[angeloINTJ]

What was wrong

The nightly savings watermark (savings.yml, tools/measure_savings.py --check) failed every night from 2026-10-02 to 2026-10-22, 21 in a row. No pull request showed it, because the job runs on none. On the last night, five switches were under their floor:

Switch	Floor	Measured (CI, 2026-10-22)
tel_tls	67,936	57,840 (-10,096)
bluetooth	140,132	137,356 (-2,776)
cli_full	48,232, RAM 0	48,152 (-80), RAM -2,048
web_export_api	12,336	12,296 (-40)
sound_buzzer	5,008	4,984 (-24)

None was a leak. bluetooth's drop was the instrument alone. The others were real changes nobody recorded in the floor, and tel_tls's had the instrument on top.

The instrument

The framework keeps BTstack's flash bank in 8 KB of .rodata, aligned to a 4 KB sector (__bluetooth_tlv, cores/rp2040/sdkoverride/btstack_flash_bank.cpp). Every image with Bluetooth has it, and among the bases those are the alpha and the Air. The bank is the last thing in .rodata, and the linker fills up to 4,095 B in front of it. PlatformIO's used counts that fill.

• On a base with the bank: a byte more of .rodata anywhere in the image vanished into the fill. The variant without Bluetooth counted it. So bluetooth's saving fell with every change, and it would have jumped 4,096 B when the fill ran out.
• On the Air: both sides have the bank, and tel_tls's saving jumped 4,096 B either way.

Measured here with one toolchain and one framework on all four commits:

	2721eb2e (10-01)	2690c0a2 (#220)	6109ddb3 (#221)	25e169df (10-22)
bluetooth, used	140,268	139,572	138,892	137,356
bluetooth, past the fill	136,792	136,816	136,808	136,808
fill on the alpha base	3,476	2,756	2,084	548
tel_tls, used	67,936	72,032	57,880	57,840
tel_tls, past the fill	69,968	69,976	58,120	58,080
fill on the Air base / variant	444 / 2,476	4,084 / 2,028	3,412 / 3,652	2,300 / 2,540

• bluetooth: its switch removes 132,474 B of symbols on 2721eb2e and 132,482 B on 25e169df. The code changed 8 B, while used reported -2,912 B.
• tel_tls: its switch removes the same 69,879 B of symbols on 2721eb2e and on 2690c0a2, while used reported +4,096 B.

This framework already carries October's patches. On 2721eb2e, the one of the first three commits the nightly job measured, bluetooth's used comes out 8 B from the job's number and tel_tls's equal to it. On 25e169df, all six switches above equal the job's numbers byte for byte.

The fix

The floor (--check, --update) compares used minus the *fill* that ends at the bank's address. It reads that fill from the linker map each build now asks for (-Wl,-Map, through PLATFORMIO_BUILD_FLAGS).

• The map changes no image. The five bases come out byte-identical with and without the flag. firmware.bin sha256: pico_w_test b4074dd0, pico_w_release e971dfe8, pico_w_asserts abd422b5, pico_w_alpha 93001b45, pico_w_air e5935de2.
• A build is refused rather than measured when it leaves no map, ran without zopfli, or leaves a map the reader cannot follow. That includes a map with the bank's object and no bank under its name, which is what a framework that renamed the bank would leave.
• --matrix keeps the whole used. There the question is fitting the slot, and the fill takes slot.

The real drops

Measured past the fill, each with its cause:

• tel_tls, -11,856 B, at feat: the stage and the apply take only signed images #221 (016dacab: the stage and the apply take only signed images).
  • The image verifies every update's ECDSA P-256 signature with BearSSL's verifier, which is now always on.
  • That is 52 symbols, 12,884 B, which the switch removed on 2721eb2e and does not on 11d38223 (mul_f256, square_f256, p256_*, br_ecdsa_i31_vrfy_raw, br_i31_*).
• cli_full, RAM 0 → -2,048 B, at Packs keep only @DICT in RAM; the License screen matches /license, with complete third-party notices #223 (3335d115).
  • The panel's License screen reads the @WEBDICT through a stack chunk, not lazyRead( ).
  • The full CLI's help never reads the pack, so the test image lost lazyRead( ) and its 2,048 B static buffer.
  • The image without the full CLI keeps both, for the emergency console's @HELP.
• cli_full, flash -80 B.
  • The setup AP opens only when asked; with no network the unit asks for the date and time #214 (ab1e5b3b) put set time in every image, for the unit with no network that asks for the time. So cmdHandleSetTime( ) and parse_3ints( ), 412 B, left what the switch removes.
  • What it removes grew around them: executeCommand( ) +396, cmdHandleSensorField( ) +124, renderMetrics( ) +88.
  • Its .rodata shrank 128.
• sound_buzzer, -24 B.
  • fix: a dry run writes only into its copy (findings 5, 6, 17, 18, 21, 38, 69) #234 (f24e1b71) moved SoundManager::fillConfig( )'s body (218 → 22 B) into soundStateToConfig( ) (186 B), which the commit_all dry run also uses.
  • What the switch removes from commit_all came out 12 B smaller.
• web_export_api, -40 B.
  • The compiler now emits std::vector<String>'s growth path (_M_check_len( ), 60 B) out of line in /api/history_days, which every image has.
  • On 2721eb2e, the variant without the export had no such path out of line.

