Thanks for getting this and for the info about the last thing TT was doing before it happened, and sorry about your scripts! My thought was that the scene data structure is large enough that, if the out-of-bounds hypothesis above were correct, we would still have most of a scene written to an area of flash that should never be written to from the same write that trashed the “fresh” field. If this were the case, I thought it might even be possible to recover the scripts saved to that scene, since they’re in the last part of the scene data.
…But it doesn’t seem like this happened. After the calibration defaults, everything else in flash is 0xFF - flash bits are typically set to 1 when erased. So it doesn’t seem like a bulk write did it, at least not off the end like that. If there was some other off-by-one condition I thought maybe the padding bytes used to align struct members could also wind up getting set, but those are 0xFF in this firmware image too.
So, sad to say after reading flash.c a half dozen more times, I got nothing. If it’s useful to anybody the ‘repl’ tool here is the program I used for sifting through the firmware image.