@@ -0,0 +26,4 @@
+}
+
+// Just enough JSON to walk objects and pick named members out of them, which is
+// cheaper than a parser library and all the manifest needs.

@@ -0,0 +173,4 @@
+				matched = matched && *w == '\0';
+				return true;
+			}
+			if (c == '\\') return false;

@@ -0,0 +174,4 @@
+				return true;
+			}
+			if (c == '\\') return false;
+			if (*w == '\0') {

@@ -0,0 +220,4 @@
+		const int8_t member = scanner.nextMember(names, 3, false);
+		switch (member) {
+			case 0:
+				if (!scanner.readString(out.path, sizeof(out.path))) return false;

@@ -0,0 +40,4 @@
+	if (length <= 0) return retry(now);
+
+	if (fetchingManifest) {
+		if (static_cast<uint32_t>(length) > maxManifestLength) {

@@ -0,0 +45,4 @@
+			return false;
+		}
+	} else {
+		if (static_cast<uint32_t>(length) != image_.size) return retry(now);

@@ -0,0 +75,4 @@
+	}
+
+	if (read == 0) {
+		if (static_cast<uint32_t>(now - lastDataMs_) >= updateStallTimeoutMs) retry(now);

@@ -0,0 +21,4 @@
+	http_.setConnectTimeout(requestTimeoutMs);
+	http_.setTimeout(requestTimeoutMs);
+
+	if (http_.GET() != HTTP_CODE_OK) {

@@ -26,0 +26,4 @@
+	// Called while the radio is up, which is the only time a fetch can run.
+	virtual void loop(uint32_t now) = 0;
+
+	// The session has ended under it: whatever is in flight stops.

@@ -0,0 +131,4 @@
+
+// A path that will not fit is refused rather than truncated: a truncated path
+// fetches the wrong file or nothing at all.
+void test_a_path_too_long_to_hold_does_not_parse() {

@@ -840,0 +921,4 @@
+	node.loop(t0 + minuteMs);
+
+	TEST_ASSERT_EQUAL_UINT8(1, radio.offCalls);
+	TEST_ASSERT_EQUAL_UINT8(1, updater.cancelCalls);

@@ -959,2 +960,3 @@
 a transfer short: one already running reaches completion or failure first, so a
-short timeout cannot drop the radio mid-image.
+short timeout cannot drop the radio mid-image. A transfer that stalls, or that
+cannot finish within five minutes, fails of its own accord: holding the radio off

@@ -0,0 +58,4 @@
+			return false;
+		}
+
+		if (!sink_.begin(image_.size)) {

@@ -0,0 +46,4 @@
+
+	Stage stage() const { return stage_; }
+
+	// True once the whole image is in the inactive slot. The three below say

@@ -65,3 +65,3 @@
 	if (updateRequested_ && !updateStarted_ && updater_ != nullptr && serverAddress_ != 0 && state_ == can::wifi_state::connected) {
 		updateStarted_ = true;
-		updater_->beginUpdate(serverAddress_, serverPort_);
+		updater_->beginUpdate(serverAddress_, serverPort_, now);

@@ -21,7 +21,10 @@ class WifiUpdater {
 	virtual ~WifiUpdater() = default;
 
 	// Called once the node has joined and has an address to fetch from.

@@ -0,0 +131,4 @@
+
+// A path that will not fit is refused rather than truncated: a truncated path
+// fetches the wrong file or nothing at all.
+void test_a_path_too_long_to_hold_does_not_parse() {

@@ -0,0 +244,4 @@
+	TEST_ASSERT_FALSE(parse(relative, bathroom, image));
+}
+
+// The longest path that fits, and the first one that does not.

@@ -0,0 +277,4 @@
+	updater.loop(lastByteAt + ctrl::updateStallTimeoutMs - 1);
+	TEST_ASSERT_TRUE(updater.inProgress());
+
+	// Every attempt gets a stall window of its own, so the whole thing takes more

@@ -0,0 +621,4 @@
+
+	updater.beginUpdate(serverAddress, serverPort, beforeWrap);
+
+	uint32_t at = beforeWrap;

@@ -1030,6 +1051,125 @@ void test_a_radio_that_drops_reports_off_and_clears_the_credentials() {
 	TEST_ASSERT_FALSE(credentials.held());
 }
 
+// The updater is pumped from here, and off the same instant the rest of the

@@ -1033,0 +1126,4 @@
+// The access point fallback and a running fetch both hang off the join, and a
+// fetch that started means the join succeeded, so the fallback must not fire
+// under it and take the network away.
+void test_a_running_transfer_is_not_interrupted_by_the_access_point_fallback() {

@@ -1033,0 +1152,4 @@
+
+// A join that never lands has no fetch to protect, and action 3 must still reach
+// the access point the fallback exists for.
+void test_a_join_for_an_update_that_never_lands_still_falls_back() {