fix: harden node upgrades and prepare 1.9.0-alpha

reticulum-daemon/README.md

@@ -64,3 +64,21 @@ packaged binary (same dest hash). The signed-identity announce (`ARCHY:2:{ed}:{x
 the Rust side (`reticulum.rs`) already passes the node's real keys through. Packaging is
 done and verified standalone. What's left is entirely hardware-dependent: the live LoRa
 message path (Phase-0 gates #2/#3) needs a real RNode-flashed board.
+
+
+### ESP32 flashing tool
+
+`build-esptool.sh` builds `dist/archy-esptool` from Espressif esptool 4.8.1.
+`build.sh` includes this step. The executable bundles its Python dependencies
+and ESP32-S3 stub, so radio flashing does not depend on a system esptool package,
+a first-use package download, or a build-machine virtual environment.
+
+The OTA runtime and ISO require this artifact. Build and installed-tool checks
+run `archy-esptool --archy-self-test`, which loads the actual ESP32-S3 stub using
+the upstream loader without opening a serial port. Source updater and bootstrap
+install it to `/usr/local/bin/archy-esptool`; firmware writes still require the
+operator's explicit board model and confirmation.
+
+Official upstream: https://github.com/espressif/esptool/tree/v4.8.1
+The binary includes upstream GPL-2.0-or-later software; retain upstream license
+metadata and source availability with distribution.

reticulum-daemon/archy_esptool.py

@@ -0,0 +1,20 @@
+"""Packaged Espressif CLI: no system Python or first-use package install required."""
+import sys
+import esptool
+from esptool.loader import StubFlasher
+
+
+def self_test():
+    # Debian's stripped package omitted this blob; validate the actual bundled
+    # resources before accepting a flash job, without opening a serial port.
+    stub = StubFlasher('ESP32-S3')
+    if not stub.text or not stub.text_start or not stub.entry:
+        raise RuntimeError('ESP32-S3 flashing stub is incomplete')
+    print(f'archy-esptool {esptool.__version__}: ESP32-S3 stub ready')
+
+
+if __name__ == '__main__':
+    if sys.argv[1:] == ['--archy-self-test']:
+        self_test()
+    else:
+        esptool._main()

reticulum-daemon/build-esptool.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Self-contained flasher shipped identically in OTA and ISO payloads.
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")"
+[ -d .venv ] || python3 -m venv .venv
+.venv/bin/python -m pip install -q 'esptool==4.8.1' -r requirements-build.txt
+.venv/bin/python archy_esptool.py --archy-self-test
+.venv/bin/pyinstaller --onefile --name archy-esptool --clean --noconfirm \
+    --collect-all esptool --copy-metadata esptool archy_esptool.py
+env -i PATH=/usr/bin:/bin dist/archy-esptool --archy-self-test
+env -i PATH=/usr/bin:/bin dist/archy-esptool version

reticulum-daemon/build.sh

@@ -63,3 +63,6 @@ if [ -n "$RNODECONF_SRC" ] && [ -f "$RNODECONF_SRC" ]; then
 else
     echo "WARNING: rnodeconf.py not found at $RNODECONF_SRC (RNS version mismatch?) — skipping archy-rnodeconf build" >&2
 fi
+
+# Bundle the ESP32 flasher and its stub; OTA nodes must not depend on apt/pip.
+bash build-esptool.sh