The bin was written to the card chunk by chunk as it arrived, on the core-0
tile worker next to the Wi-Fi driver. A FAT write that fails there leaves the
file failed for good (FatFs keeps the error on the file object), so the
per-chunk retry could never recover and the stream could not be replayed.
Map tiles never hit this: they are downloaded first and written after.
When the image fits in PSRAM (with 512 KB to spare) it is now downloaded
first, then written through an internal DMA bounce buffer, up to three whole-
file attempts (helpers/BufferedFileCommit.h, host test included). Boards
without the room stream as before.
The SD health tick also guarded the download with s_sdfw_request, which the
worker clears the moment it starts, so a probe or remount could SD.end()
under the open file. The guard and sdRuntimeLifecycleBusy() now use
s_sdfw_state == 1 as well.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
