof(known) / sizeof(known[0])] = {0};
  for (size_t i = 0; i < sizeof(known) / sizeof(known[0]); i++) {
    uint8_t name[16] = {0};
    ASSERT_LT(strlen(known[i].name), sizeof(name));
    memcpy(name, known[i].name, strlen(known[i].name));
    targets[i] = ota_bootloader_target_id(known[i].board_id, name);
    EXPECT_EQ(targets[i], known[i].target_id);
    for (size_t j = 0; j < i; j++) EXPECT_NE(targets[i], targets[j]);
  }
}

static std::vector<uint8_t> boot_manifest_bytes() {
  std::vector<uint8_t> m(MOTA_MFL, 0);
  m[0] = MOTA_BOOT_FORMAT_VER;
  m[1] = MFLAG_FULL | MFLAG_SIGNED | MFLAG_BOOTLOADER;
  m[2] = HASH_ALGO_SHA256;
  wr_u32le(m.data() + 3, OTA_XIAO_BOARD_ID_BASE);
  wr_u32le(m.data() + 7, 1);
  wr_u32le(m.data() + 11, OTA_BOOT_IMAGE_SIZE);
  wr_u32le(m.data() + 15, OTA_BOOT_IMAGE_SIZE);
  m[19] = 10;
  m[20] = 0x11; m[21] = 0x22; m[22] = 0x33; m[23] = 0x44;
  for (uint8_t i = 0; i < 32; i++) m[24 + i] = (uint8_t)(0x80 + i);
  m[56] = CODEC_FULL;
  uint8_t hw[32]; EXPECT_TRUE(ota_xiao_bootloader_hw_id(OTA_XIAO_BOARD_ID_BASE, hw));
  memcpy(m.data() + 57, hw, sizeof(hw));
  memset(m.data() + MOTA_OFF_APPROVAL, 0xFF, 4);
  return m;
}

TEST(OtaBootPackage, ParserSeparatesV2ApplicationsFromStrictV3Bootloader) {
  MotaManifest parsed;
  auto m = boot_manifest_bytes();
  ASSERT_TRUE(mota_parse_manifest(m.data(), m.size(), parsed));
  EXPECT_TRUE(parsed.is_bootloader());
  EXPECT_EQ(parsed.block_size(), 1024u);
  EXPECT_EQ(parsed.block_count, 40u);

  m[0] = MOTA_APP_FORMAT_VER;
  EXPECT_FALSE(mota_parse_manifest(m.data(), m.size(), parsed));
  m = boot_manifest_bytes(); m[1] &= ~MFLAG_BOOTLOADER;
  EXPECT_FALSE(mota_parse_manifest(m.data(), m.size(), parsed));
  m = boot_manifest_bytes(); m[19] = 9;
  EXPECT_FALSE(mota_parse_manifest(m.data(), m.size(), parsed));
  m = boot_manifest_bytes(); m[19] = 11;
  EXPECT_FALSE(mota_parse_manifest(m.data(), m.size(), parsed));
  m = boot_manifest_bytes(); memset(m.data() + 7, 0, 4);
  EXPECT_FALSE(mota_parse_manifest(m.data(), m.size(), parsed));
  m = boot_manifest_bytes(); m[MOTA_OFF_BASE_HASH] = 1;
  EXPECT_FALSE(mota_parse_manifest(m.data(), m.size(), parsed));
}

TEST(OtaBootPackage, EmbeddedIdentityVectorCapsAndExplicitConfirmationGate) {
  std::vector<uint8_t> image(OTA_BOOT_IMAGE_SIZE, 0xFF);
  wr_u32le(image.data(), OTA_NRF52840_RAM_END);
  wr_u32le(image.data() + 4, OTA_BOOT_IMAGE_START + 0x101u);
  ASSERT_TRUE(ota_bootloader_vector_sane(image.data()));
  image[4] &= 0xFE;
  EXPECT_FALSE(ota_bootloader_vector_sane(image.data()));
  wr_u32le(image.data() + 4, OTA_BOOT_IMAGE_START + 0x101u);

  const uint32_t moff = 0x100;
  memset(image.data() + moff, 0, OTA_BOOT_MANIFEST_SIZE);
  wr_u32le(image.data() + moff, OTA_BOOT_MANIFEST_MAGIC0);
  wr_u32le(image.data() + moff + 4, OTA_BOOT_MANIFEST_MAGIC1);
  image[moff + 8] = OTA_BOOT_MANIFEST_VERSION;
  image[moff + 10] = OTA_BOOT_MANIFEST_SIZE;
  wr_u32le(image.data() + moff + 12, OTA_BOOT_IMAGE_START);
  wr_u32le(image.data() + moff + 16, OTA_BOOT_IMAGE_SIZE);
  wr_u32le(image.data() + moff + 20, OTA_XIAO_BOARD_ID_BASE);
  memcpy(image.data() + moff + 24, OTA_XIAO_BOOT_DEVICE_NAME,
         OTA_BOOT_DEVICE_NAME_SIZE);
  wr_u32le(image.data() + moff + 40,
           ota_boot_image_crc32(image.data(), image.size(), moff + 40));
  const std::vector<uint8_t> canonical_image = image;

  OtaBootloaderIdentity identity;
  ASSERT_TRUE(ota_bootloader_identity_from_image(image.data(), image.size(), identity));
  EXPECT_TRUE(identity.crc_ok);
  EXPECT_EQ(identity.board_id, OTA_XIAO_BOARD_ID_BASE);

  // A structurally complete bad-CRC decoy before the real manifest must not
  // shadow the later valid identity.
  const uint32_t decoy = 0x20;
  memcpy(image.data() + decoy, image.data() + moff, OTA_BOOT_MANIFEST_SIZE);
  wr_u32le(image.data() + decoy + 40, 0xA5A5A5A5u);
  wr_u32le(image.data() + moff + 40, 0);
  wr_u32le(image.data() + moff + 40,
           ota_boot_image_crc32(image.data(), image.size(), moff + 40));
  ASSERT_NE(ota_boot_image_crc32(image.data(), image.size(), decoy + 40), 0xA5A5A5A5u);
  ASSERT_TRUE(ota_bootloader_identity_from_image(image.data(), image.size(), identity));
  EXPECT_EQ(identity.manifest_offset, moff);

  // These coupled CRC values make both otherwise identical manifests valid
  // in this deterministic fixture. Two privileged identities are ambiguous
  // and must fail closed in the helper shared with the staged-QSPI scanner.
  image = canonical_image;
  const uint32_t second = 0x200;
  memcpy(image.data() + second, image.data() + moff, OTA_BOOT_MANIFEST_SIZE);
  wr_u32le(image.data() + moff + 40, 0x07033138u);
  wr_u32le(image.data() + second + 40, 0x0998508Cu);
  ASSERT_EQ(ota_boot_image_crc32(image.data(), image.size(), moff + 40), 0x07033138u);
  ASSERT_EQ(ota_boot_image_crc32(image.data(), image.size(), second + 40), 0x0998508Cu);
  EXPECT_FALSE(ota_bootloader_identity_from_image(image.data(), image.size(), identity));

  image = canonical_image;
  image[0x300] ^= 1;
  EXPECT_FALSE(ota_bootloader_identity_from_image(image.data(), image.size(), identity));

  uint8_t marker[16] = {'M','O','T','A','B','L','D','R', 3,0, 5,0,
                        (uint8_t)(OTA_BL_STORAGE_QSPI | OTA_BL_STORAGE_BOOT_UPDATE), 0,0,0};
  OtaBootloaderCapsMarker caps;
  EXPECT_TRUE(ota_bootloader_caps_marker_parse(marker, caps));
  marker[15] = 1;
  EXPECT_FALSE(ota_bootloader_caps_marker_parse(marker, caps));
  marker[15] = 0;
  marker[8] = 0; marker[9] = 1; // ABI 0x0100: valid little-endian u16
  ASSERT_TRUE(ota_bootloader_caps_marker_parse(marker, caps));
  EXPECT_EQ(caps.apply_abi, 0x0100u);
  marker[8] = 0; marker[9] = 0;
  EXPECT_FALSE(ota_bootloader_caps_marker_parse(marker, caps));
  marker[8] = 0xFF; marker[9] = 0xFF;
  EXPECT_FALSE(ota_bootloader_caps_marker_parse(marker, caps));

  std::vector<uint8_t> internal_caps_image(64, 0xFF);
  const uint8_t internal_marker[16] = {
      'M','O','T','A','B','L','D','R', 3,0, 5,0,
      (uint8_t)(OTA_BL_STORAGE_STAGE_CEILING | OTA_BL_STORAGE_BOOT_UPDATE), 0,0,0};
  memcpy(internal_caps_image.data() + 4, internal_marker, sizeof(internal_marker));
  EXPECT_TRUE(ota_bootloader_caps_from_image(
      internal_caps_image.data(), internal_caps_image.size(),
      OTA_BL_STORAGE_STAGE_CEILING | OTA_BL_STORAGE_BOOT_UPDATE,
      caps));
  EXPECT_FALSE(ota_bootloader_caps_from_image(
      internal_caps_image.data(), internal_caps_image.size(),
      OTA_BL_STORAGE_STAGE_CEILING | OTA_BL_STORAGE_QSPI | OTA_BL_STORAGE_BOOT_UPDATE,
      caps));
  memcpy(internal_caps_image.data() + 24, internal_marker, sizeof(internal_marker));
  internal_caps_image[24 + 12] =
      OTA_BL_STORAGE_STAGE_CEILING | OTA_BL_STORAGE_QSPI | OTA_BL_STORAGE_BOOT_UPDATE;
  EXPECT_FALSE(ota_bootloader_caps_from_image(
      internal_caps_image.data(), internal_caps_image.size(),
      OTA_BL_STORAGE_STAGE_CEILING | OTA_BL_STORAGE_BOOT_UPDATE,
      caps));

  std::vector<uint8_t> full_only_caps(32, 0xFF);
  memcpy(full_only_caps.data() + 4, internal_marker, sizeof(internal_marker));
  full_only_caps[4 + 10] = 1;
  EXPECT_FALSE(ota_bootloader_caps_from_image(
      full_only_caps.data(), full_only_caps.size(),
      OTA_BL_STORAGE_STAGE_CEILING | OTA_BL_STORAGE_BOOT_UPDATE,
      caps));

  OtaBlCaps selected;
  selected.present = true;
  selected.apply_abi = 3;
  selected.storage_flags = OTA_BL_STORAGE_QSPI | OTA_BL_STORAGE_BOOT_UPDATE;
  EXPECT_FALSE(ota_bl_caps_prefer(selected, 99, OTA_BL_STORAGE_QSPI, true));
  EXPECT_TRUE(ota_bl_caps_prefer(selected, 4,
                                 OTA_BL_STORAGE_QSPI | OTA_BL_STORAGE_BOOT_UPDATE, true));

  auto mf = boot_manifest_bytes();
  MotaManifest m;
  ASSERT_TRUE(mota_parse_manifest(mf.data(), mf.size(), m));
  OtaBootloaderIdentity installed;
  installed.present = installed.crc_ok = true;
  installed.image_start = OTA_BOOT_IMAGE_START;
  installed.image_size = OTA_BOOT_IMAGE_SIZE;
  installed.board_id = OTA_XIAO_BOARD_ID_BASE;
  memcpy(installed.device_name, OTA_XIAO_BOOT_DEVICE_NAME,
         OTA_BOOT_DEVICE_NAME_SIZE);
  uint8_t mid[4] = {0x11,0x22,0x33,0x44};
  uint8_t hash8[8]; memcpy(hash8, m.image_hash, sizeof(hash8));
  EXPECT_EQ(ota_bootloader_confirmation_gate(m, installed, mid, mid, hash8), OTA_BOOT_CONFIRM_OK);
  uint8_t bad_mid[4] = {0};
  EXPECT_EQ(ota_bootloader_confirmation_gate(m, installed, mid, bad_mid, hash8),
            OTA_BOOT_CONFIRM_MID);
  hash8[0] ^= 1;
  EXPECT_EQ(ota_bootloader_confirmation_gate(m, installed, mid, mid, hash8),
            OTA_BOOT_CONFIRM_IMAGE_HASH);
}

TEST(OtaBootPackage, CapabilityScannerRejectsAnOtherwiseValidUnalignedMarker) {
  const uint8_t qspi_profile =
      OTA_BL_STORAGE_STAGE_CEILING | OTA_BL_STORAGE_QSPI |
      OTA_BL_STORAGE_BOOT_UPDATE;
  uint8_t marker[16] = {'M','O','T','A','B','L','D','R', 3,0, 5,0,
                        qspi_profile, 0,0,0};
  uint8_t image[64];
  memset(image, 0xFF, sizeof(image));
  memcpy(image + 1, marker, sizeof(marker));
  EXPECT_FALSE(ota_bl_caps_scan_aligned(image, sizeof(image), true, qspi_profile).present);

  memset(image, 0xFF, sizeof(image));
  memcpy(image + 4, marker, sizeof(marker));
  const OtaBlCaps caps = ota_bl_caps_scan_aligned(image, sizeof(image), true, qspi_profile);
  ASSERT_TRUE(caps.present);
  EXPECT_EQ(caps.apply_abi, 3u);
  EXPECT_EQ(caps.storage_flags, qspi_profile);

  marker[8] = 0; marker[9] = 1;
  memset(image, 0xFF, sizeof(image));
  memcpy(image + 4, marker, sizeof(marker));
  const OtaBlCaps high_abi =
      ota_bl_caps_scan_aligned(image, sizeof(image), true, qspi_profile);
  ASSERT_TRUE(high_abi.present);
  EXPECT_EQ(high_abi.apply_abi, 0x0100u);
  marker[8] = 3; marker[9] = 0;
  memset(image, 0xFF, sizeof(image));
  memcpy(image + 4, marker, sizeof(marker));

  // A malformed aligned magic decoy is ignored, but a second fully valid
  // privileged marker makes the installed capability identity ambiguous.
  memcpy(image + 24, marker, sizeof(marker));
  EXPECT_FALSE(ota_bl_caps_scan_aligned(image, sizeof(image), true, qspi_profile).present);
  memset(image + 24, 0xFF, sizeof(marker));
  memcpy(image + 24, marker, sizeof(marker));
  image[24 + 13] = 1;
  EXPECT_TRUE(ota_bl_caps_scan_aligned(image, sizeof(image), true, qspi_profile).present);

  // Any second structurally valid privileged marker is ambiguous, including
  // another known storage profile or the bare BOOT_UPDATE capability.
  memcpy(image + 24, marker, sizeof(marker));
  image[24 + 12] = OTA_BL_STORAGE_STAGE_CEILING |
                   OTA_BL_STORAGE_BOOT_UPDATE;
  EXPECT_FALSE(ota_bl_caps_scan_aligned(image, sizeof(image), true, qspi_profile).present);
  image[24 + 12] = OTA_BL_STORAGE_BOOT_UPDATE;
  EXPECT_FALSE(ota_bl_caps_scan_aligned(image, sizeof(image), true, qspi_profile).present);

  memset(image, 0xFF, sizeof(image));
  memcpy(image + 4, marker, sizeof(marker));
  image[4 + 12] = OTA_BL_STORAGE_BOOT_UPDATE;
  EXPECT_FALSE(ota_bl_caps_scan_aligned(image, sizeof(image), true, qspi_profile).present);
}

TEST(OtaHybridCapability, RequiresOneExactAlignedMOTARAMARecord) {
  uint8_t marker[16] = {0};
  memcpy(marker, MOTA_RAM_CAP_MAGIC, sizeof(MOTA_RAM_CAP_MAGIC));
  mota_hybrid_wr16(marker + 8u, MOTA_RAM_CAP_ABI);
  mota_hybrid_wr16(marker + 10u, MOTA_HYBRID_AUTH_LEN);
  mota_hybrid_wr32(marker + 12u, MOTA_NRF52_HYBRID_RAM_SIZE);

  OtaRamCaps parsed;
  ASSERT_TRUE(ota_ram_caps_marker_parse(marker, parsed));
  EXPECT_TRUE(ota_bootloader_supports_hybrid(parsed));
  EXPECT_EQ(parsed.abi, MOTA_RAM_CAP_ABI);
  EXPECT_EQ(parsed.record_len, MOTA_HYBRID_AUTH_LEN);
  EXPECT_EQ(parsed.arena_size, MOTA_NRF52_HYBRID_RAM_SIZE);

  uint8_t image[64];
  memset(image, 0xFF, sizeof(image));
  memcpy(image + 1u, marker, sizeof(marker));
  EXPECT_FALSE(ota_ram_caps_scan_aligned(image, sizeof(image)).present);

  memset(image, 0xFF, sizeof(image));
  memcpy(image + 4u, marker, sizeof(marker));
  EXPECT_TRUE(ota_bootloader_supports_hybrid(
      ota_ram_caps_scan_aligned(image, sizeof(image))));

  // Two valid capabilities are ambiguous; a malformed decoy is ignored.
  memcpy(image + 24u, marker, sizeof(marker));
  EXPECT_FALSE(ota_ram_caps_scan_aligned(image, sizeof(image)).present);
  image[24u + 12u] ^= 1u;
  EXPECT_TRUE(ota_ram_caps_scan_aligned(image, sizeof(image)).present);

  uint8_t bad[sizeof(marker)];
  memcpy(bad, marker, sizeof(bad));
  bad[8] = 2u;
  EXPECT_FALSE(ota_ram_caps_marker_parse(bad, parsed));
  memcpy(bad, marker, sizeof(bad));
  bad[10] = (uint8_t)(MOTA_HYBRID_AUTH_LEN - 1u);
  EXPECT_FALSE(ota_ram_caps_marker_parse(bad, parsed));
  memcpy(bad, marker, sizeof(bad));
  bad[12] ^= 1u;
  EXPECT_FALSE(ota_ram_caps_marker_parse(bad, parsed));
}

TEST(OtaHybridHandoff, EncodesExactGeometryAndRejectsCorruption) {
  const uint32_t total = 17u * MOTA_NRF52_FLASH_PAGE;
  uint32_t start = 0, flash = 0, ram = 0;
  ASSERT_TRUE(mota_nrf52_hybrid_stage_plan(
      total, MOTA_NRF52_APP_BASE_S140_V6,
      MOTA_NRF52_APP_BASE_S140_V6 + 512u * 1024u,
      MOTA_NRF52_STAGE_CEILING_EXPANDED, start, flash, ram));
  ASSERT_EQ(flash, MOTA_NRF52_FLASH_PAGE);
  ASSERT_EQ(ram, MOTA_NRF52_HYBRID_RAM_SIZE);

  uint8_t hash[32];
  for (uint8_t i = 0; i < sizeof(hash); ++i) hash[i] = (uint8_t)(i * 7u);
  uint8_t record[MOTA_HYBRID_AUTH_LEN];
  ASSERT_TRUE(mota_hybrid_auth_encode(
      record, total, start, flash, ram, hash));
  EXPECT_TRUE(mota_hybrid_auth_valid(record));
  EXPECT_EQ(memcmp(record, MOTA_HYBRID_AUTH_MAGIC, 8u), 0);
  EXPECT_EQ(mota_hybrid_rd16(record + 8u), MOTA_HYBRID_AUTH_VERSION);
  EXPECT_EQ(mota_hybrid_rd16(record + 10u), MOTA_HYBRID_AUTH_LEN);
  EXPECT_EQ(record[12], MOTA_HYBRID_AUTH_PURPOSE_APP);
  EXPECT_EQ(record[13], MOTA_HYBRID_AUTH_FORMAT_APP);
  EXPECT_EQ(mota_hybrid_rd32(record + 16u), total);
  EXPECT_EQ(mota_hybrid_rd32(record + 20u), start);
  EXPECT_EQ(mota_hybrid_rd32(record + 24u), flash);
  EXPECT_EQ(mota_hybrid_rd32(record + 28u), ram);
  EXPECT_EQ(memcmp(record + 32u, hash, sizeof(hash)), 0);
  const uint32_t crc = mota_hybrid_rd32(record + 64u);
  EXPECT_EQ(crc, mota_hybrid_crc32(record, 64u));
  EXPECT_EQ(mota_hybrid_rd32(record + 68u), ~crc);

  record[32] ^= 1u;
  EXPECT_FALSE(mota_hybrid_auth_valid(record));
  record[32] ^= 1u;
  record[68] ^= 1u;
  EXPECT_FALSE(mota_hybrid_auth_valid(record));

  // The descriptor accepts only the frozen minimum flash charge and ED000
  // ceiling. Legacy-D4000 or overcharged splits cannot be authorized.
  EXPECT_FALSE(mota_hybrid_auth_encode(
      record, total, start - MOTA_NRF52_FLASH_PAGE,
      flash + MOTA_NRF52_FLASH_PAGE,
      ram - MOTA_NRF52_FLASH_PAGE, hash));
  EXPECT_FALSE(mota_hybrid_auth_encode(
      record, total,
      MOTA_NRF52_STAGE_CEILING_LEGACY - MOTA_NRF52_FLASH_PAGE,
      MOTA_NRF52_FLASH_PAGE, ram, hash));
}

TEST(OtaBootPackage, LegacyAndCurrentBootloadersHaveSeparateCapabilityViews) {
  const uint8_t internal_profile = OTA_BL_PROFILE_INTERNAL_BOOT_UPDATE;
  const uint8_t legacy_marker[16] = {
      'M','O','T','A','B','L','D','R', 2,0, 4,0, 0,0,0,0};
  const uint8_t current_marker[16] = {
      'M','O','T','A','B','L','D','R', 3,0, 5,0,
      internal_profile, 0,0,0};
  uint8_t image[64];

  // The released OTAFIX Preview 5 marker is naturally halfword-aligned at
  // address 2 mod 4. It can still install ABI-2, codec-2 application deltas,
  // but cannot replace itself and must retain the legacy staging ceiling.
  memset(image, 0xFF, sizeof(image));
  memcpy(image + 2, legacy_marker, sizeof(legacy_marker));
  OtaBlCaps app = ota_bl_app_caps_scan(image, sizeof(image));
  OtaBlCaps update = ota_bl_update_caps_scan_aligned(
      image, sizeof(image), internal_profile);
  ASSERT_TRUE(app.present);
  EXPECT_EQ(app.apply_abi, 2u);
  EXPECT_EQ(app.codec_mask, 1u << 2);
  EXPECT_FALSE(update.present);
  EXPECT_FALSE(ota_bootloader_supports_expanded_stage(app));

  // Do not turn the compatibility exception into a bytewise magic scan.
  memset(image, 0xFF, sizeof(image));
  memcpy(image + 1, legacy_marker, sizeof(legacy_marker));
  EXPECT_FALSE(ota_bl_app_caps_scan(image, sizeof(image)).present);

  // The current marker enables both views and advertises the expanded-stage
  // handoff independently of the privileged self-update decision.
  memset(image, 0xFF, sizeof(image));
  memcpy(image + 4, current_marker, sizeof(current_marker));
  app = ota_bl_app_caps_scan(image, sizeof(image));
  update = ota_bl_update_caps_scan_aligned(image, sizeof(image), internal_profile);
  ASSERT_TRUE(app.present);
  ASSERT_TRUE(update.present);
  EXPECT_EQ(update.storage_flags, internal_profile);
  EXPECT_TRUE(ota_bootloader_supports_expanded_stage(app));

  // Ambiguous privileged markers fail closed only for self-update. Ordinary
  // application OTA remains available through the unprivileged view.
  memcpy(image + 24, current_marker, sizeof(current_marker));
  app = ota_bl_app_caps_scan(image, sizeof(image));
  update = ota_bl_update_caps_scan_aligned(image, sizeof(image), internal_profile);
  EXPECT_TRUE(app.present);
  EXPECT_FALSE(update.present);

  // A valid marker for another storage profile is visible diagnostically but
  // cannot authorize an internal-flash bootloader replacement.
  memset(image, 0xFF, sizeof(image));
  memcpy(image + 4, current_marker, sizeof(current_marker));
  image[4 + 12] = OTA_BL_PROFILE_QSPI_BOOT_UPDATE;
  app = ota_bl_app_caps_scan(image, sizeof(image));
  update = ota_bl_update_caps_scan_aligned(image, sizeof(image), internal_profile);
  EXPECT_TRUE(app.present);
  EXPECT_FALSE(update.present);
}

class FakeMotaSeederStream : public Stream {
public:
  using Stream::write;

  size_t write(const uint8_t* request, size_t len) override {
    request_valid = len == 11 && request[0] == MOTA_SEEDER_REQ_MAGIC0
        && request[1] == MOTA_SEEDER_REQ_MAGIC1 && request[2] == MS_OP_READ;
    if (!request_valid) return len;

    uint8_t checksum = request[2];
    for (size_t i = 3; i + 1 < len; i++) checksum ^= request[i];
    request_valid = checksum == request[len - 1];
    const uint32_t offset = rd_u32le(request + 4);
    const uint16_t read_len = rd_u16le(request + 8);
    offsets.push_back(offset);
    lengths.push_back(read_len);

    response.clear();
    response_pos = 0;
    response.push_back(MOTA_SEEDER_RSP_MAGIC0);
    response.push_back(MOTA_SEEDER_RSP_MAGIC1);
    response.push_back(MS_OP_READ);
    response.push_back(MS_STATUS_OK);
    uint8_t response_checksum = MOTA_SEEDER_RSP_MAGIC0 ^ MOTA_SEEDER_RSP_MAGIC1
        ^ MS_OP_READ ^ MS_STATUS_OK;
    for (uint16_t i = 0; i < read_len; i++) {
      const uint8_t value = (uint8_t)(offset + i);
      response.push_back(value);
      response_checksum ^= value;
    }
    response.push_back(response_checksum);
    return len;
  }

  int read() override {
    if (response_pos < response.size()) return response[response_pos++];
    ++g_mock_millis;
    return -1;
  }

  void flush() override {
    ++flush_calls;
    if (flush_discards_receive) {
      response.clear();
      response_pos = 0;
    }
  }

  std::vector<uint32_t> offsets;
  std::vector<uint16_t> lengths;
  bool request_valid = true;
  bool flush_discards_receive = false;
  size_t flush_calls = 0;

private:
  std::vector<uint8_t> response;
  size_t response_pos = 0;
};

class FakeDeflateMotaSeederStream : public Stream {
public:
  using Stream::write;

  FakeDeflateMotaSeederStream() {
    encoded.resize(421);
    for (size_t i = 0; i < encoded.size(); i++) encoded[i] = (uint8_t)(i * 17u + 3u);
  }

  size_t write(const uint8_t* request, size_t len) override {
    request_valid = len == 11 && request[0] == MOTA_SEEDER_REQ_MAGIC0
        && request[1] == MOTA_SEEDER_REQ_MAGIC1 && request[2] == MS_OP_DEFLATE_BLOCK;
    uint8_t checksum = request_valid ? request[2] : 0;
    for (size_t i = 3; request_valid && i + 1 < len; i++) checksum ^= request[i];
    request_valid = request_valid && checksum == request[len - 1];
    if (!request_valid) return len;

    const uint16_t block = rd_u16le(request + 4);
    const uint16_t offset = rd_u16le(request + 6);
    const uint16_t read_len = rd_u16le(request + 8);
    blocks.push_back(block);
    offsets.push_back(offset);
    lengths.push_back(read_len);

    response.clear();
    response_pos = 0;
    response.push_back(MOTA_SEEDER_RSP_MAGIC0);
    response.push_back(MOTA_SEEDER_RSP_MAGIC1);
    response.push_back(MS_OP_DEFLATE_BLOCK);
    const bool valid_range = offset <= encoded.size() && read_len <= encoded.size() - offset;
    const uint8_t status = reject || !valid_range ? MS_STATUS_ERR : MS_STATUS_OK;
    response.push_back(status);
    if (status == MS_STATUS_OK) {
      response.push_back((uint8_t)(encoded.size() & 0xFF));
      response.push_back((uint8_t)(encoded.size() >> 8));
      response.insert(response.end(), encoded.begin() + offset,
                      encoded.begin() + offset + read_len);
    }
    uint8_t response_checksum = 0;
    for (uint8_t byte : response) response_checksum ^= byte;
    response.push_back(response_checksum);
    return len;
  }

  int read() override {
    if (response_pos < response.size()) return response[response_pos++];
    ++g_mock_millis;
    return -1;
  }

  void flush() override { ++flush_calls; }

  std::vector<uint8_t> encoded;
  std::vector<uint16_t> blocks;
  std::vector<uint16_t> offsets;
  std::vector<uint16_t> lengths;
  bool request_valid = true;
  bool reject = false;
  size_t flush_calls = 0;

private:
  std::vector<uint8_t> response;
  size_t response_pos = 0;
};

static_assert(!std::is_constructible<SerialMotaSource, Stream&>::value,
              "mOTA source callers must choose a stream write policy");
static_assert(!std::is_constructible<SerialMotaSource, Stream&, uint32_t>::value,
              "a timeout must not be mistaken for a stream write policy");
static_assert(!std::is_constructible<FolderMotaStore, Stream&>::value,
              "folder store callers must choose a stream write policy");
static_assert(!std::is_constructible<FolderMotaStore, Stream&, uint32_t>::value,
              "a timeout must not be mistaken for a stream write policy");

