firestarter 3.2.5__tar.gz → 3.2.6__tar.gz

{firestarter-3.2.5/firestarter.egg-info → firestarter-3.2.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: firestarter
-Version: 3.2.5
+Version: 3.2.6
 Summary: EPROM programmer software for the Relatively Universal ROM Programmer
 Author-email: Henrik Olsson <henols@gmail.com>
 Project-URL: Homepage, https://github.com/henols/firestarter_app

{firestarter-3.2.5 → firestarter-3.2.6}/firestarter/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '3.2.5'
-__version_tuple__ = version_tuple = (3, 2, 5)
+__version__ = version = '3.2.6'
+__version_tuple__ = version_tuple = (3, 2, 6)
 
-__commit_id__ = commit_id = 'g75046d7'
+__commit_id__ = commit_id = 'g6a02a12'

{firestarter-3.2.5 → firestarter-3.2.6}/firestarter/cli_handlers.py

@@ -1443,9 +1443,11 @@ def erase(
 
     eprom_data = resolve_chip(eprom, db=app.db)
 
+    # The database leaves FLAG_CAN_ERASE clear for flash4, so `write` never
+    # carries it. The erase sets it for this command only; setup_command
+    # refuses it on firmware without the 5 V software chip erase.
     if flash4_erase_gate.is_flash4(eprom_data):
-        click.echo(flash4_erase_gate.refusal_text(eprom))
-        sys.exit(0 if ignore_unsupported else 1)
+        eprom_data = flash4_erase_gate.with_erase_flag(eprom_data)
 
     full_record = app.db.get_eprom(eprom) or {}
     if dip24_2816_erase_gate.is_affected(full_record.get("pin-map")):

{firestarter-3.2.5 → firestarter-3.2.6}/firestarter/codec.py

@@ -74,7 +74,8 @@ def format_message(msg_id: int, params: List[Any], entry: MessageDef) -> str | N
 
     P-02 MSG_OK_REV  — params[0]=physical u8, params[1]=effective u8
       effective==0xFF → "Rev{physical}" (no override)
-      effective!=0xFF → "Rev{effective}, Override HW: Rev{physical}"
+      effective!=0xFF → "Rev{effective}, Detected HW: Rev{physical}"
+      (the override is in effect; the second field is what the board detected)
 
     P-03 MSG_OK_CFG  — params[0]=r1 u32, params[1]=r2 u32, params[2]=override u8,
                        params[3]=bandgap_mv u16 (absent on firmware before 3.1.0b4)
@@ -104,7 +105,7 @@ def format_message(msg_id: int, params: List[Any], entry: MessageDef) -> str | N
         if effective == 0xFF:
             return phys_str
         eff_str = _REVISION_SILKSCREEN.get(effective, f"Rev{effective}")
-        return f"{eff_str}, Override HW: {phys_str}"
+        return f"{eff_str}, Detected HW: {phys_str}"
 
     if msg_id == MSG_OK_CFG and len(params) in (3, 4):
         r1, r2, override = params[0], params[1], params[2]

{firestarter-3.2.5 → firestarter-3.2.6}/firestarter/firmware.py

@@ -335,8 +335,8 @@ class FirmwareManager:
         """Router: returns (resolved_version, download_url) or (None, None) on failure.
 
         channel='stable'  → delegates to fetch_latest_release_info (back-compat shim).
-        channel='pre'     → paginates /releases, filters prerelease=True, sorts by PEP 440
-                            descending, takes highest; falls back to stable if none.
+        channel='pre'     → paginates /releases, takes the highest non-draft release by
+                            PEP 440, stable or pre-release; falls back to stable if none.
         channel='pinned'  → fetches /releases/tags/{version} directly.
         """  # noqa: E501
         if channel == "stable":
@@ -374,10 +374,12 @@ class FirmwareManager:
                 logger.error(f"Failed to fetch releases for pre-release channel: {e}")
                 return None, None
 
