🎖️GitЯра🎖️ - /page/blob.mu

T8b949e/*

*

* This program is free software: you can redistribute it and/or modify

* it under the terms of the GNU General Public License as published by

* the Free Software Foundation, either version 3 of the License, or

* (at your option) any later version.

*

* This program is distributed in the hope that it will be useful,

* but WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

* GNU General Public License for more details.

*

* You should have received a copy of the GNU General Public License

* along with this program. If not, see <https://www.gnu.org/licenses/>.

*/

Tff7b72package T7ee787org.meshtastic.feature.firmware.ota.dfu

Tff7b72import T7ee787co.touchlab.kermit.Logger

Tff7b72import T7ee787kotlinx.coroutines.CancellationException

Tff7b72import T7ee787kotlinx.coroutines.NonCancellable

Tff7b72import T7ee787kotlinx.coroutines.delay

Tff7b72import T7ee787kotlinx.coroutines.withContext

Tff7b72import T7ee787org.koin.core.annotation.Single

Tff7b72import T7ee787org.meshtastic.core.ble.BleConnectionFactory

Tff7b72import T7ee787org.meshtastic.core.ble.BleScanner

Tff7b72import T7ee787org.meshtastic.core.common.util.CommonUri

Tff7b72import T7ee787org.meshtastic.core.common.util.ioDispatcher

Tff7b72import T7ee787org.meshtastic.core.database.entity.FirmwareRelease

Tff7b72import T7ee787org.meshtastic.core.di.CoroutineDispatchers

Tff7b72import T7ee787org.meshtastic.core.model.DeviceHardware

Tff7b72import T7ee787org.meshtastic.core.repository.RadioController

Tff7b72import T7ee787org.meshtastic.core.resources.Res

Tff7b72import T7ee787org.meshtastic.core.resources.UiText

Tff7b72import T7ee787org.meshtastic.core.resources.firmware_update_connecting_attempt

Tff7b72import T7ee787org.meshtastic.core.resources.firmware_update_downloading_percent

Tff7b72import T7ee787org.meshtastic.core.resources.firmware_update_enabling_dfu

Tff7b72import T7ee787org.meshtastic.core.resources.firmware_update_not_found_in_release

Tff7b72import T7ee787org.meshtastic.core.resources.firmware_update_ota_failed

Tff7b72import T7ee787org.meshtastic.core.resources.firmware_update_slow_bootloader_hint

Tff7b72import T7ee787org.meshtastic.core.resources.firmware_update_starting_dfu

Tff7b72import T7ee787org.meshtastic.core.resources.firmware_update_uploading

Tff7b72import T7ee787org.meshtastic.core.resources.firmware_update_validating

Tff7b72import T7ee787org.meshtastic.core.resources.firmware_update_waiting_reboot

Tff7b72import T7ee787org.meshtastic.core.resources.getStringSuspend

Tff7b72import T7ee787org.meshtastic.feature.firmware.FirmwareArtifact

Tff7b72import T7ee787org.meshtastic.feature.firmware.FirmwareFileHandler

Tff7b72import T7ee787org.meshtastic.feature.firmware.FirmwareRetriever

Tff7b72import T7ee787org.meshtastic.feature.firmware.FirmwareUpdateHandler

Tff7b72import T7ee787org.meshtastic.feature.firmware.FirmwareUpdateState

Tff7b72import T7ee787org.meshtastic.feature.firmware.ProgressState

Tff7b72import T7ee787org.meshtastic.feature.firmware.ota.ThroughputTracker

Tff7b72import T7ee787org.meshtastic.feature.firmware.ota.calculateMacPlusOne

Tff7b72import T7ee787org.meshtastic.feature.firmware.ota.formatTransferProgress

Tff7b72import T7ee787org.meshtastic.feature.firmware.ota.retryWithDelay

Tff7b72import T7ee787org.meshtastic.feature.firmware.ota.scanForBleDevice

Tff7b72import T7ee787org.meshtastic.feature.firmware.stripFormatArgs

Tff7b72import T7ee787kotlin.time.Duration.Companion.seconds

Tff7b72import T7ee787kotlin.uuid.Uuid

Tff7b72private Tff7b72const Tff7b72val Te6edf3PERCENT_MAX Tff7b72= T79c0ff1T79c0ff0T79c0ff0

Tff7b72private Tff7b72const Tff7b72val Te6edf3GATT_RELEASE_DELAY_MS Tff7b72= T79c0ff1Te6edf3_500L

Tff7b72private Tff7b72const Tff7b72val Te6edf3DFU_REBOOT_WAIT_MS Tff7b72= T79c0ff3Te6edf3_000L

Tff7b72private Tff7b72const Tff7b72val Te6edf3RETRY_DELAY_MS Tff7b72= T79c0ff2Te6edf3_000L

Tff7b72private Tff7b72const Tff7b72val Te6edf3CONNECT_ATTEMPTS Tff7b72= T79c0ff4

T8b949e/**

* Real upload attempts a confirmed Legacy primary is allowed before declaring failure. Legacy DFU has no resume, so a

* failed upload requires a whole fresh session (new transport + reconnect + re-handshake). Stale-session cleanup cycles

* do NOT consume this budget (see [MAX_LEGACY_STALE_RESETS]).

*/

Tff7b72internal Tff7b72const Tff7b72val Te6edf3LEGACY_SESSION_ATTEMPTS Tff7b72= T79c0ff3

T8b949e/**

* Maximum number of stale-session cleanup cycles a Legacy run will perform. A [LegacyDfuException.StaleSessionReset]

* surfaces when the bootloader rejects START_DFU with INVALID_STATE (a half-finished previous session is wedged in the

* bootloader). The cleanup connects a fresh transport, RESETs, and waits for the bootloader to reboot into a clean OTA

* session. This budget is separate from [LEGACY_SESSION_ATTEMPTS] so a run that legitimately needs to reset-prime more

* than once (e.g. a mid-stream drop that left the bootloader wedged twice in a row) is not punished by losing an upload

* attempt for a cleanup that did not actually try to upload.

*/

Tff7b72internal Tff7b72const Tff7b72val Te6edf3MAX_LEGACY_STALE_RESETS Tff7b72= T79c0ff2

T8b949e/** Limited probe/fallback budget for inconclusive detection or alternate-protocol attempts. */

Tff7b72internal Tff7b72const Tff7b72val Te6edf3LIMITED_SESSION_ATTEMPTS Tff7b72= T79c0ff1

T8b949e/**

* Two-stage session budget.

*

* [preEngagementAttempts] limits speculative connection attempts before the selected DFU service has been confirmed.

* [engagedAttempts] applies after a connection to that protocol's DFU service succeeds. Engagement means the selected

* protocol's DFU service was connected to; it does not by itself universally prevent fallback (see

* [DfuFallbackCoordinator] for the fallback policy). Secure always carries [preEngagementAttempts] == [engagedAttempts]

* so engagement never expands its budget.

*/

Tff7b72internal Tff7b72data Tff7b72class T56d364DfuAttemptBudgetTb4b4b4(Tff7b72val Te6edf3preEngagementAttemptsTb4b4b4: Tffa657IntTb4b4b4, Tff7b72val Te6edf3engagedAttemptsTb4b4b4: Tffa657IntTb4b4b4) Tb4b4b4{

Tff7b72init Tb4b4b4{

Te6edf3requireTb4b4b4(Te6edf3preEngagementAttempts Tff7b72in T79c0ff1.Tb4b4b4.Te6edf3engagedAttemptsTb4b4b4) Tb4b4b4{

Ta5d6ff"Ta5d6ffpreEngagementAttempts (Tffd700$Te6edf3preEngagementAttemptsTa5d6ff) must be in 1..engagedAttempts (Tffd700$Te6edf3engagedAttemptsTa5d6ff)Ta5d6ff"

Tb4b4b4}

T8b949e/**

* Transport-dispatch key: which [DfuUploadTransport] implementation ([SecureDfuTransport] or [LegacyDfuTransport]) to

* use, and therefore which DFU service UUID its scan/connect is filtering on.

*/

Tff7b72internal Tff7b72enum Tff7b72class T56d364DfuProtocolKind Tb4b4b4{

Te6edf3SECURETb4b4b4,

Te6edf3LEGACYTb4b4b4,

Tb4b4b4}

T8b949e/**

* Outcome of bootloader service detection. Unlike [DfuProtocolKind] (which is the transport-dispatch key), this type

* keeps the "neither service observed" case representable instead of silently coercing it to one protocol.

*/

Tff7b72internal Tff7b72sealed Tff7b72class T56d364BootloaderDetection Tb4b4b4{

T8b949e/** Legacy DFU service (`1530`) was observed in the advertisement. Treat the bootloader as Legacy DFU. */

Tff7b72data Tff7b72object T56d364LegacyObserved Tb4b4b4: Te6edf3BootloaderDetectionTb4b4b4(Tb4b4b4)

T8b949e/** Secure DFU service (`FE59`) was observed in the advertisement. Treat the bootloader as Secure DFU. */

Tff7b72data Tff7b72object T56d364SecureObserved Tb4b4b4: Te6edf3BootloaderDetectionTb4b4b4(Tb4b4b4)

T8b949e/**

* Neither DFU service was conclusively observed inside the detection window. Causes of an inconclusive scan include

* advertisement-interval timing, Android scan duty-cycling, OS-level advertisement cache, and the bootloader not

* having resumed advertising yet after the buttonless reboot.

*/

Tff7b72data Tff7b72object T56d364Unknown Tb4b4b4: Te6edf3BootloaderDetectionTb4b4b4(Tb4b4b4)

Tb4b4b4}

Tff7b72internal Tff7b72sealed Tff7b72class T56d364DfuUploadResult Tb4b4b4{

Tff7b72data Tff7b72object T56d364Success Tb4b4b4: Te6edf3DfuUploadResultTb4b4b4(Tb4b4b4)

Tff7b72data Tff7b72class T56d364FailureTb4b4b4(Tff7b72val Te6edf3errorTb4b4b4: Te6edf3ThrowableTb4b4b4, Tff7b72val Te6edf3protocolEngagedTb4b4b4: Tffa657BooleanTb4b4b4) Tb4b4b4: Te6edf3DfuUploadResultTb4b4b4(Tb4b4b4)

Tb4b4b4}

T8b949e/**

* Owns fallback ordering and retry budget policy. Whether an alternate protocol is tried after a primary failure

* depends on the [detection] outcome and engagement state — see [shouldTryAlternateAfterFailure].

