Fix OTA resume and radio state recovery

Preserve resumed nRF52 flash pages and keep filtered OTA catalogs incomplete until full pages arrive. Bound stuck radio preparation, report companion setting failures, retain safe rollback, and codify conservative advert penalties with regression tests.

docs/flood_filtering.md

@@ -56,6 +56,12 @@ physical distance.
 - A full public key that exceeds the normal level in one window receives a
   first strike. If it exceeds that level again in the immediately following
   window, it enters the bad list. A quiet intervening window breaks this chain.
+- Escalation is deliberately conservative: once a key enters the bad list,
+  a later shorter route does **not** undo that decision, even if the increased
+  quota makes the current window fall below the normal level. This applies to
+  shorter duplicate and new adverts, including a matching-prefix key's route.
+  The existing restriction remains until seven-day recovery, manual clear, or
+  reboot; a shorter route alone never erases a recorded violation.
 - The bad list matches **all 32 public-key bytes**, not the prefix. Different
   full keys sharing a prefix share the ordinary forwarding quota, but their
   received counts are not combined to accuse an innocent key of ongoing abuse.

docs/ota_protocol.md

@@ -509,8 +509,10 @@ fetched per-mid only on commit (Section 8.3).
 
 Fragment numbers are canonical pages of the complete catalog sorted by `manifest_id`. `filter_target` may
 remove rows from a requested page (and can therefore produce an empty fragment), but it never renumbers pages
-or changes `frag_total`. This keeps missing-fragment recovery unambiguous when filtered and unfiltered queries
-for the same `{seeder, set_digest}` are overheard together.
+or changes `frag_total`. Receivers derive the unfiltered page count and each page's row count from the
+source's advertised `n_motas`. A page counts as received only if both counts match that complete geometry;
+filtered rows are still cached, but omitted rows leave the page eligible for an unfiltered recovery query.
+This also prevents legacy filtered replies which renumber pages from completing an unfiltered catalog.
 
 ### 8.2 Anti-storm (mandatory at mesh scale)