-            # Filter: prerelease=True AND draft=False, skip unparseable tags.
+            # Every non-draft release, stable or pre-release, as `pip --pre`
+            # does: a stable 3.2.2 must win over an older 3.1.1b2. Skip
+            # unparseable tags.
             candidates = []
             for r in all_releases:
-                if not r.get("prerelease") or r.get("draft"):
+                if r.get("draft"):
                     continue
                 tag = r.get("tag_name", "")
                 try:
@@ -387,7 +389,7 @@ class FirmwareManager:
 
             if not candidates:
                 logger.info(
-                    "No pre-release firmware available — falling back to stable "
+                    "No firmware release with a parseable tag — falling back to stable "
                     "(matches pip --pre semantics)."
                 )
                 return self.fetch_latest_release_info(board=board)
@@ -787,7 +789,7 @@ class FirmwareManager:
         Returns True if an operation (check or install) was successful in some sense, False on major failure.
 
         channel='stable'  → uses /releases/latest (default, INST-01 non-regression).
-        channel='pre'     → selects highest pre-release.
+        channel='pre'     → selects the highest release, stable or pre-release.
         channel='pinned'  → uses exact tag from pinned_version.
         """  # noqa: E501
         connected_port, current_version, current_board = self.check_current_firmware(

firestarter-3.2.6/firestarter/flash4_erase_gate.py

@@ -0,0 +1,104 @@
+"""
+Project Name: Firestarter
+Copyright (c) 2024 Henrik Olsson
+
+Permission is hereby granted under MIT license.
+
+Flash4 (protocol 0x05) erase policy.
+
+Firmware 3.2.2 added a software chip erase for protocol 0x05 (the six-cycle
+AA/55/80/AA/55/10 sequence, 5 V only). Older firmware is not safe to send
+that erase to:
+
+- 3.0.0b8 to 3.0.0b26 erase a 0x05 part with the VPP regulator and VPE
+  switched on: 12 V on a 5 V part.
+- 3.0.0b27 to 3.2.1 answer "not supported".
+
+So `FLAG_CAN_ERASE` stays clear for algorithm 5 in the database
+(`erase_support.erase_accepted`), and `write` never carries it. Only the
+`erase` command sets it, for that one command
+(`with_erase_flag`), and `SerialCommunicator.setup_command` refuses the
+command before the operation starts when the firmware is older than
+`ERASE_MIN_FIRMWARE` (`needs_newer_firmware`).
+
+Like `jp5_gate.py` and `sdp_capability.py`, this is a pure predicate module:
+no I/O, no environment reads, no serial access.
+
+`is_flash4` FAILS OPEN on absent evidence (a wire dict with no `algorithm`
+key is "not flash4"), unlike `jp5_gate` and `sdp_capability`. Refusing every
+chip this predicate cannot classify would break `erase` for chips that are
+not flash4 at all.
+"""
+
+from __future__ import annotations
+
+import re
+from typing import Any, Mapping  # noqa: UP035
+
+from firestarter.constants import COMMAND_ERASE, FLAG_CAN_ERASE
+
+FLASH4_PROTOCOL_ID = 5
+
+# The first firmware with the software chip erase for protocol 0x05.
+ERASE_MIN_FIRMWARE = (3, 2, 2)
+
+_FIRMWARE_REFUSAL_FORMAT = (
+    "Erasing this chip needs firmware {minimum} or later; this board runs "
+    "{version}. Update it with 'firestarter fw --install'."
+)
+
+
+def is_flash4(programmer_data: Mapping[str, Any] | None) -> bool:
+    """True when the wire dict's `algorithm` value is the flash4 protocol id.
+
+    The comparison is against `algorithm`, not `flags & FLAG_CAN_ERASE`: the
+    flag is also clear for UV-EPROM and SRAM parts, so a flag-based
+    predicate would widen this past its flash4-only scope.
+
+    Returns False for a missing, `None`, or empty `programmer_data`, and for
+    a dict with no `algorithm` key.
+    """
+    if not programmer_data:
+        return False
+    return programmer_data.get("algorithm") == FLASH4_PROTOCOL_ID
+
+
+def with_erase_flag(programmer_data: Mapping[str, Any]) -> dict[str, Any]:
+    """A copy of `programmer_data` with `FLAG_CAN_ERASE` set, for `erase` only."""
+    data = dict(programmer_data)
+    data["flags"] = int(data.get("flags") or 0) | FLAG_CAN_ERASE
+    return data
+
+
+def _version_tuple(version: str | None) -> tuple[int, int, int] | None:
+    match = re.match(r"(\d+)\.(\d+)\.(\d+)", version or "")
+    if not match:
+        return None
+    return (int(match.group(1)), int(match.group(2)), int(match.group(3)))
+
+
+def needs_newer_firmware(
+    command: Mapping[str, Any], firmware_version: str | None
+) -> bool:
+    """True when `command` is a flash4 erase that `firmware_version` cannot run safely.
+
+    Only an erase command that carries `FLAG_CAN_ERASE` for a flash4 part is
+    affected; every other command returns False. A version that cannot be
+    parsed counts as too old, because the 3.0.0 pre-releases with the 12 V
+    erase are older than every version this check accepts. A pre-release
+    or development build of 3.2.2 (`3.2.2rc1`, `3.2.2.dev5`) counts as 3.2.2.
+    """
+    if command.get("cmd") != COMMAND_ERASE or not is_flash4(command):
+        return False
+    if not int(command.get("flags") or 0) & FLAG_CAN_ERASE:
+        return False
+    parsed = _version_tuple(firmware_version)
+    return parsed is None or parsed < ERASE_MIN_FIRMWARE
+
+
+def firmware_refusal_text(firmware_version: str | None) -> str:
+    """The one-line refusal for a flash4 erase on firmware that is too old."""
+    return _FIRMWARE_REFUSAL_FORMAT.format(
+        minimum=".".join(str(n) for n in ERASE_MIN_FIRMWARE),
+        version=firmware_version or "an unknown version",
+    )