*/

Tff7b72internal Tff7b72class T56d364DfuFallbackCoordinatorTb4b4b4(Tff7b72private Tff7b72val Te6edf3detectionTb4b4b4: Te6edf3BootloaderDetectionTb4b4b4) Tb4b4b4{

Tff7b72suspend Tff7b72fun Td2a8ffexecuteTb4b4b4(Te6edf3uploadWithRetryTb4b4b4: Te6edf3suspend Tb4b4b4(Te6edf3DfuProtocolKindTb4b4b4, Te6edf3DfuAttemptBudgetTb4b4b4) Tff7b72-Tff7b72> Te6edf3DfuUploadResultTb4b4b4) Tb4b4b4{

Tff7b72val Te6edf3orderedProtocols Tff7b72= Te6edf3detectionTb4b4b4.Te6edf3orderedProtocolsTb4b4b4(Tb4b4b4)

Te6edf3LoggerTb4b4b4.Te6edf3i Tb4b4b4{ Ta5d6ff"Ta5d6ffDFU: detection=Tffd700$Te6edf3detectionTa5d6ff → protocols=Tffd700$Te6edf3orderedProtocolsTa5d6ff" Tb4b4b4}

Tff7b72var Te6edf3primaryErrorTb4b4b4: Te6edf3Throwable? Tff7b72= Tff7b72null

Tff7b72for Tb4b4b4(Tb4b4b4(Te6edf3indexTb4b4b4, Te6edf3protocolTb4b4b4) Tff7b72in Te6edf3orderedProtocolsTb4b4b4.Te6edf3withIndexTb4b4b4(Tb4b4b4)Tb4b4b4) Tb4b4b4{

Tff7b72val Te6edf3isPrimary Tff7b72= Te6edf3index Tff7b72=Tff7b72= T79c0ff0

Tff7b72val Te6edf3hasAlternateProtocol Tff7b72= Te6edf3index Tff7b72< Te6edf3orderedProtocolsTb4b4b4.Te6edf3lastIndex

Tff7b72val Te6edf3budget Tff7b72= Te6edf3budgetForTb4b4b4(Te6edf3protocolTb4b4b4, Te6edf3isPrimaryTb4b4b4)

Tff7b72if Tb4b4b4(Te6edf3isPrimaryTb4b4b4) Tb4b4b4{

Te6edf3LoggerTb4b4b4.Te6edf3i Tb4b4b4{

Ta5d6ff"Ta5d6ffDFU: primary protocol=Tffd700$Te6edf3protocolTa5d6ff Ta5d6ff" Tff7b72+

Ta5d6ff"Ta5d6ff(upload attempts pre=Tffd700${Te6edf3budgetTb4b4b4.Te6edf3preEngagementAttemptsTffd700}Ta5d6ff, engaged=Tffd700${Te6edf3budgetTb4b4b4.Te6edf3engagedAttemptsTffd700}Ta5d6ff)Ta5d6ff"

Tb4b4b4}

Tb4b4b4} Tff7b72else Tb4b4b4{

Te6edf3LoggerTb4b4b4.Te6edf3w Tb4b4b4{ Ta5d6ff"Ta5d6ffDFU: trying alternate protocol=Tffd700$Te6edf3protocolTa5d6ff (detection=Tffd700$Te6edf3detectionTa5d6ff, budget=Tffd700$Te6edf3budgetTa5d6ff)Ta5d6ff" Tb4b4b4}

Tb4b4b4}

Tff7b72when Tb4b4b4(Tff7b72val Te6edf3result Tff7b72= Te6edf3uploadWithRetryTb4b4b4(Te6edf3protocolTb4b4b4, Te6edf3budgetTb4b4b4)Tb4b4b4) Tb4b4b4{

Te6edf3DfuUploadResultTb4b4b4.Te6edf3Success Tff7b72-Tff7b72> Tff7b72return

Tff7b72is Te6edf3DfuUploadResultTb4b4b4.Te6edf3Failure Tff7b72-Tff7b72> Tb4b4b4{

Tff7b72if Tb4b4b4(Te6edf3isPrimaryTb4b4b4) Tb4b4b4{

Te6edf3primaryError Tff7b72= Te6edf3resultTb4b4b4.Te6edf3error

Tb4b4b4}

Tff7b72if Tb4b4b4(Tff7b72!Te6edf3hasAlternateProtocol Tff7b72|Tff7b72| Tff7b72!Te6edf3shouldTryAlternateAfterFailureTb4b4b4(Te6edf3isPrimaryTb4b4b4, Te6edf3resultTb4b4b4.Te6edf3protocolEngagedTb4b4b4)Tb4b4b4) Tb4b4b4{

Tff7b72throw Te6edf3primaryErrorTb4b4b4.Te6edf3withSuppressedAlternateTb4b4b4(Te6edf3resultTb4b4b4.Te6edf3errorTb4b4b4)

Tb4b4b4}

Te6edf3LoggerTb4b4b4.Te6edf3w Tb4b4b4{

Ta5d6ff"Ta5d6ffDFU: Tffd700$Te6edf3protocolTa5d6ff failed; trying alternate protocol (detection=Tffd700$Te6edf3detectionTa5d6ff, Ta5d6ff" Tff7b72+

Ta5d6ff"Ta5d6ffprotocolEngaged=Tffd700${Te6edf3resultTb4b4b4.Te6edf3protocolEngagedTffd700}Ta5d6ff): Tffd700${Te6edf3resultTb4b4b4.Te6edf3errorTff7b72::Te6edf3classTb4b4b4.Te6edf3simpleNameTffd700}Ta5d6ff"

Tb4b4b4}

Tff7b72throw Te6edf3IllegalStateExceptionTb4b4b4(Ta5d6ff"Ta5d6ffDFU fallback exhausted with non-empty protocol list (detection=Tffd700$Te6edf3detectionTa5d6ff)Ta5d6ff"Tb4b4b4)

Tb4b4b4}

T8b949e/**

* The ordered list of protocols to attempt for this detection outcome. The first element is the primary; the second

* is the alternate. Whether the alternate is reached depends on [shouldTryAlternateAfterFailure], not ordering.

*/

Tff7b72private Tff7b72fun Te6edf3BootloaderDetectionTb4b4b4.Td2a8fforderedProtocolsTb4b4b4(Tb4b4b4)Tb4b4b4: Te6edf3ListTff7b72<Te6edf3DfuProtocolKindTff7b72> Tff7b72= Tff7b72when Tb4b4b4(Tff7b72thisTb4b4b4) Tb4b4b4{

Te6edf3BootloaderDetectionTb4b4b4.Te6edf3LegacyObserved Tff7b72-Tff7b72> Te6edf3listOfTb4b4b4(Te6edf3DfuProtocolKindTb4b4b4.Te6edf3LEGACYTb4b4b4, Te6edf3DfuProtocolKindTb4b4b4.Te6edf3SECURETb4b4b4)

Te6edf3BootloaderDetectionTb4b4b4.Te6edf3SecureObserved Tff7b72-Tff7b72> Te6edf3listOfTb4b4b4(Te6edf3DfuProtocolKindTb4b4b4.Te6edf3SECURETb4b4b4, Te6edf3DfuProtocolKindTb4b4b4.Te6edf3LEGACYTb4b4b4)

Te6edf3BootloaderDetectionTb4b4b4.Te6edf3Unknown Tff7b72-Tff7b72> Te6edf3listOfTb4b4b4(Te6edf3DfuProtocolKindTb4b4b4.Te6edf3LEGACYTb4b4b4, Te6edf3DfuProtocolKindTb4b4b4.Te6edf3SECURETb4b4b4)

Tb4b4b4}

T8b949e/**

* Two-stage upload-attempt budget for the given protocol in this detection context.

* - Confirmed Legacy primary ([BootloaderDetection.LegacyObserved]): full [LEGACY_SESSION_ATTEMPTS] (3) budget

* before AND after engagement — the protocol was conclusively observed.

* - Unknown Legacy primary: [LIMITED_SESSION_ATTEMPTS] (1) pre-engagement probe so Secure fallback stays timely,

* promoted to [LEGACY_SESSION_ATTEMPTS] (3) once Legacy engages and is conclusively identified.

* - Legacy alternate (e.g. SecureObserved → Legacy fallback): same Unknown-style two-stage budget — pre-engagement

* probe of 1, full Legacy budget of 3 once engaged.

* - Secure: 1/1 — never expanded by engagement, since the Secure recovery path is single-shot.

*/

Tff7b72private Tff7b72fun Td2a8ffbudgetForTb4b4b4(Te6edf3protocolTb4b4b4: Te6edf3DfuProtocolKindTb4b4b4, Te6edf3isPrimaryTb4b4b4: Tffa657BooleanTb4b4b4)Tb4b4b4: Te6edf3DfuAttemptBudget Tff7b72= Tff7b72when Tb4b4b4{

Te6edf3protocol Tff7b72=Tff7b72= Te6edf3DfuProtocolKindTb4b4b4.Te6edf3SECURE Tff7b72-Tff7b72>

Te6edf3DfuAttemptBudgetTb4b4b4(

Te6edf3preEngagementAttempts Tff7b72= Te6edf3LIMITED_SESSION_ATTEMPTSTb4b4b4,

Te6edf3engagedAttempts Tff7b72= Te6edf3LIMITED_SESSION_ATTEMPTSTb4b4b4,

Tb4b4b4)

Te6edf3protocol Tff7b72=Tff7b72= Te6edf3DfuProtocolKindTb4b4b4.Te6edf3LEGACY Tff7b72&Tff7b72& Te6edf3isPrimary Tff7b72&Tff7b72& Te6edf3detection Tff7b72=Tff7b72= Te6edf3BootloaderDetectionTb4b4b4.Te6edf3LegacyObserved Tff7b72-Tff7b72>

Te6edf3DfuAttemptBudgetTb4b4b4(

Te6edf3preEngagementAttempts Tff7b72= Te6edf3LEGACY_SESSION_ATTEMPTSTb4b4b4,

Te6edf3engagedAttempts Tff7b72= Te6edf3LEGACY_SESSION_ATTEMPTSTb4b4b4,

Tb4b4b4)

T8b949e// Unknown Legacy primary and Legacy alternate: speculative probe that promotes on engagement.

Tff7b72else Tff7b72-Tff7b72>

Te6edf3DfuAttemptBudgetTb4b4b4(

Te6edf3preEngagementAttempts Tff7b72= Te6edf3LIMITED_SESSION_ATTEMPTSTb4b4b4,

Te6edf3engagedAttempts Tff7b72= Te6edf3LEGACY_SESSION_ATTEMPTSTb4b4b4,

Tb4b4b4)

Tb4b4b4}

Tff7b72private Tff7b72fun Td2a8ffshouldTryAlternateAfterFailureTb4b4b4(Te6edf3isPrimaryTb4b4b4: Tffa657BooleanTb4b4b4, Te6edf3protocolEngagedTb4b4b4: Tffa657BooleanTb4b4b4)Tb4b4b4: Tffa657Boolean Tb4b4b4{

Tff7b72if Tb4b4b4(Tff7b72!Te6edf3isPrimaryTb4b4b4) Tff7b72return Tff7b72false

Tff7b72return Tff7b72when Tb4b4b4(Te6edf3detectionTb4b4b4) Tb4b4b4{

T8b949e// Unknown detection: Legacy is tried first, Secure fallback only if Legacy fails before engagement.