TEST(MotaSourceSerial, SplitsOneKilobyteReadsBelowCdcReceiveRing) {
  resetArduinoMock();
  FakeMotaSeederStream stream;
  SerialMotaSource source(stream, MotaStreamWritePolicy::FlushTransmit);
  std::array<uint8_t, 1024> data{};

  ASSERT_TRUE(source.read(0, 0x1000, data.data(), data.size()));
  EXPECT_TRUE(stream.request_valid);
  EXPECT_EQ(stream.offsets,
            (std::vector<uint32_t>{0x1000, 0x10C0, 0x1180, 0x1240, 0x1300, 0x13C0}));
  EXPECT_EQ(stream.lengths,
            (std::vector<uint16_t>{192, 192, 192, 192, 192, 64}));
  EXPECT_EQ(stream.flush_calls, 6U);
  for (size_t i = 0; i < data.size(); i++) {
    EXPECT_EQ(data[i], (uint8_t)(0x1000 + i));
  }
}

TEST(MotaSourceSerial, AcceptsEmptyReadAndRejectsInvalidRange) {
  resetArduinoMock();
  FakeMotaSeederStream stream;
  SerialMotaSource source(stream, MotaStreamWritePolicy::FlushTransmit);
  uint8_t byte = 0;

  EXPECT_TRUE(source.read(0, 123, nullptr, 0));
  EXPECT_FALSE(source.read(0, 123, nullptr, 1));
  EXPECT_FALSE(source.read(0, UINT32_MAX, &byte, 2));
  EXPECT_TRUE(stream.offsets.empty());
}

TEST(MotaSourceSerial, NetworkPolicyPreservesReplyWhenFlushWouldDiscardRx) {
  resetArduinoMock();
  FakeMotaSeederStream stream;
  stream.flush_discards_receive = true;
  SerialMotaSource source(stream, MotaStreamWritePolicy::NoFlush, 20);
  std::array<uint8_t, 16> data{};

  ASSERT_TRUE(source.read(0, 0x2000, data.data(), data.size()));
  EXPECT_EQ(stream.flush_calls, 0U);
  for (size_t i = 0; i < data.size(); i++) {
    EXPECT_EQ(data[i], (uint8_t)(0x2000 + i));
  }
}

TEST(MotaSourceSerial, WrongFlushPolicyDemonstratesNetworkReplyLoss) {
  resetArduinoMock();
  FakeMotaSeederStream stream;
  stream.flush_discards_receive = true;
  SerialMotaSource source(stream, MotaStreamWritePolicy::FlushTransmit, 20);
  std::array<uint8_t, 4> data{};

  EXPECT_FALSE(source.read(0, 0x3000, data.data(), data.size()));
  EXPECT_EQ(stream.flush_calls, 1U);
}

TEST(MotaSourceSerial, ReadsIndependentDeflateBlockInBoundedChunks) {
  resetArduinoMock();
  FakeDeflateMotaSeederStream stream;
  SerialMotaSource source(stream, MotaStreamWritePolicy::FlushTransmit);
  std::array<uint8_t, 1024> data{};
  uint16_t encoded_len = 0;

  ASSERT_TRUE(source.read_deflated_block(2, 37, data.data(), data.size(), &encoded_len));
  EXPECT_TRUE(stream.request_valid);
  EXPECT_EQ(encoded_len, stream.encoded.size());
  EXPECT_EQ(stream.blocks, (std::vector<uint16_t>{37, 37, 37, 37}));
  EXPECT_EQ(stream.offsets, (std::vector<uint16_t>{0, 0, 190, 380}));
  EXPECT_EQ(stream.lengths, (std::vector<uint16_t>{0, 190, 190, 41}));
  EXPECT_EQ(stream.flush_calls, 4u);
  EXPECT_EQ(0, memcmp(data.data(), stream.encoded.data(), encoded_len));
}

TEST(MotaSourceSerial, DeflateExtensionFailureLeavesRawFallbackAvailable) {
  resetArduinoMock();
  FakeDeflateMotaSeederStream stream;
  stream.reject = true;                                // deployed host does not implement operation 0x09
  SerialMotaSource source(stream, MotaStreamWritePolicy::FlushTransmit);
  std::array<uint8_t, 1024> data{};
  uint16_t encoded_len = 999;

  EXPECT_FALSE(source.read_deflated_block(0, 0, data.data(), data.size(), &encoded_len));
  EXPECT_EQ(encoded_len, 0u);
  EXPECT_EQ(stream.offsets, (std::vector<uint16_t>{0}));
  EXPECT_EQ(stream.lengths, (std::vector<uint16_t>{0}));
}

class FakeFolderMotaSeederStream : public Stream {
public:
  using Stream::write;

  size_t write(const uint8_t* request, size_t len) override {
    request_valid = len >= 4
        && request[0] == MOTA_SEEDER_REQ_MAGIC0
        && request[1] == MOTA_SEEDER_REQ_MAGIC1;
    if (!request_valid) return len;

    uint8_t checksum = request[2];
    for (size_t i = 3; i + 1 < len; i++) checksum ^= request[i];
    request_valid = checksum == request[len - 1];
    if (!request_valid) return len;

    operations.push_back(request[2]);
    response = {
        MOTA_SEEDER_RSP_MAGIC0,
        MOTA_SEEDER_RSP_MAGIC1,
        request[2],
        MS_STATUS_OK,
        (uint8_t)(MOTA_SEEDER_RSP_MAGIC0 ^ MOTA_SEEDER_RSP_MAGIC1
                  ^ request[2] ^ MS_STATUS_OK),
    };
    response_pos = 0;
    return len;
  }

  int read() override {
    if (response_pos < response.size()) return response[response_pos++];
    ++g_mock_millis;
    return -1;
  }

  void flush() override {
    ++flush_calls;
    response.clear();
    response_pos = 0;
  }

  std::vector<uint8_t> operations;
  bool request_valid = true;
  size_t flush_calls = 0;

private:
  std::vector<uint8_t> response;
  size_t response_pos = 0;
};

TEST(FolderMotaStore, NetworkPolicyPreservesFastBeginAndWriteReplies) {
  resetArduinoMock();
  FakeFolderMotaSeederStream stream;
  FolderMotaStore store(stream, MotaStreamWritePolicy::NoFlush, 20);
  const uint8_t mid[4] = {0x10, 0x20, 0x30, 0x40};
  const uint8_t data[4] = {1, 2, 3, 4};
  store.set_mid(mid);

  ASSERT_TRUE(store.begin(64));
  ASSERT_TRUE(store.write(0, data, sizeof(data)));
  EXPECT_TRUE(stream.request_valid);
  EXPECT_EQ(stream.operations,
            (std::vector<uint8_t>{MS_OP_BEGIN, MS_OP_WRITE}));
  EXPECT_EQ(stream.flush_calls, 0U);
}

// Build a flashed-image layout (body || fixed 56-byte EndF) the way the host packager / build hook do:
// marker(4) body_len(4) body_hash8(8) fw_version(4) target_id(4) hw_id(32). Identity is always present
// (zero/"" = unknown).
static std::vector<uint8_t> make_image_id(const std::vector<uint8_t>& body, uint32_t fw_version,
                                          uint32_t target_id, const char* hw_id) {
  std::vector<uint8_t> img = body;
  img.insert(img.end(), ENDF_MAGIC, ENDF_MAGIC + 4);
  uint32_t n = (uint32_t)body.size();
  for (int i = 0; i < 4; i++) img.push_back((uint8_t)(n >> (8 * i)));
  uint8_t h[8]; mh8(h, body.data(), body.size());
  img.insert(img.end(), h, h + 8);
  for (int i = 0; i < 4; i++) img.push_back((uint8_t)(fw_version >> (8 * i)));
  for (int i = 0; i < 4; i++) img.push_back((uint8_t)(target_id  >> (8 * i)));
  uint8_t hw[32] = {0}; size_t k = hw_id ? strlen(hw_id) : 0; if (k > 32) k = 32; if (k) memcpy(hw, hw_id, k);
  img.insert(img.end(), hw, hw + 32);                      // -> fixed 56-byte trailer
  return img;
}
static std::vector<uint8_t> make_image(const std::vector<uint8_t>& body) {
  return make_image_id(body, 0, 0, "");                    // zero identity (still a full 56-byte trailer)
}

// --- cross-check the C++ parser/merkle against the Python reference vectors ----------------

TEST(OtaParse, ParsesReferenceContainer) {
  MotaManifest m;
  ASSERT_TRUE(mota_parse(MOTA_VEC, MOTA_VEC_LEN, m));
  EXPECT_EQ(m.format_ver, MOTA_FORMAT_VER);
  EXPECT_TRUE(m.is_full());
  EXPECT_FALSE(m.is_signed());
  EXPECT_EQ(m.target_id, EXP_TARGET_ID);
  EXPECT_EQ(m.fw_version, EXP_FW_VERSION);
  EXPECT_EQ(m.image_size, EXP_IMAGE_SIZE);
  EXPECT_EQ(m.payload_size, EXP_PAYLOAD_SIZE);
  EXPECT_EQ(m.block_count, EXP_BLOCK_COUNT);
  EXPECT_EQ(m.block_size_log2, EXP_BLOCK_SIZE_LOG2);
  EXPECT_EQ(m.codec_id, EXP_CODEC_ID);
  EXPECT_EQ(0, memcmp(m.merkle_root, EXP_MERKLE_ROOT, 4));
  EXPECT_EQ(0, memcmp(m.image_hash, EXP_IMAGE_HASH, 32));
  ASSERT_NE(m.hw_id, nullptr);
  EXPECT_EQ(0, memcmp(m.hw_id, EXP_HW_ID, 32));        // v2 hardware tag ("TESTHW" NUL-padded)
  EXPECT_EQ(0, memcmp(m.approval, APPROVAL_NOT, 4));   // distributed = not approved
  EXPECT_FALSE(m.is_approved());
}

TEST(OtaRescue, RequiresInvalidSelfExactBaseAndExactTarget) {
  const uint8_t package_base[8] = {0x63, 0xd8, 0xdf, 0x63, 1, 2, 3, 4};
  const uint8_t operator_base[8] = {0x63, 0xd8, 0xdf, 0x63, 1, 2, 3, 4};
  const uint8_t wrong_base[8] = {0x63, 0xd8, 0xdf, 0x63, 1, 2, 3, 5};
  const uint32_t target_id = 0x2FA509C1u;

  EXPECT_EQ(ota_nrf52_rescue_gate(false, package_base, operator_base,
                                   target_id, target_id), NRF52_RESCUE_OK);
  EXPECT_EQ(ota_nrf52_rescue_gate(true, package_base, operator_base,
                                   target_id, target_id), NRF52_RESCUE_SELF_VALID);
  EXPECT_EQ(ota_nrf52_rescue_gate(false, nullptr, operator_base,
                                   target_id, target_id), NRF52_RESCUE_BASE_MISSING);
  EXPECT_EQ(ota_nrf52_rescue_gate(false, package_base, wrong_base,
                                   target_id, target_id), NRF52_RESCUE_BASE_MISMATCH);
  EXPECT_EQ(ota_nrf52_rescue_gate(false, package_base, operator_base,
                                   target_id, target_id + 1), NRF52_RESCUE_TARGET_MISMATCH);
  EXPECT_EQ(ota_nrf52_rescue_gate(false, package_base, operator_base,
                                   target_id, 0), NRF52_RESCUE_TARGET_MISMATCH);
}

TEST(OtaParse, RejectsTampering) {
  MotaManifest m;
  // bad magic
  std::vector<uint8_t> b(MOTA_VEC, MOTA_VEC + MOTA_VEC_LEN);
  b[0] ^= 0xFF;
  EXPECT_FALSE(mota_parse(b.data(), b.size(), m));
  // bad trailer
  b.assign(MOTA_VEC, MOTA_VEC + MOTA_VEC_LEN);
  b[b.size() - 1] ^= 0xFF;
  EXPECT_FALSE(mota_parse(b.data(), b.size(), m));
  // wrong total-size field
  b.assign(MOTA_VEC, MOTA_VEC + MOTA_VEC_LEN);
  b[4] ^= 0x01;
  EXPECT_FALSE(mota_parse(b.data(), b.size(), m));
}

// block_idx is a uint16 on the wire, so a manifest needing > 65535 blocks can't be addressed and must be
// rejected at parse (this also keeps block_count*4 from overflowing the leaves-length computation).
TEST(OtaParse, RejectsTooManyBlocks) {
  auto manifest = [](uint32_t payload_size, uint8_t bsl) {           // fixed-layout unsigned-full manifest
    std::vector<uint8_t> m(MOTA_MFL, 0);
    m[0] = MOTA_FORMAT_VER; m[1] = MFLAG_FULL; m[2] = 0x12;
    m[15] = payload_size; m[16] = payload_size >> 8; m[17] = payload_size >> 16; m[18] = payload_size >> 24;
    m[19] = bsl;
    return m;
  };
  MotaManifest mm;
  auto over = manifest(65536u * 1024u, 10);                          // 65536 blocks -> rejected
  EXPECT_FALSE(mota_parse_manifest(over.data(), over.size(), mm));
  auto ok = manifest(65535u * 1024u, 10);                            // 65535 blocks -> allowed
  EXPECT_TRUE(mota_parse_manifest(ok.data(), ok.size(), mm));
  EXPECT_EQ(mm.block_count, 65535u);
}

TEST(OtaParse, BlockCountCeilingDoesNotOverflowAtUint32Maximum) {
  std::vector<uint8_t> manifest(MOTA_MFL, 0);
  manifest[0] = MOTA_FORMAT_VER;
  manifest[1] = MFLAG_FULL;
  manifest[2] = HASH_ALGO_SHA256;
  manifest[15] = 0xFF;
  manifest[16] = 0xFF;
  manifest[17] = 0xFF;
  manifest[18] = 0xFF;
  manifest[19] = 24;  // largest parser-valid block: ceil(UINT32_MAX / 2^24) = 256

  MotaManifest parsed;
  ASSERT_TRUE(mota_parse_manifest(manifest.data(), manifest.size(), parsed));
  EXPECT_EQ(parsed.block_count, 256u);
}

TEST(OtaMerkle, RootMatchesVectorAndLeaves) {
  MotaManifest m;
  ASSERT_TRUE(mota_parse(MOTA_VEC, MOTA_VEC_LEN, m));
  // root recomputed from stored leaves[] == merkle_root field == Python's EXP_MERKLE_ROOT
  uint8_t root[4];
  merkle_root(root, m.leaves, m.block_count);
  EXPECT_EQ(0, memcmp(root, EXP_MERKLE_ROOT, 4));
  EXPECT_TRUE(mota_check_root(m));
  // recompute each leaf from the payload block and compare to the stored leaf
  uint32_t bs = m.block_size();
  for (uint32_t i = 0; i < m.block_count; i++) {
    uint32_t off = i * bs;
    uint32_t len = (off + bs <= m.payload_size) ? bs : (m.payload_size - off);
    uint8_t leaf[4];
    merkle_leaf(leaf, m.payload + off, len);
    EXPECT_EQ(0, memcmp(leaf, m.leaves + i * 4, 4)) << "leaf " << i;
  }
  EXPECT_TRUE(mota_check_payload(m));
}

TEST(OtaMerkle, PayloadCheckDetectsCorruptionNotVisibleInStoredLeaves) {
  std::vector<uint8_t> b(MOTA_VEC, MOTA_VEC + MOTA_VEC_LEN);
  MotaManifest m;
  ASSERT_TRUE(mota_parse(b.data(), b.size(), m));
  ASSERT_TRUE(mota_check_root(m));
  ASSERT_TRUE(mota_check_payload(m));

  size_t payload_off = (size_t)(m.payload - b.data());
  b[payload_off + m.payload_size / 2] ^= 0x01;
  ASSERT_TRUE(mota_parse(b.data(), b.size(), m));
  EXPECT_TRUE(mota_check_root(m));       // leaves[] and its root are still self-consistent
  EXPECT_FALSE(mota_check_payload(m));   // actual staged payload no longer matches those leaves
}

TEST(OtaMerkle, FullImageHashMatches) {
  MotaManifest m;
  ASSERT_TRUE(mota_parse(MOTA_VEC, MOTA_VEC_LEN, m));
  EXPECT_TRUE(mota_check_image_hash_full(m));
}

TEST(OtaMerkle, ProofFromReferenceVerifies) {
  MotaManifest m;
  ASSERT_TRUE(mota_parse(MOTA_VEC, MOTA_VEC_LEN, m));
  uint32_t bs = m.block_size();
  uint32_t off = PROOF_INDEX * bs;
  uint32_t len = (off + bs <= m.payload_size) ? bs : (m.payload_size - off);

  EXPECT_TRUE(merkle_verify(m.payload + off, len, PROOF_INDEX,
                            PROOF_SIBLINGS, PROOF_NSIB, EXP_MERKLE_ROOT, m.block_count));

  // tampered block -> fails
  std::vector<uint8_t> blk(m.payload + off, m.payload + off + len);
  blk[0] ^= 0xFF;
  EXPECT_FALSE(merkle_verify(blk.data(), len, PROOF_INDEX,
                             PROOF_SIBLINGS, PROOF_NSIB, EXP_MERKLE_ROOT, m.block_count));

  // wrong index with the same proof -> fails
  EXPECT_FALSE(merkle_verify(m.payload + off, len, PROOF_INDEX + 1,
                             PROOF_SIBLINGS, PROOF_NSIB, EXP_MERKLE_ROOT, m.block_count));
}

// --- validate the O(log n) binary-counter root vs a plain level-by-level reference ----------

static void ref_root(uint8_t out[4], std::vector<std::array<uint8_t, 4>> level) {
  while (level.size() > 1) {
    std::vector<std::array<uint8_t, 4>> nxt;
    for (size_t i = 0; i < level.size(); i += 2) {
      if (i + 1 < level.size()) {
        std::array<uint8_t, 4> p;
        merkle_combine(p.data(), level[i].data(), level[i + 1].data());
        nxt.push_back(p);
      } else {
        nxt.push_back(level[i]);  // promote lone last node
      }
    }
    level.swap(nxt);
  }
  std::memcpy(out, level[0].data(), 4);
}

TEST(OtaMerkle, BinaryCounterMatchesLevelByLevel) {
  uint32_t state = 0x12345678;
  auto rnd = [&]() { state = state * 1103515245u + 12345u; return (uint8_t)(state >> 16); };
  // O(log n) root must equal the plain level-by-level root for every count
  for (uint32_t count = 1; count <= 600; count++) {
    std::vector<uint8_t> leaves(count * 4);
    std::vector<std::array<uint8_t, 4>> ref(count);
    for (uint32_t i = 0; i < count; i++)
      for (int j = 0; j < 4; j++) { uint8_t v = rnd(); leaves[i * 4 + j] = v; ref[i][j] = v; }
    uint8_t a[4], b[4];
    merkle_root(a, leaves.data(), count);
    ref_root(b, ref);
    ASSERT_EQ(0, std::memcmp(a, b, 4)) << "root mismatch count=" << count;
  }
}

TEST(OtaMerkle, StreamingAccumulatorMatchesContiguousRoot) {
  uint8_t leaves[257 * 4];
  for (size_t i = 0; i < sizeof(leaves); ++i) {
    leaves[i] = (uint8_t)(i * 29U + 7U);
  }
  MerkleAccumulator accumulator;
  for (uint32_t i = 0; i < 257; ++i) {
    ASSERT_TRUE(accumulator.add(leaves + i * 4));
  }
  uint8_t streamed[4], contiguous[4];
  ASSERT_TRUE(accumulator.finish(streamed));
  merkle_root(contiguous, leaves, 257);
  EXPECT_EQ(0, std::memcmp(streamed, contiguous, 4));
  EXPECT_EQ(257U, accumulator.count());

  accumulator.reset();
  EXPECT_FALSE(accumulator.finish(streamed));
  EXPECT_EQ(0U, accumulator.count());
}

// Verify every block's proof for several tricky counts, using proofs generated by the Python
// reference (the oracle) - covers deep promotion chains (100, 255, 256, ...).
TEST(OtaMerkle, ReferenceProofsAllIndices) {
  for (int c = 0; c < N_PROOF_CASES; c++) {
    const ProofCase& pc = PROOF_CASES[c];
    uint8_t root[4];
    merkle_root(root, pc.leaves, pc.count);
    EXPECT_EQ(0, std::memcmp(root, pc.root, 4)) << "root mismatch count=" << pc.count;
    for (uint32_t i = 0; i < pc.count; i++) {
      EXPECT_TRUE(merkle_verify_from_leaf(pc.leaves + i * 4, i,
                                          pc.pblob + pc.poff[i], pc.pnsib[i], pc.root, pc.count))
          << "count=" << pc.count << " idx=" << i;
    }
    // a wrong sibling for index 0 must fail
    if (pc.pnsib[0] > 0) {
      std::vector<uint8_t> bad(pc.pblob + pc.poff[0], pc.pblob + pc.poff[0] + pc.pnsib[0] * 4);
      bad[0] ^= 0xFF;
      EXPECT_FALSE(merkle_verify_from_leaf(pc.leaves, 0, bad.data(), pc.pnsib[0], pc.root, pc.count));
    }
  }
}

// --- availability bitmap (derived from leaves[]) -------------------------------------------

TEST(OtaBitmap, AllPresentForCompleteContainer) {
  MotaManifest m;
  ASSERT_TRUE(mota_parse(MOTA_VEC, MOTA_VEC_LEN, m));
  EXPECT_TRUE(all_present(m.leaves, m.block_count));
  EXPECT_EQ(count_present(m.leaves, m.block_count), m.block_count);

  // a leaf slot of all-FF (erased) means "missing"; bitmap round-trips
  std::vector<uint8_t> leaves(m.leaves, m.leaves + m.block_count * 4);
  std::memset(&leaves[4], 0xFF, 4);  // mark block 1 missing
  EXPECT_FALSE(leaf_present(leaves.data(), 1));
  EXPECT_FALSE(all_present(leaves.data(), m.block_count));
  EXPECT_EQ(count_present(leaves.data(), m.block_count), m.block_count - 1);

  std::vector<uint8_t> bm(bitmap_bytes(m.block_count));
  leaves_to_bitmap(leaves.data(), m.block_count, bm.data());
  EXPECT_FALSE(bitmap_get(bm.data(), 1));
  EXPECT_TRUE(bitmap_get(bm.data(), 0));
}

// --- EndF self-firmware scan (P2) -----------------------------------------------------------

TEST(OtaFirmwareInfo, FindsEndFInImage) {
  std::vector<uint8_t> body(4321);
  for (size_t i = 0; i < body.size(); i++) body[i] = (uint8_t)(i * 37 + 11);
  std::vector<uint8_t> img = make_image(body);

  // simulate a flash region: image, then erased 0xFF up to the partition end
  std::vector<uint8_t> region = img;
  region.resize(img.size() + 4096, 0xFF);

  SelfFwInfo fi;
  ASSERT_TRUE(find_self_firmware(region.data(), (uint32_t)region.size(), fi, /*verify_body=*/true));
  EXPECT_EQ(fi.body_len, body.size());
  EXPECT_EQ(fi.image_len, img.size());
  EXPECT_EQ(fi.endf_offset, body.size());
  uint8_t h[8]; mh8(h, body.data(), body.size());
  EXPECT_EQ(0, std::memcmp(fi.body_hash, h, 8));
}

// The self-describing identity lives at fixed offsets in the 56-byte EndF and is always parsed; a
// zero-identity trailer reports zero/"" (unknown), still at the fixed 56-byte size.
TEST(OtaFirmwareInfo, ParsesIdentity) {
  std::vector<uint8_t> body(2000);
  for (size_t i = 0; i < body.size(); i++) body[i] = (uint8_t)(i * 13 + 5);

  auto img = make_image_id(body, 0x01100000u, 0x04d413fdu, "RAK4631");
  std::vector<uint8_t> region = img; region.resize(img.size() + 4096, 0xFF);
  SelfFwInfo fi;
  ASSERT_TRUE(find_self_firmware(region.data(), (uint32_t)region.size(), fi, /*verify_body=*/true));
  EXPECT_EQ(fi.body_len, body.size());
  EXPECT_EQ(fi.image_len, body.size() + 56);               // fixed trailer length
  EXPECT_EQ(fi.fw_version, 0x01100000u);
  EXPECT_EQ(fi.target_id, 0x04d413fdu);
  EXPECT_STREQ(fi.hw_id, "RAK4631");

  auto img1 = make_image(body);                            // zero-identity trailer (still 56 bytes)
  std::vector<uint8_t> r1 = img1; r1.resize(img1.size() + 64, 0xFF);
  SelfFwInfo fi1;
  ASSERT_TRUE(find_self_firmware(r1.data(), (uint32_t)r1.size(), fi1, true));
  EXPECT_EQ(fi1.fw_version, 0u);
  EXPECT_EQ(fi1.target_id, 0u);
  EXPECT_STREQ(fi1.hw_id, "");
  EXPECT_EQ(fi1.image_len, body.size() + 56);
}

TEST(OtaFirmwareInfo, IgnoresStagedMotaHigherInRegion) {
  // The firmware's own EndF must win even when a staged .mota (which embeds its own EndF) sits
  // above it in the same region - the body_len == offset check disambiguates.
  std::vector<uint8_t> body(2000);
  for (size_t i = 0; i < body.size(); i++) body[i] = (uint8_t)(i ^ 0x5A);
  std::vector<uint8_t> img = make_image(body);

  std::vector<uint8_t> region = img;
  region.resize(8192, 0xFF);                                  // gap
  // drop the reference .mota (which contains an embedded EndF in its payload) higher up
  region.insert(region.end(), MOTA_VEC, MOTA_VEC + MOTA_VEC_LEN);

  SelfFwInfo fi;
  ASSERT_TRUE(find_self_firmware(region.data(), (uint32_t)region.size(), fi, true));
  EXPECT_EQ(fi.endf_offset, body.size());                     // found OUR firmware, not the .mota's
  EXPECT_EQ(fi.body_len, body.size());
}

TEST(OtaFirmwareInfo, NoMarkerReturnsFalse) {
  std::vector<uint8_t> region(1000, 0xAB);
  SelfFwInfo fi;
  EXPECT_FALSE(find_self_firmware(region.data(), (uint32_t)region.size(), fi));
}

// --- signer allowlist (P3) ------------------------------------------------------------------

TEST(OtaAllowlist, AddContainsRemoveSerialize) {
  SignerAllowlist a;
  uint8_t k1[32], k2[32], k3[32];
  memset(k1, 0x11, 32); memset(k2, 0x22, 32); memset(k3, 0x33, 32);
  EXPECT_FALSE(a.contains(k1));
  EXPECT_TRUE(a.add(k1));
  EXPECT_TRUE(a.add(k2));
  EXPECT_TRUE(a.add(k1));            // idempotent
  EXPECT_EQ(a.count(), 2);
  EXPECT_TRUE(a.contains(k1));
  EXPECT_FALSE(a.contains(k3));

  uint8_t buf[1 + MAX_OTA_SIGNERS * 32];
  uint32_t n = a.serialize(buf, sizeof(buf));
  EXPECT_EQ(n, 1u + 2 * 32);
  SignerAllowlist b;
  EXPECT_TRUE(b.deserialize(buf, n));
  EXPECT_EQ(b.count(), 2);
  EXPECT_TRUE(b.contains(k1) && b.contains(k2));

  EXPECT_TRUE(a.remove(k1));
  EXPECT_EQ(a.count(), 1);
  EXPECT_FALSE(a.contains(k1));
  EXPECT_TRUE(a.contains(k2));
}

// --- RAM store: out-of-order writes + availability via leaves[] --------------------------------

TEST(OtaStoreRamTest, RandomAccessAndErasedSentinel) {
  OtaStoreRam<4096> s;
  ASSERT_TRUE(s.begin(1000));
  EXPECT_EQ(s.staged_size(), 1000u);
  uint8_t blk[8] = {1,2,3,4,5,6,7,8};
  EXPECT_TRUE(s.write(500, blk, 8));   // out-of-order offset
  EXPECT_TRUE(s.write(0, blk, 8));
  EXPECT_FALSE(s.write(998, blk, 8));  // out of range
  uint8_t rd[8];
  EXPECT_TRUE(s.read(500, rd, 8));
  EXPECT_EQ(0, memcmp(rd, blk, 8));
  // untouched region reads as erased 0xFF (so an unfilled leaf slot is "missing")
  EXPECT_TRUE(s.read(100, rd, 8));
  for (int i = 0; i < 8; i++) EXPECT_EQ(rd[i], 0xFF);
}

TEST(OtaStoreRamTest, ClearKeepsResumeFixtureButDiscardConsumesHeader) {
  OtaStoreRam<4096> s;
  constexpr uint32_t total = 8u + MOTA_MFL + 5u;
  uint8_t header[8] = {'m', 'O', 'T', 'A',
                       static_cast<uint8_t>(total),
                       static_cast<uint8_t>(total >> 8),
                       static_cast<uint8_t>(total >> 16),
                       static_cast<uint8_t>(total >> 24)};
  ASSERT_TRUE(s.begin(total));
  ASSERT_TRUE(s.write(0, header, sizeof(header)));

  // clear() remains the cheap RAM-session reset used by reboot/resume tests.
  s.clear();
  EXPECT_TRUE(s.reopen());
  EXPECT_EQ(s.staged_size(), total);