{firestarter-3.2.5 → firestarter-3.2.6}/firestarter/ic_layout.py

@@ -12,6 +12,7 @@ from typing import Dict, List  # noqa: UP035
 from firestarter import jumper_table
 from firestarter.database import EpromDatabase, format_mv
 from firestarter.erase_support import erase_accepted, is_electrically_erasable
+from firestarter.flash4_erase_gate import FLASH4_PROTOCOL_ID
 from firestarter.vpp_display import shows_programming_vpp
 
 logger = logging.getLogger("EpromSpecBuilder")
@@ -19,6 +20,7 @@ logger = logging.getLogger("EpromSpecBuilder")
 CAN_ERASE_YES = "yes (electrically erasable)"
 CAN_ERASE_UV_ONLY = "no (UV erase only)"
 CAN_ERASE_NOT_SUPPORTED = "no (erase is not supported for this chip)"
+CAN_ERASE_FLASH4 = "yes (needs firmware 3.2.2 or later)"
 
 
 class EpromSpecBuilder:
@@ -524,6 +526,11 @@ class EpromSpecBuilder:
             etype, eprom_data.get("protocol-id"), eprom_data.get("pin-map")
         ):
             output_data["can_erase_str"] = CAN_ERASE_YES
+        elif is_electrically_erasable(etype) and (
+            eprom_data.get("protocol-id") == FLASH4_PROTOCOL_ID
+        ):
+            # `erase` sets FLAG_CAN_ERASE for flash4 itself (flash4_erase_gate).
+            output_data["can_erase_str"] = CAN_ERASE_FLASH4
         elif is_electrically_erasable(etype):
             output_data["can_erase_str"] = CAN_ERASE_NOT_SUPPORTED
         elif etype == "UV-EPROM":

