# Lappy v0.7.3 — audit-fix candidate

Subsequent Wi-Fi export/cancellation/shutdown hardware results are recorded in
[the v0.7.3 Wi-Fi bench](HARDWARE_BENCH_v0.7.3.md). The original scope below
describes the installation/build stage.

This candidate has not been flashed or physically validated. The original
v0.7.2 release archives and installed device settings are unchanged.

- Journal I/O errors cannot be treated as permission to truncate saved records;
  A/B saves preserve unreadable generations for retry.
- Track timing checks coordinate displacement against raw velocity and accuracy,
  rejecting contradictory GPS evidence before it can create a valid PB.
- Export cancellation cleans up late opens and interrupted downloads. Wi-Fi
  shutdown interrupts active sends and waits for SD ownership to become idle.
  A genuinely stuck card retains power and the recording lock for a safe retry.
- Device discovery replaces stale candidates after each successful scan. Selection
  binds to the displayed address and address type.
- Nonfinite saved numbers and invalid calendar conversions are rejected.
- Updater 1.3.0 authenticates schema-2 packages with Ed25519 before allowing the
  existing verified-backup/application-only update flow. Unsigned legacy packages
  are rejected; installed legacy V2 firmware remains supported through the signed
  compatibility list.

The signed package requires updater 1.3.0. The launch command selects that version.
Back up the owner release-signing key securely; only its public key is embedded
in the updater. No Secure Boot eFuses or partition migration are introduced.

Software validation includes the existing sanitizer-backed host suites, new
fault/concurrency/security regressions, all five simulator suites, the ESP32-S3
V2 build and linked stack/ATT checks. Actual receiver behavior, driving accuracy,
SD faults and network/power timing still need hardware acceptance. See
[implementation and validation scope](IMPLEMENTATION_v0.7.3.md).