  // User-facing cancellation uses discard(), which must prevent a fresh
  // reopen even for the native in-process persistence model.
  EXPECT_TRUE(s.discard());
  EXPECT_EQ(s.staged_size(), 0u);
  EXPECT_FALSE(s.reopen());
}

TEST(OtaStoreRamTest, SeederSizedStoreDiscardsWithoutAssumingAHeaderFits) {
  // OTA_SEEDER_ONLY intentionally uses OtaStoreRam<1>: it needs a valid
  // manager destination object but never stages firmware locally.
  OtaStoreRam<1> s;
  EXPECT_TRUE(s.discard());
  EXPECT_EQ(s.staged_size(), 0u);
  EXPECT_FALSE(s.reopen());
}

namespace {

class SessionOnlyOtaStore : public OtaStore {
public:
  bool begin(uint32_t) override { return false; }
  bool write(uint32_t, const uint8_t*, uint32_t) override { return false; }
  bool read(uint32_t, uint8_t*, uint32_t) const override { return false; }
  uint32_t capacity() const override { return 0; }
  uint32_t staged_size() const override { return 0; }
  void clear() override { cleared = true; }

  bool cleared = false;
};

}  // namespace

TEST(OtaStoreDiscardTest, ConservativeDefaultCannotClaimDurableInvalidation) {
  SessionOnlyOtaStore store;
  EXPECT_FALSE(store.discard());
  EXPECT_TRUE(store.cleared);
}

TEST(OtaDeflate, AcceptsStoredFixedDynamicAndMultiBlockRawStreams) {
  static const uint8_t stored[] = {
    0x01,0x40,0x00,0xBF,0xFF,0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,
    0x0A,0x0B,0x0C,0x0D,0x0E,0x0F,0x10,0x11,0x12,0x13,0x14,0x15,0x16,0x17,0x18,
    0x19,0x1A,0x1B,0x1C,0x1D,0x1E,0x1F,0x20,0x21,0x22,0x23,0x24,0x25,0x26,0x27,
    0x28,0x29,0x2A,0x2B,0x2C,0x2D,0x2E,0x2F,0x30,0x31,0x32,0x33,0x34,0x35,0x36,
    0x37,0x38,0x39,0x3A,0x3B,0x3C,0x3D,0x3E,0x3F,
  };
  static const uint8_t fixed[] = {
    0xF3,0x4D,0x2D,0xCE,0x70,0xCE,0x2F,0x4A,0x55,0x28,0x29,0x4A,0xCC,0x2B,0x2E,0xC8,
    0x2F,0x2A,0x51,0x48,0xCB,0xAC,0x48,0x4D,0x51,0xF0,0x28,0x4D,0x4B,0xCB,0x4D,0xCC,
    0x53,0x28,0x49,0x2D,0x2E,0xD1,0x53,0xF0,0x1D,0x55,0x46,0x1B,0x65,0x00,
  };
  static const uint8_t dynamic[] = {
    0xED,0xCF,0xD9,0x0D,0x83,0x30,0x14,0x44,0xD1,0x0B,0xC1,0x2C,0xC1,0x2C,0xC1,0x2C,
    0xB1,0x81,0xF4,0x5F,0x66,0x9E,0x26,0x05,0xA4,0x01,0x7F,0x5F,0x1D,0x69,0x86,0xA2,
    0x7C,0x54,0xAE,0xA6,0xED,0x9E,0xBD,0x1F,0x98,0xE6,0xD7,0x12,0x56,0xF6,0xE3,0x1D,
    0xD3,0xC9,0xFD,0xC1,0x32,0xAE,0x6E,0x2C,0xE3,0x87,0xD1,0x32,0x61,0xDD,0x2C,0x93,
    0xCE,0xCB,0x32,0xD2,0x0D,0xD2,0x23,0xD2,0x1B,0xD2,0x17,0xD2,0x15,0xD2,0x3D,0xD2,
    0x0B,0xD2,0x11,0xE9,0x02,0xE9,0x16,0xE9,0x09,0xE9,0x1D,0xE9,0x1B,0x69,0x87,0xB4,
    0x47,0x3A,0x20,0x9D,0x90,0x2E,0x91,0xEE,0x90,0x9E,0x91,0x3E,0x88,0xBF,0x69,0xF9,
    0x58,0x3E,0x96,0x8F,0xFD,0x3B,0xF6,0x05,
  };
  static const uint8_t multi_block[] = {
    0x4A,0xCB,0x2C,0x2A,0x2E,0xD1,0x4D,0xCA,0xC9,0x4F,0xCE,0xD6,0x4D,0x1B,0x66,0x6C,
    0x00,0x00,0x00,0x00,0xFF,0xFF,0x2B,0x4E,0x4D,0xCE,0xCF,0x4B,0x81,0x0A,0x8C,0x72,
    0xF0,0x72,0x00,
  };

  EXPECT_EQ((stored[0] >> 1) & 3u, 0u);
  EXPECT_EQ((fixed[0] >> 1) & 3u, 1u);
  EXPECT_EQ((dynamic[0] >> 1) & 3u, 2u);

  std::array<uint8_t, 1024> output{};
  uint16_t output_len = 0;
  ASSERT_TRUE(ota_transport_inflate(nullptr, stored, sizeof(stored), output.data(), 64, &output_len));
  ASSERT_EQ(output_len, 64u);
  for (uint16_t i = 0; i < output_len; i++) EXPECT_EQ(output[i], (uint8_t)i);

  static const char fixed_phrase[] = "MeshCore transport fixed Huffman test. ";
  ASSERT_TRUE(ota_transport_inflate(nullptr, fixed, sizeof(fixed), output.data(), 384, &output_len));
  ASSERT_EQ(output_len, 384u);
  for (uint16_t i = 0; i < output_len; i++)
    EXPECT_EQ(output[i], (uint8_t)fixed_phrase[i % (sizeof(fixed_phrase) - 1)]);

  ASSERT_TRUE(ota_transport_inflate(nullptr, dynamic, sizeof(dynamic), output.data(), 1024, &output_len));
  ASSERT_EQ(output_len, 1024u);
  for (uint16_t i = 0; i < output_len; i++)
    EXPECT_EQ(output[i], (uint8_t)((i % 7u) ? i % 31u : 0u));

  ASSERT_TRUE(ota_transport_inflate(nullptr, multi_block, sizeof(multi_block), output.data(), 520,
                                    &output_len));
  ASSERT_EQ(output_len, 520u);
  static const char first_phrase[] = "first-block-";
  static const char second_phrase[] = "second-block-";
  for (uint16_t i = 0; i < 220; i++)
    EXPECT_EQ(output[i], (uint8_t)first_phrase[i % (sizeof(first_phrase) - 1)]);
  for (uint16_t i = 220; i < output_len; i++)
    EXPECT_EQ(output[i], (uint8_t)second_phrase[(i - 220) % (sizeof(second_phrase) - 1)]);
}

TEST(OtaDeflate, RejectsTruncationBoundsWrongLengthTrailingBytesAndMalformedTrees) {
  static const uint8_t dynamic[] = {
    0xED,0xCF,0xD9,0x0D,0x83,0x30,0x14,0x44,0xD1,0x0B,0xC1,0x2C,0xC1,0x2C,0xC1,0x2C,
    0xB1,0x81,0xF4,0x5F,0x66,0x9E,0x26,0x05,0xA4,0x01,0x7F,0x5F,0x1D,0x69,0x86,0xA2,
    0x7C,0x54,0xAE,0xA6,0xED,0x9E,0xBD,0x1F,0x98,0xE6,0xD7,0x12,0x56,0xF6,0xE3,0x1D,
    0xD3,0xC9,0xFD,0xC1,0x32,0xAE,0x6E,0x2C,0xE3,0x87,0xD1,0x32,0x61,0xDD,0x2C,0x93,
    0xCE,0xCB,0x32,0xD2,0x0D,0xD2,0x23,0xD2,0x1B,0xD2,0x17,0xD2,0x15,0xD2,0x3D,0xD2,
    0x0B,0xD2,0x11,0xE9,0x02,0xE9,0x16,0xE9,0x09,0xE9,0x1D,0xE9,0x1B,0x69,0x87,0xB4,
    0x47,0x3A,0x20,0x9D,0x90,0x2E,0x91,0xEE,0x90,0x9E,0x91,0x3E,0x88,0xBF,0x69,0xF9,
    0x58,0x3E,0x96,0x8F,0xFD,0x3B,0xF6,0x05,
  };
  static const uint8_t invalid_distance[] = {0x63,0x00,0x3E,0x00};
  static const uint8_t invalid_tree[] = {
    0x0D,0xCE,0x81,0x00,0x00,0x00,0x00,0x80,0xA0,0xFD,0xA9,0xBB,0x1F,0xA0,0x01,
  };
  std::array<uint8_t, 1025> output{};
  uint16_t output_len = 999;

  EXPECT_FALSE(ota_transport_inflate(nullptr, dynamic, sizeof(dynamic) - 1,
                                     output.data(), 1024, &output_len));
  EXPECT_EQ(output_len, 0u);
  EXPECT_FALSE(ota_transport_inflate(nullptr, dynamic, sizeof(dynamic),
                                     output.data(), 1023, &output_len));
  EXPECT_FALSE(ota_transport_inflate(nullptr, dynamic, sizeof(dynamic),
                                     output.data(), 1025, &output_len));

  std::array<uint8_t, sizeof(dynamic) + 1> trailing{};
  memcpy(trailing.data(), dynamic, sizeof(dynamic));
  trailing.back() = 0x00;
  EXPECT_FALSE(ota_transport_inflate(nullptr, trailing.data(), trailing.size(),
                                     output.data(), 1024, &output_len));
  EXPECT_FALSE(ota_transport_inflate(nullptr, invalid_distance, sizeof(invalid_distance),
                                     output.data(), 4, &output_len));
  EXPECT_FALSE(ota_transport_inflate(nullptr, invalid_tree, sizeof(invalid_tree),
                                     output.data(), 4, &output_len));
}

// --- merkle proof GENERATION (server side) matches the Python oracle ---------------------------

TEST(OtaMerkle, GenProofMatchesPythonAndVerifies) {
  for (int c = 0; c < N_PROOF_CASES; c++) {
    const ProofCase& pc = PROOF_CASES[c];
    std::vector<uint8_t> scratch(pc.count * 4);
    uint8_t out[32 * 4];
    for (uint32_t i = 0; i < pc.count; i++) {
      uint8_t n = merkle_gen_proof(pc.leaves, pc.count, i, scratch.data(), out);
      ASSERT_EQ(n, pc.pnsib[i]) << "count=" << pc.count << " idx=" << i;
      EXPECT_EQ(0, std::memcmp(out, pc.pblob + pc.poff[i], (size_t)n * 4))
          << "gen_proof != python count=" << pc.count << " idx=" << i;
      EXPECT_TRUE(merkle_verify_from_leaf(pc.leaves + i * 4, i, out, n, pc.root, pc.count));
    }
  }
}

// --- protocol codec round-trips ---------------------------------------------------------------

TEST(OtaProtocol, ClassifiesOnlyActiveTransferMessagesAsPrimary) {
  EXPECT_FALSE(ota_is_transfer_message(OTA_ADV));
  EXPECT_FALSE(ota_is_transfer_message(OTA_QUERY));
  EXPECT_FALSE(ota_is_transfer_message(OTA_HAVE));
  EXPECT_TRUE(ota_is_transfer_message(OTA_GET_MANIFEST));
  EXPECT_TRUE(ota_is_transfer_message(OTA_MANIFEST));
  EXPECT_TRUE(ota_is_transfer_message(OTA_REQ));
  EXPECT_TRUE(ota_is_transfer_message(OTA_DATA));
  EXPECT_TRUE(ota_is_transfer_message(OTA_REQ_PROOF));
  EXPECT_TRUE(ota_is_transfer_message(OTA_PROOF));
  EXPECT_TRUE(ota_is_transfer_message(OTA_GET_LEAVES));
  EXPECT_TRUE(ota_is_transfer_message(OTA_LEAVES));
  EXPECT_FALSE(ota_is_transfer_message(0xFF));
}

TEST(OtaProtocol, CodecRoundTrips) {
  uint8_t buf[200];

  // OTA_ADV is now a tiny per-node beacon: seeder_id + n_motas + set_digest
  AdvMsg adv{{0x29,0x17,0xe4,0xf7}, 7, {0xde,0xad,0xbe,0xef}};
  uint16_t n = encode_adv(buf, sizeof(buf), adv);
  ASSERT_GT(n, 0); EXPECT_EQ(ota_msg_type(buf, n), OTA_ADV); EXPECT_EQ(n, 10);
  AdvMsg a2; ASSERT_TRUE(decode_adv(buf, n, a2));
  EXPECT_EQ(0, memcmp(a2.seeder_id, adv.seeder_id, 4));
  EXPECT_EQ(a2.n_motas, 7);
  EXPECT_EQ(0, memcmp(a2.set_digest, adv.set_digest, 4));

  // OTA_QUERY: ask a source (by seeder_id) for the offering set_digest, optionally filtered to a target
  QueryMsg qy{{0x29,0x17,0xe4,0xf7}, {0xd1,0xd2,0xd3,0xd4}, 0x11223344, 0xA5A50002};
  n = encode_query(buf, sizeof(buf), qy);
  ASSERT_GT(n, 0); EXPECT_EQ(ota_msg_type(buf, n), OTA_QUERY);
  QueryMsg q2; ASSERT_TRUE(decode_query(buf, n, q2));
  EXPECT_EQ(0, memcmp(q2.seeder_id, qy.seeder_id, 4));
  EXPECT_EQ(0, memcmp(q2.set_digest, qy.set_digest, 4));
  EXPECT_EQ(q2.filter_target, 0x11223344u);
  EXPECT_EQ(q2.want_fragments, 0xA5A50002u);
  QueryMsg qlegacy;
  ASSERT_TRUE(decode_query(buf, n - 4, qlegacy));       // original QUERY ended after filter_target
  EXPECT_EQ(qlegacy.filter_target, 0x11223344u);
  EXPECT_EQ(qlegacy.want_fragments, 0u);                // old sender means "all fragments"

  // OTA_HAVE: a 2-row catalog (mid, target, fwver, codec, flags per row) tagged with the offering digest
  uint8_t rows[2 * OTA_HAVE_ROW_BYTES];
  for (int i = 0; i < 2 * OTA_HAVE_ROW_BYTES; i++) rows[i] = (uint8_t)(i + 1);
  HaveMsg hv{{0x29,0x17,0xe4,0xf7}, {0xd1,0xd2,0xd3,0xd4}, 0, 1, 2, rows};
  n = encode_have(buf, sizeof(buf), hv);
  ASSERT_GT(n, 0); EXPECT_EQ(ota_msg_type(buf, n), OTA_HAVE);
  HaveMsg h2; ASSERT_TRUE(decode_have(buf, n, h2));
  EXPECT_EQ(0, memcmp(h2.seeder_id, hv.seeder_id, 4));
  EXPECT_EQ(0, memcmp(h2.set_digest, hv.set_digest, 4));
  EXPECT_EQ(h2.frag_total, 1); EXPECT_EQ(h2.n_rows, 2);
  EXPECT_EQ(0, memcmp(h2.rows, rows, 2 * OTA_HAVE_ROW_BYTES));

  GetManifestMsg gm{{1,2,3,4}, 0x0002};   // want only manifest fragment 1 (recovery)
  n = encode_get_manifest(buf, sizeof(buf), gm);
  GetManifestMsg g2; ASSERT_TRUE(decode_get_manifest(buf, n, g2));
  EXPECT_EQ(0, memcmp(g2.manifest_id, gm.manifest_id, 4));
  EXPECT_EQ(g2.want_mask, 0x0002);

  uint8_t mbytes[40]; for (int i = 0; i < 40; i++) mbytes[i] = (uint8_t)(i + 1);
  ManifestMsg mm{{9,8,7,6}, 0, 1, mbytes, 40};
  n = encode_manifest(buf, sizeof(buf), mm);
  ManifestMsg m2; ASSERT_TRUE(decode_manifest(buf, n, m2));
  EXPECT_EQ(m2.frag_idx, 0); EXPECT_EQ(m2.frag_total, 1); EXPECT_EQ(m2.len, 40);
  EXPECT_EQ(0, memcmp(m2.bytes, mbytes, 40));

  ReqMsg rq{{4,3,2,1}, 7, 0x005f};        // block 7, want fragments {0,1,2,3,4,6} (a recovery mask)
  n = encode_req(buf, sizeof(buf), rq);
  ReqMsg r2; ASSERT_TRUE(decode_req(buf, n, r2));
  EXPECT_EQ(r2.block_idx, 7); EXPECT_EQ(r2.want_mask, 0x005f);

  // A request window is an append-only extension: its first row is byte-for-byte a legacy ReqMsg, while
  // new decoders see every requested block. This is the rolling-upgrade fallback for adaptive flights.
  ReqWindowMsg rw{};
  memcpy(rw.manifest_id, rq.manifest_id, 4);
  rw.n_items = 3;
  rw.items[0] = {7, 0x005f}; rw.items[1] = {8, 0x007f}; rw.items[2] = {9, 0x0003};
  n = encode_req_window(buf, sizeof(buf), rw);
  ASSERT_EQ(n, 17u);
  ReqMsg legacy;
  ASSERT_TRUE(decode_req(buf, n, legacy));                 // an old source serves row zero
  EXPECT_EQ(legacy.block_idx, 7); EXPECT_EQ(legacy.want_mask, 0x005f);
  ReqWindowMsg rw2{};
  ASSERT_TRUE(decode_req_window(buf, n, rw2));
  ASSERT_EQ(rw2.n_items, 3u);
  EXPECT_EQ(rw2.items[1].block_idx, 8); EXPECT_EQ(rw2.items[2].want_mask, 0x0003);
  EXPECT_FALSE(decode_req_window(buf, n - 1, rw2));        // reject a truncated final row

  // GET_LEAVES: bulk-fetch the target leaves[] with a fragment want_mask (motatool warm-start)
  GetLeavesMsg gl{{5,6,7,8}, 0x0007};     // want leaves fragments {0,1,2}
  n = encode_get_leaves(buf, sizeof(buf), gl);
  ASSERT_GT(n, 0); EXPECT_EQ(ota_msg_type(buf, n), OTA_GET_LEAVES);
  GetLeavesMsg gl2; ASSERT_TRUE(decode_get_leaves(buf, n, gl2));
  EXPECT_EQ(0, memcmp(gl2.manifest_id, gl.manifest_id, 4)); EXPECT_EQ(gl2.want_mask, 0x0007);

  // LEAVES: one fragment of the leaves[] array
  uint8_t lbytes[80]; for (int i = 0; i < 80; i++) lbytes[i] = (uint8_t)(200 - i);
  LeavesMsg lm{{5,6,7,8}, 1, 4, lbytes, 80};
  n = encode_leaves(buf, sizeof(buf), lm);
  ASSERT_GT(n, 0); EXPECT_EQ(ota_msg_type(buf, n), OTA_LEAVES);
  LeavesMsg lm2; ASSERT_TRUE(decode_leaves(buf, n, lm2));
  EXPECT_EQ(lm2.frag_idx, 1); EXPECT_EQ(lm2.frag_total, 4); EXPECT_EQ(lm2.len, 80);
  EXPECT_EQ(0, memcmp(lm2.bytes, lbytes, 80));

  // DATA is one self-describing fragment of a block (frag_off places it; proof is fetched separately)
  uint8_t data[100]; for (int i = 0; i < 100; i++) data[i] = (uint8_t)(i * 3);
  DataMsg dm{{0,1,2,3}, 42, 0, data, 100};                  // block 42, fragment at offset 0
  n = encode_data(buf, sizeof(buf), dm);
  DataMsg d2; ASSERT_TRUE(decode_data(buf, n, d2));
  EXPECT_EQ(d2.block_idx, 42); EXPECT_EQ(d2.frag_off, 0);
  EXPECT_EQ(d2.data_len, 100); EXPECT_EQ(0, memcmp(d2.data, data, 100));

  // a later slice of the same block (non-zero frag_off)
  DataMsg dm2{{0,1,2,3}, 42, 160, data, 50};
  n = encode_data(buf, sizeof(buf), dm2);
  DataMsg d3; ASSERT_TRUE(decode_data(buf, n, d3));
  EXPECT_EQ(d3.block_idx, 42); EXPECT_EQ(d3.frag_off, 160); EXPECT_EQ(d3.data_len, 50);

  // REQ_PROOF: request the merkle proof for one (reassembled) block
  ReqProofMsg rp{{7,7,8,8}, 13};
  n = encode_req_proof(buf, sizeof(buf), rp);
  ASSERT_GT(n, 0); EXPECT_EQ(ota_msg_type(buf, n), OTA_REQ_PROOF);
  ReqProofMsg rp2; ASSERT_TRUE(decode_req_proof(buf, n, rp2));
  EXPECT_EQ(0, memcmp(rp2.manifest_id, rp.manifest_id, 4)); EXPECT_EQ(rp2.block_idx, 13);

  // PROOF: ordered sibling digests for one block
  uint8_t proof[12]; for (int i = 0; i < 12; i++) proof[i] = (uint8_t)(0xA0 + i);
  ProofMsg pm{{7,7,8,8}, 13, 3, proof};
  n = encode_proof(buf, sizeof(buf), pm);
  ASSERT_GT(n, 0); EXPECT_EQ(ota_msg_type(buf, n), OTA_PROOF);
  ProofMsg pm2; ASSERT_TRUE(decode_proof(buf, n, pm2));
  EXPECT_EQ(0, memcmp(pm2.manifest_id, pm.manifest_id, 4));
  EXPECT_EQ(pm2.block_idx, 13); EXPECT_EQ(pm2.n_proof, 3);
  EXPECT_EQ(0, memcmp(pm2.proof, proof, 12));
}

TEST(OtaProtocol, V2ProfilesPackLegacyAndExtendedLengthBoundaries) {
  const uint16_t request = ota_req_make_v2(0x007Fu, true);
  EXPECT_TRUE(ota_req_is_v2(request));
  EXPECT_EQ(ota_req_v2_fragments(request), 0x007Fu);
  EXPECT_NE(request & OTA_REQ_V2_ALLOW_DEFLATE, 0u);
  EXPECT_FALSE(ota_req_v2_extended_length(request));

  // Extended v2 needs at most twelve 171-byte fragments.  Keeping fragment bit 12 clear leaves the
  // deployed legacy "send all" value 0xFFFF unambiguous.
  const uint16_t extended_request = ota_req_make_v2(0x0FFFu, true, true);
  EXPECT_TRUE(ota_req_is_v2(extended_request));
  EXPECT_TRUE(ota_req_v2_extended_length(extended_request));
  EXPECT_EQ(ota_req_v2_fragments(extended_request), 0x0FFFu);
  EXPECT_EQ(extended_request, 0xEFFFu);
  EXPECT_FALSE(ota_req_is_v2(0xFFFFu));                    // deployed legacy full-block request
  EXPECT_FALSE(ota_req_is_v2(0x007Fu));

  uint16_t descriptor = 0;
  ASSERT_TRUE(ota_data_v2_pack(5, 1024, true, descriptor));
  uint8_t fragment = 0;
  uint16_t encoded_len = 0;
  bool deflated = false;
  ASSERT_TRUE(ota_data_v2_unpack(descriptor, fragment, encoded_len, deflated));
  EXPECT_EQ(fragment, 5u);
  EXPECT_EQ(encoded_len, 1024u);
  EXPECT_TRUE(deflated);
  EXPECT_FALSE(ota_data_v2_unpack((uint16_t)(descriptor & ~OTA_DATA_V2_MARK),
                                  fragment, encoded_len, deflated));
  EXPECT_FALSE(ota_data_v2_pack(16, 1024, false, descriptor));
  EXPECT_FALSE(ota_data_v2_pack(0, 0, false, descriptor));
  EXPECT_FALSE(ota_data_v2_pack(0, 1025, false, descriptor));

  ASSERT_TRUE(ota_data_v2_pack_extended(15, 2048, descriptor));
  EXPECT_EQ(descriptor, 0xFFFFu);
  ASSERT_TRUE(ota_data_v2_unpack_extended(descriptor, 2048,
                                          fragment, encoded_len, deflated));
  EXPECT_EQ(fragment, 15u);
  EXPECT_EQ(encoded_len, 2048u);
  EXPECT_FALSE(deflated);
  EXPECT_FALSE(ota_data_v2_unpack_extended(descriptor, 2047,
                                           fragment, encoded_len, deflated));

  ASSERT_TRUE(ota_data_v2_pack_extended(0, 1024, descriptor));
  ASSERT_TRUE(ota_data_v2_unpack_extended(descriptor, 2048,
                                          fragment, encoded_len, deflated));
  EXPECT_EQ(fragment, 0u);
  EXPECT_EQ(encoded_len, 1024u);
  EXPECT_TRUE(deflated);

  ASSERT_TRUE(ota_data_v2_pack_extended(0, 193, descriptor));
  ASSERT_TRUE(ota_data_v2_unpack_extended(descriptor, 193,
                                          fragment, encoded_len, deflated));
  EXPECT_EQ(encoded_len, 193u);
  EXPECT_FALSE(deflated);                                  // raw short tail in a 2 KiB manifest
  EXPECT_FALSE(ota_data_v2_pack_extended(16, 2048, descriptor));
  EXPECT_FALSE(ota_data_v2_pack_extended(0, 0, descriptor));
  EXPECT_FALSE(ota_data_v2_pack_extended(0, 2049, descriptor));
  EXPECT_FALSE(ota_data_v2_unpack_extended(0, 2048,
                                           fragment, encoded_len, deflated));
  EXPECT_FALSE(ota_data_v2_unpack_extended(OTA_DATA_V2_MARK, 0,
                                           fragment, encoded_len, deflated));
  EXPECT_FALSE(ota_data_v2_unpack_extended(OTA_DATA_V2_MARK, 2049,
                                           fragment, encoded_len, deflated));

  std::array<uint8_t, OTA_DATA_V2_STREAM_ID_BYTES + OTA_FRAG_DATA_V2> payload{};
  ASSERT_TRUE(ota_data_v2_pack(0, 1024, false, descriptor));
  DataMsg message{{1, 2, 3, 4}, 9, descriptor, payload.data(),
                  (uint16_t)payload.size()};
  uint8_t wire[MAX_PACKET_PAYLOAD];
  const uint16_t wire_len = encode_data(wire, sizeof(wire), message);
  EXPECT_EQ(wire_len, MAX_PACKET_PAYLOAD);
  DataMsg decoded{};
  ASSERT_TRUE(decode_data(wire, wire_len, decoded));
  EXPECT_EQ(decoded.data_len,
            (uint16_t)(OTA_DATA_V2_STREAM_ID_BYTES + OTA_FRAG_DATA_V2));
}

// --- full transfer simulation between two OtaManagers (P4b) ------------------------------------

namespace {
struct SimMsg { OtaManager* dest; std::vector<uint8_t> bytes; };
static std::vector<SimMsg> g_q;
struct SendTo { OtaManager* dest; };
static bool sim_send(void* ctx, const uint8_t* msg, uint16_t len, bool /*flood*/) {
  g_q.push_back({((SendTo*)ctx)->dest, std::vector<uint8_t>(msg, msg + len)});
  return true;
}
struct ExtendedV2Trace {
  const MotaManifest* manifest = nullptr;
  uint32_t extended_requests = 0;
  uint32_t legacy_requests = 0;
  bool full_raw = false;
  bool tail_raw = false;
  bool full_deflated = false;
  bool tail_deflated = false;
};
struct TracedSendTo { OtaManager* dest; ExtendedV2Trace* trace; };
static bool traced_sim_send(void* ctx, const uint8_t* msg, uint16_t len, bool /*flood*/) {
  TracedSendTo* route = (TracedSendTo*)ctx;
  ExtendedV2Trace* trace = route->trace;
  if (trace && trace->manifest && ota_msg_type(msg, len) == OTA_REQ) {
    ReqWindowMsg request{};
    if (decode_req_window(msg, len, request)) {
      for (uint8_t i = 0; i < request.n_items; i++) {
        if (ota_req_is_v2(request.items[i].want_mask) &&
            ota_req_v2_extended_length(request.items[i].want_mask)) {
          trace->extended_requests++;
        } else if (!ota_req_is_v2(request.items[i].want_mask)) {
          trace->legacy_requests++;
        }
      }
    }
  } else if (trace && trace->manifest && ota_msg_type(msg, len) == OTA_DATA) {
    DataMsg data{};
    if (decode_data(msg, len, data) && (data.frag_off & OTA_DATA_V2_MARK) != 0 &&
        data.block_idx < trace->manifest->block_count) {
      const uint32_t block_offset = (uint32_t)data.block_idx * trace->manifest->block_size();
      const uint16_t raw_len = (uint16_t)std::min<uint32_t>(
          trace->manifest->block_size(), trace->manifest->payload_size - block_offset);
      uint8_t fragment = 0;
      uint16_t encoded_len = 0;
      bool deflated = false;
      if (ota_data_v2_unpack_extended(data.frag_off, raw_len,
                                      fragment, encoded_len, deflated)) {
        const bool full = raw_len == trace->manifest->block_size();
        if (deflated) {
          if (full) trace->full_deflated = true;
          else trace->tail_deflated = true;
        } else {
          if (full) trace->full_raw = true;
          else trace->tail_raw = true;
        }
      }
    }
  }
  g_q.push_back({route->dest, std::vector<uint8_t>(msg, msg + len)});
  return true;
}
struct CapturedMessages { std::vector<std::vector<uint8_t>> items; };
static bool capture_send(void* ctx, const uint8_t* msg, uint16_t len, bool /*flood*/) {
  ((CapturedMessages*)ctx)->items.emplace_back(msg, msg + len);
  return true;
}
struct GatedCapture {
  bool accept = false;
  std::vector<std::vector<uint8_t>> items;
};
static bool gated_capture_send(void* ctx, const uint8_t* msg, uint16_t len, bool /*flood*/) {
  GatedCapture* capture = (GatedCapture*)ctx;
  if (!capture->accept) return false;
  capture->items.emplace_back(msg, msg + len);
  return true;
}