{firestarter-3.2.5 → firestarter-3.2.6}/firestarter/serial_comm.py

@@ -20,6 +20,7 @@ import serial.serialutil
 import serial.tools.list_ports
 
 import firestarter.codec as codec
+import firestarter.flash4_erase_gate as flash4_erase_gate
 import firestarter.transport_counters as transport_counters
 from firestarter.config import ConfigManager  # Assuming ConfigManager is refactored
 from firestarter.constants import (
@@ -957,9 +958,17 @@ class SerialCommunicator:
             # to major=3 later. Set FIRESTARTER_DEV_ALLOW_PRE_V12=1 to bypass when  # noqa: E501
             # bench-testing a current host against a historical (v2.x) firmware build.  # noqa: E501
             SerialCommunicator._validate_firmware_version(
-                version_match.group(0),
+                version_match.group(0).rstrip("."),
                 allow_pre_v12=os.environ.get("FIRESTARTER_DEV_ALLOW_PRE_V12") == "1",
             )
+            # A flash4 erase on firmware older than 3.2.2 reaches either a
+            # 12 V erase (3.0.0b8-b26) or a "not supported" answer.
+            if flash4_erase_gate.needs_newer_firmware(command_to_send, identity):
+                raise FirmwareOutdatedError(
+                    flash4_erase_gate.firmware_refusal_text(
+                        identity.split(":")[0] if identity else None
+                    )
+                )
 
         # Shield-revision gate — ordered after the version check because
         # firmware old enough to fail that check cannot be trusted to have

{firestarter-3.2.5 → firestarter-3.2.6/firestarter.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: firestarter
-Version: 3.2.5
+Version: 3.2.6
 Summary: EPROM programmer software for the Relatively Universal ROM Programmer
 Author-email: Henrik Olsson <henols@gmail.com>
 Project-URL: Homepage, https://github.com/henols/firestarter_app

{firestarter-3.2.5 → firestarter-3.2.6}/firestarter.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "3.2.5",
+  "tag": "3.2.6",
   "distance": 0,
-  "node": "g75046d7",
+  "node": "g6a02a12",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-10-27"

{firestarter-3.2.5 → firestarter-3.2.6}/tests/test_codec.py

@@ -40,10 +40,10 @@ class TestFormatMessageRevision:
         assert result == "Rev 0"
 
     def test_msg_ok_rev_with_override(self):
-        """MSG_OK_REV: effective!=0xFF → '{eff_str}, Override HW: {phys_str}'."""
+        """MSG_OK_REV: effective!=0xFF → '{eff_str}, Detected HW: {phys_str}'."""
         entry = CATALOG[MSG_OK_REV]
         result = format_message(MSG_OK_REV, [0x02, 0x04], entry)
-        assert result == "Rev 2.2 (override), Override HW: Rev 2.0-class"
+        assert result == "Rev 2.2 (override), Detected HW: Rev 2.0-class"
 
     def test_msg_ok_cfg_no_override(self):
         """MSG_OK_CFG: override==0xFF → 'R1: {r1}, R2: {r2}'."""

{firestarter-3.2.5 → firestarter-3.2.6}/tests/test_codec_format_message.py

@@ -32,8 +32,8 @@ def test_format_msg_ok_rev_with_override_includes_both() -> None:
         MSG_OK_REV, [REVISION_2_2, REVISION_UNKNOWN], CATALOG[MSG_OK_REV]
     )
     assert out is not None
-    # The format is "{eff}, Override HW: {phys}"
-    assert "Override HW" in out
+    # The format is "{eff}, Detected HW: {phys}"
+    assert "Detected HW" in out
 
 
 def test_format_msg_ok_cfg_no_override() -> None:

