Harden LoRa OTA and enable unattended targets

docs/ota_easy.md

@@ -1,4 +1,4 @@
-# Easy full-firmware update over LoRa
+# Easy full-firmware update over LoRa (ESP32)
 
 This guide shows the shortest manual path for sending a **full firmware image** from a computer to a
 MeshCore node over LoRa. It uses this temporary OTA channel:
@@ -30,10 +30,10 @@ You need:
 
 - A standard, non-logging Keymind OTA build on the source and destination nodes. Logging and MQTT builds do
   not include LoRa OTA. Use the WiFi or USB connection to update those.
-- An OTA-capable destination. ESP32 boards use their A/B firmware slots. nRF52 nodes also need the
-  MeshCore OTAFIX bootloader.
-- The new, non-merged application firmware for the destination's exact board **and role**. Use `.bin` for
-  ESP32 or `.hex` for nRF52; do not package an ESP32 `-merged.bin` factory image.
+- An OTA-capable ESP32 destination with an A/B partition table. nRF52 has a single application slot and
+  cannot install this guide's full-image container; it requires an in-place delta plus the OTAFIX bootloader.
+- The new, non-merged `.bin` application firmware for the destination's exact board **and role**. Do not
+  package an ESP32 `-merged.bin` factory image.
 - A source node connected to the computer by USB serial.
 - Overlapping `tempradio` windows on the source, destination, and every repeater needed between them.
 

docs/ota_protocol.md

@@ -195,7 +195,7 @@ cover `approval` or `leaves[]`:
 
 | `codec_id` | Meaning | Used by |
 |---|---|---|
-| 0 | full / raw | PAYLOAD = reconstructed image (`BODY‖EndF`). ESP32 A/B (and any board for a full image). |
+| 0 | full / raw | PAYLOAD = reconstructed image (`BODY‖EndF`). ESP32 A/B only. |
 | 1 | detools **sequential** | random read of base + sequential write of result → ESP32 A→B inactive slot. |
 | 2 | detools **in-place** | bounded scratch; rewrites the app region in place → nRF52 single-slot. |
 
@@ -204,9 +204,10 @@ delta only if `base_hash` matches its own `EndF.body_hash`. After applying, the
 (sha2-256:32) to `image_hash` before it is booted — the hard security gate.
 
 **A fetcher only requests firmware it can apply.** Each node declares the codec(s) it can apply
-(`set_apply_codec`/`set_apply_codec2`): ESP32 accepts `full` + `sequential` (+ `in-place`), nRF52 accepts
-`full` + `in-place`. `CODEC_FULL` is always acceptable. A `.mota` with an unsupported codec is rejected at
-discovery time, before any blocks are requested.
+(`set_apply_codec`/`set_apply_codec2`): ESP32 accepts `full` + `sequential` (+ `in-place`), while nRF52
+accepts only `in-place` because its single slot cannot stage a full application image. A `.mota` with an
+unsupported codec is rejected at discovery time, before any blocks are requested. A manual pull to an
+external folder may accept other codecs because that path captures bytes and never installs them.
 
 Compression is internal to the detools patch and must be supported by the applier. Patches are produced by
 **detools 0.53.0** (`tools/mota` → `detools.create_patch`) and decoded on-device by detools' embeddable C

docs/ota_user_guide.md

@@ -256,7 +256,7 @@ that only contains what changed). You get them by:
 | See my firmware + any download | `ota status` (or just `ota`) |
 | Admin: ids/hashes + serving + policy | `ota stats` (admin-only remotely) |
 | Find updates nearby | `ota ls` |
-| Download update #1 | `ota get 1` |
+| Download update #1 for installation | `ota get 1 flash` |
 | Cancel a download | `ota cancel` |
 | Install a finished download | `ota install` |
 | Turn on auto-download | `ota config autofetch any` |