// Tiny reversible stand-in for the separately tested RFC1951 implementation. These callbacks isolate the
// OtaManager negotiation/reassembly path: each payload block is represented by its authenticated block index,
// then expanded from the immutable test manifest before the normal Merkle proof is checked.
struct TestWireCodec {
  const MotaManifest* manifest = nullptr;
  uint32_t calls = 0;
};

static bool test_wire_encode(void* context, const uint8_t* source, uint16_t source_len,
                             uint8_t* destination, uint16_t capacity, uint16_t* encoded_len) {
  TestWireCodec* codec = (TestWireCodec*)context;
  if (!codec || !codec->manifest || !source || !destination || !encoded_len || capacity < 2) return false;
  const MotaManifest& manifest = *codec->manifest;
  const uint32_t block_size = manifest.block_size();
  for (uint32_t block = 0; block < manifest.block_count && block <= 0xFFu; block++) {
    const uint32_t offset = block * block_size;
    const uint32_t length = std::min<uint32_t>(block_size, manifest.payload_size - offset);
    if (length == source_len && memcmp(source, manifest.payload + offset, length) == 0) {
      destination[0] = 0xD1;
      destination[1] = (uint8_t)block;
      *encoded_len = 2;
      codec->calls++;
      return true;
    }
  }
  return false;
}

static bool test_wire_decode(void* context, const uint8_t* source, uint16_t source_len,
                             uint8_t* destination, uint16_t capacity, uint16_t* decoded_len) {
  TestWireCodec* codec = (TestWireCodec*)context;
  if (!codec || !codec->manifest || !source || !destination || !decoded_len || source_len != 2 ||
      source[0] != 0xD1 || source[1] >= codec->manifest->block_count) return false;
  const MotaManifest& manifest = *codec->manifest;
  const uint32_t offset = (uint32_t)source[1] * manifest.block_size();
  const uint32_t length = std::min<uint32_t>(manifest.block_size(), manifest.payload_size - offset);
  if (length != capacity) return false;
  memcpy(destination, manifest.payload + offset, length);
  *decoded_len = (uint16_t)length;
  codec->calls++;
  return true;
}

struct VectorDeflateCodec {
  const MotaManifest* manifest = nullptr;
  uint32_t calls = 0;
};

static bool vector_2k_wire_encode(void* context, const uint8_t* source, uint16_t source_len,
                                  uint8_t* destination, uint16_t capacity,
                                  uint16_t* encoded_len) {
  VectorDeflateCodec* codec = (VectorDeflateCodec*)context;
  if (!codec || !codec->manifest || !source || !destination || !encoded_len ||
      codec->manifest->block_count != SIM_MOTA_2K_BLOCKS) return false;
  for (uint32_t block = 0; block < codec->manifest->block_count; block++) {
    const uint32_t offset = block * codec->manifest->block_size();
    const uint16_t length = (uint16_t)std::min<uint32_t>(
        codec->manifest->block_size(), codec->manifest->payload_size - offset);
    if (length != source_len || memcmp(source, codec->manifest->payload + offset, length) != 0) continue;
    const uint16_t representation_len = SIM_MOTA_2K_DEFLATED_LENGTHS[block];
    if (representation_len > capacity) return false;
    memcpy(destination,
           SIM_MOTA_2K_DEFLATED + SIM_MOTA_2K_DEFLATED_OFFSETS[block],
           representation_len);
    *encoded_len = representation_len;
    codec->calls++;
    return true;
  }
  return false;
}

struct RejectWireDecode {
  uint32_t calls = 0;
};

static bool reject_wire_decode(void* context, const uint8_t*, uint16_t,
                               uint8_t*, uint16_t, uint16_t* decoded_len) {
  RejectWireDecode* decoder = (RejectWireDecode*)context;
  if (decoder) decoder->calls++;
  if (decoded_len) *decoded_len = 0;
  return false;
}

struct SyntheticRepresentationDecode {
  const uint8_t* representation = nullptr;
  uint16_t representation_len = 0;
  const uint8_t* decoded = nullptr;
  uint16_t decoded_len = 0;
  uint32_t calls = 0;
};

static bool synthetic_representation_decode(void* context, const uint8_t* source,
                                             uint16_t source_len, uint8_t* destination,
                                             uint16_t capacity, uint16_t* decoded_len) {
  SyntheticRepresentationDecode* decoder = (SyntheticRepresentationDecode*)context;
  if (!decoder || !source || !destination || !decoded_len ||
      source_len != decoder->representation_len || capacity != decoder->decoded_len ||
      memcmp(source, decoder->representation, source_len) != 0) return false;
  memcpy(destination, decoder->decoded, capacity);
  *decoded_len = capacity;
  decoder->calls++;
  return true;
}

static bool test_representation_decode(void* context, const uint8_t* source, uint16_t source_len,
                                       uint8_t* destination, uint16_t capacity,
                                       uint16_t* decoded_len) {
  const MotaManifest* manifest = (const MotaManifest*)context;
  if (!manifest || !source || !destination || !decoded_len || source_len != 300 ||
      (source[0] != 0xA1 && source[0] != 0xB2) || capacity != manifest->block_size()) return false;
  memcpy(destination, manifest->payload, capacity);
  *decoded_len = capacity;
  return true;
}

TEST(OtaMetrics, CountsOnlyPacketsAcceptedByTheRadioAdapter) {
  OtaManager manager;
  GatedCapture sent;
  manager.begin(0, gated_capture_send, &sent);

  EXPECT_EQ(manager.packetsSent(), 0u);
  manager.announce();
  EXPECT_EQ(manager.packetsSent(), 0u);
  EXPECT_TRUE(sent.items.empty());

  sent.accept = true;
  manager.announce();
  manager.announce();
  EXPECT_EQ(manager.packetsSent(), 2u);
  EXPECT_EQ(sent.items.size(), 2u);
}

// Drive the bus to quiescence: deliver queued messages; when idle, advance the client's clock (monotonic
// across calls, so a jittered query scheduled in a prior pump still comes due) and call loop() (fires the
// scheduled catalog query / block re-requests). Two idle ticks in a row = quiescent.
static uint32_t g_clk = 0;
static void pump(OtaManager& client, OtaManager* server = nullptr, int guard_max = 200000) {
  int idle = 0, guard = 0;
  while (guard++ < guard_max) {
    if (server) server->serviceEgress();
    client.serviceEgress();
    if (!g_q.empty()) {
      SimMsg m = std::move(g_q.front()); g_q.erase(g_q.begin());
      m.dest->on_message(m.bytes.data(), (uint16_t)m.bytes.size());
      idle = 0;
    } else {
      g_clk += 5000;
      client.set_clock(g_clk);
      client.loop();
      if (server) {
        server->set_clock(g_clk);
        server->loop();
        server->serviceEgress();
      }
      client.serviceEgress();
      if (!g_q.empty()) { idle = 0; continue; }
      if (++idle >= 2) break;
    }
  }
}

static void finish_staged_verification(OtaManager& manager) {
  int guard = 10000;
  while (manager.fetchState() == OtaManager::VERIFYING_STAGED
         && guard-- > 0) {
    manager.loop();
  }
  ASSERT_GT(guard, 0);
}

class FaultingResumeStore : public OtaStoreRam<4096> {
public:
  void failReadAt(uint32_t offset) { _fail_offset = offset; }

  bool read(uint32_t offset, uint8_t* buffer,
            uint32_t length) const override {
    if (offset == _fail_offset) return false;
    return OtaStoreRam<4096>::read(offset, buffer, length);
  }

private:
  uint32_t _fail_offset = UINT32_MAX;
};

// A test MotaSource backing an external "folder" with one or more complete `.mota` images held in RAM -
// the simplest concrete transport (a real device uses serial/BLE/WiFi/FS, same interface). describe()
// parses each container for the catalog + region offsets; read() is a bounds-checked memcpy.
class RamMotaSource : public mesh::ota::MotaSource {
public:
  void add(const uint8_t* buf, uint32_t len) { if (_n < 8) { _buf[_n] = buf; _len[_n] = len; _n++; } }
  void setSourceCaps(uint8_t caps) { _source_caps = caps; }
  uint32_t deflateCalls() const { return _deflate_calls; }
  uint8_t count() override { return _n; }
  bool describe(uint8_t idx, mesh::ota::MotaDesc& d) override {
    if (idx >= _n) return false;
    MotaManifest m;
    if (!mota_parse(_buf[idx], _len[idx], m)) return false;
    std::memcpy(d.mid, m.merkle_root, 4);
    d.target_id = m.target_id; d.fw_version = m.fw_version;
    d.codec_id = m.codec_id; d.flags = m.flags;
    d.block_size_log2 = m.block_size_log2;
    d.source_caps = _source_caps;
    d.total_size = _len[idx];
    d.leaves_off = (uint32_t)(m.leaves - _buf[idx]);
    d.block_count = m.block_count;
    d.payload_off = (uint32_t)(m.payload - _buf[idx]);
    d.payload_size = m.payload_size;
    return true;
  }
  bool read(uint8_t idx, uint32_t off, uint8_t* out, uint32_t len) override {
    if (idx >= _n || (uint64_t)off + len > _len[idx]) return false;
    std::memcpy(out, _buf[idx] + off, len);
    return true;
  }
  bool read_deflated_block(uint8_t, uint16_t, uint8_t*, uint16_t, uint16_t* len) override {
    _deflate_calls++;
    if (len) *len = 0;
    return false;
  }
private:
  const uint8_t* _buf[8] = {nullptr}; uint32_t _len[8] = {0}; uint8_t _n = 0;
  uint8_t _source_caps = 0;
  uint32_t _deflate_calls = 0;
};

class SyntheticCatalogSource : public mesh::ota::MotaSource {
public:
  explicit SyntheticCatalogSource(uint8_t count, uint8_t block_log2 = 10)
      : _count(count), _block_log2(block_log2) {}
  uint8_t count() override { return _count; }
  bool describe(uint8_t idx, mesh::ota::MotaDesc& d) override {
    if (idx >= _count) return false;
    d = mesh::ota::MotaDesc{};
    d.mid[0] = (uint8_t)(idx + 1); d.mid[1] = 0xA5; d.mid[2] = 0x5A; d.mid[3] = 0xC3;
    d.target_id = SIM_TARGET_ID; d.fw_version = 0x01000000u + idx;
    d.codec_id = CODEC_FULL; d.flags = MFLAG_FULL; d.block_size_log2 = _block_log2;
    d.leaves_off = 8 + MOTA_MFL; d.block_count = 1;
    d.payload_off = d.leaves_off + 4; d.payload_size = 1; d.total_size = d.payload_off + 1 + 5;
    return true;
  }
  bool read(uint8_t, uint32_t, uint8_t*, uint32_t) override { return false; }
private:
  uint8_t _count;
  uint8_t _block_log2;
};
}

TEST(OtaServe, ClearPrimaryInvalidatesCallerOwnedView) {
  OtaManager manager;
  manager.begin(0, nullptr, nullptr);

  ASSERT_TRUE(manager.serve(SIM_MOTA, SIM_MOTA_LEN));
  RamMotaSource folder;
  folder.add(SIM_MOTA_1K, SIM_MOTA_1K_LEN);
  ASSERT_TRUE(manager.add_source(&folder));
  ASSERT_EQ(manager.servedCount(), 2);

  manager.clear_primary();
  ASSERT_EQ(manager.servedCount(), 1);
  EXPECT_FALSE(manager.servedEntry(0)->is_self);

  // A caller may release the container and later install a fresh primary view
  // without dropping or overwriting attached folder sources.
  EXPECT_TRUE(manager.serve(SIM_MOTA, SIM_MOTA_LEN));
  ASSERT_EQ(manager.servedCount(), 2);
  EXPECT_TRUE(manager.servedEntry(0)->is_self);
  EXPECT_FALSE(manager.servedEntry(1)->is_self);

  // Detaching one source must preserve the primary view (and, on device, any other source such as SD).
  EXPECT_TRUE(manager.remove_source(&folder));
  ASSERT_EQ(manager.servedCount(), 1);
  EXPECT_TRUE(manager.servedEntry(0)->is_self);
  EXPECT_FALSE(manager.remove_source(&folder));
}

TEST(OtaServe, FetchSessionResetPreservesIndependentPrimaryView) {
  OtaManager manager;
  manager.begin(0, nullptr, nullptr);
  ASSERT_TRUE(manager.serve(SIM_MOTA, SIM_MOTA_LEN));
  ASSERT_EQ(manager.servedCount(), 1);
  ASSERT_TRUE(manager.servedEntry(0)->is_self);

  // `ota cancel` resets only the receive side. A served image (and its
  // caller-owned backing buffer) must remain registered until the serving
  // side explicitly calls clear_primary().
  manager.reset_session();
  ASSERT_EQ(manager.servedCount(), 1);
  EXPECT_TRUE(manager.servedEntry(0)->is_self);
}

TEST(OtaTransfer, TwoManagersFullTransfer) {
  g_q.clear();
  OtaManager server, client;
  OtaStoreRam<4096> store;
  SendTo to_client{&client}, to_server{&server};

  server.begin(/*server's own target irrelevant for serving*/ 0, sim_send, &to_client);
  client.begin(SIM_TARGET_ID, sim_send, &to_server);
  client.set_fetch_store(&store);
  client.set_autofetch(OtaManager::AUTOFETCH_ANY);   // tests exercise fetch-on-advert; policy default is OFF

  ASSERT_TRUE(server.serve(SIM_MOTA, SIM_MOTA_LEN));
  server.announce();   // -> client hears the beacon, queries, catalogs, then fetches

  pump(client, &server);        // beacon -> query -> have -> startFetch -> full transfer

  EXPECT_EQ(client.fetchState(), OtaManager::COMPLETE);
  EXPECT_EQ(client.blocksHave(), client.blocksTotal());
  EXPECT_GT(client.blocksTotal(), 1u);

  // the client's reassembled container must be byte-identical to the original .mota...
  ASSERT_EQ(store.staged_size(), SIM_MOTA_LEN);
  EXPECT_EQ(0, std::memcmp(store.data(), SIM_MOTA, SIM_MOTA_LEN));

  // ...and independently re-verify it parses with a matching root + image_hash
  MotaManifest m;
  ASSERT_TRUE(mota_parse(store.data(), store.staged_size(), m));
  EXPECT_TRUE(mota_check_root(m));
  EXPECT_TRUE(mota_check_image_hash_full(m));
}

TEST(OtaTransfer, LegacyOneKilobyteV2CodecStillStagesOriginalContainer) {
  g_q.clear();
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA_1K, SIM_MOTA_1K_LEN, manifest));
  ASSERT_EQ(manifest.block_size(), 1024u);
  OtaManager server, client;
  OtaStoreRam<4096> store;
  SendTo to_client{&client}, to_server{&server};
  TestWireCodec encoder;
  TestWireCodec decoder;
  encoder.manifest = &manifest;
  decoder.manifest = &manifest;

  server.begin(0, sim_send, &to_client);
  server.set_transport_deflate_encoder(test_wire_encode, &encoder);
  client.begin(SIM_TARGET_ID, sim_send, &to_server);
  client.set_transport_deflate_decoder(test_wire_decode, &decoder);
  client.set_fetch_store(&store);
  client.set_autofetch(OtaManager::AUTOFETCH_ANY);
  ASSERT_TRUE(server.serve(SIM_MOTA_1K, SIM_MOTA_1K_LEN));

  server.announce();
  pump(client, &server);

  EXPECT_EQ(client.fetchState(), OtaManager::COMPLETE);
  EXPECT_GT(encoder.calls, 0u);
  EXPECT_EQ(decoder.calls, manifest.block_count);
  ASSERT_EQ(store.staged_size(), SIM_MOTA_1K_LEN);
  EXPECT_EQ(0, memcmp(store.data(), SIM_MOTA_1K, SIM_MOTA_1K_LEN));
}

TEST(OtaTransfer, TwoKilobyteExtendedV2TransfersFullAndShortRawBlocks) {
  g_q.clear();
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA_2K, SIM_MOTA_2K_LEN, manifest));
  ASSERT_EQ(manifest.block_size(), 2048u);
  ASSERT_EQ(manifest.block_count, SIM_MOTA_2K_BLOCKS);
  ASSERT_EQ(manifest.block_count, 2u);
  ASSERT_GT(manifest.payload_size, manifest.block_size());
  ASSERT_LT(manifest.payload_size - manifest.block_size(), manifest.block_size());

  OtaManager server, client;
  OtaStoreRam<4096> store;
  ExtendedV2Trace trace{};
  trace.manifest = &manifest;
  TracedSendTo to_client{&client, &trace}, to_server{&server, &trace};
  server.begin(0, traced_sim_send, &to_client);
  client.begin(SIM_TARGET_ID, traced_sim_send, &to_server);
  client.set_fetch_store(&store);
  client.set_autofetch(OtaManager::AUTOFETCH_ANY);
  ASSERT_TRUE(server.serve(SIM_MOTA_2K, SIM_MOTA_2K_LEN));

  server.announce();
  pump(client, &server);

  EXPECT_EQ(client.fetchState(), OtaManager::COMPLETE);
  EXPECT_GT(trace.extended_requests, 0u);
  EXPECT_EQ(trace.legacy_requests, 0u);
  EXPECT_TRUE(trace.full_raw);
  EXPECT_TRUE(trace.tail_raw);
  EXPECT_FALSE(trace.full_deflated);
  EXPECT_FALSE(trace.tail_deflated);
  ASSERT_EQ(store.staged_size(), SIM_MOTA_2K_LEN);
  EXPECT_EQ(0, memcmp(store.data(), SIM_MOTA_2K, SIM_MOTA_2K_LEN));
}

TEST(OtaTransfer, TwoKilobyteExtendedV2InflatesFullAndShortBlocksBeforeProof) {
  g_q.clear();
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA_2K, SIM_MOTA_2K_LEN, manifest));
  ASSERT_EQ(manifest.block_size(), 2048u);
  ASSERT_EQ(manifest.block_count, SIM_MOTA_2K_BLOCKS);

  OtaManager server, client;
  OtaStoreRam<4096> store;
  ExtendedV2Trace trace{};
  trace.manifest = &manifest;
  TracedSendTo to_client{&client, &trace}, to_server{&server, &trace};
  VectorDeflateCodec encoder{};
  encoder.manifest = &manifest;
  server.begin(0, traced_sim_send, &to_client);
  server.set_transport_deflate_encoder(vector_2k_wire_encode, &encoder);
  client.begin(SIM_TARGET_ID, traced_sim_send, &to_server);
  client.set_transport_deflate_decoder(ota_transport_inflate);
  client.set_fetch_store(&store);
  client.set_autofetch(OtaManager::AUTOFETCH_ANY);
  ASSERT_TRUE(server.serve(SIM_MOTA_2K, SIM_MOTA_2K_LEN));

  server.announce();
  pump(client, &server);

  EXPECT_EQ(client.fetchState(), OtaManager::COMPLETE);
  EXPECT_EQ(encoder.calls, manifest.block_count);
  EXPECT_GT(trace.extended_requests, 0u);
  EXPECT_EQ(trace.legacy_requests, 0u);
  EXPECT_TRUE(trace.full_deflated);
  EXPECT_TRUE(trace.tail_deflated);
  EXPECT_FALSE(trace.full_raw);
  EXPECT_FALSE(trace.tail_raw);
  ASSERT_EQ(store.staged_size(), SIM_MOTA_2K_LEN);
  EXPECT_EQ(0, memcmp(store.data(), SIM_MOTA_2K, SIM_MOTA_2K_LEN));
}

static void deliver_manifest_fragment(OtaManager& client, const uint8_t mid[4], uint8_t frag_idx,
                                      const uint8_t* bytes, uint16_t len) {
  uint8_t wire[MAX_PACKET_PAYLOAD];
  ManifestMsg msg;
  memcpy(msg.manifest_id, mid, 4);
  msg.frag_idx = frag_idx;
  msg.frag_total = (uint8_t)((MOTA_MFL + OTA_MF_FRAG - 1) / OTA_MF_FRAG);
  msg.bytes = bytes;
  msg.len = len;
  uint16_t wire_len = encode_manifest(wire, sizeof(wire), msg);
  ASSERT_GT(wire_len, 0);
  client.on_message(wire, wire_len);
}

static void deliver_verified_block(OtaManager& client, const MotaManifest& manifest,
                                   uint32_t block, bool reverse_fragments = false) {
  ASSERT_LT(block, manifest.block_count);
  const uint32_t block_size = manifest.block_size();
  const uint32_t block_off = block * block_size;
  const uint32_t block_len = block_off + block_size <= manifest.payload_size
      ? block_size : manifest.payload_size - block_off;
  const uint32_t fragments = (block_len + OTA_FRAG_DATA - 1) / OTA_FRAG_DATA;
  uint8_t wire[MAX_PACKET_PAYLOAD];
  for (uint32_t position = 0; position < fragments; position++) {
    const uint32_t fragment = reverse_fragments ? fragments - position - 1 : position;
    const uint32_t offset = fragment * OTA_FRAG_DATA;
    uint32_t length = block_len - offset;
    if (length > OTA_FRAG_DATA) length = OTA_FRAG_DATA;
    DataMsg data;
    memcpy(data.manifest_id, manifest.merkle_root, 4);
    data.block_idx = (uint16_t)block;
    data.frag_off = (uint16_t)offset;
    data.data = manifest.payload + block_off + offset;
    data.data_len = (uint16_t)length;
    uint16_t wire_len = encode_data(wire, sizeof(wire), data);
    ASSERT_GT(wire_len, 0);
    ASSERT_TRUE(client.on_message(wire, wire_len));
  }
  std::vector<uint8_t> scratch(manifest.block_count * 4);
  uint8_t siblings[32 * 4];
  uint8_t sibling_count = merkle_gen_proof(
      manifest.leaves, manifest.block_count, block, scratch.data(), siblings);
  ProofMsg proof;
  memcpy(proof.manifest_id, manifest.merkle_root, 4);
  proof.block_idx = (uint16_t)block;
  proof.n_proof = sibling_count;
  proof.proof = siblings;
  uint16_t wire_len = encode_proof(wire, sizeof(wire), proof);
  ASSERT_GT(wire_len, 0);
  ASSERT_TRUE(client.on_message(wire, wire_len));
}

static void deliver_verified_v2_raw_block(OtaManager& client, const MotaManifest& manifest,
                                          uint32_t block) {
  ASSERT_LT(block, manifest.block_count);
  const uint32_t block_size = manifest.block_size();
  const uint32_t block_off = block * block_size;
  const uint16_t block_len = (uint16_t)(block_off + block_size <= manifest.payload_size
      ? block_size : manifest.payload_size - block_off);
  const uint32_t fragments = (block_len + OTA_FRAG_DATA_V2 - 1) / OTA_FRAG_DATA_V2;
  uint8_t stream_id[OTA_DATA_V2_STREAM_ID_BYTES];
  mh4(stream_id, manifest.payload + block_off, block_len);
  uint8_t wire[MAX_PACKET_PAYLOAD];
  for (uint32_t fragment = 0; fragment < fragments; fragment++) {
    const uint32_t offset = fragment * OTA_FRAG_DATA_V2;
    uint16_t length = (uint16_t)(block_len - offset);
    if (length > OTA_FRAG_DATA_V2) length = OTA_FRAG_DATA_V2;
    uint8_t body[OTA_DATA_V2_STREAM_ID_BYTES + OTA_FRAG_DATA_V2];
    memcpy(body, stream_id, sizeof(stream_id));
    memcpy(body + sizeof(stream_id), manifest.payload + block_off + offset, length);
    DataMsg data{};
    memcpy(data.manifest_id, manifest.merkle_root, 4);
    data.block_idx = (uint16_t)block;
    if (block_size > OTA_DATA_V2_LEGACY_MAX_ENCODED) {
      ASSERT_TRUE(ota_data_v2_pack_extended((uint8_t)fragment, block_len, data.frag_off));
    } else {
      ASSERT_TRUE(ota_data_v2_pack((uint8_t)fragment, block_len, false, data.frag_off));
    }
    data.data = body;
    data.data_len = (uint16_t)(sizeof(stream_id) + length);
    const uint16_t wire_len = encode_data(wire, sizeof(wire), data);
    ASSERT_GT(wire_len, 0);
    ASSERT_TRUE(client.on_message(wire, wire_len));
  }
  std::vector<uint8_t> scratch(manifest.block_count * 4);
  uint8_t siblings[32 * 4];
  const uint8_t sibling_count = merkle_gen_proof(
      manifest.leaves, manifest.block_count, block, scratch.data(), siblings);
  ProofMsg proof{};
  memcpy(proof.manifest_id, manifest.merkle_root, 4);
  proof.block_idx = (uint16_t)block;
  proof.n_proof = sibling_count;
  proof.proof = siblings;
  const uint16_t wire_len = encode_proof(wire, sizeof(wire), proof);
  ASSERT_GT(wire_len, 0);
  ASSERT_TRUE(client.on_message(wire, wire_len));
}

static void deliver_v2_representation(OtaManager& client, const MotaManifest& manifest,
                                      uint32_t block, const uint8_t* representation,
                                      uint16_t representation_len) {
  ASSERT_LT(block, manifest.block_count);
  ASSERT_NE(representation, nullptr);
  const uint32_t block_offset = block * manifest.block_size();
  const uint16_t raw_len = (uint16_t)std::min<uint32_t>(
      manifest.block_size(), manifest.payload_size - block_offset);
  ASSERT_GT(representation_len, 0u);
  ASSERT_LT(representation_len, raw_len);

  uint8_t stream_id[OTA_DATA_V2_STREAM_ID_BYTES];
  mh4(stream_id, representation, representation_len);
  const uint32_t fragments =
      (representation_len + OTA_FRAG_DATA_V2 - 1) / OTA_FRAG_DATA_V2;
  uint8_t wire[MAX_PACKET_PAYLOAD];
  for (uint32_t fragment = 0; fragment < fragments; fragment++) {
    const uint32_t offset = fragment * OTA_FRAG_DATA_V2;
    const uint16_t length = (uint16_t)std::min<uint32_t>(
        OTA_FRAG_DATA_V2, representation_len - offset);
    uint8_t body[OTA_DATA_V2_STREAM_ID_BYTES + OTA_FRAG_DATA_V2];
    memcpy(body, stream_id, sizeof(stream_id));
    memcpy(body + sizeof(stream_id), representation + offset, length);
    DataMsg data{};
    memcpy(data.manifest_id, manifest.merkle_root, 4);
    data.block_idx = (uint16_t)block;
    if (manifest.block_size() > OTA_DATA_V2_LEGACY_MAX_ENCODED) {
      ASSERT_TRUE(ota_data_v2_pack_extended(
          (uint8_t)fragment, representation_len, data.frag_off));
    } else {
      ASSERT_TRUE(ota_data_v2_pack(
          (uint8_t)fragment, representation_len, true, data.frag_off));
    }
    data.data = body;
    data.data_len = (uint16_t)(sizeof(stream_id) + length);
    const uint16_t wire_len = encode_data(wire, sizeof(wire), data);
    ASSERT_GT(wire_len, 0);
    ASSERT_TRUE(client.on_message(wire, wire_len));
  }
}

static void deliver_block_proof(OtaManager& client, const MotaManifest& manifest,
                                uint32_t block) {
  ASSERT_LT(block, manifest.block_count);
  std::vector<uint8_t> scratch(manifest.block_count * 4);
  uint8_t siblings[32 * 4];
  const uint8_t sibling_count = merkle_gen_proof(
      manifest.leaves, manifest.block_count, block, scratch.data(), siblings);
  ProofMsg proof{};
  memcpy(proof.manifest_id, manifest.merkle_root, 4);
  proof.block_idx = (uint16_t)block;
  proof.n_proof = sibling_count;
  proof.proof = siblings;
  uint8_t wire[MAX_PACKET_PAYLOAD];
  const uint16_t wire_len = encode_proof(wire, sizeof(wire), proof);
  ASSERT_GT(wire_len, 0);
  ASSERT_TRUE(client.on_message(wire, wire_len));
}

TEST(OtaTransfer, ServerPacesOneKilobyteBlockAndProactiveProofWithBackpressure) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA_1K, SIM_MOTA_1K_LEN, manifest));
  ASSERT_EQ(manifest.block_size(), 1024u);

  OtaManager server;
  GatedCapture sent;
  server.begin(0, gated_capture_send, &sent);
  ASSERT_TRUE(server.serve(SIM_MOTA_1K, SIM_MOTA_1K_LEN));

