Save RAK repeater flash while retaining fast field arithmetic

Use compact scalar crypto, reviewed GNSS version parsing and shared CLI reply copies for RAK3401/RAK4631 repeaters. Preserve keys, protocols, commands and configured capacities.

Both Reduced images save 11,580 bytes. SWD measurements on the RAK3401 found scalar-only signing still near 50.9 ms and key exchange near 38 ms. Keep compact field arithmetic off: its extra 4.3 KiB saving adds about a quarter second and delays radio servicing.

Validate Full and Reduced production OTA packages on both boards, focused crypto/GPS/CLI tests, and linked ARM crypto outputs. Include the RAM benchmark harness and scoped results. No live RF packet-loss qualification is claimed.

test/test_nrf52_flash_trim.py

@@ -67,6 +67,29 @@ class Nrf52FlashTrimTest(unittest.TestCase):
         self.assertNotIn("SSD1306_NO_SPLASH", defines)
         self.assertEqual(TRIM.flag_defines("-DMESH_NRF52_FLASH_TRIM=1 -UMESH_NRF52_FLASH_TRIM")["MESH_NRF52_FLASH_TRIM"], None)
 
+    def test_rak_repeater_trims_follow_hardware_and_effective_role(self):
+        for board in ("RAK_3401", "RAK_4631"):
+            for suffix in ("repeater", "repeater_lora_ota_no_external_sensors",
+                           "repeater_unified_lora_ota", "repeater_bridge_rs232_serial1"):
+                with self.subTest(board=board, suffix=suffix):
+                    defines = self.policy(name=board + "_" + suffix, flags="-D" + board)
+                    for name in ("ED25519_COMPACT_SCALAR", "MESH_CLI_SHARE_REPLIES"):
+                        self.assertEqual(defines[name], 1)
+                    self.assertNotIn("ED25519_COMPACT_FIELD", defines)
+            for role in ("simple_room_server", "simple_sensor", "kiss_modem", "companion_radio"):
+                defines = self.policy(role=role, flags="-D" + board)
+                for name in TRIM.RAK_REPEATER_TRIM_DEFINES:
+                    self.assertNotIn(name, defines)
+        for options in (dict(flags="-DRAK_3401=0"), dict(mcu="nrf52832", flags="-DRAK_3401"),
+                        dict(src_filter="+<../examples/simple_repeater> +<../examples/simple_sensor>",
+                             flags="-DRAK_4631")):
+            for name in TRIM.RAK_REPEATER_TRIM_DEFINES:
+                self.assertNotIn(name, self.policy(**options))
+        defines = self.policy(flags="-DRAK_3401 -DED25519_COMPACT_SCALAR=0 "
+                              "-UED25519_COMPACT_FIELD -DMESH_CLI_SHARE_REPLIES=0")
+        for name in TRIM.RAK_REPEATER_TRIM_DEFINES:
+            self.assertNotIn(name, defines)
+
     def test_local_names_honor_overlay_identity_and_explicit_defines(self):
         flags = ('-DMESH_OTA_LOCAL_TARGET_NAME_ONLY=1 '
                  '-DMOTA_TARGET_ID=0x29a0da19 '
@@ -82,6 +105,25 @@ class Nrf52FlashTrimTest(unittest.TestCase):
         for flags in ("", "-DMESH_OTA_LOCAL_TARGET_NAME_ONLY=0"):
             self.assertNotIn("OTA_TARGET_NAME_TABLE", self.policy(flags=flags))
 
+    def test_cli_reply_copy_flag_is_attached_only_to_exact_cli_object(self):
+        class Node:
+            def __init__(self, path): self.path = path
+            def srcnode(self): return self
+            def get_abspath(self): return str(self.path)
+
+        class Env(dict):
+            def subst(self, value): return value.replace("$PROJECT_DIR", str(ROOT))
+            def Object(self, node, **flags): return node, flags
+
+        env = Env(CCFLAGS=["-Os", "-flto"])
+        cli = Node(ROOT / "src/helpers/CommonCLI.cpp")
+        result, flags = TRIM.compile_shared_cli_replies(env, cli)
+        self.assertIs(result, cli)
+        self.assertEqual(flags["CCFLAGS"], ["-Os", "-flto", "-fno-builtin-strcpy"])
+        self.assertEqual(env["CCFLAGS"], ["-Os", "-flto"])
+        other = Node(ROOT / "test/fixtures/CommonCLI.cpp")
+        self.assertIs(TRIM.compile_shared_cli_replies(env, other), other)
+
     def test_local_names_do_not_change_companion_or_unqualified_roles(self):
         for options in (dict(name="RAK_4631_companion_radio_full"),
                         dict(role="custom"), dict(platform="espressif32", mcu="esp32")):