The floors

Recorded with --update on 25e169df's tree, past the fill:

Switch	Base	Flash, old floor	Flash, new floor	RAM, old	RAM, new
bluetooth	pico_w_alpha	140,132	136,808	19,348	19,348
tel_tls	pico_w_air	67,936	58,080	16	16
cli_full	pico_w_test	48,232	48,152	0	-2,048
web_https	pico_w_release	24,520	24,568	24	16
web_history	pico_w_air	21,768	23,872	0	0
tft_graph	pico_w_release	20,312	20,432	2,236	2,232
sensor_bme280	pico_w_release	17,724	17,804	220	220
mdns	pico_w_release	16,568	16,632	168	168
web_export_api	pico_w_release	12,336	12,296	2,052	2,052
tel_mqtt	pico_w_air	7,704	9,344	0	0
sensor_ds18b20	pico_w_release	5,432	5,520	64	64
sound_buzzer	pico_w_release	5,008	4,984	0	0
web_metrics	pico_w_release	4,904	4,968	0	0
sensor_dht22	pico_w_release	3,400	3,456	0	0
concurrency_asserts	pico_w_asserts	2,176	2,240	0	0
syslog	pico_w_release	1,760	1,768	0	0

• Alpha and Air switches: web_history and tel_mqtt move because the fill is now out, as bluetooth and tel_tls do.
• RAM: web_https's and tft_graph's RAM floors move 8 and 4 B, inside the 64 B the gate allows for the linker's alignment.

Tests

tools/test_measure_savings.py has 21 cases. It is a new step of the gates job, so every pull request now runs the arithmetic the floor does. The cases:

• the fill read from a real map (548 B, pico_w_alpha on 25e169df);
• the bank flush against the section before it, absent, or only under "Discarded input sections";
• the zero-size entries skipped;
• a fill further up not taken for the bank's;
• an unreadable map refused rather than read as 0, and so is a map that has the bank's object (btstack_flash_bank.cpp.o) but no bank under the bank's name, which is what a framework that renamed the bank would leave;
• the build asking for the map, and refused without it, without zopfli, or with a map it cannot follow;
• each side's fill taken off.

Mutations: 10 of 10 one-line changes to the tool are caught. Each fails the case written for it, and the reader's refusal also fails the build's. On the twelve real maps of the measurements above (alpha, Air and their variants, on three commits), the reader gives the fill each build printed, and 0 without a refusal on the variants without Bluetooth.

Gates

Locally (ci_gates_local.py), the gates, static-analysis and fuzz jobs pass: 48 of 48 steps. The sanitizer pass runs in CI only. After the review's changes, the quick set passed again, 36 of 36, with this test at 21/21.

Review

A clean-context review returned COM RESSALVAS (with reservations), nothing blocking. Taken:

• The reader refuses a map that has the bank's object but no bank under its name. A framework that renamed the bank would otherwise send the alpha and the Air back to counting the fill, silently.
• AGENTS.md's figure: 140 kB became 137 kB past the fill.
• The build.yml comment put the whole red on the fill. Now it says the fill was all of bluetooth's drop and part of tel_tls's.

Its other point, that the real path had never run on CI, is the run below.

The real path on CI

The savings workflow, dispatched on this branch: run 39788868842, green: check_savings: 16 recursos, nenhum abaixo do piso de economia.

• Its table equals this branch's ledger for all 16 switches.
• The fills it read from the runner's maps are the ones measured here: 548 B on the alpha base; 2,300 B on the Air base; and 2,540, 308 and 3,804 B on the Air's tel_tls, web_history and tel_mqtt variants.

Docs

• docs/analysis/ECONOMIA_DE_RECURSOS.md (Living) gains a section with the evidence, the causes and the table.
• AGENTS.md, tools/README.md and the savings.yml header now say:
  • what the floor compares;
  • that it builds 21 images;
  • that no pull request sees it fail. The check is gh run list --workflow "SIMUT savings watermark".
• No image changes and src/ is untouched, so CHANGELOG.md is unchanged too, as with fix(tools): patch.sh 2b-ter greps text its patch adds; a gate holds every guard to its patch #279.

Not in this pull request

• The nightly job still fails where nobody looks. Two ways out, both CI changes, are a decision for you:
  • a scheduled failure that opens or updates an issue;
  • the check running on pull requests that touch src/. That is about 16 to 21 minutes of CI time.
• The emergency console's help holds a 2,048 B static buffer (_lazyReadBuf) in every image without the full CLI, the release included. It exists only to read @HELP in one piece. Reading it line by line from flash would give that RAM back. I measured nothing for it.

🤖 Generated with Claude Code

https://claude.ai/code/session_013C6NHM2fJi3M7EMr47WyQ3