  ReqMsg request;
  memcpy(request.manifest_id, manifest.merkle_root, 4);
  request.block_idx = 0;
  request.want_mask = 0xFFFF;
  uint8_t wire[MAX_PACKET_PAYLOAD];
  uint16_t wire_len = encode_req(wire, sizeof(wire), request);
  ASSERT_GT(wire_len, 0);
  OtaManager relay;
  relay.begin(0, capture_send, &sent);
  EXPECT_FALSE(relay.on_message(wire, wire_len));         // an intermediate still forwards this request
  EXPECT_TRUE(server.on_message(wire, wire_len));
  EXPECT_TRUE(server.on_message(wire, wire_len));         // identical in-flight retry merges
  EXPECT_EQ(server.pendingServeJobs(), 1u);
  EXPECT_TRUE(sent.items.empty());                        // receive handler never allocates a packet burst

  server.serviceEgress();                                 // callback applies packet-queue backpressure
  EXPECT_TRUE(sent.items.empty());
  EXPECT_EQ(server.pendingServeJobs(), 1u);

  sent.accept = true;
  const uint32_t fragment_count = (1024 + OTA_FRAG_DATA - 1) / OTA_FRAG_DATA;
  for (uint32_t i = 0; i < fragment_count; i++) {
    server.serviceEgress();
    ASSERT_EQ(sent.items.size(), i + 1);
    DataMsg data;
    ASSERT_TRUE(decode_data(sent.items.back().data(),
                            (uint16_t)sent.items.back().size(), data));
    EXPECT_EQ(data.block_idx, 0);
    EXPECT_EQ(data.frag_off, i * OTA_FRAG_DATA);
  }
  EXPECT_EQ(server.pendingServeJobs(), 1u);                // proof is retained behind DATA
  server.serviceEgress();                                  // reserve RX turnaround for legacy REQ_PROOF
  ASSERT_EQ(sent.items.size(), fragment_count);
  server.set_clock(OTA_MANIFEST_EGRESS_MIN_GAP_MS);
  server.serviceEgress();
  ASSERT_EQ(sent.items.size(), fragment_count + 1);
  ProofMsg proof;
  ASSERT_TRUE(decode_proof(sent.items.back().data(),
                           (uint16_t)sent.items.back().size(), proof));
  EXPECT_EQ(proof.block_idx, 0);
  EXPECT_EQ(server.pendingServeJobs(), 0u);
}

TEST(OtaTransfer, LiteralLegacyFullMaskServesTwoKilobyteBlockInThirteenFragments) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA_2K, SIM_MOTA_2K_LEN, manifest));
  ASSERT_EQ(manifest.block_size(), 2048u);

  OtaManager server;
  CapturedMessages sent;
  server.begin(0, capture_send, &sent);
  ASSERT_TRUE(server.serve(SIM_MOTA_2K, SIM_MOTA_2K_LEN));

  ReqMsg request{};
  memcpy(request.manifest_id, manifest.merkle_root, 4);
  request.block_idx = 0;
  request.want_mask = 0xFFFFu;                            // deployed legacy "all fragments"
  EXPECT_FALSE(ota_req_is_v2(request.want_mask));
  uint8_t wire[MAX_PACKET_PAYLOAD];
  const uint16_t request_len = encode_req(wire, sizeof(wire), request);
  ASSERT_GT(request_len, 0);
  ASSERT_TRUE(server.on_message(wire, request_len));

  const uint32_t fragment_count =
      (manifest.block_size() + OTA_FRAG_DATA - 1) / OTA_FRAG_DATA;
  ASSERT_EQ(fragment_count, 13u);
  for (uint32_t fragment = 0; fragment < fragment_count; fragment++) {
    server.serviceEgress();
    ASSERT_EQ(sent.items.size(), fragment + 1);
    DataMsg data{};
    ASSERT_TRUE(decode_data(sent.items.back().data(),
                            (uint16_t)sent.items.back().size(), data));
    EXPECT_EQ(data.block_idx, 0u);
    EXPECT_EQ(data.frag_off, fragment * OTA_FRAG_DATA);
    const uint16_t expected_len = (uint16_t)std::min<uint32_t>(
        OTA_FRAG_DATA, manifest.block_size() - fragment * OTA_FRAG_DATA);
    EXPECT_EQ(data.data_len, expected_len);
    EXPECT_EQ(0, memcmp(data.data,
                        manifest.payload + fragment * OTA_FRAG_DATA,
                        expected_len));
  }
  EXPECT_EQ(sent.items.size(), 13u);                      // no v2 12-fragment interpretation
  EXPECT_EQ(server.pendingServeJobs(), 1u);

  server.serviceEgress();                                 // establish proof turnaround deadline
  ASSERT_EQ(sent.items.size(), 13u);
  server.set_clock(OTA_MANIFEST_EGRESS_MIN_GAP_MS);
  server.serviceEgress();
  ASSERT_EQ(sent.items.size(), 14u);
  ProofMsg proof{};
  ASSERT_TRUE(decode_proof(sent.items.back().data(),
                           (uint16_t)sent.items.back().size(), proof));
  EXPECT_EQ(proof.block_idx, 0u);
  EXPECT_EQ(server.pendingServeJobs(), 0u);
}

TEST(OtaTransfer, NegotiatedV2Carries171RawBytesAndRepeatsRepresentationId) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA_1K, SIM_MOTA_1K_LEN, manifest));
  ASSERT_EQ(manifest.block_size(), 1024u);

  OtaManager server;
  CapturedMessages sent;
  server.begin(0, capture_send, &sent);
  ASSERT_TRUE(server.serve(SIM_MOTA_1K, SIM_MOTA_1K_LEN));

  ReqMsg request;
  memcpy(request.manifest_id, manifest.merkle_root, 4);
  request.block_idx = 0;
  request.want_mask = ota_req_make_v2(0x007Fu, true); // no encoder installed: source must fall back to raw
  uint8_t wire[MAX_PACKET_PAYLOAD];
  const uint16_t request_len = encode_req(wire, sizeof(wire), request);
  ASSERT_GT(request_len, 0);
  ASSERT_TRUE(server.on_message(wire, request_len));

  const uint32_t fragment_count =
      (manifest.block_size() + OTA_FRAG_DATA_V2 - 1) / OTA_FRAG_DATA_V2;
  ASSERT_EQ(fragment_count, 6u);
  std::array<uint8_t, 1024> reassembled{};
  uint8_t expected_stream_id[4];
  mh4(expected_stream_id, manifest.payload, manifest.block_size());

  for (uint32_t i = 0; i < fragment_count; i++) {
    server.serviceEgress();
    ASSERT_EQ(sent.items.size(), i + 1);
    DataMsg data{};
    ASSERT_TRUE(decode_data(sent.items.back().data(),
                            (uint16_t)sent.items.back().size(), data));
    uint8_t fragment = 0;
    uint16_t encoded_len = 0;
    bool deflated = true;
    ASSERT_TRUE(ota_data_v2_unpack(data.frag_off, fragment, encoded_len, deflated));
    EXPECT_EQ(fragment, i);
    EXPECT_EQ(encoded_len, manifest.block_size());
    EXPECT_FALSE(deflated);
    ASSERT_GE(data.data_len, OTA_DATA_V2_STREAM_ID_BYTES);
    EXPECT_EQ(0, memcmp(data.data, expected_stream_id, sizeof(expected_stream_id)));
    const uint16_t slice_len =
        (uint16_t)(data.data_len - OTA_DATA_V2_STREAM_ID_BYTES);
    const uint32_t offset = i * OTA_FRAG_DATA_V2;
    EXPECT_EQ(slice_len, (uint16_t)std::min<uint32_t>(OTA_FRAG_DATA_V2,
                                                      manifest.block_size() - offset));
    if (i + 1 < fragment_count) EXPECT_EQ(sent.items.back().size(), MAX_PACKET_PAYLOAD);
    memcpy(reassembled.data() + offset, data.data + OTA_DATA_V2_STREAM_ID_BYTES, slice_len);
  }
  EXPECT_EQ(0, memcmp(reassembled.data(), manifest.payload, manifest.block_size()));
}

TEST(OtaTransfer, LegacyProofRequestBypassesProactiveProofTurnaround) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA_1K, SIM_MOTA_1K_LEN, manifest));

  OtaManager server;
  CapturedMessages sent;
  server.begin(0, capture_send, &sent);
  server.set_link_timing(80, 2000);                         // 3 admitted packet intervals = 480 ms
  ASSERT_TRUE(server.serve(SIM_MOTA_1K, SIM_MOTA_1K_LEN));

  ReqMsg request;
  memcpy(request.manifest_id, manifest.merkle_root, 4);
  request.block_idx = 0;
  request.want_mask = 0xFFFF;
  uint8_t wire[MAX_PACKET_PAYLOAD];
  uint16_t wire_len = encode_req(wire, sizeof(wire), request);
  ASSERT_GT(wire_len, 0);
  ASSERT_TRUE(server.on_message(wire, wire_len));

  const uint32_t fragment_count =
      (manifest.block_size() + OTA_FRAG_DATA - 1) / OTA_FRAG_DATA;
  for (uint32_t i = 0; i < fragment_count; i++) server.serviceEgress();
  ASSERT_EQ(sent.items.size(), fragment_count);

  server.set_clock(479);
  server.serviceEgress();                                  // no unsolicited proof before turnaround
  ASSERT_EQ(sent.items.size(), fragment_count);

  ReqProofMsg proof_request;
  memcpy(proof_request.manifest_id, manifest.merkle_root, 4);
  proof_request.block_idx = 0;
  wire_len = encode_req_proof(wire, sizeof(wire), proof_request);
  ASSERT_GT(wire_len, 0);
  ASSERT_TRUE(server.on_message(wire, wire_len));
  server.serviceEgress();                                  // explicit legacy request is served immediately
  ASSERT_EQ(sent.items.size(), fragment_count + 1);
  ProofMsg proof;
  ASSERT_TRUE(decode_proof(sent.items.back().data(),
                           (uint16_t)sent.items.back().size(), proof));
  EXPECT_EQ(proof.block_idx, 0);
}

TEST(OtaTransfer, ServerPacesManifestFragmentsAndConsumesResolvedRequest) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA, SIM_MOTA_LEN, manifest));

  OtaManager server;
  CapturedMessages sent;
  server.begin(0, capture_send, &sent);
  server.set_link_timing(80, 2000);  // 160 ms at the active airtime/duty spacing
  ASSERT_TRUE(server.serve(SIM_MOTA, SIM_MOTA_LEN));

  GetManifestMsg request;
  memcpy(request.manifest_id, manifest.merkle_root, 4);
  request.want_mask = 0xFFFF;
  uint8_t wire[MAX_PACKET_PAYLOAD];
  uint16_t wire_len = encode_get_manifest(wire, sizeof(wire), request);
  ASSERT_GT(wire_len, 0);

  EXPECT_TRUE(server.on_message(wire, wire_len));
  EXPECT_TRUE(sent.items.empty());
  EXPECT_EQ(server.pendingManifestJobs(), 1u);

  const uint32_t manifest_gap = 160;
  server.set_clock(manifest_gap - 1);
  server.serviceEgress();
  EXPECT_TRUE(sent.items.empty());

  server.set_clock(manifest_gap);
  server.serviceEgress();
  ASSERT_EQ(sent.items.size(), 1u);
  ManifestMsg fragment;
  ASSERT_TRUE(decode_manifest(sent.items[0].data(),
                              (uint16_t)sent.items[0].size(), fragment));
  EXPECT_EQ(fragment.frag_idx, 0u);
  EXPECT_EQ(fragment.frag_total, 2u);

  server.set_clock(2 * manifest_gap - 1);
  server.serviceEgress();
  ASSERT_EQ(sent.items.size(), 1u);

  server.set_clock(2 * manifest_gap);
  server.serviceEgress();
  ASSERT_EQ(sent.items.size(), 2u);
  ASSERT_TRUE(decode_manifest(sent.items[1].data(),
                              (uint16_t)sent.items[1].size(), fragment));
  EXPECT_EQ(fragment.frag_idx, 1u);
  EXPECT_EQ(server.pendingManifestJobs(), 0u);

  sent.items.clear();
  request.manifest_id[0] ^= 0xFF;
  wire_len = encode_get_manifest(wire, sizeof(wire), request);
  ASSERT_GT(wire_len, 0);
  EXPECT_FALSE(server.on_message(wire, wire_len));
  EXPECT_TRUE(sent.items.empty());
}

TEST(OtaTransfer, ServerQueuesEveryBlockInOneRequestFlight) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA_1K, SIM_MOTA_1K_LEN, manifest));
  ASSERT_EQ(manifest.block_count, 3u);

  OtaManager server;
  CapturedMessages sent;
  server.begin(0, capture_send, &sent);
  ASSERT_TRUE(server.serve(SIM_MOTA_1K, SIM_MOTA_1K_LEN));

  ReqWindowMsg request{};
  memcpy(request.manifest_id, manifest.merkle_root, 4);
  request.n_items = 3;
  for (uint8_t i = 0; i < request.n_items; i++) {
    request.items[i].block_idx = i;
    request.items[i].want_mask = 0xFFFF;
  }
  uint8_t wire[MAX_PACKET_PAYLOAD];
  uint16_t wire_len = encode_req_window(wire, sizeof(wire), request);
  ASSERT_GT(wire_len, 0);
  server.on_message(wire, wire_len);
  EXPECT_EQ(server.pendingServeJobs(), 3u);

  // The bounded sender remains paced and drains the jobs in request order, including each proactive proof
  // after the legacy-receiver turnaround gap.
  const uint32_t data_packets_per_full_block =
      (manifest.block_size() + OTA_FRAG_DATA - 1) / OTA_FRAG_DATA;
  for (uint32_t i = 0; i < data_packets_per_full_block; i++) server.serviceEgress();
  server.set_clock(OTA_MANIFEST_EGRESS_MIN_GAP_MS);
  server.serviceEgress();
  const uint32_t packets_per_full_block = data_packets_per_full_block + 1;
  ASSERT_EQ(sent.items.size(), packets_per_full_block);
  ProofMsg proof;
  ASSERT_TRUE(decode_proof(sent.items.back().data(),
                           (uint16_t)sent.items.back().size(), proof));
  EXPECT_EQ(proof.block_idx, 0);
  EXPECT_EQ(server.pendingServeJobs(), 2u);
}

TEST(OtaTransfer, MissingProactiveProofFallsBackAfterGrace) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA_1K, SIM_MOTA_1K_LEN, manifest));

  OtaManager client;
  OtaStoreRam<4096> store;
  CapturedMessages sent;
  client.begin(SIM_TARGET_ID, capture_send, &sent);
  client.set_fetch_store(&store);
  client.pull(manifest.merkle_root, manifest.target_id);
  sent.items.clear();
  client.set_clock(100);
  deliver_manifest_fragment(client, manifest.merkle_root, 0,
                            manifest.manifest_start, OTA_MF_FRAG);
  deliver_manifest_fragment(client, manifest.merkle_root, 1,
                            manifest.manifest_start + OTA_MF_FRAG,
                            (uint16_t)(MOTA_MFL - OTA_MF_FRAG));
  ASSERT_EQ(sent.items.size(), 1u);                       // first one-block flight opens immediately

  const uint32_t block_len = manifest.block_size();
  uint8_t wire[MAX_PACKET_PAYLOAD];
  for (uint32_t offset = 0; offset < block_len; offset += OTA_FRAG_DATA) {
    uint32_t length = block_len - offset;
    if (length > OTA_FRAG_DATA) length = OTA_FRAG_DATA;
    DataMsg data;
    memcpy(data.manifest_id, manifest.merkle_root, 4);
    data.block_idx = 0;
    data.frag_off = (uint16_t)offset;
    data.data = manifest.payload + offset;
    data.data_len = (uint16_t)length;
    uint16_t length_on_wire = encode_data(wire, sizeof(wire), data);
    ASSERT_GT(length_on_wire, 0);
    client.on_message(wire, length_on_wire);
  }
  EXPECT_EQ(sent.items.size(), 1u);

  client.set_clock(100 + OTA_PROOF_GRACE_MS - 1);
  client.serviceEgress();
  EXPECT_EQ(sent.items.size(), 1u);
  client.set_clock(100 + OTA_PROOF_GRACE_MS);
  client.serviceEgress();
  ASSERT_EQ(sent.items.size(), 2u);
  ReqProofMsg fallback;
  ASSERT_TRUE(decode_req_proof(sent.items.back().data(),
                               (uint16_t)sent.items.back().size(), fallback));
  EXPECT_EQ(fallback.block_idx, 0);
}

TEST(OtaTransfer, ClientUsesQuietBatchedFlightsAndAcceptsOutOfOrderBlocks) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA_1K, SIM_MOTA_1K_LEN, manifest));
  ASSERT_EQ(manifest.block_count, 3u);

  OtaManager client;
  OtaStoreRam<4096> store;
  CapturedMessages sent;
  client.begin(SIM_TARGET_ID, capture_send, &sent);
  client.set_fetch_store(&store);
  client.pull(manifest.merkle_root, manifest.target_id);
  sent.items.clear();                                      // discard the initial GET_MANIFEST

  deliver_manifest_fragment(client, manifest.merkle_root, 0,
                            manifest.manifest_start, OTA_MF_FRAG);
  deliver_manifest_fragment(client, manifest.merkle_root, 1,
                            manifest.manifest_start + OTA_MF_FRAG,
                            (uint16_t)(MOTA_MFL - OTA_MF_FRAG));
  ASSERT_EQ(client.fetchState(), OtaManager::FETCHING);
  ASSERT_EQ(sent.items.size(), 1u);
  ReqWindowMsg first{};
  ASSERT_TRUE(decode_req_window(sent.items[0].data(),
                                (uint16_t)sent.items[0].size(), first));
  ASSERT_EQ(first.n_items, 1u);
  EXPECT_EQ(first.items[0].block_idx, 0);
  EXPECT_EQ(client.fetchPipelineWidth(), 1u);

  // A clean one-block probe grows the next flight to two blocks, both named in ONE request packet.
  deliver_verified_block(client, manifest, 0);
  ASSERT_EQ(client.blocksHave(), 1u);
  ASSERT_EQ(client.fetchPipelineWidth(), 2u);
  ASSERT_EQ(sent.items.size(), 2u);
  ReqWindowMsg second{};
  ASSERT_TRUE(decode_req_window(sent.items[1].data(),
                                (uint16_t)sent.items[1].size(), second));
  ASSERT_EQ(second.n_items, 2u);
  EXPECT_EQ(second.items[0].block_idx, 1);
  EXPECT_EQ(second.items[1].block_idx, 2);

  // Complete block 2 first, with reversed fragments. Its slot verifies independently, but the client does
  // not refill or transmit anything while block 1's response is still expected from the same flight.
  deliver_verified_block(client, manifest, 2, true);
  EXPECT_EQ(client.blocksHave(), 2u);
  EXPECT_EQ(sent.items.size(), 2u);

  deliver_verified_block(client, manifest, 1);
  EXPECT_EQ(client.fetchState(), OtaManager::COMPLETE);
  EXPECT_EQ(client.blocksHave(), 3u);
  EXPECT_EQ(sent.items.size(), 2u);                       // no continuous-refill request was emitted
}

TEST(OtaTransfer, NewClientRequestsV2ThenRetriesLegacyWhenNoV2DataArrives) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA_1K, SIM_MOTA_1K_LEN, manifest));

  OtaManager client;
  OtaStoreRam<4096> store;
  CapturedMessages sent;
  client.begin(SIM_TARGET_ID, capture_send, &sent);
  client.set_fetch_store(&store);
  client.set_clock(100);
  client.pull(manifest.merkle_root, manifest.target_id);
  sent.items.clear();
  deliver_manifest_fragment(client, manifest.merkle_root, 0,
                            manifest.manifest_start, OTA_MF_FRAG);
  deliver_manifest_fragment(client, manifest.merkle_root, 1,
                            manifest.manifest_start + OTA_MF_FRAG,
                            (uint16_t)(MOTA_MFL - OTA_MF_FRAG));
  ASSERT_EQ(sent.items.size(), 1u);
  ReqMsg first{};
  ASSERT_TRUE(decode_req(sent.items[0].data(), (uint16_t)sent.items[0].size(), first));
  EXPECT_TRUE(ota_req_is_v2(first.want_mask));
  EXPECT_EQ(ota_req_v2_fragments(first.want_mask), 0x007Fu); // remains a complete old-source request
  EXPECT_EQ(first.want_mask & OTA_REQ_V2_ALLOW_DEFLATE, 0u); // no decoder was linked/configured

  const uint32_t timeout = client.fetchRetryTimeoutMs();
  client.set_clock(100 + timeout);
  client.loop();
  ASSERT_EQ(sent.items.size(), 2u);
  ReqMsg fallback{};
  ASSERT_TRUE(decode_req(sent.items[1].data(), (uint16_t)sent.items[1].size(), fallback));
  EXPECT_FALSE(ota_req_is_v2(fallback.want_mask));
  EXPECT_EQ(fallback.want_mask, 0x007Fu);
}

TEST(OtaTransfer, TwoKilobyteClientAcceptsCanonicalLegacyFallbackThroughBitTwelve) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA_2K, SIM_MOTA_2K_LEN, manifest));
  ASSERT_EQ(manifest.block_size(), 2048u);
  ASSERT_EQ(manifest.block_count, 2u);

  OtaManager client;
  OtaStoreRam<4096> store;
  CapturedMessages sent;
  client.begin(SIM_TARGET_ID, capture_send, &sent);
  client.set_fetch_store(&store);
  client.set_clock(100);
  ASSERT_EQ(client.pull(manifest.merkle_root, manifest.target_id), OtaManager::PULL_STARTED);
  sent.items.clear();
  deliver_manifest_fragment(client, manifest.merkle_root, 0,
                            manifest.manifest_start, OTA_MF_FRAG);
  deliver_manifest_fragment(client, manifest.merkle_root, 1,
                            manifest.manifest_start + OTA_MF_FRAG,
                            (uint16_t)(MOTA_MFL - OTA_MF_FRAG));

  ASSERT_EQ(sent.items.size(), 1u);
  ReqMsg extended{};
  ASSERT_TRUE(decode_req(sent.items[0].data(),
                         (uint16_t)sent.items[0].size(), extended));
  EXPECT_TRUE(ota_req_is_v2(extended.want_mask));
  EXPECT_TRUE(ota_req_v2_extended_length(extended.want_mask));
  EXPECT_EQ(ota_req_v2_fragments(extended.want_mask), 0x0FFFu);

  // The first canonical legacy slice selects the fallback geometry.  Completing the 2 KiB block then
  // necessarily receives fragment bit 12 (offset 1920) before its proof can authenticate and commit it.
  ASSERT_EQ((manifest.block_size() + OTA_FRAG_DATA - 1) / OTA_FRAG_DATA, 13u);
  deliver_verified_block(client, manifest, 0);
  ASSERT_EQ(client.blocksHave(), 1u);

  ASSERT_EQ(sent.items.size(), 2u);
  ReqMsg next{};
  ASSERT_TRUE(decode_req(sent.items.back().data(),
                         (uint16_t)sent.items.back().size(), next));
  EXPECT_EQ(next.block_idx, 1u);
  EXPECT_FALSE(ota_req_is_v2(next.want_mask));
  EXPECT_EQ(next.want_mask, 0x0003u);                     // short tail remains legacy after downgrade

  deliver_verified_block(client, manifest, 1);
  EXPECT_EQ(client.fetchState(), OtaManager::COMPLETE);
  EXPECT_EQ(client.blocksHave(), client.blocksTotal());
  ASSERT_EQ(store.staged_size(), SIM_MOTA_2K_LEN);
  EXPECT_EQ(0, memcmp(store.data(), SIM_MOTA_2K, SIM_MOTA_2K_LEN));
}

TEST(OtaTransfer, MalformedLegacyDataCannotForceV2SessionDowngrade) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA_1K, SIM_MOTA_1K_LEN, manifest));
  OtaManager client;
  OtaStoreRam<4096> store;
  CapturedMessages sent;
  client.begin(SIM_TARGET_ID, capture_send, &sent);
  client.set_fetch_store(&store);
  client.pull(manifest.merkle_root, manifest.target_id);
  sent.items.clear();
  deliver_manifest_fragment(client, manifest.merkle_root, 0,
                            manifest.manifest_start, OTA_MF_FRAG);
  deliver_manifest_fragment(client, manifest.merkle_root, 1,
                            manifest.manifest_start + OTA_MF_FRAG,
                            (uint16_t)(MOTA_MFL - OTA_MF_FRAG));

  uint8_t wire[MAX_PACKET_PAYLOAD];
  DataMsg malformed;
  memcpy(malformed.manifest_id, manifest.merkle_root, 4);
  malformed.block_idx = 0;
  malformed.frag_off = 1;                                // not canonical 160-byte legacy alignment
  malformed.data = manifest.payload;
  malformed.data_len = OTA_FRAG_DATA;
  uint16_t wire_len = encode_data(wire, sizeof(wire), malformed);
  ASSERT_GT(wire_len, 0);
  EXPECT_FALSE(client.on_message(wire, wire_len));

  uint8_t body[OTA_DATA_V2_STREAM_ID_BYTES + OTA_FRAG_DATA_V2];
  mh4(body, manifest.payload, manifest.block_size());
  memcpy(body + OTA_DATA_V2_STREAM_ID_BYTES, manifest.payload, OTA_FRAG_DATA_V2);
  DataMsg valid;
  memcpy(valid.manifest_id, manifest.merkle_root, 4);
  valid.block_idx = 0;
  ASSERT_TRUE(ota_data_v2_pack(0, (uint16_t)manifest.block_size(), false, valid.frag_off));
  valid.data = body;
  valid.data_len = sizeof(body);
  wire_len = encode_data(wire, sizeof(wire), valid);
  ASSERT_EQ(wire_len, MAX_PACKET_PAYLOAD);
  EXPECT_TRUE(client.on_message(wire, wire_len));          // malformed legacy packet left v2 negotiation intact
}

TEST(OtaTransfer, PartialV2SeederCanDisappearAndLegacySeederTakesOver) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA_1K, SIM_MOTA_1K_LEN, manifest));
  OtaManager client;
  OtaStoreRam<4096> store;
  CapturedMessages sent;
  client.begin(SIM_TARGET_ID, capture_send, &sent);
  client.set_transport_deflate_decoder(ota_transport_inflate);
  client.set_fetch_store(&store);
  client.set_clock(100);
  client.pull(manifest.merkle_root, manifest.target_id);
  sent.items.clear();
  deliver_manifest_fragment(client, manifest.merkle_root, 0,
                            manifest.manifest_start, OTA_MF_FRAG);
  deliver_manifest_fragment(client, manifest.merkle_root, 1,
                            manifest.manifest_start + OTA_MF_FRAG,
                            (uint16_t)(MOTA_MFL - OTA_MF_FRAG));

  uint8_t body[OTA_DATA_V2_STREAM_ID_BYTES + OTA_FRAG_DATA_V2];
  mh4(body, manifest.payload, manifest.block_size());
  memcpy(body + OTA_DATA_V2_STREAM_ID_BYTES, manifest.payload, OTA_FRAG_DATA_V2);
  DataMsg partial{};
  memcpy(partial.manifest_id, manifest.merkle_root, 4);
  partial.block_idx = 0;
  ASSERT_TRUE(ota_data_v2_pack(0, (uint16_t)manifest.block_size(), false, partial.frag_off));
  partial.data = body;
  partial.data_len = sizeof(body);
  uint8_t wire[MAX_PACKET_PAYLOAD];
  uint16_t wire_len = encode_data(wire, sizeof(wire), partial);
  ASSERT_EQ(wire_len, MAX_PACKET_PAYLOAD);
  ASSERT_TRUE(client.on_message(wire, wire_len));

  sent.items.clear();
  uint32_t now = 100;
  uint32_t timeout = client.fetchRetryTimeoutMs();
  now += timeout;
  client.set_clock(now);
  client.loop();                                            // one sparse v2 retry
  ASSERT_FALSE(sent.items.empty());
  ReqMsg retry{};
  ASSERT_TRUE(decode_req(sent.items.back().data(), (uint16_t)sent.items.back().size(), retry));
  EXPECT_TRUE(ota_req_is_v2(retry.want_mask));

  sent.items.clear();
  timeout = client.fetchRetryTimeoutMs();
  now += timeout;
  client.set_clock(now);
  client.loop();                                            // bounded whole-session legacy fallback
  ASSERT_FALSE(sent.items.empty());
  ReqMsg fallback{};
  ASSERT_TRUE(decode_req(sent.items.back().data(), (uint16_t)sent.items.back().size(), fallback));
  EXPECT_FALSE(ota_req_is_v2(fallback.want_mask));
  EXPECT_EQ(fallback.want_mask, 0x007Fu);

  deliver_verified_block(client, manifest, 0);              // an old seeder can now make forward progress
  EXPECT_EQ(client.blocksHave(), 1u);
}

TEST(OtaTransfer, FailedTwoKilobyteInflateRetriesRawWithoutLeavingExtendedV2) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA_2K, SIM_MOTA_2K_LEN, manifest));
  ASSERT_EQ(manifest.block_size(), 2048u);
  ASSERT_EQ(manifest.block_count, 2u);