Te6edf3BootloaderDetectionTb4b4b4.Te6edf3Unknown Tff7b72-Tff7b72> Tff7b72!Te6edf3protocolEngaged

T8b949e// Conclusive detection: a pre-engagement failure of the observed protocol does NOT immediately try the

T8b949e// opposite protocol. Alternate fallback is retained only after engagement failure — insurance against a

T8b949e// stale or misleading conclusive detection.

Te6edf3BootloaderDetectionTb4b4b4.Te6edf3LegacyObservedTb4b4b4,

Te6edf3BootloaderDetectionTb4b4b4.Te6edf3SecureObservedTb4b4b4,

Tff7b72-Tff7b72> Te6edf3protocolEngaged

Tb4b4b4}

Tff7b72private Tff7b72fun Td2a8ffThrowableTff7b72?.Te6edf3withSuppressedAlternateTb4b4b4(Te6edf3alternateErrorTb4b4b4: Te6edf3ThrowableTb4b4b4)Tb4b4b4: Te6edf3Throwable Tb4b4b4{

Tff7b72val Te6edf3primary Tff7b72= Tff7b72this Tff7b72?: Tff7b72return Te6edf3alternateError

Tff7b72if Tb4b4b4(Te6edf3primary Tff7b72!Tff7b72=Tff7b72= Te6edf3alternateErrorTb4b4b4) Tb4b4b4{

Te6edf3primaryTb4b4b4.Te6edf3addSuppressedTb4b4b4(Te6edf3alternateErrorTb4b4b4)

Tb4b4b4}

Tff7b72return Te6edf3primary

Tb4b4b4}

T8b949e/** The DFU service UUID this protocol scans for, for diagnostic logging. Mirrors the transport's own scan filter. */

Tff7b72private Tff7b72fun Te6edf3DfuProtocolKindTb4b4b4.Td2a8ffserviceUuidTb4b4b4(Tb4b4b4)Tb4b4b4: Te6edf3Uuid Tff7b72= Tff7b72when Tb4b4b4(Tff7b72thisTb4b4b4) Tb4b4b4{

Te6edf3DfuProtocolKindTb4b4b4.Te6edf3LEGACY Tff7b72-Tff7b72> Te6edf3LegacyDfuUuidsTb4b4b4.Te6edf3SERVICE

Te6edf3DfuProtocolKindTb4b4b4.Te6edf3SECURE Tff7b72-Tff7b72> Te6edf3SecureDfuUuidsTb4b4b4.Te6edf3SERVICE

Tb4b4b4}

T8b949e/**

* Drives the bounded Legacy/Secure DFU upload retry loop. Extracted from [SecureDfuHandler.runDfuUploadWithRetry] so

* the retry policy can be unit-tested without bringing up the full BLE stack — callers supply a [runUploadSession]

* lambda that returns the next [DfuUploadResult] and a [resetStaleBootloader] lambda that performs the fresh-connection

* RESET-prime cycle.

*

* Policy:

* - Active attempt limit starts at [DfuAttemptBudget.preEngagementAttempts]; the first [DfuUploadResult.Failure] whose

* `protocolEngaged=true` promotes the active limit to [DfuAttemptBudget.engagedAttempts] BEFORE the budget-exhaustion

* check runs, so an engaged Legacy probe receives its full retry budget.

* - Non-[LegacyDfuException.StaleSessionReset] failures consume one upload attempt.

* - A [LegacyDfuException.StaleSessionReset] consumes one of [maxStaleResets], NOT an upload attempt — the cleanup

* cycle never tried to upload.

* - After the first [LegacyDfuException.MidStreamDisconnect] on Legacy, every subsequent Legacy attempt uses

* [LegacyDfuStreamProfile.RECOVERY]; a stale-session alone never switches the profile.

* - All exit paths are bounded: the loop stops when the upload-attempt budget is exhausted or the stale-response budget

* is exceeded. Up to [maxStaleResets] reset-prime cleanups run; the next stale response terminates without another

* cleanup.

* - [DfuProtocolKind.SECURE] carries pre==engaged budgets, so engagement promotion is a no-op there.

*

* If a mid-stream drop preceded the terminal failure, the first [LegacyDfuException.MidStreamDisconnect] is attached as

* a suppressed exception on the surfaced error so the underlying cause stays visible.

*/

Tf0883e@SuppressTb4b4b4(Ta5d6ff"Ta5d6ffCyclomaticComplexMethodTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffNestedBlockDepthTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffLongMethodTa5d6ff"Tb4b4b4)

Tff7b72internal Tff7b72suspend Tff7b72fun Td2a8ffrunDfuRetryLoopTb4b4b4(

Te6edf3protocolTb4b4b4: Te6edf3DfuProtocolKindTb4b4b4,

Te6edf3budgetTb4b4b4: Te6edf3DfuAttemptBudgetTb4b4b4,

Te6edf3maxStaleResetsTb4b4b4: Tffa657IntTb4b4b4,

Te6edf3runUploadSessionTb4b4b4: Te6edf3suspend Tb4b4b4(Te6edf3LegacyDfuStreamProfileTb4b4b4) Tff7b72-Tff7b72> Te6edf3DfuUploadResultTb4b4b4,

Te6edf3resetStaleBootloaderTb4b4b4: Te6edf3suspend Tb4b4b4(Tb4b4b4) Tff7b72-Tff7b72> Tffa657UnitTb4b4b4,

Te6edf3interAttemptDelayTb4b4b4: Te6edf3suspend Tb4b4b4(Tb4b4b4) Tff7b72-Tff7b72> Tffa657UnitTb4b4b4,

Tb4b4b4)Tb4b4b4: Te6edf3DfuUploadResult Tb4b4b4{

Tff7b72var Te6edf3uploadAttempts Tff7b72= T79c0ff0

Tff7b72var Te6edf3staleResets Tff7b72= T79c0ff0

Tff7b72var Te6edf3midStreamSeen Tff7b72= Tff7b72false

Tff7b72var Te6edf3firstMidStreamErrorTb4b4b4: Te6edf3LegacyDfuExceptionTb4b4b4.Te6edf3MidStreamDisconnectTff7b72? Tff7b72= Tff7b72null

Tff7b72var Te6edf3lastErrorTb4b4b4: Te6edf3Throwable? Tff7b72= Tff7b72null

Tff7b72var Te6edf3protocolEngaged Tff7b72= Tff7b72false

Tff7b72var Te6edf3activeAttempts Tff7b72= Te6edf3budgetTb4b4b4.Te6edf3preEngagementAttempts

Tff7b72while Tb4b4b4(Te6edf3uploadAttempts Tff7b72< Te6edf3activeAttemptsTb4b4b4) Tb4b4b4{

Tff7b72var Te6edf3skipInterAttemptDelay Tff7b72= Tff7b72false

Tff7b72val Te6edf3profile Tff7b72=

Tff7b72if Tb4b4b4(Te6edf3protocol Tff7b72=Tff7b72= Te6edf3DfuProtocolKindTb4b4b4.Te6edf3LEGACY Tff7b72&Tff7b72& Te6edf3midStreamSeenTb4b4b4) Tb4b4b4{

Te6edf3LegacyDfuStreamProfileTb4b4b4.Te6edf3RECOVERY

Tb4b4b4} Tff7b72else Tb4b4b4{

Te6edf3LegacyDfuStreamProfileTb4b4b4.Te6edf3NORMAL

Tb4b4b4}

Te6edf3uploadAttemptsTff7b72+Tff7b72+

Te6edf3LoggerTb4b4b4.Te6edf3i Tb4b4b4{ Ta5d6ff"Ta5d6ffDFU: upload attempt Tffd700$Te6edf3uploadAttemptsTa5d6ff/Tffd700$Te6edf3activeAttemptsTa5d6ff (Tffd700$Te6edf3protocolTa5d6ff, profile=Tffd700$Te6edf3profileTa5d6ff)Ta5d6ff" Tb4b4b4}

Tff7b72when Tb4b4b4(Tff7b72val Te6edf3result Tff7b72= Te6edf3runUploadSessionTb4b4b4(Te6edf3profileTb4b4b4)Tb4b4b4) Tb4b4b4{

Te6edf3DfuUploadResultTb4b4b4.Te6edf3Success Tff7b72-Tff7b72> Tff7b72return Te6edf3result

Tff7b72is Te6edf3DfuUploadResultTb4b4b4.Te6edf3Failure Tff7b72-Tff7b72> Tb4b4b4{

Te6edf3lastError Tff7b72= Te6edf3resultTb4b4b4.Te6edf3error

Tff7b72val Te6edf3wasEngaged Tff7b72= Te6edf3protocolEngaged

Te6edf3protocolEngaged Tff7b72= Te6edf3protocolEngaged Tff7b72|Tff7b72| Te6edf3resultTb4b4b4.Te6edf3protocolEngaged

T8b949e// Promote the upload budget the moment a session first reports protocolEngaged. Promotion happens

T8b949e// BEFORE the budget-exhaustion check (the while condition on the next iteration) so an engaged

T8b949e// Legacy probe receives its full retry budget. For Secure (pre==engaged) this is a no-op.

Tff7b72if Tb4b4b4(Tff7b72!Te6edf3wasEngaged Tff7b72&Tff7b72& Te6edf3protocolEngaged Tff7b72&Tff7b72& Te6edf3activeAttempts Tff7b72< Te6edf3budgetTb4b4b4.Te6edf3engagedAttemptsTb4b4b4) Tb4b4b4{

Te6edf3activeAttempts Tff7b72= Te6edf3budgetTb4b4b4.Te6edf3engagedAttempts

Te6edf3LoggerTb4b4b4.Te6edf3i Tb4b4b4{

Ta5d6ff"Ta5d6ffDFU: protocol engaged; promoting upload budget Ta5d6ff" Tff7b72+

Ta5d6ff"Ta5d6ff(Tffd700${Te6edf3budgetTb4b4b4.Te6edf3preEngagementAttemptsTffd700}Ta5d6ff → Tffd700${Te6edf3budgetTb4b4b4.Te6edf3engagedAttemptsTffd700}Ta5d6ff) (Tffd700$Te6edf3protocolTa5d6ff)Ta5d6ff"

Tb4b4b4}

T8b949e// Legacy-only stale-session handling. StaleSessionReset consumes a stale-reset cycle, NOT an upload

T8b949e// attempt — the cycle never tried to upload.

