CAN Triple Device Manager 1.1.1 — review fixes (device firmware 1.0.1)

A fix release, from a full review of the project. Device firmware moves to 1.0.1 — a straight patch, no store change, so configurations load as they are and no unit needs reconfiguring.

Fixed

A new document kept the last one's Message Passwords. File → New cleared every other document secret but not the four Message Passwords, so opening a protected configuration and then starting a new one carried its derived keys forward — where a save would persist them, a send would program them onto a device, and a later Get Configuration would keep them in preference to the device's own.

A non-finite reading is now clamped (firmware 1.0.1). A channel's range is the device's clamp, but it was applied with ordered comparisons only — and every comparison against a NaN is false. A float signal fed a NaN bit pattern from the bus passed through unclamped and poisoned the value table for everything downstream: math, conditions, transmit. Non-finite values now pin to the range minimum, the same answer a value below the range already got. Proven on hardware: NaN and +Inf injected into a signal ranged −100…100 both present −100.

A failed script rolls back completely. A script that changed the configuration and then failed was restored — but only if the change had been registered. A binding that altered something and then raised an error (a bad field type, say) left that change in place, silently, without even marking the document modified. The snapshot is now restored on any failure.

Smaller things. The CAN viewer's inject button no longer stacks two transactions if pressed twice while a device is slow to answer. A script constant too large for a 32-bit float is now refused by name instead of surfacing as an "internal compiler error". A communications template's parsed passwords are no longer discarded (nothing depended on them — the messages carry their own keys). Four comments that had drifted from the code were corrected, including a send-gate message naming a menu that does not exist.

Tested

The three parts of the program that talk to a device — the configuration transfer, the firmware uploader, and the Protect Communication send gate — had no tests, because their whole surface needs a serial port. They have tests now, and the transfer and uploader run against the real firmware library, performing the same conversation they perform on a bench unit rather than against a stub that would simply agree with them.

Each new test was checked by reintroducing the bug it guards and confirming the test fails: a send gate that lets a silent device through, a configuration write that tolerates a refusal, a truncated password record, the password leak itself, and a weakened range check.

🤖 Generated with Claude Code