  OtaManager client;
  OtaStoreRam<4096> store;
  CapturedMessages sent;
  RejectWireDecode decoder{};
  client.begin(SIM_TARGET_ID, capture_send, &sent);
  client.set_transport_deflate_decoder(reject_wire_decode, &decoder);
  client.set_fetch_store(&store);
  client.set_clock(100);
  ASSERT_EQ(client.pull(manifest.merkle_root, manifest.target_id), OtaManager::PULL_STARTED);
  sent.items.clear();
  deliver_manifest_fragment(client, manifest.merkle_root, 0,
                            manifest.manifest_start, OTA_MF_FRAG);
  deliver_manifest_fragment(client, manifest.merkle_root, 1,
                            manifest.manifest_start + OTA_MF_FRAG,
                            (uint16_t)(MOTA_MFL - OTA_MF_FRAG));
  ASSERT_EQ(sent.items.size(), 1u);
  ReqMsg first{};
  ASSERT_TRUE(decode_req(sent.items[0].data(),
                         (uint16_t)sent.items[0].size(), first));
  EXPECT_TRUE(ota_req_is_v2(first.want_mask));
  EXPECT_TRUE(ota_req_v2_extended_length(first.want_mask));
  EXPECT_NE(first.want_mask & OTA_REQ_V2_ALLOW_DEFLATE, 0u);

  sent.items.clear();
  deliver_v2_representation(
      client, manifest, 0,
      SIM_MOTA_2K_DEFLATED + SIM_MOTA_2K_DEFLATED_OFFSETS[0],
      SIM_MOTA_2K_DEFLATED_LENGTHS[0]);
  EXPECT_EQ(decoder.calls, 1u);
  EXPECT_EQ(client.blocksHave(), 0u);
  EXPECT_TRUE(sent.items.empty());                         // retry is paced by the normal deadline

  const uint32_t timeout = client.fetchRetryTimeoutMs();
  client.set_clock(100 + timeout);
  client.loop();
  ASSERT_EQ(sent.items.size(), 1u);
  ReqMsg retry{};
  ASSERT_TRUE(decode_req(sent.items[0].data(),
                         (uint16_t)sent.items[0].size(), retry));
  EXPECT_EQ(retry.block_idx, 0u);
  EXPECT_TRUE(ota_req_is_v2(retry.want_mask));
  EXPECT_TRUE(ota_req_v2_extended_length(retry.want_mask));
  EXPECT_EQ(retry.want_mask & OTA_REQ_V2_ALLOW_DEFLATE, 0u);
  EXPECT_EQ(ota_req_v2_fragments(retry.want_mask), 0x0FFFu);

  sent.items.clear();
  deliver_verified_v2_raw_block(client, manifest, 0);
  ASSERT_EQ(client.blocksHave(), 1u);
  EXPECT_EQ(decoder.calls, 1u);                            // raw v2 bypasses the failed decoder
  ASSERT_EQ(sent.items.size(), 1u);
  ReqMsg next{};
  ASSERT_TRUE(decode_req(sent.items[0].data(),
                         (uint16_t)sent.items[0].size(), next));
  EXPECT_EQ(next.block_idx, 1u);
  EXPECT_TRUE(ota_req_is_v2(next.want_mask));
  EXPECT_TRUE(ota_req_v2_extended_length(next.want_mask));
  EXPECT_EQ(next.want_mask & OTA_REQ_V2_ALLOW_DEFLATE, 0u);

  deliver_verified_v2_raw_block(client, manifest, 1);
  EXPECT_EQ(client.fetchState(), OtaManager::COMPLETE);
  EXPECT_EQ(client.blocksHave(), client.blocksTotal());
  EXPECT_EQ(decoder.calls, 1u);
  ASSERT_EQ(store.staged_size(), SIM_MOTA_2K_LEN);
  EXPECT_EQ(0, memcmp(store.data(), SIM_MOTA_2K, SIM_MOTA_2K_LEN));
}

TEST(OtaTransfer, ConfirmedV2SeederCanDisappearBetweenBlocksAndLegacySeederTakesOver) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA_1K, SIM_MOTA_1K_LEN, manifest));
  ASSERT_GE(manifest.block_count, 2u);
  OtaManager client;
  OtaStoreRam<4096> store;
  CapturedMessages sent;
  client.begin(SIM_TARGET_ID, capture_send, &sent);
  client.set_fetch_store(&store);
  client.set_clock(100);
  client.pull(manifest.merkle_root, manifest.target_id);
  sent.items.clear();
  deliver_manifest_fragment(client, manifest.merkle_root, 0,
                            manifest.manifest_start, OTA_MF_FRAG);
  deliver_manifest_fragment(client, manifest.merkle_root, 1,
                            manifest.manifest_start + OTA_MF_FRAG,
                            (uint16_t)(MOTA_MFL - OTA_MF_FRAG));

  deliver_verified_v2_raw_block(client, manifest, 0);
  ASSERT_EQ(client.blocksHave(), 1u);
  sent.items.clear();                                      // v2 source vanishes before the next flight answers

  uint32_t now = 100;
  uint32_t timeout = client.fetchRetryTimeoutMs();
  now += timeout;
  client.set_clock(now);
  client.loop();                                           // one sparse v2 retry
  ASSERT_EQ(sent.items.size(), 1u);
  ReqWindowMsg retry{};
  ASSERT_TRUE(decode_req_window(sent.items.back().data(),
                                (uint16_t)sent.items.back().size(), retry));
  ASSERT_EQ(retry.n_items, 1u);
  EXPECT_TRUE(ota_req_is_v2(retry.items[0].want_mask));

  sent.items.clear();
  timeout = client.fetchRetryTimeoutMs();
  now += timeout;
  client.set_clock(now);
  client.loop();                                           // whole empty flight falls back to legacy
  ASSERT_EQ(sent.items.size(), 1u);
  ReqWindowMsg fallback{};
  ASSERT_TRUE(decode_req_window(sent.items.back().data(),
                                (uint16_t)sent.items.back().size(), fallback));
  ASSERT_GE(fallback.n_items, 1u);
  for (uint8_t i = 0; i < fallback.n_items; i++) {
    EXPECT_FALSE(ota_req_is_v2(fallback.items[i].want_mask));
  }

  deliver_verified_block(client, manifest, 1);             // deployed source resumes the same session
  EXPECT_EQ(client.blocksHave(), 2u);
}

TEST(OtaTransfer, V2NeverMixesDifferentCompressedRepresentationsAcrossSeeders) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA_1K, SIM_MOTA_1K_LEN, manifest));

  OtaManager client;
  OtaStoreRam<4096> store;
  CapturedMessages sent;
  client.begin(SIM_TARGET_ID, capture_send, &sent);
  client.set_transport_deflate_decoder(test_representation_decode, &manifest);
  client.set_fetch_store(&store);
  client.pull(manifest.merkle_root, manifest.target_id);
  sent.items.clear();
  deliver_manifest_fragment(client, manifest.merkle_root, 0,
                            manifest.manifest_start, OTA_MF_FRAG);
  deliver_manifest_fragment(client, manifest.merkle_root, 1,
                            manifest.manifest_start + OTA_MF_FRAG,
                            (uint16_t)(MOTA_MFL - OTA_MF_FRAG));
  ASSERT_EQ(sent.items.size(), 1u);
  ReqMsg request{};
  ASSERT_TRUE(decode_req(sent.items[0].data(), (uint16_t)sent.items[0].size(), request));
  EXPECT_NE(request.want_mask & OTA_REQ_V2_ALLOW_DEFLATE, 0u);

  std::array<uint8_t, 300> representation_a{};
  std::array<uint8_t, 300> representation_b{};
  representation_a.fill(0xA1);
  representation_b.fill(0xB2);
  uint8_t id_a[4], id_b[4];
  mh4(id_a, representation_a.data(), representation_a.size());
  mh4(id_b, representation_b.data(), representation_b.size());
  ASSERT_NE(0, memcmp(id_a, id_b, sizeof(id_a)));

  auto deliver_fragment = [&](const std::array<uint8_t, 300>& representation,
                              const uint8_t id[4], uint8_t fragment) {
    const uint32_t offset = (uint32_t)fragment * OTA_FRAG_DATA_V2;
    const uint16_t length = (uint16_t)std::min<uint32_t>(OTA_FRAG_DATA_V2,
                                                         representation.size() - offset);
    std::array<uint8_t, OTA_DATA_V2_STREAM_ID_BYTES + OTA_FRAG_DATA_V2> body{};
    memcpy(body.data(), id, OTA_DATA_V2_STREAM_ID_BYTES);
    memcpy(body.data() + OTA_DATA_V2_STREAM_ID_BYTES, representation.data() + offset, length);
    uint16_t descriptor = 0;
    if (!ota_data_v2_pack(fragment, (uint16_t)representation.size(), true, descriptor)) return false;
    DataMsg data;
    memcpy(data.manifest_id, manifest.merkle_root, 4);
    data.block_idx = 0;
    data.frag_off = descriptor;
    data.data = body.data();
    data.data_len = (uint16_t)(OTA_DATA_V2_STREAM_ID_BYTES + length);
    uint8_t wire[MAX_PACKET_PAYLOAD];
    const uint16_t wire_len = encode_data(wire, sizeof(wire), data);
    return wire_len != 0 && client.on_message(wire, wire_len);
  };

  ASSERT_TRUE(deliver_fragment(representation_a, id_a, 0));
  EXPECT_FALSE(deliver_fragment(representation_b, id_b, 1)); // valid stream, wrong representation id
  ASSERT_TRUE(deliver_fragment(representation_a, id_a, 1));

  std::vector<uint8_t> scratch(manifest.block_count * 4);
  uint8_t siblings[32 * 4];
  const uint8_t sibling_count = merkle_gen_proof(
      manifest.leaves, manifest.block_count, 0, scratch.data(), siblings);
  ProofMsg proof;
  memcpy(proof.manifest_id, manifest.merkle_root, 4);
  proof.block_idx = 0;
  proof.n_proof = sibling_count;
  proof.proof = siblings;
  uint8_t proof_wire[MAX_PACKET_PAYLOAD];
  const uint16_t proof_len = encode_proof(proof_wire, sizeof(proof_wire), proof);
  ASSERT_GT(proof_len, 0);
  ASSERT_TRUE(client.on_message(proof_wire, proof_len));
  EXPECT_EQ(client.blocksHave(), 1u);
  const uint32_t payload_offset = (uint32_t)(manifest.payload - SIM_MOTA_1K);
  EXPECT_EQ(0, memcmp(store.data() + payload_offset, manifest.payload, manifest.block_size()));
}

TEST(OtaTransfer, ExtendedCompressedRepresentationReassemblesThroughFragmentEight) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA_2K, SIM_MOTA_2K_LEN, manifest));
  ASSERT_EQ(manifest.block_size(), 2048u);

  std::vector<uint8_t> representation(1500);
  for (uint32_t i = 0; i < representation.size(); i++) {
    representation[i] = (uint8_t)(i * 29u + 7u);
  }
  ASSERT_GT(representation.size(), 1024u);
  ASSERT_LT(representation.size(), manifest.block_size());
  ASSERT_EQ((representation.size() + OTA_FRAG_DATA_V2 - 1) / OTA_FRAG_DATA_V2, 9u);

  SyntheticRepresentationDecode decoder{};
  decoder.representation = representation.data();
  decoder.representation_len = (uint16_t)representation.size();
  decoder.decoded = manifest.payload;
  decoder.decoded_len = (uint16_t)manifest.block_size();

  OtaManager client;
  OtaStoreRam<4096> store;
  CapturedMessages sent;
  client.begin(SIM_TARGET_ID, capture_send, &sent);
  client.set_transport_deflate_decoder(synthetic_representation_decode, &decoder);
  client.set_fetch_store(&store);
  ASSERT_EQ(client.pull(manifest.merkle_root, manifest.target_id), OtaManager::PULL_STARTED);
  sent.items.clear();
  deliver_manifest_fragment(client, manifest.merkle_root, 0,
                            manifest.manifest_start, OTA_MF_FRAG);
  deliver_manifest_fragment(client, manifest.merkle_root, 1,
                            manifest.manifest_start + OTA_MF_FRAG,
                            (uint16_t)(MOTA_MFL - OTA_MF_FRAG));
  ASSERT_EQ(sent.items.size(), 1u);
  ReqMsg request{};
  ASSERT_TRUE(decode_req(sent.items[0].data(),
                         (uint16_t)sent.items[0].size(), request));
  EXPECT_TRUE(ota_req_v2_extended_length(request.want_mask));
  EXPECT_NE(request.want_mask & OTA_REQ_V2_ALLOW_DEFLATE, 0u);

  sent.items.clear();
  deliver_v2_representation(client, manifest, 0,
                            representation.data(), (uint16_t)representation.size());
  EXPECT_EQ(decoder.calls, 1u);                            // fragment 8 completed reassembly + decode
  EXPECT_EQ(client.blocksHave(), 0u);                      // proof still gates the decoded bytes
  EXPECT_TRUE(sent.items.empty());

  deliver_block_proof(client, manifest, 0);
  EXPECT_EQ(client.blocksHave(), 1u);
  const uint32_t payload_offset = (uint32_t)(manifest.payload - SIM_MOTA_2K);
  EXPECT_EQ(0, memcmp(store.data() + payload_offset,
                      manifest.payload, manifest.block_size()));
}

TEST(OtaTransfer, NewClientFallsBackWhenLegacySourceServesOnlyFirstWindowRow) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA_1K, SIM_MOTA_1K_LEN, manifest));
  ASSERT_EQ(manifest.block_count, 3u);

  OtaManager client;
  OtaStoreRam<4096> store;
  CapturedMessages sent;
  client.begin(SIM_TARGET_ID, capture_send, &sent);
  client.set_fetch_store(&store);
  client.set_clock(100);
  client.pull(manifest.merkle_root, manifest.target_id);
  sent.items.clear();
  deliver_manifest_fragment(client, manifest.merkle_root, 0,
                            manifest.manifest_start, OTA_MF_FRAG);
  deliver_manifest_fragment(client, manifest.merkle_root, 1,
                            manifest.manifest_start + OTA_MF_FRAG,
                            (uint16_t)(MOTA_MFL - OTA_MF_FRAG));
  deliver_verified_block(client, manifest, 0);
  ASSERT_EQ(sent.items.size(), 2u);

  // Legacy decode sees and serves only row zero (block 1) from the new two-row request.
  ReqMsg legacy{};
  ASSERT_TRUE(decode_req(sent.items.back().data(),
                         (uint16_t)sent.items.back().size(), legacy));
  ASSERT_EQ(legacy.block_idx, 1);
  deliver_verified_block(client, manifest, legacy.block_idx);
  ASSERT_EQ(client.blocksHave(), 2u);
  ASSERT_EQ(sent.items.size(), 2u);                       // block 2 remains reserved; no immediate refill

  const uint32_t timeout = client.fetchRetryTimeoutMs();
  client.set_clock(100 + timeout);
  client.loop();                                         // tail row was not served: recover it conventionally
  ASSERT_EQ(sent.items.size(), 3u);
  EXPECT_EQ(sent.items.back().size(), 9u);                // exact legacy single-row OTA_REQ
  ReqMsg fallback{};
  ASSERT_TRUE(decode_req(sent.items.back().data(),
                         (uint16_t)sent.items.back().size(), fallback));
  EXPECT_EQ(fallback.block_idx, 2);

  deliver_verified_block(client, manifest, 2);
  EXPECT_EQ(client.fetchState(), OtaManager::COMPLETE);
  EXPECT_EQ(client.blocksHave(), 3u);
}

#if OTA_FETCH_PIPELINE >= 3
TEST(OtaTransfer, RequestFlightGrowsOnCleanFlightsAndHalvesAfterRecovery) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA, SIM_MOTA_LEN, manifest));
  ASSERT_GE(manifest.block_count, 7u);

  OtaManager client;
  OtaStoreRam<4096> store;
  CapturedMessages sent;
  client.begin(SIM_TARGET_ID, capture_send, &sent);
  client.set_fetch_store(&store);
  client.set_clock(100);
  client.pull(manifest.merkle_root, manifest.target_id);
  ASSERT_EQ(client.fetchPipelineCapacity(), 4u);
  sent.items.clear();
  deliver_manifest_fragment(client, manifest.merkle_root, 0,
                            manifest.manifest_start, OTA_MF_FRAG);
  deliver_manifest_fragment(client, manifest.merkle_root, 1,
                            manifest.manifest_start + OTA_MF_FRAG,
                            (uint16_t)(MOTA_MFL - OTA_MF_FRAG));
  ASSERT_EQ(client.fetchPipelineWidth(), 1u);
  ASSERT_EQ(sent.items.size(), 1u);

  deliver_verified_block(client, manifest, 0);            // clean width-1 flight -> width 2
  ASSERT_EQ(client.fetchPipelineWidth(), 2u);
  ASSERT_EQ(sent.items.size(), 2u);
  ReqWindowMsg width2{};
  ASSERT_TRUE(decode_req_window(sent.items.back().data(),
                                (uint16_t)sent.items.back().size(), width2));
  ASSERT_EQ(width2.n_items, 2u);

  deliver_verified_block(client, manifest, 1);
  EXPECT_EQ(client.fetchPipelineWidth(), 2u);              // still waiting for the same flight's block 2
  EXPECT_EQ(sent.items.size(), 2u);                        // receiver remains silent
  deliver_verified_block(client, manifest, 2);            // clean width-2 flight -> width 3
  EXPECT_EQ(client.fetchPipelineWidth(), 3u);
  ASSERT_EQ(sent.items.size(), 3u);
  ReqWindowMsg width3{};
  ASSERT_TRUE(decode_req_window(sent.items.back().data(),
                                (uint16_t)sent.items.back().size(), width3));
  ASSERT_EQ(width3.n_items, 3u);
  EXPECT_EQ(width3.items[0].block_idx, 3);

  // Ordinary one-second maintenance ticks do nothing until the flight's calculated service time expires.
  const uint32_t timeout = client.fetchRetryTimeoutMs();
  client.set_clock(100 + timeout - 1);
  client.loop();
  EXPECT_EQ(sent.items.size(), 3u);
  EXPECT_EQ(client.fetchPipelineWidth(), 3u);

  client.set_clock(100 + timeout);
  client.loop();                                           // recover one slot with a legacy single-row REQ
  ASSERT_EQ(sent.items.size(), 4u);
  ReqMsg recovery{};
  ASSERT_TRUE(decode_req(sent.items.back().data(),
                         (uint16_t)sent.items.back().size(), recovery));
  EXPECT_EQ(recovery.block_idx, 3);
  EXPECT_EQ(client.fetchPipelineWidth(), 3u);              // resize only after this flight drains

  deliver_verified_block(client, manifest, 3);
  deliver_verified_block(client, manifest, 4);
  deliver_verified_block(client, manifest, 5);
  EXPECT_EQ(client.fetchPipelineWidth(), 2u);
}
#endif

TEST(OtaTransfer, FlightRetriesOnlyMissingFragmentsAfterItsDeadline) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA_1K, SIM_MOTA_1K_LEN, manifest));

  OtaManager client;
  OtaStoreRam<4096> store;
  CapturedMessages sent;
  client.begin(SIM_TARGET_ID, capture_send, &sent);
  client.set_fetch_store(&store);
  client.set_clock(100);
  client.pull(manifest.merkle_root, manifest.target_id);
  sent.items.clear();
  deliver_manifest_fragment(client, manifest.merkle_root, 0,
                            manifest.manifest_start, OTA_MF_FRAG);
  deliver_manifest_fragment(client, manifest.merkle_root, 1,
                            manifest.manifest_start + OTA_MF_FRAG,
                            (uint16_t)(MOTA_MFL - OTA_MF_FRAG));
  ASSERT_EQ(sent.items.size(), 1u);                       // conservative one-block probe flight

  DataMsg first_fragment;
  memcpy(first_fragment.manifest_id, manifest.merkle_root, 4);
  first_fragment.block_idx = 0;
  first_fragment.frag_off = 0;
  first_fragment.data = manifest.payload;
  first_fragment.data_len = OTA_FRAG_DATA;
  uint8_t wire[MAX_PACKET_PAYLOAD];
  uint16_t wire_len = encode_data(wire, sizeof(wire), first_fragment);
  ASSERT_GT(wire_len, 0);
  client.on_message(wire, wire_len);

  const uint32_t timeout = client.fetchRetryTimeoutMs();
  client.set_clock(100 + timeout - 1);
  client.loop();                                         // no premature fixed-tick retry
  EXPECT_EQ(sent.items.size(), 1u);
  client.set_clock(100 + timeout);
  client.loop();                                         // deadline: retry only block 0's holes
  ASSERT_EQ(sent.items.size(), 2u);
  ReqMsg retry0;
  ASSERT_TRUE(decode_req(sent.items[1].data(), (uint16_t)sent.items[1].size(), retry0));
  EXPECT_EQ(retry0.block_idx, 0);
  EXPECT_EQ(retry0.want_mask, (uint16_t)(0x007F & ~0x0001));

  client.set_clock(100 + timeout * 2 - 1);
  client.loop();                                         // the recovery request restarted the deadline
  EXPECT_EQ(sent.items.size(), 2u);
}

TEST(OtaTransfer, RetryTimingAdaptsToRadioPathAndAirtimeBudget) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA_1K, SIM_MOTA_1K_LEN, manifest));

  OtaManager client;
  OtaStoreRam<4096> store;
  CapturedMessages sent;
  client.begin(SIM_TARGET_ID, capture_send, &sent);
  client.set_fetch_store(&store);
  client.set_clock(100);
  client.set_max_hops(0);
  client.set_link_timing(100, 2000);                      // direct response fits the conservative quiet floor
  client.pull(manifest.merkle_root, manifest.target_id);
  sent.items.clear();
  deliver_manifest_fragment(client, manifest.merkle_root, 0,
                            manifest.manifest_start, OTA_MF_FRAG);
  deliver_manifest_fragment(client, manifest.merkle_root, 1,
                            manifest.manifest_start + OTA_MF_FRAG,
                            (uint16_t)(MOTA_MFL - OTA_MF_FRAG));
  const uint32_t fast_direct = client.fetchRetryTimeoutMs();
  EXPECT_GE(fast_direct, (uint32_t)OTA_FETCH_RETRY_MIN_MS);

  client.set_max_hops(2);                                // no observed reply path: budget source + 2 relays
  const uint32_t fast_relayed = client.fetchRetryTimeoutMs();
  EXPECT_GT(fast_relayed, fast_direct);

  client.set_link_timing(200, 2000);                      // half the bandwidth doubles packet airtime
  const uint32_t slower_radio = client.fetchRetryTimeoutMs();
  EXPECT_GT(slower_radio, fast_relayed);

  client.set_link_timing(200, 3000);                      // a 1/3-duty node needs more service time
  EXPECT_GT(client.fetchRetryTimeoutMs(), slower_radio);
  EXPECT_GT(client.proofGraceMs(), (uint32_t)OTA_PROOF_GRACE_MS);
}

TEST(OtaTransfer, RejectsShortNonFinalManifestFragment) {
  g_q.clear();
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA, SIM_MOTA_LEN, manifest));

  OtaManager client;
  OtaStoreRam<4096> store;
  SendTo to_none{&client};
  client.begin(SIM_TARGET_ID, sim_send, &to_none);
  client.set_fetch_store(&store);
  client.pull(manifest.merkle_root, manifest.target_id);
  g_q.clear();

  const uint8_t* bytes = manifest.manifest_start;
  const uint16_t final_len = (uint16_t)(MOTA_MFL - OTA_MF_FRAG);
  deliver_manifest_fragment(client, manifest.merkle_root, 1, bytes + OTA_MF_FRAG, final_len);
  deliver_manifest_fragment(client, manifest.merkle_root, 0, bytes, OTA_MF_FRAG - 1);
  EXPECT_EQ(client.fetchState(), OtaManager::WANT_MANIFEST);

  deliver_manifest_fragment(client, manifest.merkle_root, 0, bytes, OTA_MF_FRAG);
  EXPECT_EQ(client.fetchState(), OtaManager::FETCHING);
}

TEST(OtaTransfer, RejectsManifestBlockExponentBeforeShift) {
  g_q.clear();
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA, SIM_MOTA_LEN, manifest));
  std::array<uint8_t, MOTA_MFL> bytes;
  memcpy(bytes.data(), manifest.manifest_start, bytes.size());
  bytes[19] = 32;

  OtaManager client;
  OtaStoreRam<4096> store;
  SendTo to_none{&client};
  client.begin(SIM_TARGET_ID, sim_send, &to_none);
  client.set_fetch_store(&store);
  client.pull(manifest.merkle_root, manifest.target_id);
  g_q.clear();

  deliver_manifest_fragment(client, manifest.merkle_root, 0, bytes.data(), OTA_MF_FRAG);
  deliver_manifest_fragment(client, manifest.merkle_root, 1, bytes.data() + OTA_MF_FRAG,
                            (uint16_t)(MOTA_MFL - OTA_MF_FRAG));
  EXPECT_EQ(client.fetchState(), OtaManager::FAILED);
}

TEST(OtaTransfer, RejectsUnsupportedManifestHashAlgorithm) {
  g_q.clear();
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA, SIM_MOTA_LEN, manifest));
  std::array<uint8_t, MOTA_MFL> bytes;
  memcpy(bytes.data(), manifest.manifest_start, bytes.size());
  bytes[2] = HASH_ALGO_SHA256 + 1;

  OtaManager client;
  OtaStoreRam<4096> store;
  SendTo to_none{&client};
  client.begin(SIM_TARGET_ID, sim_send, &to_none);
  client.set_fetch_store(&store);
  client.pull(manifest.merkle_root, manifest.target_id);
  g_q.clear();

  deliver_manifest_fragment(client, manifest.merkle_root, 0, bytes.data(), OTA_MF_FRAG);
  deliver_manifest_fragment(client, manifest.merkle_root, 1, bytes.data() + OTA_MF_FRAG,
                            (uint16_t)(MOTA_MFL - OTA_MF_FRAG));
  EXPECT_EQ(client.fetchState(), OtaManager::FAILED);
}

TEST(OtaTransfer, RejectsEnvelopeMidThatDoesNotMatchParsedManifestRootBeforeStaging) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA, SIM_MOTA_LEN, manifest));
  std::array<uint8_t, MOTA_MFL> bytes;
  memcpy(bytes.data(), manifest.manifest_start, bytes.size());
  bytes[20] ^= 0x80;  // parsed merkle_root; the peer keeps the requested MID in the wire envelope

  OtaManager client;
  OtaStoreRam<4096> store;
  CapturedMessages sent;
  client.begin(SIM_TARGET_ID, capture_send, &sent);
  client.set_fetch_store(&store);
  ASSERT_EQ(client.pull(manifest.merkle_root, manifest.target_id), OtaManager::PULL_STARTED);

  deliver_manifest_fragment(client, manifest.merkle_root, 0, bytes.data(), OTA_MF_FRAG);
  deliver_manifest_fragment(client, manifest.merkle_root, 1, bytes.data() + OTA_MF_FRAG,
                            (uint16_t)(MOTA_MFL - OTA_MF_FRAG));
  EXPECT_EQ(client.fetchState(), OtaManager::FAILED);
  EXPECT_EQ(client.fetchError(), OtaManager::FETCH_ERROR_MANIFEST);
  EXPECT_EQ(store.staged_size(), 0u);
}

TEST(OtaTransfer, RejectsParsedManifestTargetThatDoesNotMatchRequestedCatalogTargetBeforeStaging) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA, SIM_MOTA_LEN, manifest));
  std::array<uint8_t, MOTA_MFL> bytes;
  memcpy(bytes.data(), manifest.manifest_start, bytes.size());
  wr_u32le(bytes.data() + 3, manifest.target_id ^ 0x01000000u);

  OtaManager client;
  OtaStoreRam<4096> store;
  CapturedMessages sent;
  client.begin(SIM_TARGET_ID, capture_send, &sent);
  client.set_fetch_store(&store);
  ASSERT_EQ(client.pull(manifest.merkle_root, manifest.target_id), OtaManager::PULL_STARTED);

  deliver_manifest_fragment(client, manifest.merkle_root, 0, bytes.data(), OTA_MF_FRAG);
  deliver_manifest_fragment(client, manifest.merkle_root, 1, bytes.data() + OTA_MF_FRAG,
                            (uint16_t)(MOTA_MFL - OTA_MF_FRAG));
  EXPECT_EQ(client.fetchState(), OtaManager::FAILED);
  EXPECT_EQ(client.fetchError(), OtaManager::FETCH_ERROR_MANIFEST);
  EXPECT_EQ(store.staged_size(), 0u);
}

// Same end-to-end transfer, but with 1 KB logical blocks: each block is delivered as several
// self-describing DATA fragments (frag_off), reassembled by the client, then its merkle PROOF is
// requested + verified separately before the block is committed. Exercises the multi-fragment path.
TEST(OtaTransfer, MultiFragmentBlocks) {
  g_q.clear();
  OtaManager server, client;
  OtaStoreRam<4096> store;
  SendTo to_client{&client}, to_server{&server};

  server.begin(0, sim_send, &to_client);
  client.begin(SIM_TARGET_ID, sim_send, &to_server);
  client.set_fetch_store(&store);
  client.set_autofetch(OtaManager::AUTOFETCH_ANY);