{firestarter-3.2.5 → firestarter-3.2.6}/tests/test_decoder.py

@@ -363,8 +363,8 @@ class TestIdFrameDecoder:
 
     def test_ok_rev_p02_with_override_decodes(self, fake_serial, make_comm):
         """P-02: MSG_OK_REV with physical=0x01, effective=0x02 (override active)
-        renders 'Rev 2.0-class, Override HW: Rev 1' per Phase 34 D-05 Path A
-        silkscreen-string mapping (was 'Rev2, Override HW: Rev1' pre-Phase-34)."""
+        renders 'Rev 2.0-class, Detected HW: Rev 1': the override, then the
+        revision the board detected."""
         comm = make_comm()
         # params: u8 physical=0x01, u8 effective=0x02
         params = bytes([0x01, 0x02])
@@ -374,7 +374,7 @@ class TestIdFrameDecoder:
         response = _drive_one_response(comm)
         assert response is not None
         assert response.type == "OK"
-        assert response.message == "Rev 2.0-class, Override HW: Rev 1"
+        assert response.message == "Rev 2.0-class, Detected HW: Rev 1"
 
     def test_ok_rev_p02_no_override_decodes(self, fake_serial, make_comm):
         """P-02: MSG_OK_REV with physical=0x01, effective=0xFF sentinel renders

{firestarter-3.2.5 → firestarter-3.2.6}/tests/test_firmware_install.py

@@ -370,38 +370,42 @@ class TestFirmwareInstallPreRelease:
         assert version == "3.1.0rc1"
         assert "uno_rc1.hex" in url
 
-    def test_pre_falls_back_to_stable_when_no_prerelease(self, monkeypatch, caplog):
-        """INST-02 / D-05 — fallback to stable when no pre-release exists.
-
-        If the paginated releases contain no prerelease=True entries, the method
-        must silently fall back to /releases/latest and log INFO about the fallback.
-
-        RED today: FirmwareManager has no fetch_release_info — AttributeError.
-        """
-        stable_only = mock_releases_factory([_STABLE_RELEASE_UNO])
-        stable_latest_mock = mock_releases_factory([])
-        stable_latest_mock.json.return_value = _STABLE_RELEASE_UNO
+    def test_pre_takes_stable_when_no_prerelease(self, monkeypatch):
+        """With no pre-release in the list, the pre channel takes the stable one."""
+        monkeypatch.setattr(
+            firmware.requests,
+            "get",
+            lambda url, **kw: mock_releases_factory([_STABLE_RELEASE_UNO]),
+        )
+        fm = FirmwareManager(config_manager=MagicMock())
+        version, url = fm.fetch_release_info(channel="pre", board="uno")
+        assert version == "3.0.0"
+        assert url == "https://example.com/uno_stable.hex"
 
-        call_count = [0]
+    def test_pre_takes_a_newer_stable_over_an_older_prerelease(self, monkeypatch):
+        """Like `pip --pre`: stable 3.2.2 wins over pre-release 3.1.1b2."""
 
-        def multi_response_get(url, **kw):
-            call_count[0] += 1
-            if "latest" in url:
-                return stable_latest_mock
-            return stable_only
+        def release(tag, prerelease):
+            return {
+                "tag_name": tag,
+                "prerelease": prerelease,
+                "draft": False,
+                "assets": [
+                    {
+                        "name": "firestarter_uno.hex",
+                        "browser_download_url": f"https://example.com/{tag}.hex",
+                    }
+                ],
+            }
 
-        monkeypatch.setattr(firmware.requests, "get", multi_response_get)
+        releases = [release("3.2.2", False), release("3.1.1b2", True)]
+        monkeypatch.setattr(
+            firmware.requests, "get", lambda url, **kw: mock_releases_factory(releases)
+        )
         fm = FirmwareManager(config_manager=MagicMock())
-        with caplog.at_level(logging.INFO):
-            version, url = fm.fetch_release_info(channel="pre", board="uno")
-        # Falls back to stable release
-        assert version == "3.0.0"
-        assert url is not None
-        # Must log something about falling back to stable
-        lower_records = [r.message.lower() for r in caplog.records]
-        assert any(
-            "fall" in m or "stable" in m or "no pre" in m for m in lower_records
-        ), f"Expected a fallback log record; got: {[r.message for r in caplog.records]}"
+        version, url = fm.fetch_release_info(channel="pre", board="uno")
+        assert version == "3.2.2"
+        assert url == "https://example.com/3.2.2.hex"
 
     def test_pre_filters_draft_releases(self, monkeypatch):
         """INST-02 / D-03 — draft releases are excluded from pre-release candidates.