Tff7b72if Tb4b4b4(Te6edf3protocol Tff7b72=Tff7b72= Te6edf3DfuProtocolKindTb4b4b4.Te6edf3LEGACY Tff7b72&Tff7b72& Te6edf3resultTb4b4b4.Te6edf3error Tff7b72is Te6edf3LegacyDfuExceptionTb4b4b4.Te6edf3StaleSessionResetTb4b4b4) Tb4b4b4{

Te6edf3uploadAttemptsTff7b72-Tff7b72-

Te6edf3staleResetsTff7b72+Tff7b72+

Tff7b72if Tb4b4b4(Te6edf3staleResets Tff7b72> Te6edf3maxStaleResetsTb4b4b4) Tb4b4b4{

Te6edf3LoggerTb4b4b4.Te6edf3w Tb4b4b4{

Ta5d6ff"Ta5d6ffDFU: stale cleanup exhausted (Tffd700$Te6edf3staleResetsTa5d6ff > Tffd700$Te6edf3maxStaleResetsTa5d6ff) — giving up on Tffd700$Te6edf3protocolTa5d6ff"

Tb4b4b4}

Tff7b72break

Tb4b4b4}

Tff7b72if Tb4b4b4(Te6edf3midStreamSeenTb4b4b4) Tb4b4b4{

T8b949e// Expected: a stale session is the natural residue of a mid-stream drop, so an informational

T8b949e// log keeps the operator calm.

Te6edf3LoggerTb4b4b4.Te6edf3i Tb4b4b4{

Ta5d6ff"Ta5d6ffDFU: stale cleanup cycle Tffd700$Te6edf3staleResetsTa5d6ff/Tffd700$Te6edf3maxStaleResetsTa5d6ff after mid-stream drop Ta5d6ff" Tff7b72+

Ta5d6ff"Ta5d6ff(expected) (Tffd700$Te6edf3protocolTa5d6ff)Ta5d6ff"

Tb4b4b4}

Tb4b4b4} Tff7b72else Tb4b4b4{

T8b949e// Unexpected: the very first session came up stale with no preceding drop, which usually

T8b949e// means the device was stranded in the bootloader before this update began.

Te6edf3LoggerTb4b4b4.Te6edf3w Tb4b4b4{

Ta5d6ff"Ta5d6ffDFU: stale cleanup cycle Tffd700$Te6edf3staleResetsTa5d6ff/Tffd700$Te6edf3maxStaleResetsTa5d6ff — unexpected initial stale Ta5d6ff" Tff7b72+

Ta5d6ff"Ta5d6ffsession (Tffd700$Te6edf3protocolTa5d6ff)Ta5d6ff"

Tb4b4b4}

Te6edf3resetStaleBootloaderTb4b4b4(Tb4b4b4)

Te6edf3skipInterAttemptDelay Tff7b72= Tff7b72true

Tb4b4b4}

Tff7b72if Tb4b4b4(Tff7b72!Te6edf3skipInterAttemptDelayTb4b4b4) Tb4b4b4{

T8b949e// Mid-stream disconnect: switch subsequent Legacy uploads to the recovery profile and surface the

T8b949e// host in-flight offset in the log so it is not hidden by later cleanup failures.

Tff7b72val Te6edf3error Tff7b72= Te6edf3resultTb4b4b4.Te6edf3error

Tff7b72if Tb4b4b4(Te6edf3protocol Tff7b72=Tff7b72= Te6edf3DfuProtocolKindTb4b4b4.Te6edf3LEGACY Tff7b72&Tff7b72& Te6edf3error Tff7b72is Te6edf3LegacyDfuExceptionTb4b4b4.Te6edf3MidStreamDisconnectTb4b4b4) Tb4b4b4{

Tff7b72if Tb4b4b4(Tff7b72!Te6edf3midStreamSeenTb4b4b4) Tb4b4b4{

Te6edf3midStreamSeen Tff7b72= Tff7b72true

Te6edf3firstMidStreamError Tff7b72= Te6edf3error

Tb4b4b4}

Te6edf3LoggerTb4b4b4.Te6edf3wTb4b4b4(Te6edf3errorTb4b4b4) Tb4b4b4{

Ta5d6ff"Ta5d6ffDFU: mid-stream disconnect at host in-flight offset Ta5d6ff" Tff7b72+

Ta5d6ff"Tffd700${Te6edf3errorTb4b4b4.Te6edf3bytesSentTffd700}Ta5d6ff/Tffd700${Te6edf3errorTb4b4b4.Te6edf3totalBytesTffd700}Ta5d6ff Ta5d6ff" Tff7b72+

Ta5d6ff"Ta5d6ff(state=Tffd700${Te6edf3errorTb4b4b4.Te6edf3connectionStateTffd700}Ta5d6ff); subsequent Tffd700$Te6edf3protocolTa5d6ff attempts will use Ta5d6ff" Tff7b72+

Ta5d6ff"Tffd700${Te6edf3LegacyDfuStreamProfileTb4b4b4.Te6edf3RECOVERYTffd700}Ta5d6ff"

Tb4b4b4}

Tb4b4b4} Tff7b72else Tb4b4b4{

Te6edf3LoggerTb4b4b4.Te6edf3wTb4b4b4(Te6edf3errorTb4b4b4) Tb4b4b4{

Ta5d6ff"Ta5d6ffDFU: upload attempt Tffd700$Te6edf3uploadAttemptsTa5d6ff/Tffd700$Te6edf3activeAttemptsTa5d6ff failed (Tffd700$Te6edf3protocolTa5d6ff): Ta5d6ff" Tff7b72+

Ta5d6ff"Tffd700${Te6edf3errorTff7b72::Te6edf3classTb4b4b4.Te6edf3simpleNameTffd700}Ta5d6ff"

Tb4b4b4}

Tff7b72if Tb4b4b4(Te6edf3uploadAttempts Tff7b72< Te6edf3activeAttemptsTb4b4b4) Te6edf3interAttemptDelayTb4b4b4(Tb4b4b4)

Tb4b4b4}

Tff7b72val Te6edf3error Tff7b72= Te6edf3lastError Tff7b72?: Te6edf3DfuExceptionTb4b4b4.Te6edf3TransferFailedTb4b4b4(Ta5d6ff"Ta5d6ffDFU upload failed after Tffd700$Te6edf3activeAttemptsTa5d6ff attempts (Tffd700$Te6edf3protocolTa5d6ff)Ta5d6ff"Tb4b4b4)

T8b949e// Keep the original mid-stream failure visible even when the terminal failure is a later cleanup/transfer error.

Te6edf3firstMidStreamErrorTff7b72?.Te6edf3let Tb4b4b4{ Te6edf3drop Tff7b72-Tff7b72>

Tff7b72if Tb4b4b4(Te6edf3error Tff7b72!Tff7b72=Tff7b72= Te6edf3dropTb4b4b4) Tb4b4b4{

Te6edf3errorTb4b4b4.Te6edf3addSuppressedTb4b4b4(Te6edf3dropTb4b4b4)

Tb4b4b4}

Tff7b72return Te6edf3DfuUploadResultTb4b4b4.Te6edf3FailureTb4b4b4(Te6edf3errorTb4b4b4, Te6edf3protocolEngagedTb4b4b4)

Tb4b4b4}

T8b949e/**

* Cleanup policy for a DFU upload session's transport. Extracted from [SecureDfuHandler.runUploadSession]'s finally

* block so the skip-abort / always-close contract can be tested directly.

*

* Semantics:

* - Executes in [NonCancellable] so close always runs even if the caller was cancelled.

* - Skips [DfuUploadTransport.abort] after a completed session — nothing to abort.

* - Skips [DfuUploadTransport.abort] after a [LegacyDfuException.StaleSessionReset] — some Legacy variants become

* unresponsive after INVALID_STATE, so the same-connection RESET may block or be ineffective; the fresh-connection

* reset-prime path owns recovery.

* - Skips [DfuUploadTransport.abort] after a [LegacyDfuException.MidStreamDisconnect] — the link has already dropped,

* so there is no live connection over which to deliver an abort.

* - Attempts [DfuUploadTransport.abort] after a [DfuException.ConnectionFailed] — [DfuException.ConnectionFailed] is

* produced by [connectWithRetry] for any exhausted connection or setup failure, including cases where a GATT

* connection was established but a subsequent step (e.g. unsupported bootloader version, profile setup) failed. A

* usable connection may still exist, so the bounded best-effort abort is attempted before close.

* - Otherwise calls [DfuUploadTransport.abort], then [DfuUploadTransport.close] in a nested finally.

* - [DfuUploadTransport.abort]'s own cancellation/Error propagation contract is preserved: the [NonCancellable] context

* prevents the outer coroutine cancellation from interrupting close, but an [Error] thrown by abort still propagates

* after close runs.

*/

Tff7b72internal Tff7b72suspend Tff7b72fun Td2a8ffcleanupDfuSessionTransportTb4b4b4(

Te6edf3transportTb4b4b4: Te6edf3DfuUploadTransportTb4b4b4,

Te6edf3completedTb4b4b4: Tffa657BooleanTb4b4b4,

Te6edf3sessionFailureTb4b4b4: Te6edf3Throwable?Tb4b4b4,

Tb4b4b4) Tb4b4b4{

Te6edf3withContextTb4b4b4(Te6edf3NonCancellableTb4b4b4) Tb4b4b4{

Tff7b72val Te6edf3skipAbort Tff7b72=

Te6edf3sessionFailure Tff7b72is Te6edf3LegacyDfuExceptionTb4b4b4.Te6edf3StaleSessionReset Tff7b72|Tff7b72|

Te6edf3sessionFailure Tff7b72is Te6edf3LegacyDfuExceptionTb4b4b4.Te6edf3MidStreamDisconnect

Tff7b72try Tb4b4b4{

Tff7b72if Tb4b4b4(Tff7b72!Te6edf3completed Tff7b72&Tff7b72& Tff7b72!Te6edf3skipAbortTb4b4b4) Te6edf3transportTb4b4b4.Te6edf3abortTb4b4b4(Tb4b4b4)

Tb4b4b4} Tff7b72finally Tb4b4b4{

Te6edf3transportTb4b4b4.Te6edf3closeTb4b4b4(Tb4b4b4)

Tb4b4b4}

T8b949e/**

* KMP [FirmwareUpdateHandler] for nRF52 devices.

*

* Despite its historical name, this handler now drives **both** Nordic Secure DFU (service `FE59`) and Nordic Legacy

* DFU / Adafruit `BLEDfu` (service `1530`). After triggering the buttonless reboot it sniffs which DFU service the

* bootloader exposes and dispatches to the matching [DfuUploadTransport] implementation.

*

* All platform I/O (zip extraction, file reading) is delegated to [FirmwareFileHandler].

