# Compact packet store development validation
The optional arena and indexed codec shipped in 4.1.0 as experimental features.
The development results below are not a hardware qualification.
## Current qualification: 4.2.4 (2026-10-19)
The latest cohort uses the compact packet store and TLSF on all seven firmware
nodes, with compression disabled. Three strict starts, the all-current
120-second restart and 600-second ARM/Renode soak pass, along with both DAQ/FC
CSV reconciliations. The hosted backend's resolved SDK
version is checked explicitly, after an older lockfile was found to have ignored
a candidate path patch. The earlier passing firmware4.2.4/host4.2.3 run is retained
as mixed-version evidence rather than relabelled as all-current qualification.
See [the current qualification record](qualification-4.2.4-2026-10-19.json) and
[the earlier mixed-version record](qualification-4.2.4-mixed-host423-2026-10-19.json).
Neither simulation nor native tests establish physical SD-card throughput,
power-loss durability, lossless best-effort delivery or indefinite OOM immunity.
The packet store remains opt-in; the indexed compression configuration requires
its own MCU memory and throughput qualification.
## Current native pressure checks (2026-10-19)
The final 4.2.4 candidate repeats the explicit 600-second wall-clock codec/arena
pressure soak: 14,558,397 rounds and 227,475 deliberate oversized
request refusals. Pinned data remains intact, partial reads retain no full decode,
and live arena bytes/handles return to zero after drain. Codec scratch remains
fixed at 126,879 bytes on this native host. A separate 2,400-tick mixed-network
churn test passes recovery after injected loss and route outages. These native
checks do not qualify compression on a memory-constrained MCU.
[Exact results and source hashes](native-pressure-soaks-2026-10-19.json).
## Initial development validation (2026-10-05)
On 2026-10-05 the default, compact arena, and compact compression Rust suites
passed, along with minimal std, ARM embedded (plain and codec), and Python
build checks. Regression coverage includes pinned addresses during compaction,
shared ownership, arena/handle exhaustion, partial range reads, fixed workspace
budgets, no compression expansion, and no post-startup allocation in plain
store/read/compact operations. Router and Relay pressure tests verify that
refused admission does not prevent retained frames from draining and retrying.
Jupiter ran `bounded_codec_pressure_soak` for 600 wall-clock seconds: 14,674,011
rounds, 229,282 deliberate oversized-request refusals, and zero live bytes or
handles after draining. Scratch/context reservation stayed fixed at 126,895
bytes for 128-byte chunks on the native host. This is a substantial startup cost;
measure the ARM configuration against Gateway's 112 KiB total RAM before
enabling the codec. No Gateway compression configuration is qualified.
Ordinary arena queue parking does not enable compression.
The existing multi-node churn soak, with the compact arena actually installed,
passed 2,400 ticks of 250 ms (600 seconds of simulated protocol time). It
injected loss and route outages and checked post-recovery reliable delivery,
network variables, discovery/schema, streams, and packet transport. This is a
native network test, not 600 seconds of ARM instruction execution.
At that time, seven-board ARM/Renode qualification was incomplete. The
simulator needed byte UART DMA support, request pacing, G4 DMA completion IRQs,
allocator-specific probes, and build-selected Pico UART baud. The initial
115200-baud baseline failed queue/ring limits; the corrected 1 Mbaud baseline
still reported UART queue refusals. The compact candidate cleared that gateway
check but failed DAQ's zero-overrun bound with one startup overrun. Neither
linked attempt qualifies as a ten-minute pass. No throughput improvement or
indefinite OOM immunity is established by these partial results.
Evidence is retained in Jupiter's isolated `/home/rylan/seds-codec-20261005`
and `/home/rylan/seds-codec-arena-20261005` workspaces. Source snapshots and
build variants must be recorded with each subsequent run.
Repeat the native pressure and churn soaks explicitly:
```sh
cargo test --release --features compact-packet-compression \
--test compact_packet_store bounded_codec_pressure_soak -- --ignored --nocapture
SEDSNET_SOAK_TICKS=2400 cargo test --release --features compact-packet-compression \
--test reliable_drop_test comprehensive_multinode_churn_soak_exercises_stack_features \
-- --ignored --nocapture
```
## Queue parking and gateway headroom
Queue parking is optional: since 4.1.3, an exhausted arena leaves an existing heap Arc in place without another allocation or copy. Explicit arena/codec storage APIs still reject exhaustion. Queue limits and allocator admission continue to bound ownership.
Gateway hardware with an 8 KiB/64-handle arena reserved 10 KiB even when empty and lost downstream communications under discovery pressure. Disabling the arena restored DAQ and valve telemetry. Gateway uses normal heap packet storage with TLSF for recovery; the smaller experimental gateway arena still requires hardware qualification. This is not proof that either configuration is lossless or safe from every long-duration failure.