  ASSERT_TRUE(server.serve(SIM_MOTA_1K, SIM_MOTA_1K_LEN));
  server.announce();

  pump(client, &server);

  EXPECT_EQ(client.fetchState(), OtaManager::COMPLETE);
  EXPECT_EQ(client.blocksTotal(), SIM_MOTA_1K_BLOCKS);   // 1 KB blocks => fewer, larger blocks
  EXPECT_EQ(client.blocksHave(), client.blocksTotal());

  ASSERT_EQ(store.staged_size(), SIM_MOTA_1K_LEN);
  EXPECT_EQ(0, std::memcmp(store.data(), SIM_MOTA_1K, SIM_MOTA_1K_LEN));
  MotaManifest m;
  ASSERT_TRUE(mota_parse(store.data(), store.staged_size(), m));
  EXPECT_TRUE(mota_check_root(m));
  EXPECT_TRUE(mota_check_image_hash_full(m));
}

// Multi-mota folder serve: a node serves its OWN fw (view0) PLUS an external folder (RamMotaSource) of
// other `.mota`. Peers discover BOTH via the tiny beacon -> query -> broadcast HAVE catalog, then fetch an
// external mota end-to-end. The relaying node never holds the folder image in RAM - it streams the
// manifest/leaves/blocks from the source on demand (loadSource + srcReadTramp + proof-gen from read
// leaves). The fetched bytes must equal the original `.mota` (proves the trustless relay is byte-exact).
TEST(OtaFolder, ServesSelfPlusFolderAndFetchesExternal) {
  g_q.clear();
  OtaManager server, client;
  OtaStoreRam<4096> store;
  SendTo to_client{&client}, to_server{&server};

  server.begin(/*own target irrelevant for serving*/ 0, sim_send, &to_client);
  uint8_t srv_id[4] = {0xAB, 0xCD, 0xEF, 0x01}; server.set_seeder_id(srv_id);
  client.begin(SIM_TARGET_ID, sim_send, &to_server);
  client.set_fetch_store(&store);

  MotaManifest mSelf, mExt;
  ASSERT_TRUE(mota_parse(SIM_MOTA,    SIM_MOTA_LEN,    mSelf));   // served as our own fw (view0)
  ASSERT_TRUE(mota_parse(SIM_MOTA_1K, SIM_MOTA_1K_LEN, mExt));    // served from the external folder

  ASSERT_TRUE(server.serve(SIM_MOTA, SIM_MOTA_LEN));             // entry 0 = self
  static RamMotaSource folder;
  folder.add(SIM_MOTA_1K, SIM_MOTA_1K_LEN);                      // an external image (different mid)
  folder.add(SIM_MOTA, SIM_MOTA_LEN);                            // same as self -> must be DEDUPED
  ASSERT_TRUE(server.add_source(&folder));
  EXPECT_EQ(server.servedCount(), 2);                           // self + 1 distinct folder mota (dedup)

  // discovery: beacon -> the client catalogs the source, queries it, and the broadcast HAVE fills the
  // catalog with BOTH served mids.
  server.announce();
  pump(client, &server);
  client.queryAll();
  pump(client, &server);
  EXPECT_EQ(client.catalogCount(), 2);

  // fetch the EXTERNAL (folder) mota by mid -> served via the source, relayed block-by-block.
  client.pull(mExt.merkle_root, mExt.target_id);
  pump(client, &server);

  EXPECT_EQ(client.fetchState(), OtaManager::COMPLETE);
  EXPECT_EQ(client.blocksHave(), client.blocksTotal());
  ASSERT_EQ(store.staged_size(), SIM_MOTA_1K_LEN);
  EXPECT_EQ(0, std::memcmp(store.data(), SIM_MOTA_1K, SIM_MOTA_1K_LEN));   // byte-exact relay
  MotaManifest got;
  ASSERT_TRUE(mota_parse(store.data(), store.staged_size(), got));
  EXPECT_TRUE(mota_check_root(got));
  EXPECT_TRUE(mota_check_image_hash_full(got));
}

TEST(OtaFolder, OldHostCapabilityZeroSkipsUnsupportedDeflateOperation) {
  g_q.clear();
  OtaManager server, client;
  OtaStoreRam<4096> store;
  SendTo to_client{&client}, to_server{&server};
  server.begin(0, sim_send, &to_client);
  client.begin(SIM_TARGET_ID, sim_send, &to_server);
  client.set_transport_deflate_decoder(ota_transport_inflate);
  client.set_fetch_store(&store);

  RamMotaSource old_host;
  old_host.add(SIM_MOTA_1K, SIM_MOTA_1K_LEN);
  old_host.setSourceCaps(0);                                // deployed descriptor's reserved byte
  ASSERT_TRUE(server.add_source(&old_host));
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA_1K, SIM_MOTA_1K_LEN, manifest));

  server.announce();
  pump(client, &server);
  client.pull(manifest.merkle_root, manifest.target_id);
  pump(client, &server);

  EXPECT_EQ(client.fetchState(), OtaManager::COMPLETE);
  EXPECT_EQ(old_host.deflateCalls(), 0u);                   // no per-block timeout on unknown op 0x09
  ASSERT_EQ(store.staged_size(), SIM_MOTA_1K_LEN);
  EXPECT_EQ(0, memcmp(store.data(), SIM_MOTA_1K, SIM_MOTA_1K_LEN));
}

TEST(OtaCatalog, QueryCanRequestOnlyMissingHaveFragment) {
  OtaManager server;
  CapturedMessages sent;
  uint8_t sid[4] = {0x10, 0x20, 0x30, 0x40};
  server.begin(0, capture_send, &sent);
  server.set_seeder_id(sid);
  SyntheticCatalogSource source(12);                 // 10 rows/fragment => two HAVE fragments
  ASSERT_TRUE(server.add_source(&source));
  ASSERT_EQ(server.servedCount(), 12);

  QueryMsg query{};
  memcpy(query.seeder_id, sid, 4);
  query.want_fragments = 1UL << 1;                   // recover only fragment 1
  uint8_t wire[32];
  uint16_t n = encode_query(wire, sizeof(wire), query);
  ASSERT_GT(n, 0);
  server.on_message(wire, n);

  ASSERT_EQ(sent.items.size(), 1u);
  HaveMsg have;
  ASSERT_TRUE(decode_have(sent.items[0].data(), (uint16_t)sent.items[0].size(), have));
  EXPECT_EQ(have.frag_idx, 1);
  EXPECT_EQ(have.frag_total, 2);
  EXPECT_EQ(have.n_rows, 2);
}

TEST(OtaCatalog, IncompleteCatalogRetriesOnlyMissingFragment) {
  OtaManager client;
  CapturedMessages sent;
  client.begin(SIM_TARGET_ID, capture_send, &sent);
  client.set_archive_interest(true);
  uint8_t sid[4] = {0x44, 0x33, 0x22, 0x11};
  uint8_t digest[4] = {0xDE, 0xAD, 0xBE, 0xEF};
  AdvMsg adv{}; memcpy(adv.seeder_id, sid, 4); memcpy(adv.set_digest, digest, 4); adv.n_motas = 3;
  uint8_t wire[MAX_PACKET_PAYLOAD];
  uint16_t n = encode_adv(wire, sizeof(wire), adv);
  client.set_clock(100);
  client.on_message(wire, n);
  client.set_clock(5000);                            // past every possible discovery jitter
  client.loop();
  ASSERT_EQ(sent.items.size(), 1u);
  QueryMsg first;
  ASSERT_TRUE(decode_query(sent.items[0].data(), (uint16_t)sent.items[0].size(), first));
  EXPECT_EQ(first.want_fragments, 0u);
  sent.items.clear();

  auto deliver_have = [&](uint8_t frag) {
    uint8_t row[OTA_HAVE_ROW_BYTES] = {0};
    row[0] = (uint8_t)(frag + 1); row[1] = 0x77;
    wr_u32le(row + 4, SIM_TARGET_ID); wr_u32le(row + 8, 0x01000000u + frag);
    row[12] = CODEC_FULL; row[13] = MFLAG_FULL; row[14] = 1;
    HaveMsg have{};
    memcpy(have.seeder_id, sid, 4); memcpy(have.set_digest, digest, 4);
    have.frag_idx = frag; have.frag_total = 3; have.n_rows = 1; have.rows = row;
    uint16_t have_len = encode_have(wire, sizeof(wire), have);
    ASSERT_GT(have_len, 0);
    client.on_message(wire, have_len);
  };

  deliver_have(0);
  deliver_have(2);                                   // fragment 1 is lost
  client.set_clock(5000 + OTA_CATALOG_RETRY_MS + 1);
  client.loop();
  ASSERT_EQ(sent.items.size(), 1u);
  QueryMsg retry;
  ASSERT_TRUE(decode_query(sent.items[0].data(), (uint16_t)sent.items[0].size(), retry));
  EXPECT_EQ(retry.want_fragments, 1UL << 1);
  sent.items.clear();

  deliver_have(1);
  EXPECT_EQ(client.catalogCount(), 3);
  client.set_clock(5000 + OTA_CATALOG_RETRY_MS * 2 + 2);
  client.loop();
  EXPECT_TRUE(sent.items.empty());                    // complete means no further catalog retries
}

TEST(OtaCatalog, RetainsProtocolMaximumRows) {
  OtaManager client;
  client.begin(SIM_TARGET_ID, nullptr, nullptr);
  const uint8_t per = (uint8_t)((MAX_PACKET_PAYLOAD - 12) / OTA_HAVE_ROW_BYTES);
  const uint8_t total = (uint8_t)((255 + per - 1) / per);
  uint8_t sid[4] = {1, 2, 3, 4}, digest[4] = {5, 6, 7, 8};
  uint16_t index = 0;
  for (uint8_t frag = 0; frag < total; frag++) {
    uint8_t rows[MAX_PACKET_PAYLOAD] = {0};
    uint8_t count = 0;
    while (count < per && index < 255) {
      uint8_t* row = rows + (uint16_t)count * OTA_HAVE_ROW_BYTES;
      row[0] = (uint8_t)index; row[1] = 0xC1; row[2] = 0xD2; row[3] = 0xE3;
      wr_u32le(row + 4, SIM_TARGET_ID); wr_u32le(row + 8, 0x01000000u + index);
      row[12] = CODEC_FULL; row[13] = MFLAG_FULL; row[14] = 1;
      count++; index++;
    }
    HaveMsg have{};
    memcpy(have.seeder_id, sid, 4); memcpy(have.set_digest, digest, 4);
    have.frag_idx = frag; have.frag_total = total; have.n_rows = count; have.rows = rows;
    uint8_t wire[MAX_PACKET_PAYLOAD];
    uint16_t n = encode_have(wire, sizeof(wire), have);
    ASSERT_GT(n, 0);
    client.on_message(wire, n);
  }
  ASSERT_EQ(client.catalogCount(), 255);
  ASSERT_NE(client.catalogRow(254), nullptr);
  EXPECT_EQ(client.catalogRow(254)->mid[0], 254);
}

TEST(OtaCatalog, RejectsAdvertisedSourceWithOversizedBlocks) {
  OtaManager server;
  server.begin(0, nullptr, nullptr);
  SyntheticCatalogSource source(1, 12);              // 4096-byte blocks exceed OTA_MAX_BLOCK
  ASSERT_TRUE(server.add_source(&source));
  EXPECT_EQ(server.servedCount(), 0);
}

TEST(OtaFolder, ReportsEntriesOmittedByServeRegistryCapacity) {
  OtaManager server;
  server.begin(0, nullptr, nullptr);
  ASSERT_TRUE(server.serve(SIM_MOTA, SIM_MOTA_LEN));
  SyntheticCatalogSource source((uint8_t)(OTA_MAX_SERVE + 3));
  ASSERT_TRUE(server.add_source(&source));

  uint16_t offered = 0, advertised = 0;
  ASSERT_TRUE(server.sourceStats(&source, offered, advertised));
  EXPECT_EQ(offered, (uint16_t)(OTA_MAX_SERVE + 3));
  EXPECT_EQ(advertised, (uint16_t)(OTA_MAX_SERVE - 1)); // primary image occupies slot zero
  EXPECT_EQ(server.servedCount(), OTA_MAX_SERVE);
}

// Fetch-resume across a reboot: a client commits some blocks, "reboots" (a fresh OtaManager on the SAME
// persisted store), and resumeStaged() re-adopts the partial container and finishes the remaining blocks -
// without re-fetching the manifest or the blocks already present.
TEST(OtaTransfer, ResumeAfterReboot) {
  g_q.clear();
  OtaManager server, client;
  OtaStoreRam<4096> store;
  SendTo to_client{&client}, to_server{&server};

  server.begin(0, sim_send, &to_client);
  client.begin(SIM_TARGET_ID, sim_send, &to_server);
  client.set_fetch_store(&store);
  client.set_autofetch(OtaManager::AUTOFETCH_ANY);

  ASSERT_TRUE(server.serve(SIM_MOTA_1K, SIM_MOTA_1K_LEN));
  server.announce();

  // drive only until the first block commits, then "crash"
  int idle = 0, guard = 0;
  while (guard++ < 100000) {
    server.serviceEgress();
    client.serviceEgress();
    if (!g_q.empty()) {
      SimMsg msg = std::move(g_q.front()); g_q.erase(g_q.begin());
      msg.dest->on_message(msg.bytes.data(), (uint16_t)msg.bytes.size());
      idle = 0;
    } else {
      g_clk += 5000;
      client.set_clock(g_clk); client.loop(); client.serviceEgress();
      server.set_clock(g_clk); server.loop(); server.serviceEgress();
      if (!g_q.empty()) { idle = 0; } else if (++idle >= 2) break;
    }
    if (client.blocksHave() >= 1) break;
  }
  ASSERT_GE(client.blocksHave(), 1u);
  ASSERT_LT(client.blocksHave(), client.blocksTotal());     // genuinely partial
  uint32_t had = client.blocksHave();
  g_q.clear();                                              // in-flight packets are lost in the "reboot"

  // "reboot": a brand-new manager on the SAME store (its bytes survived) resumes the partial
  OtaManager client2;
  to_client.dest = &client2;                                // server now replies to the rebooted client
  SendTo to_server2{&server};
  client2.begin(SIM_TARGET_ID, sim_send, &to_server2);
  client2.set_fetch_store(&store);
  client2.set_autofetch(OtaManager::AUTOFETCH_ANY);
  ASSERT_TRUE(client2.resumeStaged(nullptr));               // adopt whatever is staged
  EXPECT_EQ(client2.fetchState(), OtaManager::VERIFYING_STAGED);
  finish_staged_verification(client2);
  EXPECT_EQ(client2.blocksHave(), had);                     // resumed exactly where we left off
  EXPECT_EQ(client2.fetchState(), OtaManager::FETCHING);
  EXPECT_EQ(client2.blocksTotal(), SIM_MOTA_1K_BLOCKS);

  pump(client2, &server);
  EXPECT_EQ(client2.fetchState(), OtaManager::COMPLETE);
  ASSERT_EQ(store.staged_size(), SIM_MOTA_1K_LEN);
  EXPECT_EQ(0, std::memcmp(store.data(), SIM_MOTA_1K, SIM_MOTA_1K_LEN));   // byte-identical to the original
}

TEST(OtaTransfer, BootResumeHonorsCurrentAutofetchTargetAndVersionPolicy) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA, SIM_MOTA_LEN, manifest));
  ASSERT_TRUE(manifest.is_signed());
  auto stage = [](OtaStoreRam<4096>& store, const uint8_t* bytes,
                  uint32_t length) {
    return store.begin(length) && store.write(0, bytes, length);
  };

  OtaStoreRam<4096> off_store;
  ASSERT_TRUE(stage(off_store, SIM_MOTA, SIM_MOTA_LEN));
  OtaManager off;
  off.begin(manifest.target_id, nullptr, nullptr);
  off.set_fetch_store(&off_store);
  EXPECT_FALSE(off.resumeStaged(nullptr));

  std::vector<uint8_t> unsigned_mota(SIM_MOTA, SIM_MOTA + SIM_MOTA_LEN);
  unsigned_mota[8u + 1u] &= (uint8_t)~MFLAG_SIGNED;
  memset(unsigned_mota.data() + 8u + 97u, 0, 32u + 64u);
  MotaManifest unsigned_manifest;
  ASSERT_TRUE(mota_parse(unsigned_mota.data(),
                         (uint32_t)unsigned_mota.size(), unsigned_manifest));
  ASSERT_FALSE(unsigned_manifest.is_signed());
  OtaStoreRam<4096> unsigned_store;
  ASSERT_TRUE(stage(unsigned_store, unsigned_mota.data(),
                    (uint32_t)unsigned_mota.size()));
  OtaManager signed_only;
  signed_only.begin(manifest.target_id, nullptr, nullptr);
  signed_only.set_fetch_store(&unsigned_store);
  signed_only.set_autofetch(OtaManager::AUTOFETCH_SIGNED);
  signed_only.set_auto_version_floor(manifest.fw_version - 1u, true);
  EXPECT_FALSE(signed_only.resumeStaged(nullptr));

  OtaStoreRam<4096> replay_store;
  ASSERT_TRUE(stage(replay_store, SIM_MOTA, SIM_MOTA_LEN));
  OtaManager replay;
  replay.begin(manifest.target_id, nullptr, nullptr);
  replay.set_fetch_store(&replay_store);
  replay.set_autofetch(OtaManager::AUTOFETCH_ANY);
  replay.set_auto_version_floor(manifest.fw_version, true);
  EXPECT_FALSE(replay.resumeStaged(nullptr));

  OtaStoreRam<4096> wrong_target_store;
  ASSERT_TRUE(stage(wrong_target_store, SIM_MOTA, SIM_MOTA_LEN));
  OtaManager wrong_target;
  wrong_target.begin(manifest.target_id ^ 1u, nullptr, nullptr);
  wrong_target.set_fetch_store(&wrong_target_store);
  wrong_target.set_autofetch(OtaManager::AUTOFETCH_ANY);
  wrong_target.set_auto_version_floor(manifest.fw_version - 1u, true);
  EXPECT_FALSE(wrong_target.resumeStaged(nullptr));

  OtaStoreRam<4096> newer_store;
  ASSERT_TRUE(stage(newer_store, SIM_MOTA, SIM_MOTA_LEN));
  OtaManager newer;
  newer.begin(manifest.target_id, nullptr, nullptr);
  newer.set_fetch_store(&newer_store);
  newer.set_autofetch(OtaManager::AUTOFETCH_SIGNED);
  newer.set_auto_version_floor(manifest.fw_version - 1u, true);
  EXPECT_TRUE(newer.resumeStaged(nullptr));
  EXPECT_EQ(newer.fetchState(), OtaManager::VERIFYING_STAGED);
}

TEST(OtaTransfer, ExplicitResumePreservesTargetZeroWildcard) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA, SIM_MOTA_LEN, manifest));
  auto stage = [](OtaStoreRam<4096>& store) {
    return store.begin(SIM_MOTA_LEN) &&
           store.write(0, SIM_MOTA, SIM_MOTA_LEN);
  };

  OtaStoreRam<4096> manual_store;
  ASSERT_TRUE(stage(manual_store));
  OtaManager manual;
  manual.begin(manifest.target_id ^ 1u, nullptr, nullptr);
  manual.set_fetch_store(&manual_store);
  EXPECT_EQ(manual.pull(manifest.merkle_root, 0), OtaManager::PULL_RESUMED);

  OtaStoreRam<4096> archive_store;
  ASSERT_TRUE(stage(archive_store));
  OtaManager archive;
  archive.begin(manifest.target_id ^ 1u, nullptr, nullptr);
  archive.set_fetch_store(&archive_store);
  EXPECT_EQ(archive.pull_archive(manifest.merkle_root, 0),
            OtaManager::PULL_RESUMED);

  OtaStoreRam<4096> mismatch_store;
  ASSERT_TRUE(stage(mismatch_store));
  OtaManager mismatch;
  mismatch.begin(manifest.target_id, nullptr, nullptr);
  mismatch.set_fetch_store(&mismatch_store);
  EXPECT_EQ(mismatch.pull(manifest.merkle_root, manifest.target_id ^ 1u),
            OtaManager::PULL_STARTED);
  EXPECT_EQ(mismatch.fetchState(), OtaManager::WANT_MANIFEST);
}

TEST(OtaTransfer, ExplicitDebugResumeUsesManualIntentNotAutofetchPolicy) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA, SIM_MOTA_LEN, manifest));
  OtaStoreRam<4096> store;
  ASSERT_TRUE(store.begin(SIM_MOTA_LEN));
  ASSERT_TRUE(store.write(0, SIM_MOTA, SIM_MOTA_LEN));

  // A deliberate debug/operator resume remains possible with autofetch disabled, an equal running
  // version, and a cross-target wildcard. Those same properties are rejected by resumeStaged(nullptr).
  OtaManager explicit_resume;
  explicit_resume.begin(manifest.target_id ^ 1u, nullptr, nullptr);
  explicit_resume.set_fetch_store(&store);
  explicit_resume.set_autofetch(OtaManager::AUTOFETCH_OFF);
  explicit_resume.set_auto_version_floor(manifest.fw_version, true);
  ASSERT_TRUE(explicit_resume.resumeStagedExplicit(manifest.merkle_root, 0));
  EXPECT_EQ(explicit_resume.fetchState(), OtaManager::VERIFYING_STAGED);

  OtaStoreRam<4096> wrong_mid_store;
  ASSERT_TRUE(wrong_mid_store.begin(SIM_MOTA_LEN));
  ASSERT_TRUE(wrong_mid_store.write(0, SIM_MOTA, SIM_MOTA_LEN));
  OtaManager wrong_mid;
  wrong_mid.begin(manifest.target_id, nullptr, nullptr);
  wrong_mid.set_fetch_store(&wrong_mid_store);
  uint8_t other_mid[4];
  memcpy(other_mid, manifest.merkle_root, sizeof(other_mid));
  other_mid[0] ^= 1u;
  EXPECT_FALSE(wrong_mid.resumeStagedExplicit(other_mid, 0));
  EXPECT_EQ(wrong_mid.fetchState(), OtaManager::IDLE);
}

TEST(OtaTransfer, ResumeRehashesPayloadBeforeTrustingPresentLeaf) {
  g_q.clear();
  OtaManager server, client;
  OtaStoreRam<4096> store;
  SendTo to_client{&client}, to_server{&server};
  server.begin(0, sim_send, &to_client);
  client.begin(SIM_TARGET_ID, sim_send, &to_server);
  client.set_fetch_store(&store);
  client.set_autofetch(OtaManager::AUTOFETCH_ANY);
  ASSERT_TRUE(server.serve(SIM_MOTA, SIM_MOTA_LEN));
  server.announce();
  pump(client, &server);
  ASSERT_EQ(client.fetchState(), OtaManager::COMPLETE);

  MotaManifest staged;
  ASSERT_TRUE(mota_parse(store.data(), store.staged_size(), staged));
  const uint32_t payload_offset =
      (uint32_t)(staged.payload - store.data());
  const uint32_t leaves_offset =
      (uint32_t)(staged.leaves - store.data());
  uint8_t damaged = (uint8_t)(staged.payload[0] ^ 0x5A);
  ASSERT_TRUE(store.write(payload_offset, &damaged, 1));

  OtaManager resumed;
  resumed.begin(SIM_TARGET_ID, nullptr, nullptr);
  resumed.set_fetch_store(&store);
  resumed.set_autofetch(OtaManager::AUTOFETCH_ANY);
  ASSERT_TRUE(resumed.resumeStaged(nullptr));
  finish_staged_verification(resumed);
  EXPECT_EQ(resumed.fetchState(), OtaManager::FETCHING);
  EXPECT_EQ(resumed.blocksHave() + 1, resumed.blocksTotal());
  uint8_t marker[4] = {};
  ASSERT_TRUE(store.read(leaves_offset, marker, sizeof(marker)));
  const uint8_t missing[4] = {0xFF, 0xFF, 0xFF, 0xFF};
  EXPECT_EQ(0, std::memcmp(marker, missing, sizeof(marker)));
}

TEST(OtaTransfer, ResumeReadFailureCanNeverBecomeComplete) {
  g_q.clear();
  OtaManager server, client;
  FaultingResumeStore store;
  SendTo to_client{&client}, to_server{&server};
  server.begin(0, sim_send, &to_client);
  client.begin(SIM_TARGET_ID, sim_send, &to_server);
  client.set_fetch_store(&store);
  client.set_autofetch(OtaManager::AUTOFETCH_ANY);
  ASSERT_TRUE(server.serve(SIM_MOTA, SIM_MOTA_LEN));
  server.announce();
  pump(client, &server);
  ASSERT_EQ(client.fetchState(), OtaManager::COMPLETE);

  MotaManifest staged;
  ASSERT_TRUE(mota_parse(store.data(), store.staged_size(), staged));
  store.failReadAt((uint32_t)(staged.leaves - store.data()));

  OtaManager resumed;
  resumed.begin(SIM_TARGET_ID, nullptr, nullptr);
  resumed.set_fetch_store(&store);
  resumed.set_autofetch(OtaManager::AUTOFETCH_ANY);
  ASSERT_TRUE(resumed.resumeStaged(nullptr));
  finish_staged_verification(resumed);
  EXPECT_EQ(resumed.fetchState(), OtaManager::FAILED);
}

TEST(OtaTransfer, ClientRejectsWrongTarget) {
  g_q.clear();
  OtaManager server, client;
  OtaStoreRam<4096> store;
  SendTo to_client{&client}, to_server{&server};
  server.begin(0, sim_send, &to_client);
  client.begin(SIM_TARGET_ID ^ 0x1u, sim_send, &to_server);   // different target -> not interested
  client.set_fetch_store(&store);
  client.set_autofetch(OtaManager::AUTOFETCH_ANY);   // tests exercise fetch-on-advert; policy default is OFF
  ASSERT_TRUE(server.serve(SIM_MOTA, SIM_MOTA_LEN));
  server.announce();
  pump(client, &server);   // catalogs the row but wantRow rejects it (wrong target) -> never fetches
  EXPECT_EQ(client.fetchState(), OtaManager::IDLE);   // never started
}

TEST(OtaTransfer, ManualCrossTargetFetch) {
  // A node whose own target differs from the served firmware normally won't fetch (role-switch case:
  // e.g. companion wanting repeater firmware). An explicit want() override lets it fetch deliberately.
  g_q.clear();
  OtaManager server, client;
  OtaStoreRam<4096> store;
  SendTo to_client{&client}, to_server{&server};
  server.begin(0, sim_send, &to_client);
  client.begin(SIM_TARGET_ID ^ 0xABCDu, sim_send, &to_server);   // DIFFERENT own target
  client.set_fetch_store(&store);
  client.set_autofetch(OtaManager::AUTOFETCH_ANY);   // tests exercise fetch-on-advert; policy default is OFF
  ASSERT_TRUE(server.serve(SIM_MOTA, SIM_MOTA_LEN));

  // without the override: catalogs the row but won't fetch (wrong target)
  server.announce();
  pump(client, &server);
  EXPECT_EQ(client.fetchState(), OtaManager::IDLE);

  // with want(): deliberately fetch the different-target firmware to completion
  client.want(SIM_TARGET_ID);
  server.announce();
  pump(client, &server);
  EXPECT_EQ(client.fetchState(), OtaManager::COMPLETE);
  ASSERT_EQ(store.staged_size(), SIM_MOTA_LEN);
  EXPECT_EQ(0, std::memcmp(store.data(), SIM_MOTA, SIM_MOTA_LEN));
}

// Encode a 1-row OTA_HAVE catalog (the discovery reply a peer acts on).
static uint16_t make_have1(uint8_t* buf, uint16_t cap, const uint8_t mid[4],
                           uint32_t target, uint32_t fwver, uint8_t codec, uint8_t flags) {
  uint8_t row[OTA_HAVE_ROW_BYTES];
  memcpy(row, mid, 4);
  row[4]=target; row[5]=target>>8; row[6]=target>>16; row[7]=target>>24;
  row[8]=fwver; row[9]=fwver>>8; row[10]=fwver>>16; row[11]=fwver>>24;
  row[12]=codec; row[13]=flags;
  row[14]=0; row[15]=0;   // have_count (unused in this 1-row discovery test)
  HaveMsg hv{{0xAA,0xBB,0xCC,0xDD}, {0,0,0,0}, 0, 1, 1, row};
  return encode_have(buf, cap, hv);
}

TEST(OtaTransfer, BootloaderPackageRequiresCapableExplicitMidPull) {
  const auto manifest = boot_manifest_bytes();
  const uint8_t mid[4] = {0x11, 0x22, 0x33, 0x44};
  const uint8_t boot_flags = MFLAG_FULL | MFLAG_SIGNED | MFLAG_BOOTLOADER;
  uint8_t wire[64];

  // Even a capable XIAO must never autofetch a bootloader package. The target is intentionally
  // its exact installed-bootloader board ID, so this proves the manual-MID gate rather than a
  // coincidental target mismatch.
  OtaManager capable;
  OtaStoreRam<45000> capable_store;
  capable.begin(OTA_XIAO_BOARD_ID_BASE, nullptr, nullptr);
  capable.set_fetch_store(&capable_store);
  capable.set_accept_full(false);                    // internal nRF52 app FULL remains forbidden
  capable.set_accept_bootloader(true);
  capable.set_autofetch(OtaManager::AUTOFETCH_ANY);
  capable.on_message(
      wire, make_have1(wire, sizeof(wire), mid, OTA_XIAO_BOARD_ID_BASE, 1,
                       CODEC_FULL, boot_flags));
  EXPECT_EQ(capable.fetchState(), OtaManager::IDLE);
  EXPECT_EQ(capable_store.staged_size(), 0u);