*/

Tf0883e@Single

Tff7b72class T56d364SecureDfuHandlerTb4b4b4(

Tff7b72private Tff7b72val Te6edf3firmwareRetrieverTb4b4b4: Te6edf3FirmwareRetrieverTb4b4b4,

Tff7b72private Tff7b72val Te6edf3firmwareFileHandlerTb4b4b4: Te6edf3FirmwareFileHandlerTb4b4b4,

Tff7b72private Tff7b72val Te6edf3radioControllerTb4b4b4: Te6edf3RadioControllerTb4b4b4,

Tff7b72private Tff7b72val Te6edf3bleScannerTb4b4b4: Te6edf3BleScannerTb4b4b4,

Tff7b72private Tff7b72val Te6edf3bleConnectionFactoryTb4b4b4: Te6edf3BleConnectionFactoryTb4b4b4,

Tff7b72private Tff7b72val Te6edf3dispatchersTb4b4b4: Te6edf3CoroutineDispatchersTb4b4b4,

Tb4b4b4) Tb4b4b4: Te6edf3FirmwareUpdateHandler Tb4b4b4{

Tf0883e@SuppressTb4b4b4(Ta5d6ff"Ta5d6ffLongMethodTa5d6ff"Tb4b4b4)

Tff7b72override Tff7b72suspend Tff7b72fun Td2a8ffstartUpdateTb4b4b4(

Te6edf3releaseTb4b4b4: Te6edf3FirmwareReleaseTb4b4b4,

Te6edf3hardwareTb4b4b4: Te6edf3DeviceHardwareTb4b4b4,

Te6edf3targetTb4b4b4: Tffa657StringTb4b4b4,

Te6edf3updateStateTb4b4b4: Tb4b4b4(Te6edf3FirmwareUpdateStateTb4b4b4) Tff7b72-Tff7b72> Tffa657UnitTb4b4b4,

Te6edf3firmwareUriTb4b4b4: Te6edf3CommonUri?Tb4b4b4,

Tb4b4b4)Tb4b4b4: Te6edf3FirmwareArtifact? Tb4b4b4{

Tff7b72var Te6edf3cleanupArtifactTb4b4b4: Te6edf3FirmwareArtifact? Tff7b72= Tff7b72null

Tff7b72return Tff7b72try Tb4b4b4{

Te6edf3withContextTb4b4b4(Te6edf3ioDispatcherTb4b4b4) Tb4b4b4{

T8b949e// ── 1. Obtain the .zip file ──────────────────────────────────────

Te6edf3cleanupArtifact Tff7b72= Te6edf3obtainZipFileTb4b4b4(Te6edf3releaseTb4b4b4, Te6edf3hardwareTb4b4b4, Te6edf3firmwareUriTb4b4b4, Te6edf3updateStateTb4b4b4)

Tff7b72val Te6edf3zipFile Tff7b72= Te6edf3cleanupArtifact Tff7b72?: Tff7b72returnTf0883e@withContext Tff7b72null

T8b949e// ── 2. Extract .dat and .bin from zip ────────────────────────────

Te6edf3updateStateTb4b4b4(

Te6edf3FirmwareUpdateStateTb4b4b4.Te6edf3ProcessingTb4b4b4(

Te6edf3ProgressStateTb4b4b4(Te6edf3UiTextTb4b4b4.Te6edf3ResourceTb4b4b4(Te6edf3ResTb4b4b4.Te6edf3stringTb4b4b4.Te6edf3firmware_update_starting_dfuTb4b4b4)Tb4b4b4)Tb4b4b4,

Tb4b4b4)Tb4b4b4,

Tb4b4b4)

Tff7b72val Te6edf3entries Tff7b72= Te6edf3firmwareFileHandlerTb4b4b4.Te6edf3extractZipEntriesTb4b4b4(Te6edf3zipFileTb4b4b4)

Tff7b72val Te6edf3pkg Tff7b72= Te6edf3parseDfuZipEntriesTb4b4b4(Te6edf3entriesTb4b4b4)

T8b949e// ── 3. Disconnect mesh service, trigger buttonless DFU ───────────

Te6edf3updateStateTb4b4b4(

Te6edf3FirmwareUpdateStateTb4b4b4.Te6edf3ProcessingTb4b4b4(

Te6edf3ProgressStateTb4b4b4(Te6edf3UiTextTb4b4b4.Te6edf3ResourceTb4b4b4(Te6edf3ResTb4b4b4.Te6edf3stringTb4b4b4.Te6edf3firmware_update_enabling_dfuTb4b4b4)Tb4b4b4)Tb4b4b4,

Tb4b4b4)Tb4b4b4,

Tb4b4b4)

Te6edf3radioControllerTb4b4b4.Te6edf3setDeviceAddressTb4b4b4(Ta5d6ff"Ta5d6ffnTa5d6ff"Tb4b4b4)

Te6edf3delayTb4b4b4(Te6edf3GATT_RELEASE_DELAY_MSTb4b4b4)

T8b949e// The trigger always uses SecureDfuTransport — it speaks both Secure (FE59) and Legacy (1530)

T8b949e// buttonless triggers and falls back automatically (commit f26f610c0).

Tff7b72val Te6edf3triggerTransport Tff7b72= Te6edf3SecureDfuTransportTb4b4b4(Te6edf3bleScannerTb4b4b4, Te6edf3bleConnectionFactoryTb4b4b4, Te6edf3targetTb4b4b4, Te6edf3dispatchersTb4b4b4.Te6edf3defaultTb4b4b4)

Tff7b72try Tb4b4b4{

Te6edf3triggerTransportTb4b4b4.Te6edf3triggerButtonlessDfuTb4b4b4(Tb4b4b4)Tb4b4b4.Te6edf3onFailure Tb4b4b4{ Te6edf3e Tff7b72-Tff7b72>

Te6edf3LoggerTb4b4b4.Te6edf3wTb4b4b4(Te6edf3eTb4b4b4) Tb4b4b4{ Ta5d6ff"Ta5d6ffDFU: Buttonless trigger failed (Tffd700$Te6edf3eTa5d6ff) — device may already be in DFU modeTa5d6ff" Tb4b4b4}

Tb4b4b4}

Tb4b4b4} Tff7b72finally Tb4b4b4{

Te6edf3withContextTb4b4b4(Te6edf3NonCancellableTb4b4b4) Tb4b4b4{ Te6edf3triggerTransportTb4b4b4.Te6edf3closeTb4b4b4(Tb4b4b4) Tb4b4b4}

Tb4b4b4}

Te6edf3delayTb4b4b4(Te6edf3DFU_REBOOT_WAIT_MSTb4b4b4)

T8b949e// ── 4. Service detection: which DFU service does the bootloader advertise? ─

Tff7b72val Te6edf3detection Tff7b72= Te6edf3detectBootloaderProtocolTb4b4b4(Te6edf3targetTb4b4b4, Te6edf3updateStateTb4b4b4)

Te6edf3LoggerTb4b4b4.Te6edf3i Tb4b4b4{ Ta5d6ff"Ta5d6ffDFU: Bootloader detection = Tffd700$Te6edf3detectionTa5d6ff" Tb4b4b4}

T8b949e// NOTE: do NOT drop the bond for a same-address Legacy bootloader. When Meshtastic triggers

T8b949e// buttonless DFU it hands the app's bond keys to the bootloader (peer_data), and the Adafruit

T8b949e// bootloader then advertises the DFU service on the SAME address using whitelist filtering

T8b949e// (BLE_GAP_ADV_FP_FILTER_BOTH) keyed to the bonded peer. Removing the bond strips the phone's

T8b949e// identity so it no longer matches the whitelist — the phone then can't connect at all. The

T8b949e// shared LTK also lets the DFU link encrypt cleanly (verified on-air: AES-128, keySize 16), so the

T8b949e// bond must be KEPT, mirroring Nordic's DfuServiceInitiator.setKeepBond(true)/setRestoreBond(true).

T8b949e// This applies to BOTH protocols and to the fallback path — the bond is never removed or refreshed

T8b949e// anywhere in this handler.

T8b949e// Legacy DFU has no resume, so a confirmed Legacy session is retried whole (fresh transport +

T8b949e// reconnect + re-handshake), mirroring Nordic's DFU library ("the Legacy DFU will start again"). A

T8b949e// stock bootloader that leaves the first session's control-point handshake unanswered often responds

T8b949e// after a clean reconnect. Secure DFU resumes in place, so it runs a single session.

T8b949e// DfuFallbackCoordinator resolves the detection into an ordered protocol list; whether the alternate

T8b949e// is tried depends on detection-specific engagement rules (shouldTryAlternateAfterFailure).

Te6edf3DfuFallbackCoordinatorTb4b4b4(Te6edf3detectionTb4b4b4)Tb4b4b4.Te6edf3execute Tb4b4b4{ Te6edf3protocolTb4b4b4, Te6edf3budget Tff7b72-Tff7b72>

Te6edf3runDfuUploadWithRetryTb4b4b4(Te6edf3protocolTb4b4b4, Te6edf3targetTb4b4b4, Te6edf3pkgTb4b4b4, Te6edf3budgetTb4b4b4, Te6edf3updateStateTb4b4b4)

Tb4b4b4}

Te6edf3zipFile

Tb4b4b4}

Tb4b4b4} Tff7b72catch Tb4b4b4(Te6edf3eTb4b4b4: Te6edf3CancellationExceptionTb4b4b4) Tb4b4b4{

Tff7b72throw Te6edf3e

Tb4b4b4} Tff7b72catch Tb4b4b4(Te6edf3eTb4b4b4: Te6edf3DfuExceptionTb4b4b4) Tb4b4b4{

Te6edf3LoggerTb4b4b4.Te6edf3eTb4b4b4(Te6edf3eTb4b4b4) Tb4b4b4{ Ta5d6ff"Ta5d6ffDFU: Protocol errorTa5d6ff" Tb4b4b4}

Te6edf3updateStateTb4b4b4(

Te6edf3FirmwareUpdateStateTb4b4b4.Te6edf3ErrorTb4b4b4(Te6edf3UiTextTb4b4b4.Te6edf3ResourceTb4b4b4(Te6edf3ResTb4b4b4.Te6edf3stringTb4b4b4.Te6edf3firmware_update_ota_failedTb4b4b4, Te6edf3eTb4b4b4.Te6edf3message Tff7b72?: Ta5d6ff"Ta5d6ff"Tb4b4b4)Tb4b4b4)Tb4b4b4,

Tb4b4b4)

Te6edf3cleanupArtifact

Tb4b4b4} Tff7b72catch Tb4b4b4(Tf0883e@SuppressTb4b4b4(Ta5d6ff"Ta5d6ffTooGenericExceptionCaughtTa5d6ff"Tb4b4b4) Te6edf3eTb4b4b4: Te6edf3ExceptionTb4b4b4) Tb4b4b4{

Te6edf3LoggerTb4b4b4.Te6edf3eTb4b4b4(Te6edf3eTb4b4b4) Tb4b4b4{ Ta5d6ff"Ta5d6ffDFU: Unexpected errorTa5d6ff" Tb4b4b4}

Te6edf3updateStateTb4b4b4(

Te6edf3FirmwareUpdateStateTb4b4b4.Te6edf3ErrorTb4b4b4(Te6edf3UiTextTb4b4b4.Te6edf3ResourceTb4b4b4(Te6edf3ResTb4b4b4.Te6edf3stringTb4b4b4.Te6edf3firmware_update_ota_failedTb4b4b4, Te6edf3eTb4b4b4.Te6edf3message Tff7b72?: Ta5d6ff"Ta5d6ff"Tb4b4b4)Tb4b4b4)Tb4b4b4,

Tb4b4b4)

Te6edf3cleanupArtifact

Tb4b4b4}

T8b949e// ── Helpers ──────────────────────────────────────────────────────────────

T8b949e/**

* Detect which DFU service the bootloader advertises by scanning first for the Legacy (`1530`) service UUID. If

* Legacy is observed, return immediately; otherwise scan for the Secure (`FE59`) service UUID. The scans run

* sequentially because BLE scan is a shared OS resource and parallel scans are unreliable across Android versions.