{firestarter-3.2.5 → firestarter-3.2.6}/tests/test_flash4_erase_gate.py

@@ -4,38 +4,25 @@ Copyright (c) 2024 Henrik Olsson
 
 Permission is hereby granted under MIT license.
 
-Flash4 (protocol 0x05) erase-refusal gate.
+Flash4 (protocol 0x05) erase gate.
+
+Firmware 3.2.2 erases a 0x05 part with a 5 V software chip erase. Older
+firmware either answers "not supported" or, in 3.0.0b8 to 3.0.0b26, erases
+with VPP and VPE on: 12 V on a 5 V part.
 
 Coverage:
-  1. THE PURE PREDICATE -- `is_flash4` parametrized over every `algorithm`
-     value the shipped database actually contains: True for 5, False for
-     every other value present.
-  2. FAIL-OPEN -- a missing, `None`, or empty wire dict, or one with no
-     `algorithm` key, returns False rather than raising or refusing. This
-     polarity is deliberately inverted against `jp5_gate` and
-     `sdp_capability`, which both fail CLOSED on absent evidence.
-  3. COUPLING TO THE REAL DATABASE -- the set of
-     part numbers for which the predicate fires, driven through
-     `resolve_chip` against `EpromDatabase(skip_local_override=True)`, is
-     exactly the set of shipped rows whose `programming.algorithm` is 5.
-  4. NO PART-NUMBER LITERAL IN THE MODULE -- no shipped `part_number` string
-     occurs anywhere in `flash4_erase_gate.py`'s source, docstrings
-     included, proving the predicate is database-derived rather than a
-     hand-kept list.
-  5. THE MESSAGE SHAPE -- the rendered refusal line is exactly one
-     line, names the chip, and carries none of a forbidden-substring list
-     covering the cause, the alternative, and the `--force` workaround.
-  6. NOT A BLANKET REFUSAL -- a part whose algorithm is not 5 still
-     reaches `EpromOperator.erase_eprom`.
-
-End-to-end proof that `firestarter erase` on a flash4 part refuses before
-the serial port opens, printing exactly one line and never reaching
-`EpromOperator.erase_eprom` -- the pre-connect guarantee.
+  1. `erase` on a flash4 part reaches the operator with FLAG_CAN_ERASE set,
+     and the database still leaves the flag clear, so `write` never has it.
+  2. `needs_newer_firmware`: refused below 3.2.2 and for an unparseable
+     version, accepted from 3.2.2 (and its pre-release and dev builds), and
+     never applied to another command or another protocol.
+  3. `setup_command` raises before the operation starts when a flash4 erase
+     meets firmware older than 3.2.2.
+  4. `is_flash4` over every shipped `algorithm` value, its fail-open polarity,
+     and its coupling to the real database.
 """
 
-import inspect
-from pathlib import Path
-from unittest.mock import Mock, patch
+from unittest.mock import MagicMock, Mock, patch
 
 import pytest
 from click.testing import CliRunner
@@ -44,13 +31,26 @@ from firestarter import cli_handlers
 from firestarter.chip_resolver import resolve_chip
 from firestarter.cli_handlers import AppContext, cli
 from firestarter.config import ConfigManager
+from firestarter.constants import COMMAND_ERASE, COMMAND_WRITE, FLAG_CAN_ERASE
 from firestarter.database import EpromDatabase
 from firestarter.eprom_info import EpromConsolePresenter
 from firestarter.eprom_operations import EpromOperator
-from firestarter.exceptions import ChipNotFoundError, ChipNotImplementedError
+from firestarter.exceptions import (
+    ChipNotFoundError,
+    ChipNotImplementedError,
+    FirmwareOutdatedError,
+)
 from firestarter.firmware import FirmwareManager
-from firestarter.flash4_erase_gate import FLASH4_PROTOCOL_ID, is_flash4, refusal_text
+from firestarter.flash4_erase_gate import (
+    FLASH4_PROTOCOL_ID,
+    firmware_refusal_text,
+    is_flash4,
+    needs_newer_firmware,
+)
 from firestarter.hardware import HardwareManager
+from firestarter.messages import MSG_OK_READY
+
+from .conftest import build_frame
 