  // Enabling the privileged bootloader path must not broaden the ordinary
  // single-slot application codec policy or turn autofetch on for FULL apps.
  const uint8_t app_mid[4] = {0x21, 0x22, 0x23, 0x24};
  capable.on_message(
      wire, make_have1(wire, sizeof(wire), app_mid, OTA_XIAO_BOARD_ID_BASE, 2,
                       CODEC_FULL, MFLAG_FULL));
  EXPECT_EQ(capable.fetchState(), OtaManager::IDLE);
  EXPECT_EQ(capable_store.staged_size(), 0u);

  // An exact explicit pull admits the strict v3 manifest and opens the store for the 40 KiB payload.
  EXPECT_EQ(capable.pull(mid, OTA_XIAO_BOARD_ID_BASE), OtaManager::PULL_STARTED);
  deliver_manifest_fragment(capable, mid, 0, manifest.data(), OTA_MF_FRAG);
  deliver_manifest_fragment(capable, mid, 1, manifest.data() + OTA_MF_FRAG,
                            (uint16_t)(MOTA_MFL - OTA_MF_FRAG));
  EXPECT_EQ(capable.fetchState(), OtaManager::FETCHING);
  EXPECT_TRUE(capable.fetched_is_bootloader());
  EXPECT_GT(capable_store.staged_size(), OTA_BOOT_IMAGE_SIZE);

  // The same explicit pull is rejected before storage begin when this firmware lacks the privileged
  // capability. This is the manager-layer guard; every apply backend has an independent rejection too.
  OtaManager incapable;
  OtaStoreRam<45000> incapable_store;
  incapable.begin(OTA_XIAO_BOARD_ID_BASE, nullptr, nullptr);
  incapable.set_fetch_store(&incapable_store);
  incapable.set_accept_full(true);
  EXPECT_EQ(incapable.pull(mid, OTA_XIAO_BOARD_ID_BASE), OtaManager::PULL_STARTED);
  deliver_manifest_fragment(incapable, mid, 0, manifest.data(), OTA_MF_FRAG);
  deliver_manifest_fragment(incapable, mid, 1, manifest.data() + OTA_MF_FRAG,
                            (uint16_t)(MOTA_MFL - OTA_MF_FRAG));
  EXPECT_EQ(incapable.fetchState(), OtaManager::FAILED);
  EXPECT_EQ(incapable.fetchError(), OtaManager::FETCH_ERROR_CODEC);
  EXPECT_EQ(incapable_store.staged_size(), 0u);
}

// A node must not fetch firmware it can't apply: a catalog row whose codec the platform can't decode is
// not fetched. Full-image acceptance is platform-selectable (nRF52 single-slot disables it).
TEST(OtaTransfer, RejectsIncompatibleCodec) {
  g_q.clear();
  OtaManager client; OtaStoreRam<4096> store;
  SendTo to_server{&client};                       // dest unused (we only check client state)
  client.begin(SIM_TARGET_ID, sim_send, &to_server);
  client.set_fetch_store(&store);
  client.set_autofetch(OtaManager::AUTOFETCH_ANY);
  client.set_apply_codec(CODEC_DETOOLS_INPLACE);
  client.set_accept_full(false);                   // nRF52-style: in-place delta only
  uint8_t b[64];

  // a SEQUENTIAL delta for our target -> incompatible -> not fetched (stays IDLE)
  uint8_t midA[4] = {1,2,3,4};
  client.on_message(b, make_have1(b, sizeof(b), midA, SIM_TARGET_ID, 0x01000000, CODEC_DETOOLS_SEQUENTIAL, 0));
  EXPECT_EQ(client.fetchState(), OtaManager::IDLE);

  // a FULL image cannot be installed in an nRF52 single slot -> do not spend hours fetching it
  uint8_t midFull[4] = {2,3,4,5};
  client.on_message(b, make_have1(b, sizeof(b), midFull, SIM_TARGET_ID, 0x01000000, CODEC_FULL, MFLAG_FULL));
  EXPECT_EQ(client.fetchState(), OtaManager::IDLE);

  // an IN-PLACE delta for our target -> compatible -> begins fetching (requests the manifest)
  uint8_t midB[4] = {5,6,7,8};
  client.on_message(b, make_have1(b, sizeof(b), midB, SIM_TARGET_ID, 0x01000000, CODEC_DETOOLS_INPLACE, 0));
  EXPECT_EQ(client.fetchState(), OtaManager::WANT_MANIFEST);
  g_q.clear();
}

TEST(OtaTransfer, ManualPullReportsIncompatibleManifestInsteadOfGoingIdle) {
  g_q.clear();
  OtaManager server, client;
  OtaStoreRam<4096> store;
  SendTo to_client{&client}, to_server{&server};
  server.begin(0, sim_send, &to_client);
  client.begin(SIM_TARGET_ID, sim_send, &to_server);
  client.set_fetch_store(&store);
  client.set_apply_codec(CODEC_DETOOLS_INPLACE);
  client.set_accept_full(false);
  ASSERT_TRUE(server.serve(SIM_MOTA, SIM_MOTA_LEN));
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA, SIM_MOTA_LEN, manifest));

  EXPECT_EQ(client.pull(manifest.merkle_root, manifest.target_id), OtaManager::PULL_STARTED);
  pump(client, &server);

  EXPECT_EQ(client.fetchState(), OtaManager::FAILED);
  EXPECT_EQ(client.fetchError(), OtaManager::FETCH_ERROR_CODEC);
  EXPECT_EQ(client.wanted(), 0u);                    // terminal rejection no longer leaves discovery armed
  EXPECT_EQ(store.staged_size(), 0u);                // compatibility is rejected before the store is begun
}

TEST(OtaTransfer, AutomaticAdmissionRejectsReplayAndRechecksLyingHaveVersion) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA, SIM_MOTA_LEN, manifest));
  OtaManager client;
  OtaStoreRam<4096> store;
  CapturedMessages sent;
  client.begin(SIM_TARGET_ID, capture_send, &sent);
  client.set_fetch_store(&store);
  client.set_autofetch(OtaManager::AUTOFETCH_ANY);
  client.set_auto_version_floor(manifest.fw_version, true);

  uint8_t wire[64];
  client.on_message(wire, make_have1(wire, sizeof(wire), manifest.merkle_root,
                                     manifest.target_id, manifest.fw_version,
                                     manifest.codec_id, manifest.flags));
  EXPECT_EQ(client.fetchState(), OtaManager::IDLE);  // equal-version replay rejected at catalog admission

  client.on_message(wire, make_have1(wire, sizeof(wire), manifest.merkle_root,
                                     manifest.target_id, manifest.fw_version + 1u,
                                     manifest.codec_id, manifest.flags));
  ASSERT_EQ(client.fetchState(), OtaManager::WANT_MANIFEST);
  deliver_manifest_fragment(client, manifest.merkle_root, 0,
                            manifest.manifest_start, OTA_MF_FRAG);
  deliver_manifest_fragment(client, manifest.merkle_root, 1,
                            manifest.manifest_start + OTA_MF_FRAG,
                            (uint16_t)(MOTA_MFL - OTA_MF_FRAG));
  EXPECT_EQ(client.fetchState(), OtaManager::FAILED); // parsed version defeats the lying HAVE row
  EXPECT_EQ(client.fetchError(), OtaManager::FETCH_ERROR_VERSION);
  EXPECT_EQ(store.staged_size(), 0u);
}

TEST(OtaTransfer, SignedOnlyAutofetchRechecksTheParsedManifestFlag) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA, SIM_MOTA_LEN, manifest));
  ASSERT_TRUE(manifest.is_signed());
  std::array<uint8_t, MOTA_MFL> unsigned_bytes;
  memcpy(unsigned_bytes.data(), manifest.manifest_start, unsigned_bytes.size());
  unsigned_bytes[1] &= (uint8_t)~MFLAG_SIGNED;
  OtaManager client;
  OtaStoreRam<4096> store;
  CapturedMessages sent;
  client.begin(SIM_TARGET_ID, capture_send, &sent);
  client.set_fetch_store(&store);
  client.set_autofetch(OtaManager::AUTOFETCH_SIGNED);
  client.set_auto_version_floor(manifest.fw_version - 1u, true);

  uint8_t wire[64];
  client.on_message(wire, make_have1(wire, sizeof(wire), manifest.merkle_root,
                                     manifest.target_id, manifest.fw_version,
                                     manifest.codec_id,
                                     (uint8_t)(manifest.flags | MFLAG_SIGNED)));
  ASSERT_EQ(client.fetchState(), OtaManager::WANT_MANIFEST);
  deliver_manifest_fragment(client, manifest.merkle_root, 0,
                            unsigned_bytes.data(), OTA_MF_FRAG);
  deliver_manifest_fragment(client, manifest.merkle_root, 1,
                            unsigned_bytes.data() + OTA_MF_FRAG,
                            (uint16_t)(MOTA_MFL - OTA_MF_FRAG));
  EXPECT_EQ(client.fetchState(), OtaManager::FAILED);
  EXPECT_EQ(client.fetchError(), OtaManager::FETCH_ERROR_MANIFEST);
  EXPECT_EQ(store.staged_size(), 0u);
}

TEST(OtaTransfer, ExplicitManualPullMayOverrideAutomaticVersionFloor) {
  MotaManifest manifest;
  ASSERT_TRUE(mota_parse(SIM_MOTA, SIM_MOTA_LEN, manifest));
  OtaManager client;
  OtaStoreRam<4096> store;
  CapturedMessages sent;
  client.begin(SIM_TARGET_ID, capture_send, &sent);
  client.set_fetch_store(&store);
  client.set_auto_version_floor(manifest.fw_version, true);

  ASSERT_EQ(client.pull(manifest.merkle_root, manifest.target_id), OtaManager::PULL_STARTED);
  deliver_manifest_fragment(client, manifest.merkle_root, 0,
                            manifest.manifest_start, OTA_MF_FRAG);
  deliver_manifest_fragment(client, manifest.merkle_root, 1,
                            manifest.manifest_start + OTA_MF_FRAG,
                            (uint16_t)(MOTA_MFL - OTA_MF_FRAG));
  EXPECT_EQ(client.fetchState(), OtaManager::FETCHING);
  EXPECT_GT(store.staged_size(), 0u);
}

TEST(OtaTransfer, PullAdmissionReportsNoStoreAndBusyWithoutReplacingIntent) {
  g_q.clear();
  OtaManager client;
  SendTo to_none{&client};
  client.begin(SIM_TARGET_ID, sim_send, &to_none);
  uint8_t first[4] = {1, 2, 3, 4}, second[4] = {5, 6, 7, 8};
  EXPECT_EQ(client.pull(first, SIM_TARGET_ID), OtaManager::PULL_NO_STORE);
  EXPECT_EQ(client.fetchState(), OtaManager::IDLE);
  EXPECT_EQ(client.wanted(), 0u);

  OtaStoreRam<4096> store;
  client.set_fetch_store(&store);
  EXPECT_EQ(client.pull(first, SIM_TARGET_ID), OtaManager::PULL_STARTED);
  EXPECT_EQ(client.pull(second, SIM_TARGET_ID ^ 0x55AAu), OtaManager::PULL_BUSY);
  EXPECT_EQ(client.fetchState(), OtaManager::WANT_MANIFEST);
  EXPECT_EQ(client.wanted(), SIM_TARGET_ID);
  EXPECT_EQ(0, memcmp(client.fetchManifestId(), first, sizeof(first)));
  g_q.clear();
}

// An archive capture is not an install. It must retain cross-target and otherwise unsupported containers
// byte-for-byte so this node can relay them to hardware that does understand their codec.
TEST(OtaTransfer, ArchivePullAcceptsCrossTargetUnsupportedCodec) {
  g_q.clear();
  OtaManager server, client;
  OtaStoreRam<4096> store;
  SendTo to_client{&client}, to_server{&server};
  server.begin(0, sim_send, &to_client);
  client.begin(SIM_TARGET_ID ^ 0x55AAu, sim_send, &to_server);
  client.set_fetch_store(&store);
  client.set_apply_codec(CODEC_DETOOLS_INPLACE);
  client.set_accept_full(false);                    // install path cannot accept SIM_MOTA (full image)
  ASSERT_TRUE(server.serve(SIM_MOTA, SIM_MOTA_LEN));

  MotaManifest m;
  ASSERT_TRUE(mota_parse(SIM_MOTA, SIM_MOTA_LEN, m));
  client.pull_archive(m.merkle_root, m.target_id);  // capture ignores local target + install codec
  pump(client, &server);

  EXPECT_EQ(client.fetchState(), OtaManager::COMPLETE);
  ASSERT_EQ(store.staged_size(), SIM_MOTA_LEN);
  EXPECT_EQ(0, std::memcmp(store.data(), SIM_MOTA, SIM_MOTA_LEN));
}

// Encode a 1-row OTA_HAVE from a specific seeder, carrying have_count (Phase-2 awareness).
static uint16_t make_have_row(uint8_t* buf, uint16_t cap, const uint8_t mid[4], uint32_t target,
                              uint32_t fwver, uint8_t codec, uint8_t flags,
                              const uint8_t seeder[4], uint16_t have_count,
                              const uint8_t digest[4] = nullptr) {
  uint8_t row[OTA_HAVE_ROW_BYTES];
  memcpy(row, mid, 4);
  row[4]=target; row[5]=target>>8; row[6]=target>>16; row[7]=target>>24;
  row[8]=fwver; row[9]=fwver>>8; row[10]=fwver>>16; row[11]=fwver>>24;
  row[12]=codec; row[13]=flags;
  row[14]=(uint8_t)(have_count & 0xFF); row[15]=(uint8_t)(have_count >> 8);
  HaveMsg hv; memcpy(hv.seeder_id, seeder, 4);
  if (digest) memcpy(hv.set_digest, digest, 4); else memset(hv.set_digest, 0, 4);
  hv.frag_idx=0; hv.frag_total=1; hv.n_rows=1; hv.rows=row;
  return encode_have(buf, cap, hv);
}

// Catalog accounting: "N nodes have it" must count DISTINCT seeders (a repeated HAVE from one node must
// not inflate it), and have_max tracks the best progress any source reported.
TEST(OtaCatalog, DistinctSeederCountAndHaveCount) {
  OtaManager m; SendTo none{&m}; m.begin(SIM_TARGET_ID, sim_send, &none);
  uint8_t b[64]; uint8_t mid[4]={9,9,9,9};
  uint8_t s1[4]={1,0,0,0}, s2[4]={2,0,0,0};
  m.on_message(b, make_have_row(b, sizeof b, mid, SIM_TARGET_ID, 0x01020300, CODEC_FULL, 0, s1, 5));
  m.on_message(b, make_have_row(b, sizeof b, mid, SIM_TARGET_ID, 0x01020300, CODEC_FULL, 0, s1, 7));  // same seeder
  ASSERT_EQ(m.catalogCount(), 1);
  EXPECT_EQ(m.catalogRow(0)->n_seeders, 1);          // counted once despite two HAVEs
  EXPECT_EQ(m.catalogRow(0)->have_max, 7u);          // max progress seen
  m.on_message(b, make_have_row(b, sizeof b, mid, SIM_TARGET_ID, 0x01020300, CODEC_FULL, 0, s2, 3));  // new seeder
  EXPECT_EQ(m.catalogRow(0)->n_seeders, 2);
  EXPECT_EQ(m.catalogRow(0)->have_max, 7u);          // still the max, not overwritten by the lower one
  g_q.clear();
}

TEST(OtaCatalog, DigestChangePurgesOnlyThatSeedersRowsAndProgress) {
  OtaManager m; SendTo none{&m}; m.begin(SIM_TARGET_ID, sim_send, &none);
  m.set_archive_interest(true);
  uint8_t wire[64], mid[4] = {9, 8, 7, 6};
  uint8_t s1[4] = {1, 0, 0, 0}, s2[4] = {2, 0, 0, 0};
  uint8_t d1[4] = {0x11, 0, 0, 0}, d2[4] = {0x22, 0, 0, 0}, changed[4] = {0x33, 0, 0, 0};

  auto advertise = [&](const uint8_t sid[4], const uint8_t digest[4], uint8_t count = 1) {
    AdvMsg adv{}; memcpy(adv.seeder_id, sid, 4); memcpy(adv.set_digest, digest, 4); adv.n_motas = count;
    uint16_t n = encode_adv(wire, sizeof(wire), adv);
    ASSERT_GT(n, 0);
    m.on_message(wire, n);
  };
  advertise(s1, d1);
  advertise(s2, d2);
  m.set_clock(100);
  m.on_message(wire, make_have_row(wire, sizeof(wire), mid, SIM_TARGET_ID, 0x01020300,
                                   CODEC_FULL, MFLAG_FULL, s1, 7, d1));
  m.set_clock(200);
  m.on_message(wire, make_have_row(wire, sizeof(wire), mid, SIM_TARGET_ID, 0x01020300,
                                   CODEC_FULL, MFLAG_FULL, s2, 3, d2));
  ASSERT_EQ(m.catalogCount(), 1);
  ASSERT_EQ(m.catalogRow(0)->n_seeders, 2);
  ASSERT_EQ(m.catalogRow(0)->have_max, 7u);

  advertise(s1, changed);
  ASSERT_EQ(m.catalogCount(), 1);
  EXPECT_EQ(m.catalogRow(0)->n_seeders, 1);
  EXPECT_EQ(m.catalogRow(0)->have_max, 3u);
  EXPECT_EQ(m.catalogRow(0)->last_ms, 200u);

  m.set_clock(300);
  m.on_message(wire, make_have_row(wire, sizeof(wire), mid, SIM_TARGET_ID, 0x01020300,
                                   CODEC_FULL, MFLAG_FULL, s1, 9, d1)); // delayed row from the old digest
  ASSERT_EQ(m.catalogCount(), 1);
  EXPECT_EQ(m.catalogRow(0)->n_seeders, 1);
  EXPECT_EQ(m.catalogRow(0)->have_max, 3u);

  advertise(s2, changed, 0);                         // an explicit empty advert withdraws the source
  EXPECT_EQ(m.catalogCount(), 0);                    // nobody still advertises the old set
  g_q.clear();
}

// An unanswered GET_MANIFEST must not pin the fetch slot forever: after OTA_MANIFEST_MAX_RETRY ticks with
// no manifest, the session gives up (FAILED) so a new pull can take the slot. (Bounded primary operation.)
TEST(OtaTransfer, ManifestGiveUpAfterRetries) {
  g_q.clear();
  OtaManager client; OtaStoreRam<4096> store; SendTo to_none{&client};
  client.begin(SIM_TARGET_ID, sim_send, &to_none);
  client.set_fetch_store(&store);
  uint8_t mid[4]={7,7,7,7};
  client.pull(mid, SIM_TARGET_ID);                   // no server -> stuck WANT_MANIFEST
  EXPECT_EQ(client.fetchState(), OtaManager::WANT_MANIFEST);
  for (int i = 0; i < OTA_MANIFEST_MAX_RETRY + 2; i++) { g_clk += 5000; client.set_clock(g_clk); client.loop(); g_q.clear(); }
  EXPECT_EQ(client.fetchState(), OtaManager::FAILED);
  EXPECT_EQ(client.fetchError(), OtaManager::FETCH_ERROR_MANIFEST_TIMEOUT);
  EXPECT_EQ(client.wanted(), 0u);
}

// A receiver never becomes a source, either while fetching or after completion.
TEST(OtaTransfer, ReceiverDoesNotReSeed) {
  g_q.clear();
  OtaManager server, client; OtaStoreRam<4096> store;
  SendTo to_client{&client}, to_server{&server};
  server.begin(0, sim_send, &to_client);
  client.begin(SIM_TARGET_ID, sim_send, &to_server);
  client.set_fetch_store(&store);
  client.set_autofetch(OtaManager::AUTOFETCH_ANY);
  ASSERT_TRUE(server.serve(SIM_MOTA, SIM_MOTA_LEN));
  server.announce();
  pump(client, &server);
  ASSERT_EQ(client.fetchState(), OtaManager::COMPLETE);
  EXPECT_EQ(client.servedCount(), 0);
  client.reset_session();
  EXPECT_EQ(client.servedCount(), 0);
}

// --- detools delta decode (vendored detools C decoder, CRLE-only build) ----------------------
// Mirrors the device apply path (src/helpers/ota/OtaApply.cpp): base read via from_read/from_seek,
// patch streamed via patch_read, output written via to_write. Proves the on-device delta apply uses
// detools 0.53.0's own decoder and reproduces the exact target the host packager targeted.
namespace {
struct DTMem {
  const uint8_t* base; long base_len; long base_pos;
  const uint8_t* patch; long patch_len; long patch_pos;
  std::vector<uint8_t> out;
};
int dt_from_read(void* a, uint8_t* b, size_t n) {
  DTMem* c = (DTMem*)a;
  if (c->base_pos < 0 || c->base_pos + (long)n > c->base_len) return -DETOOLS_IO_FAILED;
  std::memcpy(b, c->base + c->base_pos, n); c->base_pos += (long)n; return DETOOLS_OK;
}
int dt_from_seek(void* a, int off) {
  DTMem* c = (DTMem*)a; c->base_pos += off;
  if (c->base_pos < 0 || c->base_pos > c->base_len) return -DETOOLS_IO_FAILED;
  return DETOOLS_OK;
}
int dt_patch_read(void* a, uint8_t* b, size_t n) {
  DTMem* c = (DTMem*)a;
  if (c->patch_pos + (long)n > c->patch_len) return -DETOOLS_IO_FAILED;
  std::memcpy(b, c->patch + c->patch_pos, n); c->patch_pos += (long)n; return DETOOLS_OK;
}
int dt_to_write(void* a, const uint8_t* b, size_t n) {
  DTMem* c = (DTMem*)a; c->out.insert(c->out.end(), b, b + n); return DETOOLS_OK;
}

// In-place apply over a flat memory region (models the nRF52 app workspace / the bootloader's flash).
struct DTInPlace {
  std::vector<uint8_t> mem;             // [0,memory_size): base in, target out
  const uint8_t* patch; long plen, ppos; int step;
};
int ip_mem_read(void* a, void* dst, uintptr_t src, size_t n) {
  DTInPlace* c = (DTInPlace*)a; if (src + n > c->mem.size()) return -DETOOLS_IO_FAILED;
  std::memcpy(dst, c->mem.data() + src, n); return DETOOLS_OK;
}
int ip_mem_write(void* a, uintptr_t dst, void* src, size_t n) {
  DTInPlace* c = (DTInPlace*)a; if (dst + n > c->mem.size()) return -DETOOLS_IO_FAILED;
  std::memcpy(c->mem.data() + dst, src, n); return DETOOLS_OK;
}
int ip_mem_erase(void* a, uintptr_t addr, size_t n) {
  DTInPlace* c = (DTInPlace*)a; if (addr + n > c->mem.size()) return -DETOOLS_IO_FAILED;
  std::memset(c->mem.data() + addr, 0xFF, n); return DETOOLS_OK;
}
int ip_step_set(void* a, int s) { ((DTInPlace*)a)->step = s; return DETOOLS_OK; }
int ip_step_get(void* a, int* s) { *s = ((DTInPlace*)a)->step; return DETOOLS_OK; }
int ip_patch_read(void* a, uint8_t* b, size_t n) {
  DTInPlace* c = (DTInPlace*)a; if (c->ppos + (long)n > c->plen) return -DETOOLS_IO_FAILED;
  std::memcpy(b, c->patch + c->ppos, n); c->ppos += (long)n; return DETOOLS_OK;
}
}  // namespace

TEST(Detools, SequentialCrlePatchReproducesTarget) {
  DTMem c{DT_BASE, (long)DT_BASE_LEN, 0, DT_PATCH, (long)DT_PATCH_LEN, 0, {}};
  int r = detools_apply_patch_callbacks(dt_from_read, dt_from_seek, dt_patch_read,
                                        (size_t)DT_PATCH_LEN, dt_to_write, &c);
  ASSERT_EQ(r, (int)DT_TARGET_LEN);                 // returns to-size on success
  ASSERT_EQ(c.out.size(), (size_t)DT_TARGET_LEN);
  EXPECT_EQ(0, std::memcmp(c.out.data(), DT_TARGET, DT_TARGET_LEN));
}

TEST(Detools, WrongBaseDoesNotReproduceTarget) {
  // a base that differs from the one the patch was built against must NOT yield the target
  std::vector<uint8_t> bad(DT_BASE, DT_BASE + DT_BASE_LEN);
  for (size_t i = 0; i < bad.size(); i += 7) bad[i] ^= 0xFF;
  DTMem c{bad.data(), (long)bad.size(), 0, DT_PATCH, (long)DT_PATCH_LEN, 0, {}};
  int r = detools_apply_patch_callbacks(dt_from_read, dt_from_seek, dt_patch_read,
                                        (size_t)DT_PATCH_LEN, dt_to_write, &c);
  bool reproduced = (r == (int)DT_TARGET_LEN && c.out.size() == (size_t)DT_TARGET_LEN &&
                     std::memcmp(c.out.data(), DT_TARGET, DT_TARGET_LEN) == 0);
  EXPECT_FALSE(reproduced);   // wrong base -> wrong/short output (the device then fails image_hash)
}

TEST(Detools, TruncatedPatchFails) {
  DTMem c{DT_BASE, (long)DT_BASE_LEN, 0, DT_PATCH, (long)(DT_PATCH_LEN / 2), 0, {}};
  int r = detools_apply_patch_callbacks(dt_from_read, dt_from_seek, dt_patch_read,
                                        (size_t)(DT_PATCH_LEN / 2), dt_to_write, &c);
  EXPECT_TRUE(r < 0 || c.out.size() != (size_t)DT_TARGET_LEN);
}

// nRF52 path: the bootloader applies an in-place patch over the single app slot. Model the app
// region as a DT_IP_MEM buffer holding the base; after apply, region[0:to_size] must equal the target.
TEST(Detools, InPlaceCrlePatchReproducesTarget) {
  DTInPlace c; c.mem.assign(DT_IP_MEM, 0xFF);
  std::memcpy(c.mem.data(), DT_IP_BASE, DT_IP_BASE_LEN);   // base loaded at offset 0
  c.patch = DT_IP_PATCH; c.plen = DT_IP_PATCH_LEN; c.ppos = 0; c.step = 0;
  int r = detools_apply_patch_in_place_callbacks(ip_mem_read, ip_mem_write, ip_mem_erase,
                                                 ip_step_set, ip_step_get, ip_patch_read,
                                                 (size_t)DT_IP_PATCH_LEN, &c);
  ASSERT_EQ(r, (int)DT_IP_TARGET_LEN);                     // returns to-size on success
  EXPECT_EQ(0, std::memcmp(c.mem.data(), DT_IP_TARGET, DT_IP_TARGET_LEN));
}

// --- leaf-diff warm-start core (motatool folder-capture): the device fetches the target leaves[], recomputes
// the root to authenticate them, then keeps every seed block whose leaf matches and refetches only the rest.
// This exercises that logic (leaf authentication + per-block diff) with no store/fetch machinery. ----------
TEST(OtaWarmStart, LeafDiffAuthenticatesAndFindsDifferingBlocks) {
  const uint32_t BS = 16, BC = 5;
  std::vector<uint8_t> target(BS * BC), seed(BS * BC);
  for (uint32_t i = 0; i < target.size(); i++) target[i] = seed[i] = (uint8_t)(i * 7 + 3);
  seed[1 * BS + 5] ^= 0xFF;      // blocks 1 and 3 differ in the seed (a non-deterministic-rebuild style diff)
  seed[3 * BS + 0] ^= 0x01;

  // target leaves + root (what the device receives over OTA_LEAVES + the manifest merkle_root)
  uint8_t tleaves[BC * 4], troot[4];
  for (uint32_t i = 0; i < BC; i++) merkle_leaf(tleaves + i * 4, target.data() + i * BS, BS);
  merkle_root(troot, tleaves, BC);

  // authenticate the fetched leaves: recomputing the root from them must equal the manifest root
  uint8_t chk[4]; merkle_root(chk, tleaves, BC);
  EXPECT_EQ(0, memcmp(chk, troot, 4));

  // diff: a seed block is kept iff its leaf equals the (authenticated) target leaf
  int nmiss = 0; bool miss[BC] = {false};
  for (uint32_t i = 0; i < BC; i++) {
    uint8_t sl[4]; merkle_leaf(sl, seed.data() + i * BS, BS);
    if (memcmp(sl, tleaves + i * 4, 4) != 0) { miss[i] = true; nmiss++; }
  }
  EXPECT_EQ(nmiss, 2);
  EXPECT_TRUE(miss[1]);  EXPECT_TRUE(miss[3]);
  EXPECT_FALSE(miss[0]); EXPECT_FALSE(miss[2]); EXPECT_FALSE(miss[4]);
}

int main(int argc, char** argv) {
  ::testing::InitGoogleTest(&argc, argv);
  return RUN_ALL_TESTS();
}