[Linjieqiang]

What this changes

When initialization encounters a FDB_KV_PRE_WRITE record, it marks the record
FDB_KV_ERR_HDR and returns true from check_and_recovery_kv_cb(). In
kv_iterator(), true stops the entire scan. _fdb_kv_load() only retries when
gc_request is set, so initialization can return success without recovering later
FDB_KV_PRE_DELETE records. Valid old values can consequently disappear from
lookups until another initialization.

Continue the current scan after marking an unfinished write. The iterator already
handles invalid CRCs by searching for the next record, and the existing GC retry
path for failed PRE_DELETE recovery remains unchanged. This adds no allocation,
public API, configuration option, or storage format change.

The three registered regression cases create interrupted-write snapshots in the
existing file-backed test database and perform one deinit/init reboot. They cover:

• Multiple unfinished records before an old value requiring recovery.
• A torn value before a pending deletion in a later sector.
• A committed replacement that must win over the pending old value, with exactly
  one visible copy and stable results after another reboot.

The fixtures restore complete status tables only on the emulated file medium;
they do not require programming erased bits back to one on physical NOR Flash.
Blob lengths cross the configured write granularity.

Related issue

No issue number assigned yet. The descriptive test names can be updated when an
issue is opened. Reproduced against official master
360a68d0b1f9f02b0d597a9f08c141e28b332c1e.

Test closure

• Added cases in tests/fdb_kvdb_tc.c.
• New cases are registered in testcase().
• Relevant boundaries covered: multiple interrupted records, torn values,
  cross-sector traversal, blob/write-granularity boundaries, and committed versus
  uncommitted replacements. No GC algorithm or init error-policy changes.
• Bug fix: all three cases fail before the fix and pass after it in targeted
  host runs with the real FlashDB file backend.
• Case names carry an issue number: pending issue creation, not invented here.
• No new case needed: N/A; regression cases are included.

Write granularity covered

• Full RT-Thread/QEMU CI passed for 1 / 8 / 32 / 64 / 128 / 256: not run locally;
  the required QEMU/SCons environment is unavailable.
• Targeted local manual verification: all three new case bodies, extracted
  unchanged from the upstream test file, run with MSVC and the real file backend
  at 1 / 8 / 32 / 64 / 128 / 256, with KV caching both disabled and enabled
  (36 runs before the fix and 36 runs after it).
• Firmware integration regression: 9,474 simulated power cuts with the real
  FlashDB/FAL and the AT32 Flash port at 32 bits, including GC, full 16-model
  transactions, reboot/readback and retries. No repeated-init workaround is used.
• Not verified: full RT-Thread/QEMU suite, optional read-cache configuration,
  and real hardware power loss. The targeted host checks do not substitute for CI.

Data layout and compatibility

• KV/TSL node format unchanged.
• Node format changed: N/A.
• Public struct or API changed: N/A.
• API or config macro changed: N/A; API documentation changes are unnecessary.

Power-loss semantics

• Not on a write path: N/A; initialization recovery writes record status.
• Covered by fdb_kvdb_deinit() -> fdb_kvdb_init() reboot simulation.
• Not coverable by utest: N/A; cases are included and registered.

[Linjieqiang]

关联: #437