fix(firmware): harden release discovery errors

Guard bundled release compare-and-write behind the refresh mutex so an older bundled snapshot cannot race and replace fresher API data.

Stop collecting release flows after hardware resolution fails, clear stale firmware metadata on connected and recovery errors, and cover both paths in view-model tests.

Author: jeremiah-k

core/data/src/commonMain/kotlin/org/meshtastic/core/data/repository/FirmwareReleaseRepositoryImpl.kt

@@ -122,14 +122,17 @@ open class FirmwareReleaseRepositoryImpl(
 
             val bundled = bundledSnapshot?.releases ?: return
 
-            // Re-evaluate against the current active DB on every call — it may have switched devices.
-            val toApply =
-                listOf(FirmwareReleaseType.STABLE to bundled.stable, FirmwareReleaseType.ALPHA to bundled.alpha)
-                    .filter { (type, releases) -> isBundleNewerFor(type, releases) }
-                    .toMap()
-            if (toApply.isNotEmpty()) {
-                Logger.i { "FirmwareReleaseRepository: applying bundled snapshot for ${toApply.keys}" }
-                localDataSource.replaceFirmwareReleases(toApply)
+            refreshMutex.withLock {
+                // Re-evaluate against the current active DB under the same lock as network refresh so an older bundled
+                // snapshot cannot overwrite fresher data that just arrived from the API.
+                val toApply =
+                    listOf(FirmwareReleaseType.STABLE to bundled.stable, FirmwareReleaseType.ALPHA to bundled.alpha)
+                        .filter { (type, releases) -> isBundleNewerFor(type, releases) }
+                        .toMap()
+                if (toApply.isNotEmpty()) {
+                    Logger.i { "FirmwareReleaseRepository: applying bundled snapshot for ${toApply.keys}" }
+                    localDataSource.replaceFirmwareReleases(toApply)
+                }
             }
         }
     }

feature/firmware/src/commonMain/kotlin/org/meshtastic/feature/firmware/FirmwareUpdateViewModel.kt

@@ -172,22 +172,18 @@ class FirmwareUpdateViewModel(
                         enterRecoveryModeOrError()
                         return@launch
                     }
+                    val deviceHardware = getDeviceHardware(ourNode) ?: return@launch
+                    _deviceHardware.value = deviceHardware
+                    _currentFirmwareVersion.value = ourNode.firmwareVersion
+
                     val releaseFlow =
                         if (_selectedReleaseType.value == FirmwareReleaseType.LOCAL) {
                             flowOf(null)
                         } else {
                             firmwareReleaseRepository.getReleaseFlow(_selectedReleaseType.value)
                         }
-
-                    val deviceHardware = getDeviceHardware(ourNode)
-                    if (deviceHardware != null) {
-                        _deviceHardware.value = deviceHardware
-                        _currentFirmwareVersion.value = ourNode.firmwareVersion
-                    }
-
                     releaseFlow.collectLatest { release ->
                         _selectedRelease.value = release
-                        if (deviceHardware == null) return@collectLatest
 
                         val dismissed = bootloaderWarningDataSource.isDismissed(address)
                         val firmwareUpdateMethod =
@@ -247,12 +243,14 @@ class FirmwareUpdateViewModel(
     private suspend fun enterRecoveryModeOrError() {
         val recovery = firmwareRecoveryDataSource.pending.first()
         if (recovery == null) {
+            clearDeviceMetadata()
             _state.value = FirmwareUpdateState.Error(UiText.Resource(Res.string.firmware_update_no_device))
             return
         }
         pendingRecovery = recovery
         val hardware =
             deviceHardwareRepository.getDeviceHardwareByModel(recovery.hwModel, recovery.pioEnv).getOrElse {
+                clearDeviceMetadata()
                 _state.value =
                     FirmwareUpdateState.Error(
                         UiText.Resource(Res.string.firmware_update_unknown_hardware, recovery.hwModel),
@@ -587,6 +585,7 @@ class FirmwareUpdateViewModel(
     }
 
     private fun clearDeviceMetadata() {
+        _selectedRelease.value = null
         _deviceHardware.value = null
         _currentFirmwareVersion.value = null
     }

feature/firmware/src/commonTest/kotlin/org/meshtastic/feature/firmware/FirmwareUpdateViewModelTest.kt