 NO_PIN1_BUS_CONFIG = {"bus": [0, 1, 2]}
 
@@ -66,51 +66,88 @@ def _cli_app_context(eprom_operator):
     )
 
 
-def test_cli_erase_on_flash4_part_refuses_pre_connect_with_one_line():
+def test_cli_erase_on_flash4_part_sends_can_erase():
     runner = CliRunner()
     eprom_operator = Mock(spec=EpromOperator)
+    eprom_operator.erase_eprom.return_value = True
     app = _cli_app_context(eprom_operator)
     with patch.object(
         cli_handlers,
         "resolve_chip",
-        return_value={"algorithm": 5, "bus-config": NO_PIN1_BUS_CONFIG},
+        return_value={"algorithm": 5, "flags": 0, "bus-config": NO_PIN1_BUS_CONFIG},
     ):
         result = runner.invoke(cli, ["erase", "AE29F2008"], obj=app)
 
-    assert result.exit_code == 1
-    lines = result.output.splitlines()
-    assert lines == [refusal_text("AE29F2008")]
-    eprom_operator.erase_eprom.assert_not_called()
+    assert result.exit_code == 0, result.output
+    eprom_operator.erase_eprom.assert_called_once()
+    sent = eprom_operator.erase_eprom.call_args.args[1]
+    assert sent["flags"] & FLAG_CAN_ERASE
 
 
-def test_cli_erase_ignore_unsupported_exits_0_with_byte_identical_output():
-    runner = CliRunner()
+def test_database_leaves_can_erase_clear_for_flash4_writes():
+    """`write` must never carry FLAG_CAN_ERASE for a flash4 part."""
+    db = EpromDatabase(skip_local_override=True)
+    data = resolve_chip("AE29F2008", db=db)
+    assert is_flash4(data)
+    assert not data["flags"] & FLAG_CAN_ERASE
 
-    exit1_operator = Mock(spec=EpromOperator)
-    exit1_app = _cli_app_context(exit1_operator)
-    with patch.object(
-        cli_handlers,
-        "resolve_chip",
-        return_value={"algorithm": 5, "bus-config": NO_PIN1_BUS_CONFIG},
-    ):
-        exit1_result = runner.invoke(cli, ["erase", "AE29F2008"], obj=exit1_app)
 
-    exit0_operator = Mock(spec=EpromOperator)
-    exit0_app = _cli_app_context(exit0_operator)
-    with patch.object(
-        cli_handlers,
-        "resolve_chip",
-        return_value={"algorithm": 5, "bus-config": NO_PIN1_BUS_CONFIG},
-    ):
-        exit0_result = runner.invoke(
-            cli, ["erase", "AE29F2008", "--ignore-unsupported"], obj=exit0_app
-        )
+def _erase(flags=FLAG_CAN_ERASE, algorithm=FLASH4_PROTOCOL_ID, cmd=COMMAND_ERASE):
+    return {"cmd": cmd, "algorithm": algorithm, "flags": flags}
+
 