test/test_nrf52_gnss_version_trim.py

@@ -50,6 +50,13 @@ class BuildEnv:
 
 
 class GnssVersionTrimTests(unittest.TestCase):
+    def test_both_reviewed_revisions_use_the_same_bounded_transform(self):
+        for hash_name in ("SOURCE_SHA256", "SOURCE_2_2_28_SHA256"):
+            with self.subTest(revision=hash_name), patch.object(TRIM, hash_name, TRIM.digest(SOURCE)):
+                patched = TRIM.patched_source(SOURCE)
+                self.assertNotIn(TRIM.ORIGINAL_CONVERSION, patched)
+                self.assertIn(TRIM.VERSION_CONVERSION, patched)
+
     def test_private_copy_checks_source_and_all_headers_and_preserves_downloads(self):
         # Small synthetic dependencies test the transform mechanics; production
         # fingerprints remain fixed to the complete reviewed library files.
@@ -90,7 +97,7 @@ class GnssVersionTrimTests(unittest.TestCase):
                     self.assertFalse(other_env.path.exists())
                     target.write_bytes(before)
 
-    def test_only_qualified_companion_installs_middleware(self):
+    def test_only_qualified_roles_install_middleware_and_opt_out_is_preserved(self):
         spec = importlib.util.spec_from_file_location("flash_trim", ROOT / "scripts/nrf52_flash_trim.py")
         policy = importlib.util.module_from_spec(spec)
         spec.loader.exec_module(policy)
@@ -107,14 +114,22 @@ class GnssVersionTrimTests(unittest.TestCase):
             def subst(self, value): return value.replace("$PROJECT_DIR", str(ROOT))
             def AddBuildMiddleware(self, callback, pattern): self.setdefault("middleware", []).append(pattern)
 
-        for role, flags, expected in (("companion_radio", "", True),
-                ("companion_radio", "-DMESH_NRF52_COMPANION_TRIM=0", False),
-                ("simple_repeater", "", False), ("custom", "", False)):
+        for role, flags, expected, shared_replies in (("companion_radio", "", True, False),
+                ("companion_radio", "-DMESH_NRF52_COMPANION_TRIM=0", False, False),
+                ("simple_repeater", "", False, False), ("custom", "", False, False),
+                ("simple_repeater", "-DRAK_3401", True, True),
+                ("simple_repeater", "-DRAK_4631", True, True),
+                ("simple_room_server", "-DRAK_4631", False, False),
+                ("simple_sensor", "-DRAK_3401", False, False),
+                ("simple_repeater", "-DRAK_4631 -DMESH_NRF52_GNSS_VERSION_TRIM=0", False, True),
+                ("simple_repeater", "-DRAK_4631 -DMESH_CLI_SHARE_REPLIES=0", True, False),
+                ("simple_repeater", "-DRAK_3401 -DMESH_NRF52_FLASH_TRIM=0", False, False)):
             with self.subTest(role=role, flags=flags):
                 env = Env(BUILD_FLAGS=flags, CPPDEFINES=[], PIOENV="custom",
                           SRC_FILTER="+<../examples/" + role + ">")
                 policy.install(env)
                 self.assertEqual("*" + TRIM.SOURCE_NAME in env.get("middleware", []), expected)
+                self.assertEqual("*CommonCLI.cpp" in env.get("middleware", []), shared_replies)
 
     def test_native_gnss_conversion_parity_and_bounded_cli_tokens(self):
         compiler = shutil.which("g++") or shutil.which("clang++")