[geonnave]

dotbot fw build --as <set> collects images into a named set in the cache, and nothing stopped a second build into that set from a different source folder (another worktree, say). The set then mixes images from two checkouts that can disagree with each other, for example on the swarmit NSC veneer table a sandboxed app is linked against, and nothing in the set says so.

The build manifest now records the source folder of every image. A build into a set whose recorded folder differs from the one being built is refused, naming the set's folder and the ways out: --path <that folder>, or another --as. --force builds into it anyway, and the set then names the new folder. The "Building ..." line now also says which folder it builds from and whether that came from --path or the configured source.

Split out: the NSC interface check. An earlier version of this PR also hashed the NSC table each image was linked against into the manifest and refused a dotbot swarm flash onto robots whose bootloader exports another table. That part is dropped from here. The NSC table is swarmit's interface, and swarmit has its own flash paths (the swarmit flash CLI, the local and HTTP clients, the dashboard webserver) that a PyDotBot-only guard would not cover. The check moves to swarmit, ideally with the bootloader reporting its NSC id in device info and the app image carrying the id it was linked against.

File	+	-
dotbot/cli/fw.py	+27	-1
dotbot/tests/test_fw_sources.py	+26	-0
dotbot/cli/_fw_sources.py	+13	-0
Total, 3 files	+66	-1

Independent of the open LH2 calibration PRs; branched from main at #332 and merges cleanly onto current main.

Validation: unit tests only, not run against robots for this version. test_fw_sources.py, test_fw.py and test_swarm_flash.py pass (164 passed). The full suite gives 1727 passed, 2 failed; both failures (test_camera_service.py::test_a_registration_without_controls_warns_about_nothing, test_controller.py::test_controller_dotbot_simulator) fail identically on the base commit and are unrelated. What is left here is host-side only (fw build and its manifest), so a bench run would add little beyond one fw build --as from two folders to read the refusal.

[codecov]

Codecov Report

❌ Patch coverage is 96.87500% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 88.21%. Comparing base (6805e0a) to head (14f38f0).
⚠️ Report is 4 commits behind head on main.

Files with missing lines	Patch %	Lines
dotbot/cli/_fw_sources.py	88.88%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #340      +/-   ##
==========================================
+ Coverage   88.17%   88.21%   +0.04%     
==========================================
  Files         227      227              
  Lines       36028    36179     +151     
  Branches     2323     2323              
==========================================
+ Hits        31769    31917     +148     
- Misses       4255     4258       +3     
  Partials        4        4              

Flag	Coverage Δ
console	81.99% <ø> (ø)
python	91.15% <96.87%> (+0.04%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
dotbot/cli/fw.py	97.50% <100.00%> (+0.07%)	⬆️
dotbot/tests/test_fw_sources.py	100.00% <100.00%> (ø)
dotbot/cli/_fw_sources.py	97.76% <88.88%> (-0.47%)	⬇️

... and 5 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[geonnave]

HIL on the bench (2026-10-15), five DotBot v3 on swarm A001, all on bootloader/netcore 0.11.0-15-g5a91ee5 (NSC table 1af2d2c8ffc7). Code under test: this branch at 7c9d7ca (this PR's two commits plus #341 on top), with swarmit from the lh2 stack.

Swarm-side bootloader read (_robot_bootloaders) - wrapped to print its return value, otherwise unchanged:

• swarm -d ...E774 flash returned {'AFAA808B9905E774': '0.11.0-15-g5a91ee5'}.
• swarm flash with no -d, with 14AB running its app and the other four in the bootloader, returned the four bootloader robots only, each with 0.11.0-15-g5a91ee5. 14AB was left out as expected.

Compatible app passes. swarm -d <robot> flash -y -s -f <set built against this bootloader> remote-control flashed with no note and no refusal. Tested on 14AB and E774, then on four robots at once (A461, 6980, E774, 2B07). Transfers were 155/155, and every robot came back Running / soft-reset with digest 7d6466bead38d00f.

Mismatched app is refused before anything is sent:

• -f 1.25.0 remote-control (NSC e7cf414f0f65) was refused for -d E774, and also with no -d, where the refusal listed all four bootloader robots under bootloader 0.11.0-15-g5a91ee5. Exit code 1.
• -f 1.22.0 (NSC ddda1e8d0101) was refused the same way.
• Afterwards no robot had changed: images, last reset (power-on) and status were all the same, so nothing was transferred. --force was not tried.

fw build --as mixed set. fw build dotbot --as <set> --print-path (a host-only check, nothing built) was refused, naming the folder the set was recorded from and the configured folder. With --path <the recorded folder> it went through and printed the path.

One wording nit: "was built for another bootloader than these robots run (NSC table e7cf414f0f65)" reads as if the robots' table were e7cf..., but that is the app's table. Naming both tables, or putting the id after the image name, would make this clear.