*

* Returns a [BootloaderDetection] that keeps the inconclusive case (`Unknown`) *representable* instead of silently

* coercing a missed Legacy scan into a Secure-DFU verdict. The fallback coordinator resolves a detection into an

* ordered list of protocols to attempt, so a `Unknown` result no longer locks the handler into a single transport —

* both protocols are tried (Legacy first) before the update is declared failed. `Unknown` means neither service was

* observed in the detection windows.

*/

Tff7b72private Tff7b72suspend Tff7b72fun Td2a8ffdetectBootloaderProtocolTb4b4b4(

Te6edf3targetTb4b4b4: Tffa657StringTb4b4b4,

Te6edf3updateStateTb4b4b4: Tb4b4b4(Te6edf3FirmwareUpdateStateTb4b4b4) Tff7b72-Tff7b72> Tffa657UnitTb4b4b4,

Tb4b4b4)Tb4b4b4: Te6edf3BootloaderDetection Tb4b4b4{

Te6edf3updateStateTb4b4b4(

Te6edf3FirmwareUpdateStateTb4b4b4.Te6edf3ProcessingTb4b4b4(Te6edf3ProgressStateTb4b4b4(Te6edf3UiTextTb4b4b4.Te6edf3ResourceTb4b4b4(Te6edf3ResTb4b4b4.Te6edf3stringTb4b4b4.Te6edf3firmware_update_waiting_rebootTb4b4b4)Tb4b4b4)Tb4b4b4)Tb4b4b4,

Tb4b4b4)

Tff7b72val Te6edf3macPlusOne Tff7b72= Te6edf3calculateMacPlusOneTb4b4b4(Te6edf3targetTb4b4b4)

Tff7b72val Te6edf3targetAddresses Tff7b72= Te6edf3setOfTb4b4b4(Te6edf3targetTb4b4b4, Te6edf3macPlusOneTb4b4b4)

Te6edf3LoggerTb4b4b4.Te6edf3i Tb4b4b4{ Ta5d6ff"Ta5d6ffDFU: detect — predicate matches original MAC and MAC+1Ta5d6ff" Tb4b4b4}

Te6edf3LoggerTb4b4b4.Te6edf3i Tb4b4b4{ Ta5d6ff"Ta5d6ffDFU: detect — scanning for Legacy DFU service (Tffd700${Te6edf3LegacyDfuUuidsTb4b4b4.Te6edf3SERVICETffd700}Ta5d6ff)Ta5d6ff" Tb4b4b4}

Tff7b72val Te6edf3legacyHit Tff7b72=

Te6edf3scanForBleDeviceTb4b4b4(

Te6edf3scanner Tff7b72= Te6edf3bleScannerTb4b4b4,

Te6edf3tag Tff7b72= Ta5d6ff"Ta5d6ffDFU detect (legacy)Ta5d6ff"Tb4b4b4,

Te6edf3serviceUuid Tff7b72= Te6edf3LegacyDfuUuidsTb4b4b4.Te6edf3SERVICETb4b4b4,

Te6edf3retryCount Tff7b72= T79c0ff1Tb4b4b4,

Te6edf3retryDelay Tff7b72= T79c0ff0.Te6edf3secondsTb4b4b4,

Te6edf3scanTimeout Tff7b72= Te6edf3DETECT_SCAN_TIMEOUTTb4b4b4,

Te6edf3predicate Tff7b72= Tb4b4b4{ Tffa657itTb4b4b4.Te6edf3address Tff7b72in Te6edf3targetAddresses Tb4b4b4}Tb4b4b4,

Tb4b4b4)

Tff7b72if Tb4b4b4(Te6edf3legacyHit Tff7b72!Tff7b72= Tff7b72nullTb4b4b4) Tb4b4b4{

Te6edf3LoggerTb4b4b4.Te6edf3i Tb4b4b4{

Ta5d6ff"Ta5d6ffDFU: detect — Legacy service observed; skipping Secure DFU scan (Legacy wins per orderedProtocols)Ta5d6ff"

Tb4b4b4}

Tff7b72return Te6edf3BootloaderDetectionTb4b4b4.Te6edf3LegacyObserved

Tb4b4b4}

Te6edf3LoggerTb4b4b4.Te6edf3i Tb4b4b4{ Ta5d6ff"Ta5d6ffDFU: detect — scanning for Secure DFU service (Tffd700${Te6edf3SecureDfuUuidsTb4b4b4.Te6edf3SERVICETffd700}Ta5d6ff)Ta5d6ff" Tb4b4b4}

Tff7b72val Te6edf3secureHit Tff7b72=

Te6edf3scanForBleDeviceTb4b4b4(

Te6edf3scanner Tff7b72= Te6edf3bleScannerTb4b4b4,

Te6edf3tag Tff7b72= Ta5d6ff"Ta5d6ffDFU detect (secure)Ta5d6ff"Tb4b4b4,

Te6edf3serviceUuid Tff7b72= Te6edf3SecureDfuUuidsTb4b4b4.Te6edf3SERVICETb4b4b4,

Te6edf3retryCount Tff7b72= T79c0ff1Tb4b4b4,

Te6edf3retryDelay Tff7b72= T79c0ff0.Te6edf3secondsTb4b4b4,

Te6edf3scanTimeout Tff7b72= Te6edf3DETECT_SCAN_TIMEOUTTb4b4b4,

Te6edf3predicate Tff7b72= Tb4b4b4{ Tffa657itTb4b4b4.Te6edf3address Tff7b72in Te6edf3targetAddresses Tb4b4b4}Tb4b4b4,

Tb4b4b4)

Tff7b72val Te6edf3detection Tff7b72= Tff7b72if Tb4b4b4(Te6edf3secureHit Tff7b72!Tff7b72= Tff7b72nullTb4b4b4) Te6edf3BootloaderDetectionTb4b4b4.Te6edf3SecureObserved Tff7b72else Te6edf3BootloaderDetectionTb4b4b4.Te6edf3Unknown

Te6edf3LoggerTb4b4b4.Te6edf3i Tb4b4b4{ Ta5d6ff"Ta5d6ffDFU: detect — secureHit=Tffd700${Te6edf3secureHit Tff7b72!Tff7b72= Tff7b72nullTffd700}Ta5d6ff, result=Tffd700$Te6edf3detectionTa5d6ff" Tb4b4b4}

Tff7b72return Te6edf3detection

Tb4b4b4}

T8b949e/**

* Run the connect + init + firmware upload, retrying within the [DfuFallbackCoordinator] budget. Delegates the

* bounded retry logic to [runDfuRetryLoop] (testable without bringing up the full BLE stack); the lambdas here

* supply the real [runUploadSession] and [resetStaleBootloader] implementations.

*/

Tff7b72private Tff7b72suspend Tff7b72fun Td2a8ffrunDfuUploadWithRetryTb4b4b4(

Te6edf3protocolTb4b4b4: Te6edf3DfuProtocolKindTb4b4b4,

Te6edf3targetTb4b4b4: Tffa657StringTb4b4b4,

Te6edf3pkgTb4b4b4: Te6edf3DfuZipPackageTb4b4b4,

Te6edf3budgetTb4b4b4: Te6edf3DfuAttemptBudgetTb4b4b4,

Te6edf3updateStateTb4b4b4: Tb4b4b4(Te6edf3FirmwareUpdateStateTb4b4b4) Tff7b72-Tff7b72> Tffa657UnitTb4b4b4,

Tb4b4b4)Tb4b4b4: Te6edf3DfuUploadResult Tff7b72= Te6edf3runDfuRetryLoopTb4b4b4(

Te6edf3protocol Tff7b72= Te6edf3protocolTb4b4b4,

Te6edf3budget Tff7b72= Te6edf3budgetTb4b4b4,

Te6edf3maxStaleResets Tff7b72= Te6edf3MAX_LEGACY_STALE_RESETSTb4b4b4,

Te6edf3runUploadSession Tff7b72= Tb4b4b4{ Te6edf3profile Tff7b72-Tff7b72> Te6edf3runUploadSessionTb4b4b4(Te6edf3protocolTb4b4b4, Te6edf3targetTb4b4b4, Te6edf3pkgTb4b4b4, Te6edf3profileTb4b4b4, Te6edf3updateStateTb4b4b4) Tb4b4b4}Tb4b4b4,

Te6edf3resetStaleBootloader Tff7b72= Tb4b4b4{ Te6edf3resetStaleBootloaderTb4b4b4(Te6edf3protocolTb4b4b4, Te6edf3targetTb4b4b4) Tb4b4b4}Tb4b4b4,

Te6edf3interAttemptDelay Tff7b72= Tb4b4b4{ Te6edf3delayTb4b4b4(Te6edf3SESSION_RETRY_DELAY_MSTb4b4b4) Tb4b4b4}Tb4b4b4,

Tb4b4b4)

Tff7b72private Tff7b72fun Td2a8ffcreateTransportTb4b4b4(

Te6edf3protocolTb4b4b4: Te6edf3DfuProtocolKindTb4b4b4,

Te6edf3targetTb4b4b4: Tffa657StringTb4b4b4,

Te6edf3legacyProfileTb4b4b4: Te6edf3LegacyDfuStreamProfile Tff7b72= Te6edf3LegacyDfuStreamProfileTb4b4b4.Te6edf3NORMALTb4b4b4,

Tb4b4b4)Tb4b4b4: Te6edf3DfuUploadTransport Tff7b72= Tff7b72when Tb4b4b4(Te6edf3protocolTb4b4b4) Tb4b4b4{

T8b949e// Legacy transport receives the selected stream profile; default NORMAL keeps prior behavior for any caller

T8b949e// that does not pass an explicit profile (e.g. reset-prime, which is a control-point operation only).

