OTAFIX 2.4.3 (Adafruit 0.11.0, recovery hardening)

Stable OTAFIX 2.4.3 release based on Adafruit bootloader 0.11.0.

Recovery and handoff hardening:

• Clears stale BLE-entry state and resets after MBR bootloader/SoftDevice bank finalization.
• Resets after every completed BLE, CDC, or UF2 application install so applications start with clean peripheral state.
• Disables an inherited SoftDevice before USB CDC/UF2 performs direct NVMC operations.
• Lets a mounted no-application USB recovery session reset into battery-powered BLE recovery when VBUS is removed.

UF2 reliability:

• Invalidates saved application state before the first target-page erase.
• Splits nRF52840/nRF52833 page erases into supported 2 ms partial-erase steps so TinyUSB and inherited watchdogs remain serviced.
• Accepts a retransmitted application block only when the committed flash bytes match, while rejecting same-geometry image collisions.

USB and build reproducibility:

• Pins the TinyUSB nRF5x startup-race fix and post-SoftDevice HFCLK retry on the compatible 0.12-era fork.
• Requires Arm GNU Toolchain 14.2.Rel1 or newer and aligns Make/CMake startup, builtin, and one-partition LTO behavior.
• Uses explicit test-only packed versions for nonrelease CI and dirty qualification trees; production artifacts still require an exact canonical tag.

Signed bootloader mOTA:

• OTAFIX-2.4.3-bootloader-mota.zip contains all 16 qualified, exact-board, Ed25519-signed bootloader .mota packages plus an inventory and checksums.
• Each package is a full 41,330-byte format-3 image and can update any compatible older version. Full images are required: the bootloader format rejects deltas. A hypothetical 2.4.2-to-2.4.3 delta averaged about 66.4% smaller (about 27.4 KB saved), but is not supported for privileged bootloader installation.
• OTAFIX_MOTA_SIGNING_PUBLIC_KEY.txt is the official public trust key. The private key is not distributed.
• otafix_mota_update.py is the menu-driven version checker and LoRa updater. It checks this latest release, verifies the GitHub asset digests, pinned signer, signed binary contract, exact target identity, version, MID, and image hash before asking to install.
• The menu offers BW 500/250/125/62.5 kHz and 1-4 hop estimates. Defaults are SF5 and 909.950 MHz; use --sf and --frequency to override them.
• Custom OTAFIX builders can generate their own Ed25519 key, add its public half with ota key add, and sign their own variants. See the mOTA signing guide for the complete release and custom-key process.

Physical LoRa qualification:

All four targets were placed on an exact 2.4.2 baseline, then updated to 2.4.3 over LoRa from a Heltec V4 at 909.950 MHz, BW500, SF5, CR5. Each finished with the same bootloader identity, blup:C8, and no staged download.

Target	Transfer time	Result
Heltec Tower V2	89 s	Passed
Seeed XIAO nRF52840	67 s	Passed
WisMesh Tag	69 s	Passed
SenseCAP T1000-E	72 s	Passed

Conservative total-time estimates for a 41,330-byte update, including discovery, verification, apply, and reboot:

RF hops	BW500	BW250	BW125	BW62.5
1	1m45s-3m10s	2m50s-4m50s	5m00s-8m10s	9m20s-14m50s
2	2m34s-4m25s	4m28s-7m20s	8m15s-13m10s	15m50s-24m50s
3	3m23s-5m40s	6m05s-9m50s	11m30s-18m10s	22m20s-34m50s
4	4m12s-6m55s	7m43s-12m20s	14m45s-23m10s	28m50s-44m50s

Narrow-band and multi-hop values are scaled estimates, not guarantees. Every relay must use the same temporary radio tuple, and radio settings must be legal at the operating location.

Validation:

• Complete host and sanitizer suites passed.
• GCC 14.2.Rel1 qualification passed for all supported boards through both Make and CMake.
• Signed and dual-bank Make/CMake variants passed for both Heltec T096 (ST7735S) and Heltec T114 (ST7789).
• The exact tagged release workflow passed 22 board builds and produced 66 original firmware assets.

Packed bootloader version: 0x020403FF.

Release assets are built by the repository workflow for every supported board.

GAT562 board-asset addendum (2026-08-28):

• Added the GAT562 merged HEX, serial-DFU ZIP, and bootloader-update UF2 as OTAFIX 2.4.3, built from ffb1580.
• Existing board assets were not replaced. The GAT562 target passed the full 23-board build qualification and manifest checks; physical GAT562 hardware qualification has not yet been performed.
• GAT562 is not included in the signed bootloader mOTA bundle.