RTC, NVS & Data Safety
Partitions
| Partition | Offset | Size | Purpose |
|---|---|---|---|
nvs | 0x9000 | 24 KiB | Primary/backup saves |
phy_init | 0xF000 | 4 KiB | PHY |
factory | 0x10000 | 8 MiB | Production app |
storage | 0x810000 | 7 MiB | Future content reserve |
coredump | 0xF10000 | 512 KiB | Crash diagnosis |
Save envelope
Firmware stores magic PSTR, schema, state size, trusted-clock flag and FNV checksum. Read order is primary → backup. Corrupt and unknown formats are rejected rather than normalized from random bytes.
Schema evolution
| Stage | Envelope / State | Change |
|---|---|---|
| v6 | schema1 / v2 | Base settings and 240-byte state |
| early v7 | schema2 / v3 | Tilt level and other v7 state |
| 2026-08-19 | schema3 / v4 | Ambient display and power-save closure |
Host tests cover schema 1/2/3 migration, v4 round-trip, corrupt-primary fallback, checksum rejection, empty save and factory seal.
Write throttling
- Ordinary dirty state writes at most every 60 seconds.
- Purchase, settings, TEAM, Gift and launch write immediately.
- Ambient entry, restart and power-off use a synchronous barrier.
- Shutdown reads back and decodes; failure cancels software power-off.
RTC and offline rewards
PCF85063 keeps wall time through power loss. Invalid integrity seeds from firmware build time. Rewards require both current and saved time to be trustworthy, preventing uninitialized or rolled-back clocks from generating resources.
Rollback and coredump
All 16 MiB of Flash was backed up before migration. The coredump partition initializes correctly and validation found no crash dump. Restoring the original image overwrites all Flash and requires separate confirmation of port and image hash.