Te6edf3DfuProtocolKindTb4b4b4.Te6edf3LEGACY Tff7b72-Tff7b72>

Te6edf3LegacyDfuTransportTb4b4b4(Te6edf3bleScannerTb4b4b4, Te6edf3bleConnectionFactoryTb4b4b4, Te6edf3targetTb4b4b4, Te6edf3dispatchersTb4b4b4.Te6edf3defaultTb4b4b4, Te6edf3legacyProfileTb4b4b4)

Te6edf3DfuProtocolKindTb4b4b4.Te6edf3SECURE Tff7b72-Tff7b72> Te6edf3SecureDfuTransportTb4b4b4(Te6edf3bleScannerTb4b4b4, Te6edf3bleConnectionFactoryTb4b4b4, Te6edf3targetTb4b4b4, Te6edf3dispatchersTb4b4b4.Te6edf3defaultTb4b4b4)

Tb4b4b4}

T8b949e/**

* Reboot a bootloader wedged in a stale DFU session. Connects a fresh transport (which is responsive before any

* START) and issues RESET (0x06) via the bounded [DfuUploadTransport.abort], then closes the connection and waits

* for the configured [RESET_PRIME_REBOOT_WAIT_MS] reboot/re-advertisement interval. Operational [Exception]s during

* abort are best-effort (swallowed by [DfuUploadTransport.abort]); structured-concurrency cancellation and [Error]

* subtypes propagate per the abort contract.

*/

Tff7b72private Tff7b72suspend Tff7b72fun Td2a8ffresetStaleBootloaderTb4b4b4(Te6edf3protocolTb4b4b4: Te6edf3DfuProtocolKindTb4b4b4, Te6edf3targetTb4b4b4: Tffa657StringTb4b4b4) Tb4b4b4{

Te6edf3LoggerTb4b4b4.Te6edf3i Tb4b4b4{ Ta5d6ff"Ta5d6ffDFU: reset-priming stale bootloader before retryTa5d6ff" Tb4b4b4}

Tff7b72val Te6edf3transport Tff7b72= Te6edf3createTransportTb4b4b4(Te6edf3protocolTb4b4b4, Te6edf3targetTb4b4b4)

Tff7b72try Tb4b4b4{

Te6edf3transport

Tb4b4b4.Te6edf3connectToDfuModeTb4b4b4(Tb4b4b4)

Tb4b4b4.Te6edf3onSuccess Tb4b4b4{

Te6edf3transportTb4b4b4.Te6edf3abortTb4b4b4(Tb4b4b4)

Te6edf3LoggerTb4b4b4.Te6edf3i Tb4b4b4{ Ta5d6ff"Ta5d6ffDFU: reset-prime RESET attempted; disconnecting and waiting for re-advertisementTa5d6ff" Tb4b4b4}

Tb4b4b4}

Tb4b4b4.Te6edf3onFailure Tb4b4b4{ Te6edf3LoggerTb4b4b4.Te6edf3wTb4b4b4(Tffa657itTb4b4b4) Tb4b4b4{ Ta5d6ff"Ta5d6ffDFU: reset-prime connect failed: Tffd700${Tffa657itTb4b4b4.Te6edf3messageTffd700}Ta5d6ff" Tb4b4b4} Tb4b4b4}

Tb4b4b4} Tff7b72finally Tb4b4b4{

Te6edf3withContextTb4b4b4(Te6edf3NonCancellableTb4b4b4) Tb4b4b4{ Te6edf3transportTb4b4b4.Te6edf3closeTb4b4b4(Tb4b4b4) Tb4b4b4}

Tb4b4b4}

Te6edf3delayTb4b4b4(Te6edf3RESET_PRIME_REBOOT_WAIT_MSTb4b4b4)

Tb4b4b4}

T8b949e/** A single connect + init-packet + firmware-upload session over a fresh transport; always cleans up. */

Tff7b72private Tff7b72suspend Tff7b72fun Td2a8ffrunUploadSessionTb4b4b4(

Te6edf3protocolTb4b4b4: Te6edf3DfuProtocolKindTb4b4b4,

Te6edf3targetTb4b4b4: Tffa657StringTb4b4b4,

Te6edf3pkgTb4b4b4: Te6edf3DfuZipPackageTb4b4b4,

Te6edf3legacyProfileTb4b4b4: Te6edf3LegacyDfuStreamProfileTb4b4b4,

Te6edf3updateStateTb4b4b4: Tb4b4b4(Te6edf3FirmwareUpdateStateTb4b4b4) Tff7b72-Tff7b72> Tffa657UnitTb4b4b4,

Tb4b4b4)Tb4b4b4: Te6edf3DfuUploadResult Tb4b4b4{

Tff7b72val Te6edf3transportTb4b4b4: Te6edf3DfuUploadTransport Tff7b72= Te6edf3createTransportTb4b4b4(Te6edf3protocolTb4b4b4, Te6edf3targetTb4b4b4, Te6edf3legacyProfileTb4b4b4)

Tff7b72var Te6edf3completed Tff7b72= Tff7b72false

Tff7b72var Te6edf3protocolEngaged Tff7b72= Tff7b72false

Tff7b72var Te6edf3sessionFailureTb4b4b4: Te6edf3Throwable? Tff7b72= Tff7b72null

Tff7b72try Tb4b4b4{

Te6edf3connectWithRetryTb4b4b4(Te6edf3transportTb4b4b4, Te6edf3protocolTb4b4b4, Te6edf3updateStateTb4b4b4)

Te6edf3protocolEngaged Tff7b72= Tff7b72true

Te6edf3updateStateTb4b4b4(

Te6edf3FirmwareUpdateStateTb4b4b4.Te6edf3ProcessingTb4b4b4(Te6edf3ProgressStateTb4b4b4(Te6edf3UiTextTb4b4b4.Te6edf3ResourceTb4b4b4(Te6edf3ResTb4b4b4.Te6edf3stringTb4b4b4.Te6edf3firmware_update_starting_dfuTb4b4b4)Tb4b4b4)Tb4b4b4)Tb4b4b4,

Tb4b4b4)

Te6edf3LoggerTb4b4b4.Te6edf3i Tb4b4b4{

Ta5d6ff"Ta5d6ffDFU: Sending init packet (Tffd700${Te6edf3pkgTb4b4b4.Te6edf3initPacketTb4b4b4.Te6edf3sizeTffd700}Ta5d6ff bytes) and firmware Ta5d6ff" Tff7b72+

Ta5d6ff"Ta5d6ff(Tffd700${Te6edf3pkgTb4b4b4.Te6edf3firmwareTb4b4b4.Te6edf3sizeTffd700}Ta5d6ff bytes) via Tffd700$Te6edf3protocolTa5d6ff"

Tb4b4b4}

Te6edf3transportTb4b4b4.Te6edf3transferInitPacketTb4b4b4(Te6edf3pkgTb4b4b4.Te6edf3initPacketTb4b4b4)Tb4b4b4.Te6edf3getOrThrowTb4b4b4(Tb4b4b4)

Tff7b72val Te6edf3uploadMsg Tff7b72= Te6edf3UiTextTb4b4b4.Te6edf3ResourceTb4b4b4(Te6edf3ResTb4b4b4.Te6edf3stringTb4b4b4.Te6edf3firmware_update_uploadingTb4b4b4)

Tff7b72val Te6edf3slowHint Tff7b72=

Tff7b72if Tb4b4b4(Te6edf3transportTb4b4b4.Te6edf3isLowSpeedTransferTb4b4b4) Tb4b4b4{

Te6edf3UiTextTb4b4b4.Te6edf3ResourceTb4b4b4(Te6edf3ResTb4b4b4.Te6edf3stringTb4b4b4.Te6edf3firmware_update_slow_bootloader_hintTb4b4b4)

Tb4b4b4} Tff7b72else Tb4b4b4{

Tff7b72null

Tb4b4b4}

Te6edf3updateStateTb4b4b4(Te6edf3FirmwareUpdateStateTb4b4b4.Te6edf3UpdatingTb4b4b4(Te6edf3ProgressStateTb4b4b4(Te6edf3uploadMsgTb4b4b4, T79c0ff0fTb4b4b4, Te6edf3hint Tff7b72= Te6edf3slowHintTb4b4b4)Tb4b4b4)Tb4b4b4)

Tff7b72val Te6edf3firmwareSize Tff7b72= Te6edf3pkgTb4b4b4.Te6edf3firmwareTb4b4b4.Te6edf3size

Tff7b72val Te6edf3throughputTracker Tff7b72= Te6edf3ThroughputTrackerTb4b4b4(Tb4b4b4)

Te6edf3transport

Tb4b4b4.Te6edf3transferFirmwareTb4b4b4(Te6edf3pkgTb4b4b4.Te6edf3firmwareTb4b4b4) Tb4b4b4{ Te6edf3progress Tff7b72-Tff7b72>

Tff7b72val Te6edf3bytesSent Tff7b72= Tb4b4b4(Te6edf3progress Tff7b72* Te6edf3firmwareSizeTb4b4b4)Tb4b4b4.Te6edf3toLongTb4b4b4(Tb4b4b4)

Te6edf3throughputTrackerTb4b4b4.Te6edf3recordTb4b4b4(Te6edf3bytesSentTb4b4b4)

Tff7b72val Te6edf3details Tff7b72= Te6edf3formatTransferProgressTb4b4b4(Te6edf3progressTb4b4b4, Te6edf3firmwareSizeTb4b4b4, Te6edf3throughputTrackerTb4b4b4.Te6edf3bytesPerSecondTb4b4b4(Tb4b4b4)Tb4b4b4)

Te6edf3updateStateTb4b4b4(

Te6edf3FirmwareUpdateStateTb4b4b4.Te6edf3UpdatingTb4b4b4(Te6edf3ProgressStateTb4b4b4(Te6edf3uploadMsgTb4b4b4, Te6edf3progressTb4b4b4, Te6edf3detailsTb4b4b4, Te6edf3hint Tff7b72= Te6edf3slowHintTb4b4b4)Tb4b4b4)Tb4b4b4,

Tb4b4b4)

Tb4b4b4}

Tb4b4b4.Te6edf3getOrThrowTb4b4b4(Tb4b4b4)

Te6edf3updateStateTb4b4b4(

Te6edf3FirmwareUpdateStateTb4b4b4.Te6edf3ProcessingTb4b4b4(Te6edf3ProgressStateTb4b4b4(Te6edf3UiTextTb4b4b4.Te6edf3ResourceTb4b4b4(Te6edf3ResTb4b4b4.Te6edf3stringTb4b4b4.Te6edf3firmware_update_validatingTb4b4b4)Tb4b4b4)Tb4b4b4)Tb4b4b4,

Tb4b4b4)

Te6edf3completed Tff7b72= Tff7b72true

Te6edf3updateStateTb4b4b4(Te6edf3FirmwareUpdateStateTb4b4b4.Te6edf3SuccessTb4b4b4(Te6edf3wasLowSpeedTransfer Tff7b72= Te6edf3transportTb4b4b4.Te6edf3isLowSpeedTransferTb4b4b4)Tb4b4b4)

