# v0.9 — Robustness

> Part of the [Typoena macro plan](macroplan.md). Requirements and targets:
> [qfd.md](qfd.md). Load-bearing decisions: [adr.md](adr.md).

**Status:** not started.

- [ ] Crash-safe writes (write to `.tmp`, fsync, rename) — NB FatFS `f_rename`
      refuses to overwrite, so it's unlink-then-rename + `*.tmp` boot-recovery
      (found in [Spike 3](postmortems/2026-07-05-spike3-sd-cmd59.md), still
      open there)
- [ ] Recover from interrupted push (re-attempt on next save) — the splice
      journal + stranded-commit recovery (2026-07-13) already survive a
      power-pull mid-push; this item is the _retry_ half
- [ ] Reconnect-on-stale-connection in the libgit2 http/stream layer — the
      push keep-alive race is **avoided, not fixed** (repack keeps the marking
      phase at ~3.5 s ≪ the ~30 s idle window; a multi-pack or cold-cache
      state could still lose it — see the
      [real-repo-sync kaizen](kaizen/real-repo-sync.md))
- [ ] `:gl` recovers from a divergence by rebasing — instead of refusing (the
      v0.7 ff-only behavior), the pull replants the device's local commit(s)
      onto origin's tip (`rebase_local_onto`: splice the `merge_base..HEAD`
      paths from the card onto origin's tree, last-writer-wins per note, no
      content merge) and ends `LocalAhead` for `:gp` to publish. The branch ref
      moves **last**, after the merged tree is applied to the card, so a
      power-pull mid-rebase leaves HEAD at the old tip and the next `:gl`
      recomputes the identical commit idempotently. Snackbar `rebased <oid> -
      :gp to publish`. Core done 2026-07-14 (`git_sync.rs`, full build green);
      **on-device verification pending** — needs a real divergence to
      reproduce (a stranded local commit plus a foreign push to the same
      branch)
- [ ] Eradicate the paint-during-sync DMA allocation failure: persistent
      internal DMA scratch in `Epd` (safety net + allocation-free repaints
      shipped; see the
      [editor-freeze postmortem](postmortems/2026-07-11-editor-freeze-spi-dma-oom-during-sync.md))
- [ ] SD card removal / reinsert handling
- [ ] Wi-Fi reconnect with backoff
- [ ] On-device provisioning + settings screen: SSID, PAT rotation, default
      remote, commit author (replaces the v0.1 dev-only NVS-flashing path —
      first release usable by someone who is not the firmware author)