@@ -26,6 +26,7 @@ import dev.mokkery.mock
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.ExperimentalCoroutinesApi
 import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.flow
 import kotlinx.coroutines.flow.flowOf
 import kotlinx.coroutines.test.StandardTestDispatcher
 import kotlinx.coroutines.test.advanceUntilIdle
@@ -44,6 +45,7 @@ import org.meshtastic.core.repository.RadioPrefs
 import org.meshtastic.core.resources.Res
 import org.meshtastic.core.resources.UiText
 import org.meshtastic.core.resources.firmware_update_battery_low
+import org.meshtastic.core.resources.firmware_update_unknown_hardware
 import org.meshtastic.core.testing.FakeNodeRepository
 import org.meshtastic.core.testing.FakeRadioController
 import org.meshtastic.core.testing.TestDataFactory
@@ -311,21 +313,23 @@ class FirmwareUpdateViewModelTest {
     fun `checkForUpdates sets error when hardware lookup fails`() = runTest {
         advanceUntilIdle()
         assertIs<FirmwareUpdateState.Ready>(viewModel.state.value)
+        assertEquals("1.0.0", viewModel.selectedRelease.value?.title)
         assertIs<DeviceHardware>(viewModel.deviceHardware.value)
         assertEquals("0.9.0", viewModel.currentFirmwareVersion.value)
 
-        val release = FirmwareRelease(id = "2", title = "2.0.0", zipUrl = "url", releaseNotes = "notes")
-        every { firmwareReleaseRepository.stableRelease } returns flowOf(release)
+        every { firmwareReleaseRepository.stableRelease } returns flow { error("cache read failed") }
         everySuspend { deviceHardwareRepository.getDeviceHardwareByModel(any(), any()) } returns
             Result.failure(IllegalStateException("Unknown hardware"))
 
         viewModel.checkForUpdates()
         advanceUntilIdle()
 
-        assertEquals(release, viewModel.selectedRelease.value)
+        assertEquals(null, viewModel.selectedRelease.value)
         assertEquals(null, viewModel.deviceHardware.value)
         assertEquals(null, viewModel.currentFirmwareVersion.value)
-        assertIs<FirmwareUpdateState.Error>(viewModel.state.value)
+        val errorState = assertIs<FirmwareUpdateState.Error>(viewModel.state.value)
+        val error = assertIs<UiText.Resource>(errorState.error)
+        assertEquals(Res.string.firmware_update_unknown_hardware, error.res)
     }
 
     @Test
@@ -439,4 +443,37 @@ class FirmwareUpdateViewModelTest {
         assertEquals("1234abcd", state.address) // fullAddress.drop(1)
         assertIs<FirmwareUpdateMethod.Ble>(state.updateMethod)
     }
+
+    @Test
+    fun `recovery hardware lookup failure clears stale device metadata`() = runTest {
+        advanceUntilIdle()
+        assertIs<FirmwareUpdateState.Ready>(viewModel.state.value)
+        assertEquals("1.0.0", viewModel.selectedRelease.value?.title)
+        assertIs<DeviceHardware>(viewModel.deviceHardware.value)
+        assertEquals("0.9.0", viewModel.currentFirmwareVersion.value)
+
+        every { radioPrefs.devAddr } returns MutableStateFlow(null)
+        every { firmwareRecoveryDataSource.pending } returns
+            flowOf(
+                PendingFirmwareRecovery(
+                    fullAddress = "x1234abcd",
+                    hwModel = 999,
+                    pioEnv = "unknown",
+                    releaseType = "STABLE",
+                    deviceName = "Stale Node",
+                ),
+            )
+        everySuspend { deviceHardwareRepository.getDeviceHardwareByModel(any(), any()) } returns
+            Result.failure(IllegalStateException("Unknown hardware"))
+
+        viewModel.checkForUpdates()
+        advanceUntilIdle()
+
+        assertEquals(null, viewModel.selectedRelease.value)
+        assertEquals(null, viewModel.deviceHardware.value)
+        assertEquals(null, viewModel.currentFirmwareVersion.value)
+        val errorState = assertIs<FirmwareUpdateState.Error>(viewModel.state.value)
+        val error = assertIs<UiText.Resource>(errorState.error)
+        assertEquals(Res.string.firmware_update_unknown_hardware, error.res)
+    }
 }