Fix DestroyObjectsChecked aborting batches that name an absent id

[yosuke-wolfssl]

Fix DestroyObjectsChecked aborting batches that name an absent id

Fixes f_6645.

Problem

wh_Nvm_DestroyObjectsChecked returned WH_ERROR_NOTFOUND if any id in a
batch was absent, destroying none of the objects — contradicting the
DestroyObjects contract ("IDs not present do not cause an error") and the
sibling wh_Nvm_AddObjectChecked, which already tolerates NOTFOUND. Reachable
from clients via wh_Client_NvmDestroyObjects and wh_Client_KeyErase.

Fix

• wh_Nvm_DestroyObjectsChecked tolerates NOTFOUND — an absent id is
  skipped; only ACCESS/BADARGS abort the batch.
• wh_Server_KeystoreEraseKeyChecked stops masking policy denials — it
  previously discarded the evict return code when NVM was attached, so a revoked
  cache-only key would report a successful erase while staying usable. It now
  propagates ACCESS and tolerates only NOTFOUND.
• No-op-destroy flash wear avoided in the backend — an all-absent destroy no
  longer replicates the whole partition. The skip lives in wh_NvmFlash_DestroyObjects
  (not the backend-agnostic wh_nvm.c), keeping the checked and unchecked APIs
  identical on every backend; zero-count compaction still replicates.

Behavior changes (client-visible)

wh_Client_KeyErase (missing key) and wh_Client_NvmDestroyObjects (any listed
id absent) now return WH_ERROR_OK instead of WH_ERROR_NOTFOUND, matching the
DestroyObjects contract. Add a ## Bug Fixes ChangeLog line when the release
section is cut.

Tests

• test/wh_test_nvmflags.c — mixed batch destroys the present ids and returns OK;
  a policy violation still aborts the whole batch.
• test-refactor/server/wh_test_nvm_policy.c (new) — batch tolerance, all-absent
  no-churn (via reclaim accounting) + zero-count compaction, missing-key erase,
  and the cached-only revoked-key ACCESS regression guard.
• Doc updates to wh_nvm.h / wh_server_keystore.h; wh_test_nvm_optional.c
  assertion updated to the unified semantics.

Verification

refactored suite 38 passed / 0 failed; legacy suite clean on default, DMA=1,
NOCRYPTO=1, THREADSAFE=1 under -std=c90 -Werror. Negative controls confirm
each guard is load-bearing (reverting the NVM tolerance reproduces the 6645
symptom exactly).

[Copilot]

Pull request overview

Aligns wh_Nvm_DestroyObjectsChecked and wh_Server_KeystoreEraseKeyChecked with the “absent IDs/keys are not an error” contract, while also preventing unnecessary flash partition rewrites when a non-empty destroy list contains no present objects.

Changes:

• Update wh_Nvm_DestroyObjectsChecked to tolerate WH_ERROR_NOTFOUND from policy checks so a batch destroy won’t abort just because some IDs are absent.
• Fix wh_Server_KeystoreEraseKeyChecked to stop masking cache-eviction policy denials when NVM is attached, while treating missing keys as a successful erase.
• Avoid no-op flash wear by skipping replication in the flash backend when a non-empty destroy list matches no present objects; add/adjust tests and docs for the unified semantics.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
wolfhsm/wh_server_keystore.h	Documents checked erase semantics: missing key is OK; policy denial returns WH_ERROR_ACCESS.
wolfhsm/wh_nvm.h	Documents checked destroy semantics: absent IDs do not error; batch still enforces policy on present objects.
src/wh_server_keystore.c	Propagates ACCESS from checked eviction; treats missing key as OK; uses checked NVM destroy when attached.
src/wh_nvm.c	Allows WH_ERROR_NOTFOUND during per-ID policy checks in wh_Nvm_DestroyObjectsChecked.
src/wh_nvm_flash.c	Skips partition replication when a non-empty destroy list matches nothing (prevents unnecessary flash wear).
test/wh_test_nvmflags.c	Adds client-side coverage for mixed present/absent batch destroy and “policy violation aborts batch” behavior.
test-refactor/wh_test_list.c	Registers new server-side refactor test whTest_NvmPolicyChecked.
test-refactor/server/wh_test_nvm_policy.c	Adds server-side tests for batch tolerance, no-churn all-absent destroy, missing-key erase OK, and ACCESS propagation regression guard.
test-refactor/server/wh_test_nvm_optional.c	Updates expectations: checked erase returns OK for missing key even without NVM.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #461

Scan targets checked: wolfhsm-core-bugs, wolfhsm-crypto-bugs, wolfhsm-src

No new issues found in the changed files. ✅