Tff7b72return Te6edf3DfuUploadResultTb4b4b4.Te6edf3Success

Tb4b4b4} Tff7b72catch Tb4b4b4(Te6edf3eTb4b4b4: Te6edf3CancellationExceptionTb4b4b4) Tb4b4b4{

Tff7b72throw Te6edf3e

Tb4b4b4} Tff7b72catch Tb4b4b4(Tf0883e@SuppressTb4b4b4(Ta5d6ff"Ta5d6ffTooGenericExceptionCaughtTa5d6ff"Tb4b4b4) Te6edf3eTb4b4b4: Te6edf3ExceptionTb4b4b4) Tb4b4b4{

Te6edf3sessionFailure Tff7b72= Te6edf3e

Tff7b72return Te6edf3DfuUploadResultTb4b4b4.Te6edf3FailureTb4b4b4(Te6edf3eTb4b4b4, Te6edf3protocolEngagedTb4b4b4)

Tb4b4b4} Tff7b72finally Tb4b4b4{

Te6edf3cleanupDfuSessionTransportTb4b4b4(Te6edf3transportTb4b4b4, Te6edf3completedTb4b4b4, Te6edf3sessionFailureTb4b4b4)

Tb4b4b4}

Tff7b72private Tff7b72suspend Tff7b72fun Td2a8ffconnectWithRetryTb4b4b4(

Te6edf3transportTb4b4b4: Te6edf3DfuUploadTransportTb4b4b4,

Te6edf3protocolTb4b4b4: Te6edf3DfuProtocolKindTb4b4b4,

Te6edf3updateStateTb4b4b4: Tb4b4b4(Te6edf3FirmwareUpdateStateTb4b4b4) Tff7b72-Tff7b72> Tffa657UnitTb4b4b4,

Tb4b4b4) Tb4b4b4{

Tff7b72val Te6edf3serviceUuid Tff7b72= Te6edf3protocolTb4b4b4.Te6edf3serviceUuidTb4b4b4(Tb4b4b4)

Te6edf3updateStateTb4b4b4(

Te6edf3FirmwareUpdateStateTb4b4b4.Te6edf3ProcessingTb4b4b4(Te6edf3ProgressStateTb4b4b4(Te6edf3UiTextTb4b4b4.Te6edf3ResourceTb4b4b4(Te6edf3ResTb4b4b4.Te6edf3stringTb4b4b4.Te6edf3firmware_update_waiting_rebootTb4b4b4)Tb4b4b4)Tb4b4b4)Tb4b4b4,

Tb4b4b4)

Te6edf3retryWithDelayTb4b4b4(

Te6edf3attempts Tff7b72= Te6edf3CONNECT_ATTEMPTSTb4b4b4,

Te6edf3retryDelayMillis Tff7b72= Te6edf3RETRY_DELAY_MSTb4b4b4,

Te6edf3onAttempt Tff7b72= Tb4b4b4{ Te6edf3attempt Tff7b72-Tff7b72>

Te6edf3updateStateTb4b4b4(

Te6edf3FirmwareUpdateStateTb4b4b4.Te6edf3ProcessingTb4b4b4(

Te6edf3ProgressStateTb4b4b4(

Te6edf3UiTextTb4b4b4.Te6edf3ResourceTb4b4b4(

Te6edf3ResTb4b4b4.Te6edf3stringTb4b4b4.Te6edf3firmware_update_connecting_attemptTb4b4b4,

Te6edf3attemptTb4b4b4,

Te6edf3CONNECT_ATTEMPTSTb4b4b4,

Tb4b4b4)Tb4b4b4,

Tb4b4b4)

Tb4b4b4}Tb4b4b4,

Te6edf3block Tff7b72= Tb4b4b4{ Te6edf3attempt Tff7b72-Tff7b72>

Te6edf3LoggerTb4b4b4.Te6edf3i Tb4b4b4{

Ta5d6ff"Ta5d6ffDFU: Connect attempt Tffd700$Te6edf3attemptTa5d6ff/Tffd700$Te6edf3CONNECT_ATTEMPTSTa5d6ff via Tffd700$Te6edf3protocolTa5d6ff (scan service=Tffd700$Te6edf3serviceUuidTa5d6ff)Ta5d6ff"

Tb4b4b4}

Te6edf3transportTb4b4b4.Te6edf3connectToDfuModeTb4b4b4(Tb4b4b4)Tb4b4b4.Te6edf3onFailure Tb4b4b4{

Te6edf3LoggerTb4b4b4.Te6edf3wTb4b4b4(Tffa657itTb4b4b4) Tb4b4b4{

Ta5d6ff"Ta5d6ffDFU: Connect attempt Tffd700$Te6edf3attemptTa5d6ff/Tffd700$Te6edf3CONNECT_ATTEMPTSTa5d6ff via Tffd700$Te6edf3protocolTa5d6ff failed: Tffd700${Tffa657itTb4b4b4.Te6edf3messageTffd700}Ta5d6ff"

Tb4b4b4}

Tb4b4b4}Tb4b4b4,

Tb4b4b4)

Tb4b4b4.Te6edf3getOrElse Tb4b4b4{

Tff7b72throw Te6edf3DfuExceptionTb4b4b4.Te6edf3ConnectionFailedTb4b4b4(

Ta5d6ff"Ta5d6ffFailed to connect to DFU device via Tffd700$Te6edf3protocolTa5d6ff after Tffd700$Te6edf3CONNECT_ATTEMPTSTa5d6ff attemptsTa5d6ff"Tb4b4b4,

Tffa657itTb4b4b4,

Tb4b4b4)

Tb4b4b4}

Tff7b72private Tff7b72suspend Tff7b72fun Td2a8ffobtainZipFileTb4b4b4(

Te6edf3releaseTb4b4b4: Te6edf3FirmwareReleaseTb4b4b4,

Te6edf3hardwareTb4b4b4: Te6edf3DeviceHardwareTb4b4b4,

Te6edf3firmwareUriTb4b4b4: Te6edf3CommonUri?Tb4b4b4,

Te6edf3updateStateTb4b4b4: Tb4b4b4(Te6edf3FirmwareUpdateStateTb4b4b4) Tff7b72-Tff7b72> Tffa657UnitTb4b4b4,

Tb4b4b4)Tb4b4b4: Te6edf3FirmwareArtifact? Tb4b4b4{

Tff7b72if Tb4b4b4(Te6edf3firmwareUri Tff7b72!Tff7b72= Tff7b72nullTb4b4b4) Tb4b4b4{

Tff7b72return Te6edf3FirmwareArtifactTb4b4b4(Te6edf3uri Tff7b72= Te6edf3firmwareUriTb4b4b4, Te6edf3fileName Tff7b72= Te6edf3firmwareUriTb4b4b4.Te6edf3pathSegmentsTb4b4b4.Te6edf3lastOrNullTb4b4b4(Tb4b4b4)Tb4b4b4)

Tb4b4b4}

Tff7b72val Te6edf3downloadingMsg Tff7b72= Te6edf3getStringSuspendTb4b4b4(Te6edf3ResTb4b4b4.Te6edf3stringTb4b4b4.Te6edf3firmware_update_downloading_percentTb4b4b4, T79c0ff0Tb4b4b4)Tb4b4b4.Te6edf3stripFormatArgsTb4b4b4(Tb4b4b4)

Te6edf3updateStateTb4b4b4(

Te6edf3FirmwareUpdateStateTb4b4b4.Te6edf3DownloadingTb4b4b4(

Te6edf3ProgressStateTb4b4b4(Te6edf3message Tff7b72= Te6edf3UiTextTb4b4b4.Te6edf3DynamicStringTb4b4b4(Te6edf3downloadingMsgTb4b4b4)Tb4b4b4, Te6edf3progress Tff7b72= T79c0ff0fTb4b4b4)Tb4b4b4,

Tb4b4b4)Tb4b4b4,

Tb4b4b4)

Tff7b72val Te6edf3path Tff7b72=

Te6edf3firmwareRetrieverTb4b4b4.Te6edf3retrieveOtaFirmwareTb4b4b4(Te6edf3releaseTb4b4b4, Te6edf3hardwareTb4b4b4) Tb4b4b4{ Te6edf3progress Tff7b72-Tff7b72>

Tff7b72val Te6edf3pct Tff7b72= Tb4b4b4(Te6edf3progress Tff7b72* Te6edf3PERCENT_MAXTb4b4b4)Tb4b4b4.Te6edf3toIntTb4b4b4(Tb4b4b4)

Te6edf3updateStateTb4b4b4(

Te6edf3FirmwareUpdateStateTb4b4b4.Te6edf3DownloadingTb4b4b4(

Te6edf3ProgressStateTb4b4b4(Te6edf3UiTextTb4b4b4.Te6edf3DynamicStringTb4b4b4(Te6edf3downloadingMsgTb4b4b4)Tb4b4b4, Te6edf3progressTb4b4b4, Ta5d6ff"Tffd700$Te6edf3pctTa5d6ff%Ta5d6ff"Tb4b4b4)Tb4b4b4,

Tb4b4b4)Tb4b4b4,

Tb4b4b4)

Tb4b4b4}

Tff7b72if Tb4b4b4(Te6edf3path Tff7b72=Tff7b72= Tff7b72nullTb4b4b4) Tb4b4b4{

Te6edf3updateStateTb4b4b4(

Te6edf3FirmwareUpdateStateTb4b4b4.Te6edf3ErrorTb4b4b4(

Te6edf3UiTextTb4b4b4.Te6edf3ResourceTb4b4b4(Te6edf3ResTb4b4b4.Te6edf3stringTb4b4b4.Te6edf3firmware_update_not_found_in_releaseTb4b4b4, Te6edf3hardwareTb4b4b4.Te6edf3displayNameTb4b4b4)Tb4b4b4,

Tb4b4b4)Tb4b4b4,

Tb4b4b4)

Tb4b4b4}

Tff7b72return Te6edf3path

Tb4b4b4}

Tff7b72private Tff7b72companion Tff7b72object Tb4b4b4{

T8b949e/**

* Per-service scan timeout for bootloader protocol detection. Applied to both Legacy (1530) and Secure (FE59)

* scans. Sequential, so worst-case detection is 2× this value.

*/

Tff7b72private Tff7b72val Te6edf3DETECT_SCAN_TIMEOUT Tff7b72= T79c0ff8.Te6edf3seconds

T8b949e/** Delay between whole-session retries (lets the bootloader settle / resume advertising). */

Tff7b72private Tff7b72const Tff7b72val Te6edf3SESSION_RETRY_DELAY_MS Tff7b72= T79c0ff2Te6edf3_000L

T8b949e/** Wait after a reset-prime RESET for the bootloader to reboot and re-advertise a clean OTA session. */

Tff7b72private Tff7b72const Tff7b72val Te6edf3RESET_PRIME_REBOOT_WAIT_MS Tff7b72= T79c0ff4Te6edf3_000L

Tb4b4b4}