-    assert exit1_result.exit_code == 1
-    assert exit0_result.exit_code == 0
-    assert exit0_result.output == exit1_result.output
-    exit1_operator.erase_eprom.assert_not_called()
-    exit0_operator.erase_eprom.assert_not_called()
+@pytest.mark.parametrize(
+    "version",
+    [None, "", "garbage", "3.0.0", "3.0.0b20", "3.1.1b2", "3.2.0", "3.2.1"],
+)
+def test_flash4_erase_needs_firmware_3_2_2(version):
+    assert needs_newer_firmware(_erase(), version) is True
+
+
+@pytest.mark.parametrize(
+    "version",
+    ["3.2.2", "3.2.2:uno", "3.2.2rc1:leonardo", "3.2.2.dev48", "3.2.10", "3.3.0"],
+)
+def test_flash4_erase_runs_on_firmware_3_2_2_and_later(version):
+    assert needs_newer_firmware(_erase(), version) is False
+
+
+@pytest.mark.parametrize(
+    "command",
+    [
+        _erase(algorithm=6),
+        _erase(cmd=COMMAND_WRITE),
+        _erase(flags=0),
+        {"state": 13},
+    ],
+)
+def test_firmware_gate_applies_only_to_a_flagged_flash4_erase(command):
+    assert needs_newer_firmware(command, "3.0.0b20") is False
+
+
+def test_firmware_refusal_text_is_one_line_and_names_the_versions():
+    text = firmware_refusal_text("3.2.1")
+    assert "\n" not in text
+    assert "3.2.2" in text and "3.2.1" in text
+
+
+def _ready_frame(version: bytes) -> bytes:
+    # [buffer_size u16][hw_revision u8][ver_len u8][version bytes]
+    params = b"\x02\x00" + bytes([0]) + bytes([len(version)]) + version
+    return build_frame(MSG_OK_READY, params)
+
+
+def test_setup_command_refuses_flash4_erase_on_old_firmware(make_comm, fake_serial):
+    fake_serial.feed(_ready_frame(b"3.2.1:uno"))
+    comm = make_comm()
+    with pytest.raises(FirmwareOutdatedError, match="3.2.2"):
+        comm.setup_command(_erase(), MagicMock())
+
+
+def test_setup_command_accepts_flash4_erase_on_3_2_2(make_comm, fake_serial):
+    fake_serial.feed(_ready_frame(b"3.2.2:uno"))
+    comm = make_comm()
+    assert comm.setup_command(_erase(), MagicMock()) is True
 
 
 def _shipped_algorithm_values(db: EpromDatabase) -> set:
@@ -188,47 +225,6 @@ def test_predicate_matches_real_database_algorithm_5_rows_exactly():
     )
 
 
-def _module_source(module) -> str:
-    path = inspect.getsourcefile(module)
-    assert path is not None, f"could not resolve a source file for {module!r}"
-    return Path(path).read_text(encoding="utf-8")
-
-
-FORBIDDEN_REFUSAL_SUBSTRINGS = (
-    "force",
-    "firestarter write",
-    "write",
-    "workaround",
-    "route around",
-    "because",
-    "reason",
-    "cause",
-    "alternative",
-    "instead",
-    "try",
-)
-
-
-def test_refusal_text_is_one_line_and_carries_no_forbidden_content():
-    """THE MESSAGE SHAPE: exactly one line, names the chip, and
-    carries none of a forbidden-substring list covering the cause, the
-    alternative, and the `--force` forged-identity workaround. A NEGATIVE
-    assertion on purpose -- it is what stops a later executor quietly
-    re-adding the cause clause and the alternative that were deliberately
-    left out of the tool's output.
-    """
-    text = refusal_text("ae29f2008")
-
-    assert "\n" not in text
-    assert text == "Erase not supported for AE29F2008"
-
-    lowered = text.lower()
-    for forbidden in FORBIDDEN_REFUSAL_SUBSTRINGS:
-        assert forbidden not in lowered, (
-            f"refusal text {text!r} contains forbidden substring {forbidden!r}"
-        )
-
-
 def test_cli_erase_on_non_flash4_part_still_reaches_operator():
     """NOT A BLANKET REFUSAL: a part whose algorithm is not 5 still
     reaches `EpromOperator.erase_eprom`. Without this leg, a fail-closed